BO-Sealed-Bid
Agent-to-agent commerce has a bad default: to negotiate its price
Demo
About
Agent-to-agent commerce has a bad default: to negotiate, an agent either reveals its reserve price (and gets priced at the edge of it) or trusts a middleman who sees both numbers. We remove the middleman with a Chainlink CRE **Confidential Workflow**. Agent A and Agent B each hold a private reserve. A CRE Confidential Workflow reads both as Vault secrets inside a Nitro enclave and returns only SETTLE @ midpoint or NO_OVERLAP. SETTLE is written to a receiver on Base Sepolia; NO_OVERLAP writes nothing. Third-party vetting via x402. Both reserve prices and two commitment salts are CRE Vault secrets. Inside a `handlerInTee` handler running on AWS Nitro, the workflow makes one `getSecrets` call, computes whether the bands overlap, and produces exactly one of two outputs: `SETTLE @ clearing` (the midpoint) or the literal `NO_OVERLAP`. Alongside it: two salted commitments `sha256(reserve‖salt)` and a run id, so either party can later prove what it bid without the enclave ever having published it. Nothing else crosses back to the DON — not the reserves, not the gap, not which side was higher. That property is tested at every layer, with deliberately leaky implementations kept in the suite as negative controls. On `SETTLE`, the DON writes the attestation through the CRE Forwarder to `SealedBidReceiver` on Base Sepolia, a contract that records only SETTLE outcomes and reverts everything else — so even a misbehaving workflow could not leave a NO_OVERLAP trace. Agent A then pays Agent B the clearing amount. On `NO_OVERLAP`, no transaction is sent at all. Settlement is not self-certified. Before bidding, each agent vets the other through BlindOracle, a public pay-per-call API settled over x402 in USDC on Base mainnet; a trust badge opens the bracket, a reputation lookup closes it, and a process-followed attestation can be bought over the hash-chained, signed evidence of the run. Every one of those payments is a USDC transfer anyone can check on Basescan. The one thing `SETTLE` does reveal is `A_max + B_min`. That is the standard sealed-bid trade-off and we state it rather than hide it.
How it's made
- **Chainlink CRE** (CLI v1.31.0, `@chainlink/cre-sdk` 1.18.0, TypeScript). `cre.handlerInTee` with a Nitro/us-west-2 constraint; one `getSecrets` call for four Vault secrets (a measured runtime limit — a second call fails); `usingTheDons().report(...)` with an ABI-encoded attestation; `EVMClient.writeReport` on SETTLE only. 34 bun tests. Deployed live to the on-chain registry on 2026-09-11; one DON execution settled through the real Forwarder, the next was refused as a duplicate run. Measured along the way: `cre workflow simulate --broadcast` writes through the simulator's own mock forwarder as a placeholder owner, so a receiver built for the production Forwarder correctly rejects it — hence two deployed receivers, one per forwarder, documented in EVIDENCE.md. - **Solidity / Foundry.** `SealedBidReceiver` implements CRE's `IReceiver`; forwarder-only, optional pinned workflow owner, SETTLE-only state, ERC-165. 13 forge tests including a fuzz over the midpoint. - **Base.** Settlement on Base Sepolia (receiver + the A→B transfer); BlindOracle payments on Base mainnet. - **x402.** The `x402` Python SDK signs EIP-3009 `TransferWithAuthorization`s; the facilitator settles gaslessly. 42 real payments across 4 SKUs during the build ($4.02), every one a USDC transfer on Base mainnet listed in `bo_calls.jsonl`. - **Python.** `bo_client.py` (client + the reserve-never-leaves-the-parties rule), `scripts/demo.py` (the whole protocol in one command, producing a hash-chained evidence bundle in the RAP-1 wire format, signed with **ed25519** — public key at `evidence/signing-key.pub`; HMAC only as the keyless fallback), `scripts/skucheck.py`. - **Process attestation.** The signed bundle is bought against BlindOracle's `security.process-attestation` SKU: `conformant`, `signature_binding: attributable` (tx `0xa562f6f7…a1fc`, USDC on Base mainnet). The first run came back `non_conformant` and is recorded as such in `EVIDENCE.md` — the fix was matching a published wire format and switching to an asymmetric key, not rewording the claim. - **AI assistance.** Built with Claude Code from this repository's own SPEC.md, after kick-off, from a minimal CLAUDE.md that forbids reading anything outside the repo. See DISCLOSURE.md.