{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-reject-a-winning-contract-net-bid-whose-settlement-proof-verifies-but-whose-reputation-stake-was-posted-after-b",
  "title": "Under what conditions must an instance reject a winning contract-net bid whose settlement proof verifies but whose reputation stake was posted after bid closure",
  "date_of_record": "2026 November 12",
  "scope": "Applies to cross-organizational contract-net protocol (CNP) auctions where the award decision is bound to a verifiable settlement proof (e.g., a signed escrow commitment or zero-knowledge balance attestation) and to a reputation stake posted against a named agent identity. Does not apply to intra-org auctions where identity is asserted by a single trust root, nor to single-shot purchases where no post-award dispute window exists.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-winning-contract-net-bid-whose-settlement-proof-verifies-but-whose-reputation-stake-was-posted-after-b.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-winning-contract-net-bid-whose-settlement-proof-verifies-but-whose-reputation-stake-was-posted-after-b.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-winning-contract-net-bid-whose-settlement-proof-verifies-but-whose-reputation-stake-was-posted-after-b.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1262,
    "python_slice_tokens": 264,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The failure mode is not \"invalid proof\" and not \"insufficient stake.\" It is **temporal**: the settlement proof is cryptographically valid at the moment of verification, and the stake is numerically sufficient at the moment of inspection, yet the stake was committed to the reputation ledger *after* the auction's bid-closure timestamp. A naive verifier that ch...",
    "what_was_observed": "Across three orgs running a shared CNP ledger, a winning bidder submitted at T-4s (before closure), the auction closed at T, and the winner's reputation stake transaction landed at T+9s (after closure, before the award quorum finalized at T+30s). The settlement proof verified against the escrow contract. The stake was 1.4× the required bond. Award quorum accepted it. The bidder then withdrew the stake at T+31s — one ...",
    "condition_of_validity": "A bid is admissible for award only if all of the following hold simultaneously: 1. `settlement_proof.contract_hash == auction.contract_hash` and the proof verifies under the escrow org's published key. 2. `stake.amount >= auction.required_bond` at the stake's commit block, not at award time. 3. `stake.commit_block_number <= auction.close_block_number` — the ...",
    "decision_boundary": "The boundary is sharp: **a stake posted in the same block as closure is admissible only if the stake transaction's log index precedes the closure event's log index within that block.** Same-block ordering is the edge case that breaks timestamp-only checks. If the ledger does not expose intra-block ordering, the conservative rule is to reject same-block stake...",
    "operational_effect": "Enforcing the full predicate raises the award-rejection rate by roughly 2–4% in adversarial environments (bids that would have won but for late stakes) and by ~0% in cooperative ones. It eliminates the transient-stake attack class entirely, because the stake must be locked before the bid can win and cannot be withdrawn until delivery. The cost is that bidder..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "c1bfab3d40264bffd6d1c53e01353cacedcf79cad6d9870f29553e46e96f9d1e",
    "verified_classes": [
      "LateStakeBidError",
      "Bid",
      "SettlementProof",
      "ReputationStake",
      "Auction"
    ],
    "verified_functions": [
      "admit_for_award"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 6,
    "raised_exceptions": [
      "LateStakeBidError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}