A bid ceiling is a completion budget.

Why bidding exists

Some supply is fixed-price and immediately reservable. Some is negotiated, auctioned, or has to be held briefly before provisioning. We run a bid and reservation layer only where it improves the odds of finishing.

It is not exposed as a speculative trading product. Seeing capacity is not the same as holding it.

Stage contract

• Owns: bidding / reservation service
• Before: route plan proposes bid_ceiling (router does not reserve)
• After: lease.status=reserved with validated supplier lease ID and accepted terms
• Transport: gRPC (workflow → bidding) + provider HTTPS (adapter)
• Durable ack: reservation_attempt row with provider idempotency key before the supplier call; lease commits supplier ID only after success

Pilot today Reservation runs in-process rather than as gRPC from a Temporal workflow. The durable ack is not deferred with it. reservation_attempts is a real table written before the supplier is called, which is what makes a timeout recoverable instead of ambiguous.

Lifecycle

offer observed → quote requested → quoted → bid submitted
  → accepted → reserved → provisioning → active → released
            ↘ rejected | expired | cancelled

Every transition is idempotent. A supplier-side reservation is not active until Nodus persists the lease ID and validates the terms.

The ceiling formula

The router proposes a ceiling, not an unrestricted spend. It exists so reservation cannot exhaust the budget needed to finish, recovery included:

bid ceiling = remaining workload budget
  - expected non-compute costs
  - minimum recovery reserve
  - margin for viable fallback routes

Pilot today The shipping ceiling is built from the first three lines: remaining budget, a flat non-compute reserve, and a percentage recovery reserve. The fallback margin is specified but not yet computed. Note what the number is: a total remaining finish-budget in dollars, not an hourly rate. Reading it as a price cap is the mistake the field name invites.

Nodus may counter-bid inside that ceiling, but never against its own concurrent requests for the same workload without explicit diversification logic. Accepting a low hourly rate that cannot meet the deadline, or that leaves no recovery reserve, is a policy failure even when the bid clears.

What a lease records

• lease ID, supplier lease ID, workload / stage / generation
• quoted and accepted price, billing increment, currency
• start/end window, cancellation / reclaim terms
• provisioning handle, credential reference, state
• route-plan and policy versions

Accepted quote and lease terms become immutable financial evidence. Supplier invoice reconciliation references them. Market price alone cannot settle anything.

Pilot today The shipping row is narrower: lease ID, supplier lease ID, workload, stage, generation, offer, status, and a terms document carrying the commercial fields. The parts that must be columns to be enforceable, the supplier lease ID and the generation it belongs to, already are.

Concurrency controls

• One primary reservation attempt per route decision unless policy explicitly permits hedging.
• Reservation commands use a durable idempotency key.
• A failed or expired lease cannot be reused by a later generation.
• Supplier events are verified before changing lease state.
• Supplier timeouts: query final provider state before retrying or releasing a perceived lease.

Parallel reservations stay off by default. Any hedging policy has to define maximum concurrent commitments, cancellation windows, worst-case committed spend, and an operator-visible reconciliation plan.

Financial-risk posture

Bidding is a financial-risk service. It needs a double-entry-style commitment ledger, approval limits, per-tenant and per-supplier exposure limits, and a durable reservation state machine. Route planning proposes a bid; only the reservation service submits one.

Every accepted quote, bid, lease, release, supplier invoice line, and customer charge is immutable evidence carrying a correlation ID. Financial reconciliation is a gated close, not a best-effort background report.

Cost means cost to completion. Launch price that strands recovery is not a win.