back
loading skill details...
Design and run an agent-native, evidence-settled prediction market — the trust model (who proposes, trades, settles), the propose→open→settle lifecycle, mach...
--- name: resonance-futures description: Design and run an agent-native, evidence-settled prediction market — the trust model (who proposes, trades, settles), the propose→open→settle lifecycle, machine-measurable settlement, anti-gaming rules, and the path from play-credits to real money. Use when building a prediction market that autonomous agents originate and settle. --- # Resonance Futures — an agent-native prediction market A prediction market run *by* and *for* autonomous agents is only trustworthy if it is a **market**, not a poll: claims are falsifiable and machine-measurable, identity is verified, and settlement is evidence-first and separated from authorship. This skill is the architecture, distilled from building one across a multi-service constellation and hardening it with an adversarial review. ## The one-sentence thesis *Labs measure · the Exchange settles · a public ledger witnesses.* Keep those three responsibilities in different hands and most of the failure modes disappear. ## Trust model — separate the credentials Give each capability a **distinct** credential; do not reuse one bearer token for everything. | Capability | Who | Why it's separate | |---|---|---| | Propose a prediction | any verified identity (user or agent) | origination should be open, but attributable | | Curate — open / reject | the Labs oracle (service) or an admin | opens the measurability gate | | Trade / vote | any verified identity | one account per verified principal | | **Settle / resolve** | the **oracle service only** | a proposer must never settle their own market | | Dispute | any verified identity, within a window | a check on the oracle | **Identity provider.** Issue short-lived, asymmetrically-signed tokens (EdDSA) from one provider; every surface verifies them *locally* against a published JWKS — no per-request introspection. Harden the verifier: pin the algorithm allowlist (reject `alg=none` and HMAC-with-the-public-key confusion), require `exp`/`iat`/`nbf`, select the key by `kid`, and **fail closed** if the JWKS can't be fetched. Bind an agent token to an identity the provider has *proven* control of (e.g. a challenge the agent answers through a channel only it controls) — never to a merely-observed id. Derive a trader's id from the verified token `sub`, never from a request-body string (that's the sybil door). ## Lifecycle `proposed → open → settled` (plus `rejected`, `disputed`). 1. **Propose** — a verified principal submits a statement + a settlement method, attributed to them. It carries no tradeable market yet. 2. **Curate / open** — the oracle applies the **measurability gate** and, if it passes, opens the market (and pairs a tradeable market if you have one). 3. **Trade** — verified principals take positions. 4. **Settle** — the oracle measures and records the *reading* (the actual measurement output), sets TRUE/FALSE, and witnesses it. ## The measurability gate A proposal may not **open** unless it can actually be settled by evidence: either a **machine-readable measurement spec** (auto-settle) *or* a **named settlement procedure plus a deadline**. "Will X be cool?" is rejected at curation, not settled by whoever shows up at the deadline. A measurement spec is a small, declarative object your settler can execute — e.g. *count entities matching a condition in a named external data source at a deadline; settle TRUE if the count meets a threshold*. Store the spec with the prediction so settlement is reproducible and auditable. ## Settlement — evidence-first and safe - **Record the reading.** Every settlement stores what was actually measured, who/what settled it, and when. Push it to an append-only public ledger. - **Early settlement only for monotone, irreversible facts**, and only after the condition has **held across several consecutive checks** — an external signal that can be reverted (a claim that gets undone) must not lock a permanent wrong outcome on a single transient read. - **Partial/ambiguous measurements are a skip, not a settle.** A truncated or paginated data read that yields a low count must be treated as "measurement failed → stay open," never as a settlement. Never settle FALSE at a deadline off one unconfirmed read. - **Cross-service consistency.** If settlement writes to more than one store (a registry, a ledger, a paired market), use a durable **outbox** and idempotent, retried deliveries — never fire-and-forget. Otherwise the ledger says TRUE while the market paid FALSE. ## Anti-gaming rules (the ones that actually bite) - **No self-fulfilling conditions.** If a market participant can *cause* the measured fact (e.g. "someone builds a building" is trivially caused by a Yes-holder), the market is theft-at-real-money. Require the triggering fact to be attributable to a **non-participant**, exclude actions by principals holding a position, and/or gate settlement behind independent corroboration. - **Sybil-proof the price.** An open, self-registration market's displayed price is trivially forgeable by one actor with N free accounts — **never cite it as authoritative signal.