1OriginCredit data trust
Menu

Flagship · Clearstream

Interoperability is a proof, not a parser.

Clearstream is 1Origin's rail bridge. A financial message is a linear type. A connector is a proof of Source ⊸ Dest. The kernel that runs is the same object a counterparty can re-hash. There is no grammar walk, no AST, and no dlopen.

RailLogic typesProtocol as ProofGL1-shaped kernels

Source type

MT103 = header ⊗ sender ⊗ receiver ⊗ amount ⊗ currency ⊗ reference ⊗ trailer

UAE SWIFT MT103, as a tensor. Header and trailer are waste: they must be discarded, not silently dropped.

Dest type

SEPA = payment_id ⊗ debtor ⊗ creditor ⊗ amount ⊗ currency ⊗ remittance_info

SEPA credit transfer. Settlement currency is a refinement (EUR). Parties require Proof(!Sanctioned). Amount requires Proof(amount ≤ cap), Proof(Insured), and Proof(¬Tainted). The debtor requires Proof(Authorization). CloseDest issues a ReversalToken.

Dual-kernel pair

Each institution publishes a half-kernel against Canonical IR. Origin cuts them.

MT103 ⊸ IR and IR ⊸ SEPA compose, via the cut rule, to MT103 ⊸ SEPA. Intermediate IR fields are eliminated. The composed kernel reads MT103 bytes and writes SEPA bytes.

  1. Half-kernel A

    MT103 ⊸ IR

    Bank A on SWIFT. The inbound proof consumes MT103 and produces Canonical IR.

  2. Half-kernel B

    IR ⊸ SEPA

    Bank B on SEPA. The outbound proof consumes IR and produces a SEPA credit transfer.

The payment

AED 1,000.50 from Dubai, proved into EUR on SEPA.

United Arab Emirates → European Union. Real-time monitoring is on because UAE requires it. The compiled amount cap is 1000000 dest minor units (tighter of the two CDD triggers). Signed FxBook version 1 (refreshable; integer mantissa and scale, no floats). Synthetic names.

Source wire

MT103|header=F01BANKAEADXXXX|sender=ACME LLC DUBAI|receiver=WIDGETS GMBH BERLIN|amount=100050|currency=AED|reference=INV-2026-0001|trailer=CHKOK

Dest wire

SEPA|payment_id=0db32f41d764297e643402873fad83bfa4ea7a9ee8f583f97fa19862921bbe0f|debtor=ACME LLC DUBAI|creditor=WIDGETS GMBH BERLIN|amount=25063|currency=EUR|remittance_info=INV-2026-0001

Payment id (BLAKE3 of the source wire and dest schema, not a random UUID): 0db32f41d764297e643402873fad83bfa4ea7a9ee8f583f97fa19862921bbe0f. Converted to EUR. Ordered at height 0 on a 4-validator in-process quorum (k-of-n, hash-chained; not tendermint).

Proof net

A circuit of links, not a tree of parser states.

Each link consumes a linear resource exactly once. The certificate is a BLAKE3 of the canonical kernel. Anyone who has the program can recompute it. Origin's word is not required.

Kernel certificate ae789f22f3693d7e4e77a092c50d4be2816b581a13fb85568e168e815f7f304f for MT103 ⊸ SEPA. Payment attestation dest digest 39fb9073b5f71e3c788d6d8ed47ff63b5d1845ee6a887e724659e7dd29083a83 (digest-bound PaymentAttestation, not Groth16).

Encodings of the same types

SWIFT MT103 blocks in, pain.001 out. The kernel still reads pipe wire.

SWIFTNet and SFTP adapters wrap the linear record. They are not live membership.

SWIFT MT103 blocks

{1:F01BANKAEADAXXX0000000000}{2:I103BANKDEFFXXXXN}{4:
:20:INV-2026-0001
:32A:260818AED1000,50
:50K:ACME LLC DUBAI
:59:WIDGETS GMBH BERLIN
-}{5:{CHK:CHKOK}}

ISO 20022 pain.001

<?xml version="1.0" encoding="UTF-8"?>
<Document xmlns="urn:iso:std:iso:20022:tech:xsd:pain.001.001.09">
  <CstmrCdtTrfInitn>
    <PmtInf>
      <CdtTrfTxInf>
        <PmtId><EndToEndId>0db32f41d764297e643402873fad83bfa4ea7a9ee8f583f97fa19862921bbe0f</EndToEndId></PmtId>
        <Amt><InstdAmt Ccy="EUR">250.63</InstdAmt></Amt>
        <Dbtr><Nm>ACME LLC DUBAI</Nm></Dbtr>
        <Cdtr><Nm>WIDGETS GMBH BERLIN</Nm></Cdtr>
        <RmtInf><Ustrd>INV-2026-0001</Ustrd></RmtInf>
      </CdtTrfTxInf>
    </PmtInf>
  </CstmrCdtTrfInitn>
</Document>

Trace

The execution is the artifact.

