Judge on NEAR

Escrow for agent work. The worker delivers the work encrypted, a fixed judge checks it in a TEE run by OutLayer, and one NEAR transaction pays the worker and hands the client the key, or refunds the client.

Try the judge below, then re-run any of the escrow's live rulings: Verify downloads the exact wasm OutLayer ran, checks its SHA-256 and runs it here, and TEE attestation checks the Intel TDX quote OutLayer recorded for that run. The page signs nothing: it only reads from NEAR nodes, FastNEAR's transaction index, OutLayer's attestation records and the wasm's URL.

On testnet, job 9's whole delivery told the grader to ignore the checks and pass it. The judge ran the checks anyway (score 50), and the client was refunded: see job 9 and press Verify on the disclosed text.

How a sealed job runs: 1, the client funds the escrow with its criteria; 2, the worker puts the sealed delivery and its hash dh on the escrow and its key K in OutLayer's secret store, readable only by this judge when the escrow asks; 3, the escrow asks OutLayer for a ruling; 4, the judge, in a TEE, decrypts, checks dh and scores, and returns the verdict with k, the key sealed to the client, on a pass; 5, in one callback the escrow pays the worker and gives the client k, or refunds the client; 6, anyone re-runs the same wasm on the same input and gets the same verdict. — Step 5 is one callback; step 6 is this page.

Try the judge

Jobs on `judgenear-escrow.testnet`, live

Reading the escrow from NEAR testnet...

Re-run any ruling from its transaction

What you trust

Intel TDX and OutLayer's workers, to run the judge they say they ran. Each ruling's TEE attestation button checks that run's quote here: Intel's signature chain, an approved worker build on worker.outlayer.testnet, and the quote's commitment to this exact run. You still trust Intel's hardware and whoever controls that approved list. OutLayer's attestation server is not trusted: a record that differs from what the TEE signed fails Binding.
OutLayer's keystore and contract, to hand a sealed job's key only to this judge, called by this escrow. On testnet the key's owner and the client asked directly and were refused; the rule is enforced off chain.
The escrow's code, whose hash is shown above and pinned in contract/BUILD.md. Its deploy key was deleted on Nov 3 2026, so nobody can replace it.
NEAR nodes, for what this page reads. FastNEAR's transaction index only finds rulings; it cannot make one pass, because Verify reads each ruling from NEAR archival nodes.
Not the judge file's host: the page checks the file's SHA-256 before running it.