Skip to content

PayPal sandbox only. No real money moves.

LearnHow it works

Engine and ledger

A deterministic auction core and a hash-chained audit trail.

Verifiedbacked by a real run or committed evidence

Page last changed 7 Nov 2026 (from the git history)

The engine

An English ascending auction with ceilings and a soft close. The core is three pure functions, decide, evolve and replay, with no Node built-ins, so the same events always give the same result.

Events are real names from the code: AUCTION_CREATED, LOT_ADDED, LOT_OPENED, BID_RECORDED, BID_REJECTED, BID_STRUCK, LOT_CLOSING, LOT_HAMMERED, LOT_UNSOLD, LOT_ABORTED, LOT_PAUSED, LOT_RESUMED, LOT_EXTENDED, LOT_SETTLED, AUCTION_CLOSED. See events.

The ledger

Every event is linked to the one before it by a hash. A redacted public export and a verifier detect an edited chain. A cut tail shows as not closed, and is proven only against a head hash published elsewhere.

  • verifyPublicExport(entries) returns { ok: true } or the first bad index with a reason. Pass expectedHead to also detect truncation.
  • verify-ledger <ledger.jsonl> in packages/engine checks an export without a server and exits non-zero on tampering.

The room runtime

The server is a single Node process per host. It holds the room, turns spoken and typed bids into engine commands, schedules settlement and keeps file stores for the room log, ledger, journals, holds and webhook events. A persistent store for a hosted deploy needs a persistent disk and a single instance.

Edit on GitHub

Last updated on