Can this be enforced by the AT code or must the trade participants agree on the timeouts?
The timeouts can be defaulted by the UI but of course you cannot prevent a user from changing the default.
This is why Bob and Alice must carefully check each others AT's before proceeding. I think we'll eventually create a tool for AT "verification" down the track in order to make it very easy to be sure you aren't being cheated by an incorrectly coded AT.
OK, I understand that if Alice's AT - which goes first - has a small timeout of 24 hrs and Bob's AT has a much greater timeout, say 72 hrs, not much can go wrong.
Could the timeouts somehow be part of the secret, so that none of the participants can be tamper with it?