Wire escrow and settlement contracts into the intent lifecycle #20

Turns the security model from a claim into a property.

Problem

CreateIntent persists a row. SettleExecution calls the Circle API. At no point does user capital sit under contract control, so the central claim in every product document — that agents never custody user funds and constraints are enforced before settlement — has nothing enforcing it.

Scope

Wire IntentEscrow and SettlementManager into the intent lifecycle.

• On create — user deposits USDC into escrow with the intent's constraints. The intent is not open for bidding until the deposit confirms.
• On settle — call the settlement contract, which validates and releases. Do not release directly from the backend; the point of the contract is that the backend is not the only thing standing between an agent and the funds.
• On expiry or failure — refund path, reachable without the user being online.

Two validators, one answer

internal/validation/service.go already implements six checks: token pair, slippage, deadline, approved venue, intent match, agent id. The settlement contract implements the same checks on-chain.

They must agree. A system where the answer depends on which layer you ask is worse than either layer alone. Where they disagree, the contract wins — it is the one holding the money.

Notes

• Keep this behind a flag so the backend still runs without chain access. Local development and the existing Circle path should not break.
• Deposit confirmation is asynchronous. The intent needs a state for "waiting for escrow" — internal/models has no such status today.
• An intent whose deposit never confirms must reach a terminal state rather than sitting in pending forever.

Acceptance criteria

• Creating an intent locks USDC in escrow on Arc
• Settlement releases through the contract, not directly from the backend
• A constraint violation reverts and funds stay escrowed
• Refund works after expiry without user action
• The backend still starts and serves with chain integration disabled

Depends on

Cookit-labs/intent-core-contracts#7, #8, #10, and the Arc chain client issue in this repo