Devpost Project Submission Dossier: IntentLock
Project Name: IntentLock — Cryptographic Chain-of-Intent & Conditional Escrow for Agentic Commerce
Tagline: Eliminating the 79% Checkout Cliff with cryptographic intent contracts and conditional PayPal sandbox escrow.
Target Tracks: Best Use of Agentic Commerce ($5,000) & Grand Prize ($12,000)
Repository:https://github.com/ShayanMuhammad-CS/hunter/tree/main/intentlock
Built by: Shayan Muhammad (Lead Engineer) & Shaheen (Autonomous Manager)
💡 Inspiration
In 2026, autonomous AI agents can search, compare, and reason across thousands of e-commerce stores in milliseconds. However, agentic commerce has crashed into what the industry calls the "Checkout Cliff":
- According to Worldpay and Accenture research, 79% of consumers refuse to grant autonomous AI agents payment authorization.
- Why? Because users are terrified of hallucinations, wrong product variants, dynamic surcharge traps at checkout, and indirect prompt injections embedded on third-party seller pages.
- Meanwhile, merchants and banks face a legal vacuum: when an AI buys the wrong item, who is liable? Current payment rails cannot verify whether an AI strictly obeyed the user's intent.
We asked: What if an AI agent never touches a raw credit card or static payment token, and instead operates under a cryptographic Chain-of-Intent backed by PayPal's Two-Phase Escrow? That vision became IntentLock.
⚙️ What It Does
IntentLock acts as a zero-trust execution bridge between consumers, autonomous shopping agents, and merchants using PayPal's Two-Phase Payment Protocol (AUTHORIZE $\rightarrow$ CAPTURE):
- User Mandate Compilation: The consumer inputs a request in plain English ("Buy wireless mechanical keyboard under $80 with Brown switches"). IntentLock compiles this into an immutable Pydantic Intent Contract and computes a SHA-256 integrity hash.
- Conditional PayPal Sandbox Escrow: IntentLock initiates a PayPal order with
intent: "AUTHORIZE". The user approves the maximum budget hold ($80.00). Zero money moves, and raw financial details are never exposed to the agent. - Autonomous Agent Execution: The AI shopping agent navigates the merchant catalog, selects candidate products, and submits raw metadata.
- Independent Zero-Trust Gate: The Gate bypasses the agent's potentially tainted self-reporting and directly inspects the raw seller data against the user's intent contract, while scanning for adversarial prompt injections (including homoglyphs and unicode tricks).
- Deterministic PayPal Settlement:
- Invariants PASSED (100% Match): PayPal executes
capturewith"final_capture": true. The exact amount is captured, and unspent escrow balance (e.g. $5.01) is instantly returned to the user's wallet. - Invariants FAILED / INJECTION: PayPal executes
void. The authorization hold is cancelled instantly. Zero funds are lost.
- Invariants PASSED (100% Match): PayPal executes
🛠️ How We Built It
- Backend & Verification: Built with Python 3.11 and FastAPI, enforcing mathematical invariant models with Pydantic v2.
- Payment Rails: Direct integration with the PayPal Orders v2 REST API, using two-phase conditional authorizations (
POST /v2/checkout/orderswithintent: "AUTHORIZE"), buyer approval handshakes, and final capture with unspent hold release. - Security & NLP Defense: Multi-stage prompt injection scanner that performs unicode normalization to dismantle homoglyph evasion and delimiter override attacks.
- Frontend Mission Control: Sleek, responsive split-screen dashboard built with Tailwind CSS, featuring real-time visual progress across all 4 pipeline stages.
- Spec-Driven Architecture: Designed using Google's Elephant-Goldfish Model (EGM), separating high-context specification drafting from isolated adversarial subagent stress-testing.
🚧 Challenges We Ran Into (Caught by the Goldfish Review!)
During our EGM adversarial review phase, an isolated Goldfish subagent stress-tested our initial architecture and caught 3 critical failure modes before we wrote a single line of code:
- The "Silent Approval" Illusion: We initially assumed calling
intent: "AUTHORIZE"immediately yielded an active escrow hold. The review caught that PayPal Orders v2 requires an interactive buyer approval step via thepayer-actionURL before authorization can be completed. - Partial Capture Stranding: In PayPal’s REST API, capturing $74.99 on an $80.00 authorization without explicitly specifying
"final_capture": truestrands the remaining $5.01 in the user's bank for up to 29 days! We solved this by strictly enforcing"final_capture": true. - The "Incorruptible Extractor" Fallacy: We realized that if an adversarial merchant page hijacks the agent's extraction prompt, the agent will report false attributes to the Gate. We solved this by having the Zero-Trust Gate independently inspect raw merchant ground truth.
🏆 Accomplishments We're Proud Of
- 100% Deterministic Test Fidelity: Comprehensive automated test suite passing across all 4 scenarios (Happy Path, Attribute Drift Trap, Surcharge Fee Trap, and Prompt Injection Exploit).
- Zero Funds at Risk: Proved that autonomous agents can shop freely while mathematically guaranteeing that zero unauthorized funds can ever be captured.
- True Agentic Commerce Infrastructure: Built an open, reproducible framework that any autonomous coding or shopping agent can plug into.
📖 What We Learned
- Deep nuances of PayPal's Two-Phase Orders v2 API and how authorization holds can serve as the ultimate trust layer for autonomous software.
- The transformative power of Google's Elephant-Goldfish Model—catching fatal fintech and security bugs in design documents before writing code saved us days of wasted debugging.
🔮 What's Next for IntentLock
- Multi-Agent Budget Pooling: Enabling teams of autonomous agents to draw from a shared, pre-authorized PayPal escrow pool with sub-agent quotas.
- Multi-Party Merchant Onboarding: Integrating PayPal Commerce Platform (PPCP) for direct automated disbursements to third-party merchants upon verified parcel tracking delivery.
