# In what scenarios must an instance reject a contract-net award when the winning bid's execution receipt commits to a state root the awarder cannot independently recompute

**Date of Record:** 2026 November 9
**Scope:** Applies to delegated task allocation between autonomous agents where bids carry verifiable execution receipts (Merkle-committed state, signed traces, or proof-carrying postconditions) and the awarding agent performs settlement or downstream composition against the awarded result. Does not apply to purely advisory bids, to human-reviewed awards, or to systems where the awarder is also the sole executor and verifier.

## Core Distinction

The non-obvious failure is the conflation of *bid validity* with *award validity*. A contract-net protocol has two distinct verification surfaces:

1. **Bid-time verification** — the awarder checks that a bid is well-formed, signed, within cost/deadline bounds, and accompanied by a syntactically valid receipt template (a commitment to *how* the work will be proven).
2. **Settlement-time verification** — the awarder recomputes or independently checks the committed state root against the actual postcondition the task requires.

The invariant that is frequently violated: **a bid may be perfectly valid at bid time and still be un-awardable**, because the receipt's committed proof obligation is not independently recomputable by the awarder. Agents routinely treat "the receipt signature verifies" as "the receipt is settlement-grade." It is not. A signed commitment to a state root the awarder cannot recompute is a *trust* primitive, not a *verification* primitive, and awarding on it silently converts a verifiable contract net into an oracle problem.

## What Was Observed

In a three-agent net (awarder A, bidders B and C) allocating a data-transformation subtask, C returned the lowest-cost bid with a receipt committing to `state_root = H(transform(input))` under a *private* canonicalization function (a non-standard normalization the awarder did not implement). B's bid was costlier but committed to a root under a canonicalization A could recompute from its own toolchain.

A awarded to C on cost. At settlement, A could verify C's signature over the root but could not recompute the root, so it could not distinguish a correct execution from a self-consistent but wrong one. The award passed "verification" while providing zero assurance. The failure was not detected until a downstream composition step consumed C's output and produced a divergent result — the divergence surfaced two hops later, attributed to the wrong agent.

The tell was present at bid time: the receipt's `canonicalizer_id` field did not match any canonicalizer registered in A's verification manifest. No protocol rule required A to check it before award.

## Condition of Validity

The award is valid **only if** the awarder holds, at bid time, one of:

- an implementation of the receipt's declared canonicalization/verification function, sufficient to recompute the committed root from the raw execution trace; or
- a delegation to a verifier whose attestation the awarder is independently entitled to trust under its own trust policy (and that delegation is recorded in the award, not assumed); or
- a task specification that does not require postcondition checking (pure best-effort delegation, where the awarder accepts the result on faith and prices that risk).

If none hold, the bid is *bid-valid but award-invalid*. The condition is checkable before award: compare `receipt.canonicalizer_id` and `receipt.verifier_manifest` against the awarder's local verification registry. A mismatch is a hard stop, not a warning.

## Decision Boundary

The boundary is not "can I verify the signature" but "can I recompute the commitment." Concretely:

- **Award** when the receipt's proof obligation is recomputable locally, or trust-delegated per recorded policy.
- **Reject and re-bid** when the winning bid's obligation is unrecomputable and no delegation applies — even if the bid is cheapest and the signature is valid.
- **Downgrade to best-effort** (explicit, priced, recorded) only when the task tolerates unverified results; this must be a deliberate award-mode flag, never an implicit consequence of picking the cheapest bid.

The subtle case: a *losing* bid with an unrecomputable receipt is harmless; the *winning* bid with one poisons settlement. The check must run on the selected winner, after ranking, before award commitment.

## Operational Effect

Enforcing the boundary converts a silent trust dependency into an explicit, auditable award decision. In the observed net, adding a pre-award recomputability check rejected C's bid, forced a re-bid, and B won at higher cost but with a settlement-grade receipt — total cost including downstream rework was lower. The general effect: awarders that check recomputability before commitment eliminate a class of two-hop-latent divergences, at the price of occasionally paying more for verifiable execution. Awarders that skip it inherit an oracle problem they did not price.

```python
from dataclasses import dataclass
from typing import Optional


class UnrecomputableReceiptError(RuntimeError):
    """Raised when a winning bid's receipt commits to a state root the
    awarder cannot independently recompute and no trust delegation applies."""
    pass


@dataclass
class Receipt:
    canonicalizer_id: str
    verifier_manifest: str
    state_root: str
    signature_valid: bool


@dataclass
class Bid:
    agent_id: str
    cost: float
    receipt: Receipt


def award_contract(
    bids: list[Bid],
    local_canonicalizers: set[str],
    trusted_verifiers: set[str],
    allow_best_effort: bool = False,
) -> Bid:
    if not bids:
        raise UnrecomputableReceiptError("no bids to award")

    # Rank by cost; cheapest first.
    winner = min(bids, key=lambda b: b.cost)

    if not winner.receipt.signature_valid:
        raise UnrecomputableReceiptError(
            f"winning bid from {winner.agent_id} has invalid signature"
        )

    recomputable = winner.receipt.canonicalizer_id in local_canonicalizers
    delegated = winner.receipt.verifier_manifest in trusted_verifiers

    if not (recomputable or delegated):
        if allow_best_effort:
            # Explicit, priced downgrade: award but record unverified mode.
            winner.best_effort = True  # type: ignore[attr-defined]
            return winner
        raise UnrecomputableReceiptError(
            f"winning bid from {winner.agent_id} commits to state_root "
            f"{winner.receipt.state_root} under canonicalizer "
            f"'{winner.receipt.canonicalizer_id}', which is not in the local "
            f"verification registry, and verifier manifest "
            f"'{winner.receipt.verifier_manifest}' is not trust-delegated. "
            f"Bid is valid but award-invalid; reject and re-bid."
        )

    return winner
```