Sealed tenders.
Verifiable awards.

Open appExplore demo tender

Encrypted in your browser.
Evaluated inside a TEE.
Recorded on NEAR testnet.

Scroll to explore

Confidential bids.
An inspectable decision.

Every bid. On the record.

A completed confidential tender on NEAR testnet.

86.66AWARDED

Bid ACommittee selection

Four-phase methodology, priced mid-range

52.00FLAGGED

Bid CInjection suspected

Bid text instructs the scorer to give it full marks

47.55RANKED

Bid BEvaluation recorded

Thin methodology, cheapest price

10/10PASS

OutLayerTEE evidence checks

Inspect the recorded attestation, inputs and model calls. ↗

12,000 tUSDC paid to the awarded supplier.
3,000 tUSDC returned to the buyer.

View the settlement ↗

Recorded demonstration, tender 1. Model scores vary between runs. See the measured limits.

Pinned evaluator. Private inputs.

  1. 01

    Sealed in your browser.

    Encrypted on your device. The buyer can count the bids, not read them.

  2. 02

    The deadline locks the set.

    A Merkle root freezes the bids. Nothing added late, nothing quietly dropped.

  3. 03

    Opened inside the TEE.

    The contract calls the evaluator it pinned before bidding opened.

  4. 04

    Models read. Code checks.

    Models assess written criteria. They never see prices and never rank.

  5. 05

    The committee awards.

    Going outside the ranking needs a written rationale. The contract pays once.

  6. 06

    Receipts for every step.

    Recompute what the code decided from the recorded evidence.

03 / THE TRUST BOUNDARYTRANSPARENCY INCLUDES THE LIMITS.

Trust the evidence.
Know the limits.

Confidentiality and verification have boundaries. Here are ours, with the measurements to back them up.

Check the evidence ↗
01

Model scores are not reproducible.

The same rubric and the same bid text, at temperature 0 with a fixed seed, scored 8,166 / 8,666 / 8,666 basis points across three real runs, and on the third run the ranking order moved. What is reproducible is the check: a verifier re-reads what the models actually said, from the stored bytes, and recomputes everything code decided.

BID A / THREE EARLIER RUNS
Earlier tender 1
8,166 bp
Earlier tender 2
8,666 bp
Earlier tender 3
8,666 bp

Earlier contract: tenders.sealedchoice.testnet. Same rubric and bid text. Temperature 0, seed 1.

02

Contract and secret-owner keys remain active.

The deployer can replace the contract, and the secret-row owner can rebind the master secret to another build and decrypt bids. Both accounts retain their keys in this demo. These operator powers are stated in the threat model; no account lock is claimed.

03

A committee can still award badly.

Nothing here replaces human judgment, and nothing tries to. What the contract removes is doing it quietly: an award off the ranking carries a written rationale, an ineligible bid cannot be awarded at all, and all of it is on chain under the committee's own accounts.

04 / INDEPENDENT VERIFICATIONTHE RECORD IS OPEN.

LESS TRUST. MORE PROOF.

Don’t take
our word for it.

Inspect the contract, the evaluator and the recorded model calls. The result should stand up to more than a landing page.

Read the documentation Open the contract ↗
PINNED EVALUATOR BUILD737b91e724b25f…7b5f18d470
sealedchoice / evidence↗
RECORDED DEMO / TENDER 1COMPLETE
10/ 10evidence checks passed
  • ✓Bundle hash and schemaPASS
  • ✓Frozen bid set and rubricPASS
  • ✓Signed model call evidencePASS
  • ✓Pinned evaluator attestationPASS
  • ✓No plaintext in the public bundlePASS
Evaluation 35.1sSigned calls 6/6Result 309 bytes
PUBLIC EVIDENCE. PRIVATE BID TEXT.
INSPECT RECORDED EXECUTIONSFinal tender 1 OutLayer #15517 ↗Earlier tender 1 OutLayer #9603 ↗Earlier tender 2 OutLayer #9605 ↗
For developers +

Run the same ten public checks against the final demo tender. Earlier executions above belong to the previous contract, tenders.sealedchoice.testnet.

pnpm verify --tender 1 --network testnet --contract tenders-v1.sealedchoice.testnet