{"slug": "i-built-27-tools-and-an-ai-arbiter-that-settles-escrow-disputes-on-chain", "title": "I built 27 tools and an AI arbiter that settles escrow disputes on-chain", "summary": "A solo developer operating pigfox.com has built 27 tools—16 free—covering OSINT, email security, TLS, and document forensics, plus three live smart-contract demos on Base Sepolia. One demo features an AI arbiter that settles escrow disputes on-chain, with the model's role narrowly bounded to proposing rulings within a fixed grammar while the contract executes the decision. The developer emphasizes verifiability: every tool hits real infrastructure, and all on-chain demos produce inspectable transaction hashes.", "body_md": "I run [pigfox.com](https://pigfox.com?utm_source=devto&utm_medium=article&utm_campaign=zk-arbiter-2026-07&utm_content=intro) as a one-person shop. It's two things now: **27 tools, 16 of them free**, covering OSINT, email security, TLS and document forensics — and **three live smart-contract demos** on Base Sepolia, one of which lets a language model decide who gets the money.\n\nBoth halves follow the same rule, and that rule is the actual subject of this post.\n\nThere's a genre of tool I refused to build — paste a domain in a box, a model hallucinates a paragraph, you get a confident answer nobody can verify.\n\nEvery tool here hits real infrastructure first. DNS. WHOIS. TLS handshakes. Certificate-transparency logs. Raw EXIF bytes. Raw `Received:`\n\nheaders. PDF object tables. The output shows you the signals it collected so you can check them yourself.\n\nFive of the 27 call a model at all — and only *after* the evidence is on the table. Six more are metered without touching a model, because reverse-image lookups and WHOIS history cost money per query whether or not an LLM is involved. The other 16 are free and staying that way.\n\nNow watch what happens when you take that rule on-chain.\n\nThree interactive demos, all live, all against **Base Sepolia (chain 84532)** — deployed contracts, real testnet transactions, hashes you can open in a block explorer.\n\nThere's a doctrine behind that: **no forking.** No `--fork-url`\n\n, no mainnet simulation, no mocked chain state. If a demo says something settled, there's a transaction hash. The Playwright E2E suite runs against the live chain too — slower, occasionally flaky, worth it. A test that passes against a mock proves nothing about a contract.\n\nTwo parties lock funds in an escrow contract. Something goes wrong. One opens a dispute. **An AI arbiter reads the case and issues a ruling — and that ruling settles on-chain, moving funds.**\n\nWhich is precisely the thing you should be nervous about. A language model deciding who gets paid is a terrible idea if the model is a trusted oracle with an open-ended mandate. So it isn't one:\n\nNine disputes have run end to end on-chain. Every one is inspectable.\n\nThat's what bounded AI means concretely: the model's role is narrow, its inputs are fixed, and the thing that executes its decision is a contract that structurally cannot do what the model was never allowed to ask for. The model proposes within a grammar. The chain disposes.\n\nCompare that to the default posture — hand the model a tool that can call any function with any argument and hope the system prompt holds. That's the on-chain equivalent of vibe coding, and it's how you lose a treasury.\n\nAn ERC-3643-style permissioned token. The interesting part versus a plain ERC-20: transfers are conditional. The contract checks an on-chain identity and compliance registry, and a transfer to an unverified address **reverts**. Tokenized real-world assets don't get to be bearer instruments — the restriction has to live in the token, not in a database somewhere off to the side.\n\nBuilt with Foundry, pushed through Slither and Echidna.\n\nProve you satisfy a compliance requirement without handing over the data that proves it. Same cryptographic primitive as the escrow circuit, aimed at KYC-shaped problems: the verifier learns *you qualify*, and nothing else.\n\nQueued behind these: a gas-optimization demo with measured before/after deltas, and an adversarial lab — intentionally vulnerable contracts, Foundry proof-of-concept exploits, and patched versions side by side.