Kwarry

Kwarry turns “I have an idea” and “I can build it” into an enforceable agreement. An Inspirer posts an encrypted spec and prefunds an escrow; a Builder signs an NDA to unlock it, applies, and both sign a Ricardian contract whose hash is anchored on chain. Milestones release USDC on approval, after a 72-hour dispute window, or by a tribunal ruling.

For whom: a Primus Cloud Solutions product with five audiences: Inspirers and Builders in the client app, arbiters and jurors in the tribunal app, and admins behind SSO and an IP allowlist. Constraints: money and signatures on chain, specs that must stay secret until an NDA is signed, and a single engineer to build all of it.

• gRPC between services, RabbitMQ for events, never REST inside. Three BFF gateways front thirteen gRPC services; every cross-domain reaction (contract signed, escrow opened, milestone released) is a topic, not a call.

• One shared Prisma schema, Kysely at runtime. Thirteen services, one migration history, so schema changes stay atomic across the whole marketplace.

• Ricardian contracts, dual-signed, hash-anchored. A PDF the humans read plus machine clauses the escrow executes; e-signature and EIP-712 typed data cost the user nothing, and only the hash goes on chain with the relayer paying gas.

• An escrow vault with four exits. Per-project ERC-20 escrow with a six-state milestone machine: released by approval, by auto-release after the dispute window, by an arbiter, or refunded. A separate prefund mapping lets the bounty lock before a builder is chosen.

• Privy for people, Keycloak for staff. Social, email and passkey sign-in with an MPC embedded wallet for users who have never held one; SSO for the admin console.

• Specs encrypted before IPFS. AES-256-GCM on the full spec, pinned through Pinata, unlocked only once the NDA is anchored.

Every milestone from the event backbone through money rails, identity hardening and notifications is deployed to a live staging swarm and verified there, with the verification evidence committed next to the code. The contracts are deployed to Sepolia for staging and target Polygon PoS for production. What is not built yet is stated just as plainly in the roadmap: no fiat rails, no KYC, no crawler, no admin console.

The two architecture notes I am proudest of explain signing and escrow to non-experts: what a signature is, why EIP-712 makes one useless on any other chain or app, and why funding takes two transactions instead of one, including the alternatives considered and rejected.

Running the services under an esbuild-based TypeScript runner stripped the decorator metadata Nest uses for constructor injection, so providers resolved to undefined at runtime with no error at build time. The fix became a rule rather than a patch: an explicit inject decorator on every constructor parameter, and gRPC client modules registered in the module that uses them, never at the root.

Separately, when hosted CI was unavailable mid-milestone, the release went out by hand: source shipped over a tar pipe after rsync proved flaky, six service images rebuilt on the box, and the consumer deployed before any producer so the notification queue existed before the first event was published.