  1. RailLogic.recordopened MT103
  2. linear-logic.cutdiscarded header
  3. linear-logic.cutdiscarded trailer
  4. linear-logic.cutpayment_id=0db32f41d764297e643402873fad83bfa4ea7a9ee8f583f97fa19862921bbe0f
  5. linear-logic.cutsender → debtor
  6. linear-logic.cutreceiver → creditor
  7. linear-logic.cutamount → amount
  8. linear-logic.cutcurrency → currency
  9. linear-logic.cuttruncated reference to 140 → remittance_info
  10. RailLogic.fx100050 AED → 25063 EUR
  11. PaP.sanctionswitness NotSanctioned on debtor
  12. PaP.sanctionswitness NotSanctioned on creditor
  13. PaP.amount-capwitness AmountCapped on amount
  14. PaP.insurancewitness Insured on amount
  15. PaP.authorizationwitness Authorized on debtor
  16. PaP.untaintedwitness Untainted on amount
  17. PaP.reversalissued reversal token
  18. RailLogic.recordclosed SEPA

Failing closed

A sanctioned sender is not a runtime error. It is a missing proof.

No Proof(!Sanctioned) for BLOCKED ENTITY LLC. CloseDest never runs.

The kernel still verified. Execution could not produce Proof(!Sanctioned), so CloseDest never ran and no SEPA message exists.

Deposit insurance as a linear token

InsuredDeposit = Deposit ⊗ InsurancePolicy.

When the kernel closes, Origin issues a fixture-signed policy on the originating deposit and a second policy on the converted dest amount. The chain for this payment: UAE-DGS 100050 AED → EU-DGS 25063 EUR. Split conserves the covered amount. Claim consumes the policy. Signers are derived fixture keys in an AuthorityRegistry. Live agency material enters through register when provided — this cut does not hold FDIC / FSCS HSMs.

Reversal and taint

Fraud recovery is a linear transformation, not a ticket queue.

The dest rail issues a ReversalToken valid for 90 days. Present it once to claw back funds that still exist and are not frozen or devalued. After the window the token is consumed and the transfer is irreversible.

TaintedFunds are not Funds. The type system will not spend them. Allowed steps: freeze, clawback (with a matching reversal token), or devalue. DevaluedFunds fail every merchant proof that requires Funds. Marks live on a hash-chained taint ledger (height 1 in this walkthrough) with optional quorum endorsements. Hosts that hold the same chain see the same marks. This is not the FCRA Root Ledger.

Funds held by TAINTED HOLDER are TaintedFunds on the global taint ledger. Spend is not well-typed.

No Proof(Insured) for 12525299 EUR held by ACME LLC DUBAI. The statutory cap is a type, not paperwork.

cash_out consumes a Deposit and emits ExternalCash. cash_in refuses a serial devalued on the taint ledger. Ink on a banknote cannot be erased.

Authorization

AuthorizedTransfer = Transfer ⊗ Proof(Authorization).

Two factors, no scoring: account-holder signature ⊗ device attestation. Origin does not take biometrics and does not issue behavioural certificates. A circuit breaker is Funds ⊸ FrozenFunds.

No Proof(Authorization) for UNAUTHORIZED HOLDER. CloseDest never runs.

RailLogic

Linear types: ⊗, ⊸, !, refinements. Schemas for MT103, Canonical IR, SEPA, NPP. Type-directed wire, not a grammar.

Protocol as Proof

Search, linearity verifier, cut elimination, proof nets, digest-bound certificates. A VerifiedKernel is the only runnable value, the same technique as GL1.

Clearstream

The product: a signed FX book, jurisdiction tables as integers, Confirmation-of-Payee, registry-checked insurance proofs, reversal tokens, taint as a type, QuorumConsensus plus ReplicaNetwork vote packets, SWIFTNet/SFTP/NppPort adapters. Amount caps are digest-bound PaymentAttestations, not Groth16.

Honest limits

What this cut will not pretend.

Proof search is the RailLogic fragment, not Lolli. The kernel ISA is the GL1 technique applied to rails, not LLVM extraction. Origin forbids unsafe and therefore forbids dlopen: institutions publish types; composition is proof search. Amount-cap witnesses are digest-bound predicates — Origin already says that about credit attestations, and Clearstream does not switch stories to Groth16. Insurance signers are derived keys in a registry; register is how live FDIC / FSCS verifying keys enter when an agency supplies them. Physical cash ink cannot be devalued from software. ReplicaNetwork ships signed CanonicalJson vote bytes — not tendermint, not gRPC. NPP overlay encoding ships next to MT103 blocks and pain.001. This cut does not hold national HSMs.

Crates: origin-raillogic, origin-pap, origin-clearstream. Notes live in docs/clearstream.md. Nine credit capabilities.