Sandbox The hosted app is connected to PayPal's sandbox: no real money moves
Milestone Ledger , home
Open the app

Verified delivery on PayPal

Pay against evidence, not promises.

Milestone Ledger turns a grant or statement of work into tranches with checkable acceptance criteria, verifies the evidence against them, and settles each tranche through PayPal. Neither side has to go first.

Try the demo How it works

The demo runs on PayPal's sandbox with a funder, a grantee and a reviewer already signed in, so you can play every side. No account and no real money.

Riverside Reads · Spring literacy grant

  1. 1 Hire and train three workshop leadsCriteria met · 3 of 3 · paid 14 Mar USD 4,000.00Settled
  2. 2 Run twelve spring workshopsEvidence submitted · verifier found it met (92%) USD 10,000.00Held
  3. 3 Publish attendance and outcomes reportDue 30 Jun · waiting on the funder to fund USD 6,000.00Unfunded
  4. Total USD 20,000.00

Released 4,000.00Held at PayPal 10,000.00Not yet funded 6,000.00

A tranche settles when its evidence meets the criteria both sides signed.

The problem

Whoever moves first takes the risk.

Work paid by milestone runs on trust and chasing. A contractor delivers and then waits weeks for the client to sign off. A grantee files a report and the next tranche sits until a program officer reads it.

If the contractor hands over the work first, the client can stop paying. If the client pays first, the contractor can stop delivering. Escrow solves half of that: it protects the money, but not the work.

Milestone Ledger holds both. The payer's money is held at PayPal and the payee's work is held by the engine. When the evidence meets the criteria, PayPal captures the payment and the work is released at the same moment.

How it works

How a tranche moves

Five stages. Each one leaves a line in the audit log, and each status is a stamp that means the same thing everywhere in the product.

  1. Agree on criteria

    Draft

    Write the tranches yourself, or upload the grant or statement of work and the engine proposes tranches with criteria, each quoting the clause it came from. A lint flags criteria nobody could check ("make good progress") before anyone signs.

    Every party signs the exact version they read. The criteria hash is the seal: if a word changes, the signatures no longer apply.

  2. Fund the tranche

    Held

    The payer approves a PayPal hold for the tranche. The funds sit at PayPal, never with us, and the payee can see the hold before starting work. Invoice mode skips the hold and sends a PayPal pay link once the tranche verifies instead.

  3. Submit evidence

    Evidence in

    Upload files, paste text, or connect GitHub so merged, labelled pull requests arrive on their own. Contractors can keep code in their own private repository, pin a commit per tranche, and hand it over only when the tranche is paid.

    Pre-check before you submit: the same checks run and tell you what would pass and what is still missing.

  4. Verify

    Needs review

    Deterministic checks run first: file present, tests green, numbers in range. Then the AI verifier reads the rest of the evidence against each criterion and returns a verdict with citations into the evidence. A skeptic pass argues the other side before anything releases on its own.

    Below the confidence threshold your organization set, a person decides. Rejections say exactly what is missing, and the payee can dispute.

  5. Settle

    Settled

    PayPal captures the payment and any withheld work is released to the payer at the same moment. A short window lets the payer contest; after it closes, the payee is paid. The ledger, the verdicts and the evidence references are exportable as a compliance packet.

Who it's for

Every side of the agreement

We start where PayPal is already how money moves, and where tranches are small enough that card and wallet fees are acceptable.

Payees

Contractors, agencies, grantees

  • Funds are held before you start, and you can see the hold.
  • Pre-check your evidence against the criteria before you submit.
  • Your work stays yours until you are paid.
  • You never pay to get paid. Pre-check and the criteria lint are free.

Payers

Clients and funders

  • Pay only against evidence that meets what you agreed to.
  • Every decision comes with citations into the evidence.
  • Set your own confidence threshold, or keep every release in human hands.
  • A contest window after each capture, and a dispute pack if you need one.

Grant programs

Community foundations, microgrants, sponsorships

  • A portfolio view of every grant, with what is held, released and overdue.
  • Reviewer roles, so a program officer or a neutral reviewer decides the close calls.
  • Compliance packets (PDF and JSON) ready for your finance team or auditors.
  • Grantees use it free.

Trust in the verdict

The model never decides alone.

How a verdict is reached

  • Checks before the model. Anything that can be checked deterministically is, and the result is final.
  • Citations required. The verifier must point at the evidence for every criterion it marks met.
  • A skeptic pass. Before a tranche can release on its own, a second pass argues that the criteria were not met. Disagreement sends it to a person.
  • A person below the threshold. Each organization sets the confidence it needs for auto-release, or turns auto-release off.
  • Replayable. Every verdict stores the criteria hash, the evidence ids, and the model and prompt version it used.
  • Money moves only by human hands or by your rule. Confirming criteria, funding, approving, releasing and disputing are never available to an agent or an API key.

The five stamps

Status is never colour alone. Each stamp carries a word and a glyph, and the inks mean the same thing on every page.

  • SettledPaid, and the work released.
  • HeldFunds held at PayPal, or verification in progress.
  • Needs reviewA person has to decide.
  • DisputedFailed, contested or disputed.
  • DraftNeutral: not yet signed, funded or submitted.

Agents

Built for people and their agents.

Point Claude Desktop, Claude Code or any other MCP client at the server. It signs you in, asks which organization it should act for, and gets tools bound to that organization: list agreements, check status, read evidence and verdicts, pre-check a submission, submit evidence, read the review queue and the portfolio, export a compliance packet, and draft new agreements.

Headless agents use an organization API key as their bearer token, scoped the same way.

The steps that move money or bind a party stay with people: confirming criteria, funding, reviewing, releasing and disputing. An agent can prepare the decision, but a person signs it.

Connect an MCP client

Enter https://app.milestone-ledger.com/mcp as a remote server. The client discovers the OAuth endpoints and opens a consent page. Client compatibility notes.

Open source

The engine is open. Run it yourself.

The Milestone Disbursement Engine is licensed under the AGPL-3.0: agreements, the criteria lint, verification and the release gate, PayPal settlement, the evidence adapters, the MCP server and the web app. One docker compose up runs the whole thing against a PayPal sandbox app of your own.

Client SDKs for Python and TypeScript, with webhook signature verification, live in the same repository. The specification and the business plan are public too.

Source on GitHub Read the spec API reference

Where it stands

Milestone Ledger was built for the PayPal AI Hackathon in November 2026. The hosted service at app.milestone-ledger.com runs in sandbox mode: payees connect PayPal sandbox accounts, payers approve holds with sandbox accounts, and no real money moves. A live deployment needs PayPal partner approval, which we are applying for. What's left is tracked in the open.

Try it with sandbox money.

Play the funder, the grantee and the reviewer on a ready-made grant. Approve a hold, submit evidence, watch the verdict land, and release the tranche.

Try the demo Sign in to the app

Questions? support@milestone-ledger.com