The parts worth arguing with.
A tender that cannot be argued with is not a tender, it is an announcement. This page is the scoring rule, the appeal path, and exactly where the score stops and your own judgement starts - written down before anyone bids rather than after they lose.
Nobody is trusted to hand down a score. Several validators grade the same proposal against the same published criteria, separately, and the network keeps the answer only if enough of them independently agree on it.
A leader proposes
One validator reads the revealed proposal against the published criteria and proposes a score from 0 to 5 for each, with a one-line reason pointing at the part of the text it used.
Every other validator scores it independently
They do not see the leader's answer first. Each grades the same proposal against the same criteria on its own, which is what makes the comparison worth anything.
The answers are compared
The criterion set must match exactly and each score may differ by at most one step. Agreement keeps the leader's answer; disagreement rotates the leader and tries again with a different model.
The contract does the arithmetic
Once the per-criterion scores are agreed, the contract multiplies each by the buyer's published weight and adds them up. No model is ever asked for the total.
| What is compared | May differ by | Why |
|---|---|---|
| The set of criteria | Nothing | A missing criterion is an error, not a silent zero. |
| Each score | One step | Two honest readers can land a point apart. Demanding an exact match would stall on the rounding of judgment. |
| The written reasons | Not compared | Two nodes word the same observation differently. Putting free prose under an equality check is the fastest way to make scoring never settle. |
| The weighted total | Never proposed | Weights never enter the prompt. The contract multiplies and adds the agreed scores in ordinary deterministic code. |
The bid is left unscored and the round pauses rather than awarding around it. Awarding while one bid is unscored would mean somebody won by being the only bid the network could read, so the contract refuses.
Two validators never agree on a malformed answer either. Agreeing would write “the scoring failed” into a tender as though it were a finding; disagreeing rotates the leader and tries again with a different model.
- Every angle bracket in a proposal is neutralised, so it cannot close the tag that holds it and impersonate the criteria.
- A proposal that asks for a particular score, claims to be the best, or addresses the scorer directly is scored zero on every criterion.
- Claims are treated as claims: an unevidenced claim scores lower than an evidenced one.
- Scores must be integers in range, one per criterion, with matching indices. A missing criterion is an error rather than a silent zero.
A criterion can be frozen and still be ambiguous. When it is, every bidder resolves the ambiguity privately and differently, and the scores end up measuring who guessed the buyer’s intent rather than who is best placed to do the work. That is the opposite of what this contract exists to measure.
So the clarification happens in the open. Anyone may ask - you do not need to have sealed a bid, because needing to pay a deposit to find out what a criterion means would defeat the point, and the answer is public either way. The buyer answers once, and everyone reads the same answer with the same timestamp. A private word between a buyer and one bidder would be worth more than any criterion on the page.
Questions close when the commit window closes, not when the reveal window does. An answer arriving after commitments were sealed would be information only the bidders who held back could act on: the ones who already committed cannot rewrite their proposal. Closing questions with commitments removes the reward for waiting.
An answer is written once and cannot be revised. Moving the goalposts is bad; moving them with no record that they moved is worse, and the record is the product.
An answer does not change what is scored. The network is given the frozen criteria and nothing else, so a clarification helps a bidder write to the standard rather than altering the standard. If an answer would genuinely change the standard, the honest move is to decline the round and publish a better one - which costs the buyer the budget back and nothing else.
Capped at 32 questions per round and 3 per address. The cap is not about storage: the buyer’s attention is the scarce resource, and one address flooding the queue spends every other bidder’s share of it.
When an appeal makes sense. A score on a specific criterion looks wrong against your own proposal text. Both are public after the reveal, so the claim is checkable by anyone rather than a matter of opinion.
What it costs. The bond above, and the award is held while the appeal is open. A tender that paid out during a live scoring appeal would make the appeal meaningless.
What happens. The bid is re-scored against the same proposal, with your argument attached as a claim about that text. If the argument points at wording that is genuinely in the proposal, that wording is taken into account. If it asserts anything the proposal does not say, it is ignored - an appeal cannot become a second, unsealed bid.
How it settles. If the weighted total moves, the appeal is upheld and the bond comes back. If it does not, the bond pays for the re-scoring. Either way the new scorecard replaces the old one and is marked as re-scored, with the previous total kept beside it.
Who can resolve it. Anyone. An unresolved appeal blocks the whole round, so nobody - least of all the buyer waiting to award - should need the appellant’s cooperation to move it.
