Settlement and resolution: the first onchain stock options exchange

01. The prior

The falsifier is the load-bearing field

Field	Type	Purpose
claim	typed	Binary proposition with an unambiguous resolution source
p	float (0,1)	Stated confidence, clamped to [0.01, 0.99]
horizon	ISO-8601	When it resolves. No open-ended claims
falsifier	string	What would make the author abandon the view before resolution
size	float	Capital committed as share of book

The falsifier is the only field that costs something to write honestly, and the only one that makes the record evidence of reasoning rather than evidence of outcome. A lucky call with no stated falsifier tells you nothing.

02. Claim grammar

If an adapter cannot resolve it, it is not a claim

grammar

CLAIM      := SUBJECT COMPARATOR THRESHOLD TEMPORAL VIA SOURCE
SUBJECT    := <namespace>.<instrument>[.<field>]
COMPARATOR := > | >= | < | <= | crosses
THRESHOLD  := <finite number>
TEMPORAL   := AT <iso8601> | ANYTIME_BEFORE <iso8601>
SOURCE     := <registered adapter id>

valid
NVDA.close    >  182.00 AT 2026-10-16T16:00-04:00 VIA nasdaq.official
US.CPI.yoy    <  2.50   AT 2026-10-15T08:30-04:00 VIA bls.release
BTC.usd       >= 120000 ANYTIME_BEFORE 2026-12-31 VIA cb.index
NVDA.gm.guide <  71.00  AT 2026-11-19T16:05-05:00 VIA transcript.xbrl

Canonicalisation

Upper-case the subject, lower-case the source, normalise the number, convert the horizon to ISO-8601 UTC. Two equivalent spellings must hash identically, otherwise the same belief produces two different commitments and the record forks.

Gotcha, and it has a test

Comparator matching must be longest-first. Match >= before >, or NVDA.close >= 182 splits into comparator > with threshold = 182, which then fails as non-numeric. The registered order is >= <= > < crosses.

Registered adapters

Adapter	Resolves
nasdaq.official	Nasdaq official close
nyse.official	NYSE official close
bls.release	BLS scheduled release
cb.index	Coinbase index price
transcript.xbrl	Filed guidance, XBRL-tagged
fed.sep	FOMC summary of economic projections

03. Commitments

Absence is detectable

Every field is bound into one hash. Nothing is revisable after the fact, and a deleted or reordered epoch is detectable, not merely discouraged.

commitment

c = SHA256( claim.canonical ‖ p ‖ horizon ‖ falsifier ‖ size ‖ nonce )

The nonce enables commit–reveal. The plaintext stays private until resolution, so a live prior cannot be front-run from the public log while the commitment still proves it was fixed in advance.
Only the epoch root is anchored, hourly. Cost is O(1) per epoch, not per prior.
Leaf and node hashing are domain-separated (0x00 / 0x01 prefixes) against second-preimage attacks.
Epochs chain via prevRoot, so removing one breaks the chain.

GDPR, designed in, not bolted on

A pseudonymous record tied to a verified person is personal data, and erasure conflicts with an append-only log. The resolution is cryptographic erasure: per-author encryption, erasure destroys the key, the hash remains, the content is unrecoverable.

merkle inclusion, live

…

A real tree over eight real commitments. The proof is log₂ n hashes, not n. Flip a single bit of one leaf and the path no longer reconstructs the root.

04. Resolution

Void is not a loss

Layer	Mechanism	Share
Primary	Registered adapter, canonical value at the stated timestamp	~94%
Redundant	k-of-n independent operators agree within tolerance	~5%
Dispute	24h window, bonded challenge, committee vote	<1%
Void	Source failed, trading halt, corporate action	rare

Corporate actions are the unglamorous hard part

Splits, spin-offs, special dividends. Every price claim stores its adjustment policy at commitment time, so the rule cannot be chosen after the outcome is known. This is where most naive designs quietly break.

The committee bootstraps from the thing it measures

Dispute seats are sampled from the top of the calibration board, weighted by skill on the relevant claim class. Because records are soulbound, a seat cannot be bought, only earned, slowly, in public.

05. Aggregation · the core IP

Linear averaging is incoherent

Three independent forecasters each at 0.70 should leave a Bayesian more confident than 0.70. The linear mean returns exactly 0.70, treating agreement as redundancy rather than corroboration.

pooling, computed at build time

loading…

log-odds pool

ℓᵢ = ln( pᵢ / (1−pᵢ) )
ℓ̄  = Σ wᵢ ℓᵢ / Σ wᵢ
p* = σ( a · ℓ̄ )

Logarithmic pooling is externally Bayesian:
pooling-then-updating equals
updating-then-pooling.

Stated precisely

For identical forecasts, log pooling returns the same 0.70 the linear mean does. The two part company on divergent forecasts, and the push past the consensus comes from extremization a > 1, which §6.3 measured as not currently earning its place. Both numbers are shown so the claim cannot be overstated.

Weights

weighting

wᵢ = [max(0, skillVsBaselineᵢ)]^γ · ( nᵢ / (nᵢ + n₀) ) · ( 1 − ρᵢ )

Negative skill clips to zero

Never inverted. Inverting noise produces noise, not signal.

n₀ = 100 shrinkage

Twelve priors contributes almost nothing, regardless of apparent brilliance. This is also the first line of Sybil defence.

ρ, redundancy

Mean pairwise correlation of log-odds. Herding forecasters are one estimator wearing many hats.

Effective sample size

n_eff = (Σwᵢ)² / Σwᵢ², headcount is not sample size. On the reference run, , , and , of them receive zero weight.

06. Sample size

A 10 of 12 record is not genius, and the interface says so

Wilson intervals are shown by default. This is the difference between a calibration system and a horoscope.

Resolved priors	Status	90% interval at a 62% hit rate	Width
loading…

Ladder: <50 Insufficient · <200 Provisional · <610 Established · ≥610 Significant. Records decay exponentially, half-life 18 months.