** Require verified-identity trading (and per-principal position caps) on any market whose price you quote. - **Halt trading before a deterministic settlement**, and snapshot the price at the freeze — otherwise anyone who sees the reading flip buys in risk-free. - **Single-flip settlement.** Guard the resolve in the database (`… WHERE resolved = 0` + changed-rows check) so a manual settle racing an automated one can't pay winners twice and mint credits. Guard the debit (`… WHERE balance >= cost`) so concurrent trades can't overdraw. ## Ledger — before any real money - **Double-entry, append-only, hash-chained.** Balances are *derived* from balanced postings, never stored-and-mutated. Each entry commits to the previous entry's hash; enforce no-UPDATE/no-DELETE as a database grant, not an app-code convention. A witnessed settlement is a new superseding row, never an in-place rewrite. - **Integer minor units** for money-shaped amounts; keep market *prices* floating but settle *amounts* as integers, with one canonical rounding rule. - **The automated market maker is a funded account.** Its bounded subsidy is a real posting escrowed at market creation, so payouts don't mint unbacked credit and total value is conserved. ## From play-credits to real money — a hard gate Real-money event contracts are regulated in most jurisdictions. Treat legal review as a **launch precondition, not a to-do**. Build so the gate is the only blocker: KYC + geo-fencing hooks at the identity layer; custody keys physically separated from the settlement oracle (different box / HSM / multisig, so no single credential both settles and pays); a continuous reconciler that **halts** settlement on any on-chain/off-chain divergence; and play vs real ledgers segregated and never fungible. Until the gate opens, the market's realness comes from **integrity, not stakes** — verified identity, measurable claims, evidence-first settlement, and an append-only public record. ## Before you build it This is exactly the "hard to reverse" territory an adversarial design review pays for: identity, settlement authority, and money. Attack the design first — have specialists each hunt one lens (capability/identity, ledger integrity, oracle/market economics, cross-service consistency) for concrete failure scenarios — then implement the survivors.
don't have the plugin yet? install it then click "run inline in claude" again.
build a prediction market that autonomous agents originate, trade, and settle without a central authority. the market only works if claims are falsifiable and machine-measurable, identity is verified at every step, and settlement is evidence-first and separated from authorship. use this skill when you need a trustworthy prediction market where agents propose predictions, curate them, trade positions, and an oracle (never the proposer) settles the outcome with recorded evidence. the core thesis: labs measure, the exchange settles, a public ledger witnesses. keep those three responsibilities in different hands and most failure modes disappear.
identity provider
IDENTITY_PROVIDER_JWKS_URL, IDENTITY_PROVIDER_ISSUERsub (verified subject), exp, iat, nbf, kid; never derive trader id from request bodyoracle service credential
ORACLE_SERVICE_TOKEN (used only for settle/resolve operations, never for proposing or trading)measurement sources (varies by market type)
ledger storage (append-only, hash-chained)
LEDGER_DB_URL or LEDGER_EVENT_STOREoptional: automated market maker (amm) subsidy account
AMM_SUBSIDY_ACCOUNT_ID, AMM_SUBSIDY_AMOUNT_MINOR_UNITSoptional: dispute window and resolver
DISPUTE_WINDOW_HOURS, DISPUTE_RESOLVER_ENDPOINToptional: kyc/geo-fencing and custody separation (real-money markets only)
KYC_PROVIDER_URL, GEO_FENCE_ALLOWLIST, CUSTODY_KEY_LOCATIONdesign the trust model and credentials
alg=none, hmac with public key)configure the identity provider and local jwt verification
exp/iat/nbf, select key by kid, fail closed if jwks fetch failssub, never from request-body stringdefine the measurability gate for proposals
implement the proposal → open → settled lifecycle
subORACLE_SERVICE_TOKEN) applies the measurability gatesub), market_id, position_side (yes/no/float), amount_minor_units, current market priceWHERE balance >= cost guard in databasehalt trading and snapshot the price before settlement
guard against double-settlement and concurrent overdrafts
UPDATE market SET resolved = true, outcome = ? WHERE market_id = ? AND resolved = 0 + verify changed rows = 1UPDATE balance SET balance = balance - ? WHERE principal_id = ? AND balance >= ? + verify changed rows = 1implement the append-only, double-entry ledger
implement the automated market maker (if using one)
implement dispute window and resolver (optional, if allowing post-settlement disputes)
implement early-settlement safeguards for monotone, irreversible facts
implement cross-service consistency with an outbox pattern (if settlement writes to multiple stores)
implement anti-gaming rules
set up the ledger reconciler and balance auditor
gate real-money markets with kyc, geo-fencing, and custody separation (if applicable)
run an adversarial design review before launch
if proposal has a machine-readable measurement spec (auto-settle), proceed to step 4b curation gate and check the spec is sound. else if proposal has a named settlement procedure + deadline, check the procedure is specific and the deadline is future, then proceed to curation. else reject at curation.
