Skip to content

PayPal sandbox only. No real money moves.

LearnHow it works

Engine and ledger

A deterministic auction core and a hash-chained audit trail.

Verifiedbacked by a real run or committed evidence

Page last changed 8 Nov 2026 (from the git history)

The engine

An English ascending auction with and a . The core is three pure functions, decide, evolve and replay, with no Node built-ins, so the same events always give the same result.

Events are real names from the code: AUCTION_CREATED, LOT_ADDED, LOT_OPENED, BID_RECORDED, BID_REJECTED, BID_STRUCK, LOT_CLOSING, LOT_HAMMERED, LOT_UNSOLD, LOT_ABORTED, LOT_PAUSED, LOT_RESUMED, LOT_EXTENDED, LOT_SETTLED, AUCTION_CLOSED. See events.

The ledger

Every event is linked to the one before it by a hash. A redacted public export and a detect an edited chain. A cut tail shows as not closed, and is proven only against a head hash published elsewhere.

  • verifyPublicExport(entries) returns { ok: true } or the first bad index with a reason. Pass expectedHead to also detect truncation.
  • verify-ledger <ledger.jsonl> in packages/engine checks an export without a server and exits non-zero on tampering.

The room runtime

The server is a single Node process per host. It holds the , turns spoken and typed bids into engine commands, schedules settlement and keeps file stores for the room log, ledger, journals, holds and webhook events. A persistent store for a hosted deploy needs a persistent disk and a single instance.

Edit on GitHub

Last updated on

Voice and the confirm gate code-checked

Speech never becomes a bid by itself. The pipeline, the gate and where the accuracy gate stands.

Roadmap

The next steps, in order, and what the G3 readings decide.

On this page

The engineThe ledgerThe room runtime