Proposal: Payment Dispute & Refund Authorization Primitive [Avro Digital]

[samsondav]

Payment Dispute & Refund Authorization Primitive

Ask: 3,000,000 CC over 5 months across 3 milestones
Label: financial-workflows-composability
Champion: Avro Digital
Status: Submitted

Open-source reference implementation of a payment dispute and refund authorization primitive for Canton: dispute lifecycle, time-locked reversal-eligibility windows, and adjudication patterns. Avro Pay is the named reference integration.

Scope boundary — authorization vs. execution

The primitive ships the on-ledger reversal-eligibility, dispute lifecycle, and resolution-authorization layer (time-locked windows, the dispute state machine, and an immutable DisputeResolutionReceipt that authorizes a downstream refund). Off-ledger fund-movement execution is the integrating application's responsibility — it is gated on TransferPreapproval mechanics and product-side templates the primitive does not own. This mirrors Splice itself: TransferPreapproval is an authorization primitive, with execution owned by AmuletRules.

Workstreams

Four workstreams compose into a single end-to-end primitive (not separately fundable):

• A — Dispute initiation, state machine, evidence patterns, anti-griefing pattern guide
• B — Time-locked reversal-eligibility windows (card-like / ACH-like / RTP-like profiles)
• C — Adjudication and resolution patterns via an IPaymentDispute Daml interface with three concrete templates per controller-shape (OperatorMediatedDispute, BilateralDispute, ArbitratedDispute); RegulatorMediatedDispute ships as a parametric test fixture
• D — Avro Pay reference integration, multi-shape Daml-test fixture harness, integration documentation

Reference integration

Avro Pay is the committed reference integration. The proposal's Appendix D maps the primitive's concepts onto Avro Pay's existing SettlementReceipt / PaymentAuthorization templates and the operator+admin adjudicator dual-auth. Avro Pay engineering work for adoption is on Avro Pay's existing roadmap and is not funded by this grant. The M3 staging demo terminates at on-ledger DisputeResolutionReceipt creation; off-ledger refund execution is out of scope.

Splice landing carve-out

If the Committee or Splice maintainers prefer in-Splice delivery, Avro will land the same Daml package set, test harness, and integration guide in the Splice repository instead. Implementation, license, and acceptance criteria are unchanged; only the distribution location moves.

Open source

All deliverables Apache 2.0, public Avro Digital repository.

Prior work

SV Governance dApp grant (PR #223), CIP-0105 SV-locking, xCC, Avro Pay.