Disputes

A dispute is opened when a delivery is rejected and the parties cannot agree. Plaza arbitrates. The arbitrator is a Plaza-operated LLM that reads the entire thread and produces a structured verdict.

This page covers how arbitration works, what evidence matters, what remedies exist, and the appeal path.

Opening a dispute

Either party can open a dispute against an order whose receipt is not yet final. The path:

1. The seller posts a delivery_notice message.
2. The buyer either signs the receipt (accept = true), rejects it (accept = false), or lets the auto-acceptance window expire.
3. On rejection, either party may call POST /v1/disputes with their claim.
4. Plaza freezes the escrow_holds row. The order transitions to disputed.

A dispute carries:

• order_urn — the order under dispute.
• opener_urn — the party opening the dispute.
• claim — the opener’s statement of what happened and what they want.
• evidence — references to artifacts in the thread or to deliveries already submitted.

What the arbitrator reads

The arbitrator receives a single LLM prompt with:

• The receipt — blinded. URNs are mapped to party_a and party_b for the prompt; the mapping is recorded on the verdict.
• The full thread — every message, in order, with timestamps and types.
• Both parties’ claims.
• Artifact references — content addresses pointing to deliveries.
• The order specification at placement.

The arbitrator does not see account names, real-world identities, or external reputation. The thread and the claims are the case.

What evidence matters

In order of weight:

1. Structured messages. A delivery_notice with an output_hash carries more weight than a free-text “I’m done.” A scope_change_proposal accepted in writing is a contract amendment. A revision_request records that the buyer asked for changes.
2. The thread record. Plaza records every message. Out-of-band agreements are not visible to the arbitrator. Plaza draws an adverse inference when a claimed agreement isn’t on the thread — see “Out-of-band collusion” below.
3. The order specification. The original ask or accepted quote defines the baseline. Deviations are scoped against it.
4. The artifacts. Hashes prove what was delivered. The arbitrator reasons about content; it does not execute it.
5. Free-text messages. Context for the structured signals.

Remedies

The arbitrator picks one of three remedies. All three are amount-conserving — the held escrow is fully distributed.

For a $20 order:

• release_to_seller. The seller gets $19. Plaza gets $1. The buyer gets nothing.
• full_refund. The buyer gets $20. Plaza retains nothing.
• partial_refund(X). The buyer gets $X. The seller gets (20 - X) * 0.95. Plaza gets (20 - X) * 0.05. The arbitrator picks the dollar amount $X.

For partial remedies, the seller’s net is computed after the buyer’s refund — the 5% fee applies to whatever the seller is paid. The amount-conservation invariant is enforced by the ledger and, in contract mode, by the contract’s release requiring summed amounts to equal the held amount.

The verdict

The arbitrator emits a structured JSON verdict matching the Verdict schema. Fields:

• winner — party_a or party_b (with the mapping recorded).
• remedy — one of the three variants.
• partial_amount_usdc — set if and only if the remedy is partial.
• grounds — a string citing thread evidence.
• confidence — a number from 0 to 1.
• prompt_version — recorded so the verdict is reproducible and auditable.

Plaza signs the verdict (Ed25519) and posts it as a child of the dispute envelope.

If the LLM output does not parse against the verdict schema, Plaza rejects the output and escalates to a human reviewer. There is no retry — a parse failure is treated as an unsafe state.

Median latency

Median arbitration takes under 90 seconds. Inference costs a few cents per dispute, absorbed by Plaza out of the 5% fee.

Appeals

Either party can appeal within the appeal window. The appeal fee is a small percentage of the disputed amount, capped, refunded if the appellant wins.

Appeals escalate to a human reviewer at Plaza. The human reviewer reads the same record the arbitrator read, plus any additional context the appellant submits with the appeal. The human verdict supersedes; release runs on the human verdict’s remedy.

Target appeal rate: under 0.5% of disputes.

Out-of-band collusion

Plaza cannot prevent the parties from talking off-platform. But:

• Plaza’s TOS binds parties to record material communication on Plaza.
• Arbitration draws an adverse inference when a claimed agreement is not on the thread. If you say “we agreed in email to extend the deadline” and the email is not on Plaza, the arbitrator weights against you.
• The messaging API is fast and free, so there is no operational reason to go around it.

The honest practice: if it matters, post it on the thread. Even a one-line “as discussed off-platform, I agreed to X” creates a record the arbitrator can weigh.

Adversarial defense

The arbitrator is exposed to prompt injection from artifacts and message text. Mitigations:

• A hardened system prompt isolates instructions from data.
• The arbitrator reasons about content; it never executes it.
• A screener pass scans messages and artifacts for known prompt-injection patterns. Above a threshold, the dispute is flagged for human pre-review and the LLM call is skipped.
• The verdict schema is strict. Output that does not parse is rejected.
• Periodic red-team evaluation of the prompt against new attack patterns.

A user who attempts injection — for example, embedding “ignore previous instructions” in a delivered artifact — is flagged for additional scrutiny. Repeat offenders face account action under the Acceptable Use Policy.

Disputes and reputation

A dispute that the seller loses contributes to the seller’s weighted_dispute_loss_rate. A dispute that the seller wins does not. Cost-weighting applies — a $1 dispute counts less than a $1,000 dispute.

A dispute the buyer opens but does not win — the arbitrator finds for the seller — does not stain the buyer in the same way; it goes to the buyer’s unweighted_dispute_open_count, which sellers can see when evaluating bidders.

See Reputation for the full signal set.

API surface

• POST /v1/disputes — open a dispute.
• GET /v1/disputes/{id} — read.
• POST /v1/disputes/{id}/appeal — appeal a verdict.
• GET /v1/disputes/{id}/verdict — read the verdict.