Mechanism
Each market participant, buyer, seller, or both, holds a credentialed identity issued by one or more credentialing authorities. A credential carries the participant's declared role, the authorized commodity classes, the authorized counterparty classes, and a revocation channel. To list, the seller emits a credentialed listing object naming a commodity under a declared taxonomy, a quantity, a price or pricing rule, a settlement-asset identifier, and a set of acceptable counterparty credential classes. The listing is not deposited with an operator; it is propagated through the mesh and recorded in lineage by every relay that carries it. To bid, the buyer emits a credentialed bid object referencing the listing's lineage anchor and binding the buyer's credential, the offered terms, and the buyer's proposed settlement instrument.
Matching is bilateral. When a buyer's bid satisfies the seller's pricing rule and counterparty constraints, the two participants jointly emit a credentialed match object. The match object is signed by both counterparties and carries lineage references to the listing, the bid, the credentials of both sides, and the declared settlement protocol. Settlement proceeds through the matched-pair settlement primitive: the two parties exchange the commodity reference and the settlement instrument through paired governed observations that produce governance-chain-preserving bilateral settlement. Where conditional or cross-settlement dependencies arise, settlement may be placed under governance-credentialed escrow custody, with release governed by an escrow-condition specification and an escrow-release evaluator applying composite admissibility, rather than by a platform operator holding funds.
Disputes do not flow to a platform operator because there is none. They flow to dispute resolvers declared in the governance chain and accepted in advance by both counterparties as a precondition of the match. A dispute object references the match lineage and invokes a resolver whose authority class authorizes adjudication of that commodity class and that dispute type. The resolver's ruling enters lineage, is itself credentialed, and is enforceable through the same primitives that enforce the match: credential revocation, admissibility downgrade, or settlement reversal under the declared escrow and chained-settlement mechanism.
Operating Parameters
A listing declares a credential-class filter for acceptable counterparties; a bid declares a credential-class filter for acceptable sellers. The intersection determines whether a match is structurally permitted before any pricing comparison is performed. Pricing rules are declared per listing, supporting a plurality of pricing forms including fixed-price, auction-based, negotiated, dynamic, and parametric, and are evaluated against incoming bids by the participants themselves or by optional credentialed pricing-engine services. Settlement-protocol parameters specify the governance-policy-defined spatial and temporal windows within which the paired observations must fall, the cryptographic binding that produces a non-repudiable settlement artifact, the settlement-failure and rollback procedure on timeout or failed fulfillment, and any governance-credentialed escrow custody and release conditions that apply to the settlement event.
Taxonomy authorities declare commodity classes and their distinguishing attributes. Two taxonomies may interoperate through credentialed translation maps, allowing a listing under taxonomy A to be discovered by a bidder operating under taxonomy B without requiring either party to migrate. Dispute-resolver authority is declared per commodity class and per dispute type; a resolver's ruling carries an admissibility weight derived from the resolver's credential class, and a contested ruling can be appealed to a higher-authority resolver where one is declared.
Alternative Embodiments
In a spectrum-and-RF-access marketplace embodiment, spectrum-holding authorities offer spectrum usage rights under temporal-scope credentials, and settlement binds the spectrum-authority's use grant against the settlement-asset transfer. In a capacity-exchange embodiment, place-governing agents offer capability-envelope allocations including port berths, charging stations, warehouse slots, airspace corridors, parking stalls, runway operations, and ferry slips; counterparty filters express the governance-policy constraints declared for each commodity class; settlement binds the capability-envelope allocation against payment in a declared settlement asset. In an intermodal-freight capacity marketplace embodiment, rail, ship, air, and truck operators offer capacity at intermodal transfer points with chain-of-custody handoff, and dispute resolution is bound to the governance-credentialed authority declared for that commodity class.
In a peer-to-peer civilian embodiment, listings represent goods, services, or labor; credentialing authorities may include identity providers, professional licensing bodies, and reputation oracles; dispute resolvers may include consumer-protection authorities and arbitration bodies. In every embodiment the structural property is preserved: no entity sits between the counterparties as an obligatory rent-extractor or governance-controller; every participant in the transaction chain, including optional listing aggregators, matching engines, and settlement processors, participates as a credentialed peer rather than as a structurally privileged operator.