if oracle service approves the proposal, open the market (step 4b). else reject and return reject_reason to the proposer.
if a trade request arrives and the trader's balance >= cost, debit the balance atomically (step 4c). else reject the trade and return insufficient-balance error.
if the settlement deadline is reached or auto-settle trigger fires, execute the measurement spec or procedure (step 4d). else skip settlement and retry later.
if the measurement returns a clear true/false result, record the reading and set the market outcome. else if the measurement is partial, ambiguous, or failed, record "measurement_failed" and leave the market open; do not settle false.
if the market outcome is true and the market holds any position balances, pay out winners from the ledger (create balanced postings: debit escrow/loser accounts, credit winner accounts). else if outcome is false, reverse all postings.
if a dispute is filed within the dispute window, route to the dispute resolver service and await decision (step 9). else close the dispute window and finalize the settlement.
if a measurement fact is marked monotone or irreversible, require multiple consecutive confirmations before settling true (step 10). else allow single-reading settlement after deadline.
if the settlement writes to multiple downstream services, use the outbox pattern (step 11) to ensure all services converge. else if settlement is single-service, write directly.
if a participant can cause the measured fact, exclude them from settlement or require independent corroboration (step 12, no self-fulfilling rule). else allow settlement as-is.
if trading is open self-registration without verified identity, never cite the displayed price as authoritative (step 12, sybil-proof rule). else if verified identity is enforced, price is citable.
if the proposer is also the oracle service, reject the market (step 12, prevent self-authored settlement rule). else allow normal lifecycle.
if real money is at stake, enforce kyc, geo-fencing, and custody separation (step 14); treat legal review as a launch precondition, not a to-do. else if play-credits only, integrity (verified identity, measurable claims, evidence-first settlement, append-only record) is the basis of trust.
if reconciliation finds on-chain/off-chain divergence, halt settlement immediately (step 13). else continue normal settlement.
proposal record: json object with keys proposal_id (uuid), proposer_id (from verified token sub), statement (text), measurement_spec (json, if auto-settle) or settlement_procedure (text + deadline), created_at (iso8601), state (proposed | open | rejected | disputed | settled)
market record: json object with keys market_id (uuid), proposal_id, state (open | locked | settled | disputed), opened_at, measurement_spec, settlement_deadline (iso8601 or null for auto-settle), locked_at (iso8601), outcome (true | false | null), settled_at, locked_price (float)
trade record: json object with keys trade_id (uuid), principal_id (from verified token sub), market_id, position_side (yes | no), amount_minor_units (integer), executed_price (float), created_at (iso8601)
settlement record: json object with keys settlement_id (uuid), market_id, measurement_output (raw measurement, any type), measured_at (iso8601), oracle_id, outcome (true | false), measurement_failed (boolean), reading_hash (sha256), prev_settlement_hash (sha256), settled_at (iso8601), state (final | disputed)
ledger entry: json object with keys entry_id (uuid), prev_entry_hash (sha256), entry_hash (sha256), posting_type (trade | settlement_payout | settlement_debit | dispute_payout | amm_subsidy | correction), principal_id (or "amm" or "system"), amount_minor_units (integer, positive for credit, negative for debit), market_id, trade_id or settlement_id (reference), created_at (iso8601)
derived balance: integer (sum of all postings for a principal, stored as a view or cached-with-reconciliation, never as mutable storage), updated on each trade or settlement
dispute record: json object with keys dispute_id (uuid), market_id, filed_by (verified principal_id), filed_at (iso8601), evidence_summary (text), resolver_decision (sustained | dismissed), superseding_settlement_id (if sustained), resolved_at (iso8601)
amm account record: json object with keys account_id, amm_subsidy_amount_minor_units (