\n\nThe bulk of the recent tool work is a cluster built around one question — *is this person, offer, document, or company what it claims to be?*\n\n**Job-Offer Legitimacy Check** (AI) surfaces signals to investigate in a recruiter message, including the sender domain's real age. **Candidate Photo Verify** does reverse-image evidence: where else that photo appears online. **Timeline Discrepancy Checker** (AI) reads a résumé for internal-consistency signals — overlapping roles, date-vs-total mismatches, impossible tech or certification dates. **Website Legit Check** rolls domain age, TLS, redirects, email-security DNS and headers into one pass. **Counterparty Due-Diligence Check** vets a supplier before you wire anything. **Document Authenticity Check** scans a PDF's structure for integrity signals — incremental updates, appended content, cross-reference and date anomalies. **Username Cross-Platform Check** reports presence of a handle across a curated platform set.\n\nNote what the résumé and document checkers *don't* do: they don't render a verdict on a person. They surface structural anomalies and hand them to you. A date gap is a question to ask, not a conviction.\n\n**OSINT & security (13 free)**\n\n`Received:`\n\nhop chain plus SPF, DKIM, DMARC.**SEO & marketing (2 free)**\n\n`robots.txt`\n\nallows, whether you have an `llms.txt`\n\n, whether your content is trapped behind JS.**Utilities (1 free)**\n\nFull index including the paid tools: [pigfox.com/tools](https://pigfox.com/tools?utm_source=devto&utm_medium=article&utm_campaign=zk-arbiter-2026-07&utm_content=toolindex)\n\nSPF allows a maximum of **10 DNS lookups** during evaluation. Blow past it and the record fails — silently, from the sender's side. Most orgs find out when a quarter of their mail lands in spam.\n\n[DNS Email-Security Check](https://pigfox.com/dns-security-check?utm_source=devto&utm_medium=article&utm_campaign=zk-arbiter-2026-07&utm_content=spf-deepdive) counts the lookups and shows you where you sit against the ceiling. It parses DMARC properly (`p`\n\n, `pct`\n\n, `rua`\n\n, `sp`\n\n— subdomain policy is the one everybody forgets), auto-probes common DKIM selectors instead of making you guess them, pulls MX, and returns a plain-language deliverability verdict instead of a wall of TXT records.\n\n`html/template`\n\nserver-side, no SPA. Registry-driven, so adding a tool is a struct plus a handler.Unglamorous recent work, since this is a developer audience: burned a `golangci-lint`\n\nbacklog from 840 findings to zero, moved every template off `text/template`\n\nto `html/template`\n\n(a real P1 XSS), put CSP into enforce mode, and rotated a deployer key after pasting it somewhere it shouldn't have gone. That last one is the most useful thing in this post: assume you will do it too, and have the rotation path ready before you need it.\n\nTry the [ZK Escrow Explorer](https://pigfox.com/demos?utm_source=devto&utm_medium=article&utm_campaign=zk-arbiter-2026-07&utm_content=cta-demo) and open one of the settlements in a block explorer. Then run [DNS Email-Security Check](https://pigfox.com/dns-security-check?utm_source=devto&utm_medium=article&utm_campaign=zk-arbiter-2026-07&utm_content=cta-dns) against your own domain.\n\nFeedback, bug reports, and \"this tool is wrong about my domain\" all welcome — that last one especially.", "url": "https://wpnews.pro/news/i-built-27-tools-and-an-ai-arbiter-that-settles-escrow-disputes-on-chain", "canonical_source": "https://dev.to/pigfox/i-built-27-tools-and-an-ai-arbiter-that-settles-escrow-disputes-on-chain-4mo6", "published_at": "2026-07-26 15:22:47+00:00", "updated_at": "2026-07-26 15:29:09.169307+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-safety", "developer-tools"], "entities": ["pigfox.com", "Base Sepolia", "Foundry", "Slither", "Echidna", "ERC-3643", "Playwright"], "alternates": {"html": "https://wpnews.pro/news/i-built-27-tools-and-an-ai-arbiter-that-settles-escrow-disputes-on-chain", "markdown": "https://wpnews.pro/news/i-built-27-tools-and-an-ai-arbiter-that-settles-escrow-disputes-on-chain.md", "text": "https://wpnews.pro/news/i-built-27-tools-and-an-ai-arbiter-that-settles-escrow-disputes-on-chain.txt", "jsonld": "https://wpnews.pro/news/i-built-27-tools-and-an-ai-arbiter-that-settles-escrow-disputes-on-chain.jsonld"}}