What we borrowed
A market-making desk keeps a live book: instruments, sizes, prices, staleness, and risk independent of any single trade. Our market service plays that role for infrastructure capacity, today mostly accelerator supply as the beachhead. It does not warehouse inventory like a classic two-sided maker. It normalizes other people’s supply into one internal book the rest of the control plane can trust.
Freshness is a routing feature. Stale inventory is not discounted politely; it is penalized or made ineligible.
Stage contract
- Owns: market service + supplier adapters
- Before: continuous poll / webhook / private pool feeds
- After: normalized offer snapshots with TTL and health facts
- Transport: HTTPS → Kafka → materialize current-offer view
- Durable ack: append-only ingest first, then bounded-freshness snapshot for the router
Market runs asynchronously relative to any one workload. The router never queries provider APIs on its critical path. It reads these snapshots.
Pilot today Ingest, health computation, and materialization run as in-process loops against Postgres, with events moving through the outbox relay and Kafka fan-out optional. The two properties that make the boundary real are already here: ingest is append-only before anything materializes, and routing reads a bounded-freshness snapshot ID rather than a live provider call.
The adapter boundary
Every supplier hides behind one internal interface. Adapters cannot mutate workload state. They publish validated commands and events; the control plane remains the authority.
# One interface. N suppliers.
list_offers(filters) -> offers
quote(offer, window) -> quote
reserve(quote, idempotency_key) -> lease
provision(lease, workload_generation) -> runtime_handle
release(lease)
get_usage(lease) -> usage records
verify_event(webhook) -> supplier event
Supply arrives as real-time APIs, batch feeds, private reserved-capacity
agreements, spot adapters, first-party pools, or opaque wholesale adapters.
Supplier identity stays internal on purpose. The customer catalog is a
Nodus-only projection, and no wholesale brand appears in
GET /v1/workloads/{id} or anywhere else a
customer can see. We hold that boundary in this series too.
A normalized offer
Offers are snapshots, not promises. A router cannot reserve an expired offer without a fresh quote. Interruption behavior and provisioning latency are first-class fields because we score cost to completion, not hourly price.
- supplier / offer ID / snapshot timestamp / TTL
- compute class (
vmoraccelerator) and fit class - resources: vCPU, host memory, optional device memory, disk, network
- region, residency, compliance attributes
- availability window and provisioning latency
- price, billing increment, lease and cancellation terms
- interruptibility, observed interrupt rate, supplier-health snapshot
Compute class matters more than it looks. An offer normalizes as a VM or as accelerator capacity, with device memory an optional axis rather than the primary one, so the book can carry classes with no accelerator at all. Accelerators are the beachhead, not the schema.
Ingest is append-only
Every update is timestamped, versioned, and linked to its source: source time, receive time, adapter version, verification result, expiration. Materializing into the current-offer view is a separate step. Malformed supplier events go to a dead-letter path. No adapter retries a non-idempotent reservation without a stable idempotency key and a confirmed provider-side status query.
Adapters run as isolated workers with per-supplier credentials, circuit breakers, bounded retries, and independent rate limits. A slow or compromised supplier must not block routing for another or exhaust shared worker capacity.
Health is not price
Health computes independently of any single offer: provisioning success, reclaim frequency, runner failure rate, adapter heartbeat, webhook quality, billing variance, recent operator intervention. We store the score and the underlying facts so the router can explain itself. These are production inputs to eligibility, not dashboard metrics.
Ownership line
- Market owns offer snapshots, quotes, adapter health, supplier capabilities.
- Bidding owns the commercial commitment to an offer.
- Router consumes immutable market snapshots; it does not call providers synchronously.
That separation is how a reclaim storm on one supplier becomes a scoring input instead of a control-plane outage.