KEYSTONE

Progress payments that release on evidenced work, and retention money nobody can quietly forget.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• General contractor. Draws release on inspection evidence, not on chasing.
• Subcontractor. Your milestone money is visible in escrow before you pour.
• Project owner and lender. A draw schedule that is a ledger, not a spreadsheet.
• Site inspection. Sign-offs from named engineers whose presence signs.

The problem

Construction runs on progress payments that arrive late, retention money that arrives never, and a paper trail that turns adversarial exactly when it matters. The subcontractor three tiers down finances everyone above them, involuntarily.

The system

KEYSTONE runs a 40-storey build as a tree of escrowed contracts. The owner funds the general contract; the general contractor mirrors its obligations down to nineteen subcontractors as contracts on the same rails, so the concrete crew can see its milestone money sitting in escrow before the first pour. Draw twelve releases when the inspection agent submits sensor and photo evidence and the supervising engineer, a named human whose presence signs, approves above the threshold.

The retention is the design’s quiet victory: five percent sits as a final milestone that cannot be forgotten, renegotiated in a hallway, or lost in an acquisition, because it is not a promise in a PDF. It is value on a ledger with a release condition. When the facade dispute arrives in month fourteen, that work’s money freezes, the arbiter rules, the escrow splits per the ruling exactly once, and every other trade keeps getting paid on schedule.

The cast and their ceilings

The flow, step by step

1. The build funds as escrow, mirrored down nineteen subcontracts.
2. The crew claims draw twelve. Their money was visible before the pour.
3. Inspection submits the site evidence.
4. A named engineer signs, presence proven above the threshold.
5. The draw releases on evidence, on schedule.
6. Retention sits as a final milestone the ledger cannot forget.

Each need, mapped to a live primitive

The attack this chamber refuses: The forgotten retention

The attack. Two years after handover, the owner’s new management declines to remember the five percent retention owed to nineteen trades.

Why it fails. The retention is not an entry in the owner’s accounting; it is escrowed value on a shared ledger with a release condition. Forgetting it is not an available operation, and unwinding it would require the counterparties’ own contracts to agree.

What actually happens. The retention releases when its condition is met, to the trades it belongs to, regardless of who now sits at the owner’s desk.

Deep architecture

KEYSTONE deployed: the project frame holds the master contract, the draw escrow and the evidence chain; the trades and the arbiter act from their own registries; site hardware feeds the attestations. The subcontract tree is data on the same rails, which is why the concrete crew can watch its milestone money exist before the first pour. The trace replays draw twelve, evidence to credit, with the retention sitting where nobody can lose it.

The deployment, traced

1. The owner funds the master contract. The budget is now a fact, not a promise.
2. Escrow at award, retention held as a final milestone that cannot be forgotten in a hallway.
3. The general contractor mirrors its obligations down: nineteen subcontracts on the same rails.
4. The concrete crew watches its milestone money exist before the first pour.
5. Draw twelve: the site hardware feeds the inspection agent.
6. The inspection agent submits sensor and photo evidence. It attests; it cannot release.
7. The crew claims the draw from its own registry.
8. The fabric couriers the signed commands home. The relaying peer is never the principal.
9. Above the threshold, the supervising engineer signs: a named human, present, recorded.
10. Evidence, approval and release land on the chain, append-only.
11. The draw crosses registries with an idempotency key.
12. The crew’s own TEG credits it, under its own law.
13. Month fourteen: the facade dispute freezes that work’s money only. The ruling splits the escrow exactly once, and every other trade keeps getting paid on schedule.

Adoption, phase by phase

Discover: One trade package, re-told as escrows.

• Runs. Nothing. One finished package redrawn as milestones, evidence rules and a retention schedule.
• Agents. None. The commercial team and the engineer set the evidence thresholds while nothing is owed yet.
• Integrates. Nothing. BIM, scheduling and the site stay untouched.
• Deliberately not yet. No escrow, no attestor, no tree.
• Proof that gates the next phase. Last year’s most contested draw re-expressed as evidence plus release conditions, and both sides agree on where it would have settled.

Pilot: One package, real money, small draws.

• Runs. A project registry on a single VM. One subcontract runs through it end to end.
• Agents. owner-desk, gc-ops, one sub-crew, the inspection agent. The engineer holds a pilot-ceiling mandate.
• Integrates. Site photos and sensor exports feed the attestor; the scheduler remains the scheduler.
• Deliberately not yet. One package only. Retention modelled, not yet at stake. The arbiter expects boredom.
• Proof that gates the next phase. Five draws release on evidence with the engineer’s presence recorded on each, and zero payment-application emails.

Production: The whole tree, retention on the ledger.

• Runs. One registry per project or per firm: registry, TEG, EventStore, identity fabric. About nine containers.
• Agents. The full cast; nineteen subcontracts as data; retention held as final milestones with release conditions.
• Integrates. Inspection hardware in production; the evidence chain feeds the office instead of a claims folder.
• Deliberately not yet. Cross-project reputation. Each project’s tree stands alone first.
• Proof that gates the next phase. A completed project closes out with every retention released or disputed on the ledger, and none renegotiated in a hallway.

Federation: Trades carry their record to the next site.

• Runs. Unchanged. Trades and owners bring frames or seats.
• Agents. Crew reputations travel with DIDs; the next tender can read settled outcomes, not references.
• Integrates. Each new trade is a signed card and a licence.
• Deliberately not yet. Nothing structural. Growth is projects.
• Proof that gates the next phase. A trade wins a package on a new project and its first draw releases within the first month, with no bilateral setup.

Sizing

One draw, evidence to credit

sequenceDiagram
  participant Ins as inspection-agent
  participant Crew as sub-crew-07 (their frame)
  participant Fab as federation fabric
  participant MC as master contract (project frame)
  participant Eng as supervising engineer
  participant TEG as draw escrow
  participant XT as cross-registry pay
  Ins->>Fab: sensor + photo evidence, signed
  Crew->>Fab: draw twelve claimed
  Fab->>MC: relayed commands (principal checked)
  MC->>Eng: above threshold: presence required
  Eng-->>MC: signed, present, recorded
  MC->>TEG: release the draw
  TEG->>XT: pay the crew (idempotency key)
  XT->>Crew: their TEG credits, exactly once
  Note over TEG: retention stays as a final milestone with a release condition

Topology, as declared

flowchart LR
  O["owner"] -->|"fund master contract"| CS["contract spine<br/>strict-order draws"]
  CS -->|"mirrored sub-escrows"| SUB["19 subcontracts<br/>same rails"]
  I["inspection agent"] -->|"signed site evidence"| G{"draw gate"}
  E["engineer mandate<br/>presence proof"] --> G
  G -->|"release draw"| TEG["TEG escrow mover"]
  TEG --> ES[("project ledger<br/>retention milestone")]
  DIS["dispute"] -.->|"ruling splits escrow once"| TEG

Standing it up

• Infrastructure. One registry per project or per firm. The subcontract tree is data, not deployments.
• Agents. 5 roles; inspection hardware feeds the attestor.
• Integration. Scheduling and BIM stay where they are. The protocol carries agreement, evidence and money.

What this does not claim

• KEYSTONE does not certify structural work and replaces no building authority or engineer-of-record duty.
• Lien law and statutory retention regimes vary; the escrow implements the agreement, and counsel maps it to the jurisdiction.