The deadline. An appeal can be opened at any time while the round is still open - it is bounded by settlement, not by the decision window. Scoring has no deadline, so a bid can be scored after that window has already passed, and bounding appeals by it would leave that bidder no window at all on a scorecard they could not have seen earlier. Once a round is awarded or declined, nothing can be appealed.
Separately from all of this, GenLayer’s own protocol appeal exists: anyone can challenge an accepted transaction during its finality window by posting the protocol bond, and each round roughly doubles the jury. That is a challenge to the consensus; the appeal above is a challenge to the score.
What is graded is the submitted text, against your criteria. So a well written proposal from a weak supplier will outscore a badly written one from a strong supplier. Criteria demanding verifiable, named references pull the score back towards evidence, and that is the lever you have.
No page is fetched during a round, by design: a scoring pass that reached out to the web would give every validator a different document and agreement would never settle. If a bidder names three references, the network scores that three were named. Checking them is your step, before you award.
Each commitment is a hash bound to its own bidder's address, so nobody can see a rival's number before the window closes, and nobody can submit under another's name. Bidders determined to agree in advance still can, and their proposals are scored exactly as faithfully as everyone else's.
There is no method that edits criteria or weights, and no owner override - that immutability is the guarantee the whole product rests on. It applies to typos too. The remedy is to decline the round, which returns every deposit and the budget, and publish the corrected standard.
Validators re-run the scoring independently and the network settles on the answer they agree about. A contract cannot read its own vote tally, so these screens say a result was agreed rather than 'five of five' - a number no code here is in a position to print.
GenLayer supports an agreed settlement workflow, and this contract gives you a record every party can check line by line. Turning that record into a binding obligation is contract law, not consensus: the agreements, the jurisdiction and the escalation path stay where they were.
| Failure | Designed behaviour |
|---|---|
| A bidder never reveals | The commitment expires unscored and the entry deposit is forfeited, which is what pays for scoring the bids that did arrive. Expiry is a real state change anyone can trigger, not a status inferred from a clock. |
| A reveal does not match the hash | Refused immediately, before any scoring runs, and nothing is stored. The bidder can correct the text and reveal again while the window is open; if they never produce matching bytes, the bid expires. |
| A reveal arrives during the commit window | Refused. Allowing one would let a later bidder read an opened proposal and price against it, which is the exact failure sealed bidding exists to prevent. |
| An ineligible bidder tries to bid | Refused on the deterministic eligibility check, with no scoring cost. Eligibility rules are checked in code; anything needing judgment belongs in the criteria. |
| Every bid scores poorly | The buyer may decline and the budget returns. That possibility is stated in the tender before bidding opens, and a buyer cannot decline before every revealed bid has been scored. |
| One bid cannot be scored | The round pauses. Awarding around an unscored bid would mean winning by being the only bid the network could read. |
| Two bids tie on the total | Broken by the criterion the buyer marked primary at publication, and only then by the order the commitments arrived. Never a coin flip and never list order. |
| The buyer tries to change the criteria mid-round | Impossible. There is no method in the contract that edits them. |
| The buyer does nothing at all | After the decision window, awarding is permissionless. If no bid was ever scored, anyone can close the round and return the budget. An escrowed budget cannot be stranded by a buyer who dislikes the result. |
A full round with several bidders runs on Studio end to end: commit and reveal, escrow, scoring, appeal and award. Every rule on this page is exercised there against real transactions. What Studio does not settle is money. Read the list below before taking a balance off this network: every item on it is a property of the test network rather than of the contract, and each one says which.
- A payout does not land here. When a round is awarded, the contract emits the transfer correctly - the settlement receipt carries the right recipient and the right amount, and the contract is debited by exactly that - but Studio’s ledger does not apply an emitted transfer to an ordinary account. So a winner on this network will see the award recorded and their balance unchanged. That is the test network, not the contract, and it is the single most important thing to re-verify on a live one before anyone escrows real money.
- Studio is gasless. A receipt from here says nothing about live fees. One scoring pass runs per revealed bid, so cost scales with bidder count rather than with budget - and the cost of scoring twenty long proposals is a measurement to take on a live network too.
- A pre-flight balance guard is switched off here. Studio has answered 0 to a balance query for accounts whose payable calls then succeeded, so refusing a write on a zero balance would refuse everything. The transaction is the judge.
- Chain-layer and ghost-contract behaviour is not fully modelled, and the validator set is not the live one.
- Anything money-critical is validated on a live network before launch. That is a blocker, not a nice-to-have.