Optional infrastructure services may be declared and credentialed. A listing aggregator that crawls and indexes listings is admitted as a credentialed indexing service; a matching engine that proposes matches is admitted as a credentialed matching service; a settlement processor that executes the matched-pair settlement is admitted as a credentialed settlement service. None is required; each is substitutable; none captures structural rents because none holds a structural monopoly on any phase of the transaction.
Composition With Other Primitives
The no-operator marketplace composes with the credential-revocation primitive: a participant whose credential is revoked is removed from the eligible counterparty set without operator intervention. It composes with the lineage-and-admissibility primitive: every listing, bid, match, and settlement carries credentialed lineage that downstream auditors and regulators can inspect. It composes with the byzantine-robust observation primitive: claims about market state, best bid, last trade, are observed by credentialed reporters whose reports are themselves subject to admissibility evaluation. It composes with the dispute-mechanism primitive disclosed elsewhere in the application, allowing disputed matches to be re-adjudicated under a declared appeals chain.
It composes with the composite admissibility evaluator: a counterparty whose admissibility has degraded under cross-source evaluation is filtered out of the eligible counterparty set automatically, even if the counterparty's listing or bid would otherwise satisfy the structural filters. It composes with the cross-jurisdictional federation primitive: a buyer credentialed under jurisdiction A can transact with a seller credentialed under jurisdiction B through a declared translation map, with the resulting match carrying lineage to both jurisdictional authorities. The composition properties are emergent from the architectural choice not to interpose an operator: each governance concern is delegated to a primitive whose authority is declared and revocable, rather than absorbed into a single operator policy.
Distinction From Prior Art
Prior centralized marketplace platforms require a platform operator to mediate trust, identity, settlement, and dispute resolution with platform-internal records, whereas the present primitive operates without a central platform operator using the governance chain as the trust substrate. Prior platforms require contributors and consumers to register with a specific operator, enforce platform-controlled disclosure and licensing, and preserve transaction history only within a specific marketplace-operator service. The disclosed primitive differs structurally on multiple axes: there is no operator entity, no operator-controlled matching, no operator-policy disclosure control, and no operator-policy dispute resolution. Trust is sourced from a multi-authority governance chain rather than from a single operator's records; rents accrue, where they accrue at all, to optional governance-credentialed intermediary services chosen by the counterparties rather than to a structurally privileged intermediary.
Failure Modes And Mitigations
A no-operator marketplace must address failure modes that an operator-led marketplace handles by fiat. The first is settlement failure: one counterparty performs while the other defaults. Mitigation: the matched-pair settlement primitive binds both legs of the exchange through a settlement-failure and rollback mechanism handling timeout, non-acceptance, and failed-fulfillment conditions, and conditional or cross-settlement dependencies may be placed under governance-credentialed escrow custody, with the chosen mechanism declared per match and recorded in lineage. A settlement that aborts emits a credentialed failure event that downstream lineage consumers can admit; persistent failure patterns degrade the offending counterparty's standing under composite admissibility evaluation.
The second failure mode is taxonomy ambiguity, in which a listing declares a commodity class whose attributes do not in fact match the delivered commodity. Mitigation: taxonomies are themselves credentialed objects with declared attribute schemas; a listing whose declared attributes fall outside the schema is rejected at relay; a delivered commodity that fails post-settlement attribute verification triggers a dispute under the declared dispute resolver for that commodity class. Repeat offenders accumulate dispute-loss evidence that downstream consumers can admit, and they are filtered out of future matches under composite admissibility evaluation.
The third failure mode is sybil flooding, in which an adversary creates many credentialed identities to manipulate apparent market state. Mitigation: credentialing authorities declare per-class issuance policies that constrain identity creation; counterparty filters can require credentials issued under specific authority classes whose issuance policies are sybil-resistant; and market-state observations are subject to byzantine-robust evaluation rather than being trusted from any single reporter. The composition of these primitives produces structural sybil resistance without requiring an operator to police identities.
Disclosure Scope
The disclosure covers the no-platform-operator marketplace primitive as an architectural element of the credentialed-mesh framework. It covers the credentialed listing, bid, and match objects; the bilateral matched-pair settlement procedure; the governance-chain-sourced trust model; the admission of optional credentialed services without conferring structural privilege; and the integration of dispute resolution as a credentialed authority chain rather than an operator policy. It does not claim any particular settlement-asset type, any particular commodity class, or any particular cryptographic settlement construction; the primitive is defined at the architectural layer above those choices. The architecture is described in U.S. Provisional Application No. 64/049,409.
