# AERE Market Settlement The dispute and settlement rail of a verifiable infrastructure market, measured end to end on testnet 28001: an order with its reward in escrow, a provider bond, the provider's result committed on chain and its proof notarized under a post-quantum certified anchor, a challenge window in which anyone can dispute with a recomputed result and a matching bond, an arbiter who can only route the escrow between the three parties (and a permissionless timeout if the arbiter never answers), a deadline after which an undelivered order is reclaimed, and an AIP-23 settlement receipt of the payout. Built from what already exists: `AereComputeMarketV3` (the contract, here as a committed artifact), `proof-kinds/` (the execution envelope and the settlement receipt), `agents/agent-ancora.mjs` (the one notarization call of the house) and the AIP-23 reference verifier. | step | on chain | off chain, checkable by anyone | |---|---|---| | order | `postJob`: reward escrowed, `specHash` of the public workload, deadline, challenge window, required provider bond | the spec itself (`sarcina.mjs`: a keccak chain anyone recomputes) | | claim | `claimJob` with the bond, only before the deadline | | | proof | `submitResult`: `keccak256(result)` recorded, the bytes emitted; the window starts | the provider's `aere-proof-of-execution` envelope (program, `inputHash` = specHash, `outputHash` = resultHash) notarized on AereNotary: its `firstSeen` is the chain's time, read back under a post-quantum certified anchor by `verify-proof.mjs` | | dispute | `dispute(recomputedHash)` with a bond equal to the provider's, only inside the window | the judge replays the spec and says which side the arbiter should take | | settlement | `finalize` by anyone after the window (Paid); `resolveDispute` by the ARBITER (Paid or Slashed); `resolveByTimeout` by anyone after 14 days (Refunded, bonds returned); `reclaimExpired` by the requester after the deadline (Refunded, bond slashed); `cancelJob` on an open order | `piata.mjs judeca`: the timeline against the rules; `chitanta`: the AIP-23 `settlement` envelope of the payout tx | `piata.mjs` has the three pieces a reader needs: `codulAsteptat` rebuilds the runtime code a market must have from the committed artifact and the four constructor arguments (so `eth_getCode` is compared before any event is believed), `cronologie` reads a job's state and every event with its block time and sender, and `judeca` is a pure function over that timeline: claim and submission before the deadline, dispute strictly inside the window, finalize only after it (unless the requester accepts early), resolution only by the arbiter or after `ARBITRATION_TIMEOUT`, the terminal payout matching the state, the result bytes hashing to the commitment, the replay of the public spec agreeing with whoever won, and the notarized envelope naming this job's spec and result before the window closed. Every refusal names its rule (`reguli`). A timeline the judge cannot read is refused by name, not thrown, and so is one that lacks an event the job state implies: a timeline with its submission event withheld used to skip the window rule and come out VALID (found by the conformance suite on 2026-10-03, `conformance/`). WHEN the provider's envelope was notarized is the chain's word, not the envelope's: the caller hands the judge the reading of the AIP-23 reference verifier for that envelope (`certified`: the first-seen time held by the notary under a verified post-quantum anchor); the judge takes the time from it and only compares the envelope's own claim with it. Until 2026-10-03 the time was taken from the claim. Without a certified reading the judge says so (`nemasurat`). ``` AERE_TESTNET_KEY_FILE= AERE_ETHERS_DIR= node proba-piata-28001.mjs # the flow on 28001 (five scenarios) node proba-judecata.mjs # the judge on the recorded timelines: 7 honest VALID, 18 forged or malformed INVALID, the receipt node proba-judecata.mjs --control-negativ # 10 plantings on a copy of piata.mjs; each forged fixture must then be accepted node extrage-artefact.mjs # regenerate AereComputeMarketV3.json from the contracts build (refuses a changed source) ``` ## What it is not, and what is not measured - **Not a marketplace.** No discovery, no pricing, no reputation, no real GPU, storage or inference behind the workload; the task is a keccak chain chosen because anyone can replay it. The rail settles; it does not find providers. - **The arbiter is one key.** A dispute is decided by `ARBITER`, who can only route the escrow between requester, provider and challenger, never elsewhere, and whose silence is unwound by anyone after 14 days. That is a trust assumption, named, not a proof; the judge checks the arbiter's decision against the replay afterwards, which makes a wrong ruling visible, not impossible. - **REPLAY mode only.** `ZK_VERIFIED` (pay only on an SP1 proof) cannot be exercised on this deployment: 28001 has no SP1 gateway, so the market was built with a contract that has code but no `verifyProof` (the notary), and a ZK job reverts, fail-closed. `pqcSettlement` (a Falcon-512 payout authorization) is not exercised either. The 14-day arbitration timeout and the 7-day PQC grace are not waited for: the probe shows they refuse early (`ArbitrationTimeoutNotPassed`), not that they unwind. - **Native tAERE only.** An allowlisted ERC-20 reward and the 2-of-2 agent wallet as requester are not measured: the contract wallet has no function that calls `postJob`, so an agent that orders through this rail does it from its EOA, under its ledger and policy. - **Chain 2800: nothing.** `AereComputeMarketV3` is held back from mainnet until an external audit of fund-flow contracts; everything here ran on testnet 28001 with test keys (the provider's and the arbiter's derived from the requester's test key, never printed). - The replay uses a dependency-free keccak-256 (BigInt): about 7 s for the 20,000 iterations of the laboratory task on a laptop, against well under a second with a native or WebAssembly keccak; the cost is the price of a component with nothing to install, and it is measured, not hidden. - The judge trusts the RPC for the timeline (events and block times), like every reader of a chain through an endpoint; the notarized envelope's time is checked under a post-quantum certified anchor by the reference verifier, the rest is not.