§1 — The architecture
The oracle is a contract,
not a telescope.
Every prediction market needs a referee. Most try to engineer closer to a “true” answer. We do the opposite — we specify the rule, freeze it before the bet, and publish the audit.
Settlement-grade truth: deterministic, replayable, and agreed upfront. The data isn’t the truth. The data is a reading under a spec.
Open commitments
000
currently in flight
Settled · pass
000
stake returned
Settled · forfeit
000
to charity
Insufficient data
001
flagged, not paid
Last settlement scan: 15h ago · 2026-05-29 07:15:46Z
1 total commitments to date
§2 — Settlement-grade truth, in three pieces
Three things the rulebook has to ship.
01
Frozen spec
Every market locks vendor, endpoint, field, timezone, and quantization at creation time. Whoop v2 recovery_score, UTC, integer. The rule does not move once you stake.
- ›metric: recovery | sleep_performance | strain | workouts
- ›aggregator: avg | min | max | count
- ›operator: gte | lte
- ›minSamples: minimum data points before settlement
- ›windowStart / windowEnd: UTC ms epoch, immutable
02
Replay method
The settler is open-source. Given the same raw API response and the same market spec, anyone can rerun the verdict. No proprietary scoring, no closed-doors arbitration.
- ›fetch metric range from /v2/cycle, /v2/recovery, /v2/sleep
- ›aggregate over window per spec
- ›test against operator + target
- ›status ∈ { settled_success, settled_forfeit, insufficient_data }
- ›all logged to settle:log:{ts} for replay
03
Exception procedure
Strap off the wrist. API down. Cycle rescored mid-window. Each failure mode has a written rule that pays out the same way every time. Insufficient data is not a forfeit — it is a flag.
- ›no Whoop token / API error → insufficient_data, no forfeit
- ›minSamples not met → insufficient_data, no forfeit
- ›aggregation empty → insufficient_data, no forfeit
- ›explicit error string in settle log
- ›human review path documented before market opens
§3 — Anatomy of one settlement
What actually happens when the cron fires.
- T-7dMarket opensUser stakes $X on a habit. Spec written into KV: metric=recovery, agg=count, op=gte, target=5, minSamples=7, window=168h.
- T-0Window closesCron picks up the market. Pulls recovery_score for the window from the Whoop API. No early settlement — windowEnd is immutable.
- T+0sAggregationCount days where recovery_score ≥ 70. Apply operator. Sample count checked against minSamples.
- T+1sVerdictsettled_success → stake returned. settled_forfeit → stake to charity. insufficient_data → flagged for human review, no money moves.
- T+1sAuditFull settle log written: scanned IDs, per-market status, raw value, target, error string. Public, queryable, replayable.
§4 — Audit log · last 5 settlement scans
Replay anything. Nothing rescored after the fact.
| When (UTC) | Ago | Scanned | Pass | Forfeit | No data | Errors |
|---|---|---|---|---|---|---|
| 2026-05-29 07:15:46Z | 15h ago | 0 | 0 | 0 | 0 | 0 |
| 2026-05-28 07:15:46Z | 2d ago | 0 | 0 | 0 | 0 | 0 |
| 2026-05-27 07:15:46Z | 3d ago | 0 | 0 | 0 | 0 | 0 |
| 2026-05-26 07:15:46Z | 4d ago | 0 | 0 | 0 | 0 | 0 |
| 2026-05-25 07:15:46Z | 5d ago | 0 | 0 | 0 | 0 | 0 |
Per-market detail (anonymized) requires admin access. Full, raw scan logs live at /admin?secret=....