Privacy, specification, and custody in a clearinghouse for interdependent action. Three design dials, one result: the welfare-maximizing clearinghouse holds no principal, fixes terms late, and discloses progress only through a k-anonymized aggregate.