DOCUMENTATION

Covenant, from zero.

Never touched Stacks, a crypto wallet, or a smart contract before? Perfect. This page walks you from a blank machine to a real, auditable conditional-treasury transaction on the Stacks testnet — every click explained.

1. What is Covenant?

Covenant is a conditional treasury platform. Money is deposited into a shared vault and only moves when a real-world condition is verifiably met — a milestone being delivered, a payroll check-in happening, an insurance incident being declared.

Think of it as programmable escrow. Instead of trusting one person to hold funds and “do the right thing,” the rules for how money is locked, split, and released are enforced on-chain and recorded on a public ledger anyone can audit.

2. What is FlowVault?

FlowVault is a programmable asset-routing layer on Stacks. It provides a single contract (flowvault-v2) with per-wallet routing rules. When you deposit tokens, FlowVault can automatically:

  • Lock an amount until a future block height (a time-lock).
  • Split an amount to another address on deposit (auto-routing).
  • Hold the remainder as your withdrawable balance.

Covenant uses these primitives — set-routing-rules, deposit, withdraw — as the on-chain engine underneath every vault type.

3. The escrow custodian pattern (read this)

Here’s the honest, important design detail. FlowVault’s routing rules are fixed at the moment of deposit, and withdraw always pays the depositor back. So the contract cannot natively branch “if the milestone succeeds send here, otherwise refund there.”

Covenant solves this at the application layer with a per-program escrow custodian:

1
The grantor funds a dedicated custodian
Each program gets its own deterministic custodian address. The grantor sends the full pool of USDCx there from their wallet. The program isn’t publicly listed until that balance is verified on-chain.
2
On award, the pool is locked in FlowVault
When the grantor accepts a builder and sets the milestone schedule, the custodian calls set-routing-rules + deposit, locking the pool until the first milestone’s deadline block.
3
Judges attest each milestone (2-of-N)
The grantor names the judges at award time. For the active milestone, each judge connects their wallet and cryptographically signs“met” / “not met”; the server verifies the signature against their address.
4
Each payment releases — or expires — automatically
At a milestone’s deadline the reconcile engine acts on its own: if judges attested MET it withdraws and pays that milestone amount to the builder, then re-locks the remainder until the next deadline. If the deadline passed un-attested, the remaining pool is returned to the grantor and the program ends. No manual “release” button.

Every one of those steps produces a real transaction id with a clickable Stacks explorer link, so the whole lifecycle is auditable.

4. One-time setup (about 10 minutes)

1
Install a Stacks wallet
Xverse (easiest) or Leather. Create an account and switch it to Testnet. Your address starts with ST….
2
Get free testnet STX (for gas)
Open the Hiro testnet faucet, paste your ST… address, and request STX. This is play money — it has no real value.
3
Get testnet USDCx (the token Covenant uses)
Use the FlowVault bounty’s “Need Testnet USDCx?” dispenser, or ask in the Stacks/FlowVault community channel. Send some to your ST… address.
4
Just want to try it? Use the live app
You don’t have to run anything locally — the deployed app is at thecovenant.vercel.app. Connect a testnet wallet and go straight to the walkthrough.
5
Or run it locally (for developers)
You need Node.js 18+. Then:
git clone <your-repo-url>
cd covenant
npm install
cp .env.example .env       # then edit values (see below)
npm run db:push            # local SQLite; for Vercel use Turso (step 7)
npm run dev
Open http://localhost:3000.
6
Configure the custodian key (server-side only)
In .env, set STACKS_PRIVATE_KEY to the private key of a separate funded testnet account — this is the escrow custodian. It is read only on the server and never shipped to the browser.
NEXT_PUBLIC_FLOWVAULT_NETWORK=testnet
NEXT_PUBLIC_FLOWVAULT_CONTRACT_ADDRESS=STD7QG84VQQ0C35SZM2EYTHZV4M8FQ0R7YNSQWPD
NEXT_PUBLIC_FLOWVAULT_CONTRACT_NAME=flowvault-v2
NEXT_PUBLIC_FLOWVAULT_TOKEN_CONTRACT_ADDRESS=ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM
NEXT_PUBLIC_FLOWVAULT_TOKEN_CONTRACT_NAME=usdcx
STACKS_PRIVATE_KEY=your_custodian_private_key_here
DATABASE_URL="file:./dev.db"
7
Deploying to Vercel? Add a Turso database
Vercel’s filesystem is read-only, so the local SQLite file can’t be used in production. Covenant uses Turso (a hosted, SQLite-compatible database) — no schema changes needed. Create it, load the tables, and set two env vars in Vercel:
turso auth signup
turso db create covenant
turso db shell covenant < schema.sql   # creates all tables

# In Vercel -> Settings -> Environment Variables:
TURSO_DATABASE_URL   (turso db show covenant --url)
TURSO_AUTH_TOKEN     (turso db tokens create covenant)
STACKS_PRIVATE_KEY   (your funded custodian key)
When TURSO_DATABASE_URL is set it is used automatically; otherwise the app falls back to the local file.

No custom smart contract is deployed by you — Covenant consumes the already-deployed flowvault-v2contract. The only “deployment” you do is funding the custodian account. See the custodian pattern above.

5. Full walkthrough (real transactions)

1
Connect your wallet
Click CONNECT WALLET (top right) and approve. Your address appears truncated with a copy button.
2
Grantor: create a program
Go to Programs New Program. Give it a title, a description, eligibility conditions, the total pool, and a horizon. Submit.
3
Grantor: fund escrow & publish (your first on-chain tx)
On the program page, click SEND POOL TO ESCROW— your wallet signs a USDCx transfer to the program’s custodian. Once the balance is verified, click PUBLISH PROGRAM. It’s now open to builders.
4
Builder: apply
A builder opens the program, writes a short pitch, and clicks APPLY TO BUILD.
5
Grantor: award + set milestones
The grantor picks one applicant, names the judges, and defines the milestone schedule (each with a name, a % of the award, and a deadline — percentages sum to 100%). Confirming locks the pool in FlowVault until milestone 1.
6
Build → attest → auto-disburse
The builder marks a milestone ready for review; judges sign MET. At that milestone’s deadline the payment goes to the builder automatically and the remainder re-locks for the next one. A milestone that lapses un-attested returns its funds to the grantor — no manual settlement, every transfer logged with an explorer link.

That’s a complete milestone-grant cycle on real testnet infrastructure — exactly what a demo video should show.

6. The vault types

The Milestone-Based Grant is the flagship — a grantor-funded pool disbursed milestone-by-milestone to one builder as independent judges verify each milestone. The other three are secondary behaviors built on the same escrow + FlowVault primitives. All execute real on-chain USDCx transfers.

7. Troubleshooting

“STACKS_PRIVATE_KEY is required” — set the key in .env and restart npm run dev.

A transaction fails — the sending wallet (yours or the custodian) is out of USDCx or STX gas. Top up from the faucet.

My address didn’t appear after connecting — hard refresh (Ctrl/Cmd + Shift + R) and connect again.

Balance looks stale — Stacks needs a few seconds to confirm; click Check Balance again after the tx confirms in the explorer.