Pricing, Bonds & Audits

Pricing Boundary

Written out, a finding's counterfactual value looks roughly like P(buyer would have attempted) x cost-if-attempted x P(same dead end) x redundancy x decay. These inputs describe the buyer's counterfactual plan, which the seller and venue cannot observe at listing time. The design therefore does not estimate the finding's value.

The proposed rule prices a bound: what the buyer would have paid to derive the same conclusion directly, discounted for how likely the buyer was to attempt it, how much a redundant sibling already covers, and how strong the seller's guarantee is. That bound is computable today, from data Chio already holds.

The Substitute-Good Ceiling

chio-finding computes that bound as FindingBidBasis, a struct of policy-visible inputs, and finding_bid_ceiling(), a pure function over it. The ceiling caps what a buyer may bid; it never estimates what the finding is worth:

pub struct FindingBidBasis {
    /// Buyer's own re-derivation cost estimate, in billing units.
    pub rederivation_quote_units: u64,
    /// Planner prior, in bps: probability the buyer would have run
    /// the derivation at all. An open problem, not a solved one.
    pub would_have_run_bps: u32,
    /// Pool-dedup haircut, in bps, for redundant sibling coverage.
    pub sibling_redundancy_bps: u32,
    /// Guarantee-class multiplier, in bps. See the table below.
    pub guarantee_class_bps: u32,
    /// Hard cap: buyer's remaining budget, in billing units.
    pub budget_remaining_units: u64,
}

pub fn finding_bid_ceiling(basis: &FindingBidBasis) -> u64 {
    let would_have_run = basis.rederivation_quote_units
        .saturating_mul(basis.would_have_run_bps as u64) / 10_000;
    let after_redundancy = would_have_run
        .saturating_mul(10_000 - basis.sibling_redundancy_bps as u64) / 10_000;
    let after_guarantee = after_redundancy
        .saturating_mul(basis.guarantee_class_bps as u64) / 10_000;
    after_guarantee.min(basis.budget_remaining_units)
}

The planned input fields are: rederivation_quote_units comes from a MeteredBillingQuote; would_have_run_bps is a planner prior and the least settled input here; sibling_redundancy_bps is a pool-dedup haircut for ground a sibling already covers; and budget_remaining_units is a hard cap that binds regardless of the other terms. guarantee_class_bps is policy-tunable, not kernel-fixed; suggested defaults appear in the table below. finding_bid_ceiling() returns the same ceiling for the same basis. Signed or metered inputs can be reviewed, and increasing a basis-points input cannot reduce the ceiling. The function bounds a bid; it does not value the finding.

Seller Pricing

Everything above bounds the buyer's bid; the seller side stays exactly as simple as any other v1 listing: a posted price, ListingPricingHint.price_per_call, set once at publish time. A bid clears only when that posted price sits at or under the buyer's finding_bid_ceiling(); anything higher is refused with BidCeilingTooLow. There is no auction, no counter-offer, and no per-buyer price discrimination in v1: an auction or negotiation mechanism, letting price float between the ceiling and a seller reservation price, is a deferred, demand-gated decision that ships only if posted-price listings show the ceiling binds often enough to justify it.

Guarantee Classes and How Each Prices

guarantee_class_bps is not pulled from nowhere: it reads off the same three-class taxonomy every finding is sold under, and each class prices differently because each is re-checkable to a different degree.

These multipliers are suggested policy defaults, not kernel constants; an operator can retune all three per namespace. The rule that never bends: an asserted claim starts and stays asserted until independently re-verified, the same truthfulness discipline Chio's formal layer proves for status reporting generally (property P10: asserted or observed, never inflated in transit).

Honesty Economics

A seller who fabricates a finding outright, publishing a claim with no derivation behind it, commits a new abuse class, FabricatedFindingEvidence, joining the four chio-open-market already enforces (SpamPublication, FraudulentListing, ReplayPublication, UnverifiableListingBehavior).

Enforcement is not a side channel: a FabricatedFindingEvidence penalty slashes only through the same fail-closed path every abuse class uses, an enforced sanction case under Governance Charters, evaluated against a slashable bond class, with SlashBond amount-capped to the bond actually posted and ReverseSlash intact on a successful appeal. Slashed capital goes to the buyers defrauded or, absent an identifiable victim, to a namespace community fund, never to the party that raised the case. The predeclared decision rules behind that case are limited to what is mechanically decidable: a digest mismatch between the revealed content and what the buyer priced; evidence that fails re-verification against the receipt chain, a checkpoint, or a revocation record; and, for a deterministic_replay finding, a bonded challenger whose mediated re-execution contradicts the claim. A low reputation score or a disgruntled buyer's say-so does not, alone, open a sanction case.

Probabilistic Audits

Buyer challenges catch a fabrication somebody already noticed, not one nobody has bought yet. The venue closes that gap by funding audits directly, at a published rate, sized so fabricating is never positive expected value:

// deterrence condition, evaluated per guarantee class and namespace
audit_rate * slash_amount >= expected_fabrication_profit

// expected_fabrication_profit ~= price_per_call * expected_sales_in_window

Below that line, fabricating is positive expected value and the audit budget is under-funding its own deterrent; above it, a seller's dominant strategy is to sell only what it can back. Publishing the rate is deliberate: within the costly-evaluation model of peer prediction, mechanisms that reward agents for matching each other's reports admit low-effort or collusive equilibria, and limited ground-truth re-execution dominates that class. This is a narrowing, not an impossibility proof: peer and market signals stay useful for prioritizing which findings an audit re-executes first; they never settle a determination alone.

Bond Sizing

A bond must cover finalized fraud exposure, fabrication a sanction case has actually confirmed, over the detection horizon: how long a fabricated finding can keep selling before an audit or challenger catches it. The sizing rule is bond at least k * price_per_call * expected_sales_within_detection_horizon, with k at least 1. A thin bond against a fast-selling, slow-to-detect finding underprices exactly the risk this section exists to price; sizing k and the detection horizon is a namespace policy choice, covered in Underwriting Risk Taxonomy.

What v1 Ships and What It Does Not

Next Steps

• Reveal & Settlement · the digest-gated payout this ceiling and these bonds price
• Status & Retraction · what happens to a paid finding after a retraction
• Governance Charters · the sanction and appeal lifecycle a FabricatedFindingEvidence case runs through
• Underwriting Risk Taxonomy · how a bond class and its requirements get sized
• Pricing Models & SLAs · ListingPricingHint and MeteredBillingQuote, the metered-billing context this page builds on