Architecture
The planner proposes. Settlement enforces.
CROSSLOT separates the party that finds a match from the party that is allowed to move assets. A planner may be wrong, slow or offline without putting a vault at risk, because settlement re-checks every constraint before anything moves.
Data path
Independent vaults → Authorized intents → Planner → Settlement checks → Internal transfers + external residual → Liquidity positions
Lifecycle
Select a step. Each stage below describes intended behaviour of a proposed design.
A vault mandate emits a signed inventory delta with bounds and an expiry. This is the only authority the batch may rely on.
Proposed modules
| Module | Intended responsibility | State |
|---|---|---|
| MandateVault | Holds one strategy's assets, limits and accounting. Authorizes inventory changes; never executes discretionary trades. | Proposed |
| IntentRegistry | Records signed inventory intents with asset identity, signed amount, price limit and expiry. | Proposed |
| NettingPlanner | Off-chain proposer. Finds compatible opposite intents and constructs a candidate batch. Proposes only; enforces nothing. | Proposed |
| BatchSettlement | Re-verifies every constraint, performs internal transfers plus the external residual leg, and reverts the whole batch on any failure. | Proposed |
| StockAssetAdapter | Normalizes token units and decimals, checks feed freshness, and handles corporate-action treatment for a Stock Token. | Proposed |
| PositionAdapter | Establishes the intended liquidity positions from settled balances. | Proposed |
| ExecutionReceipts | Per-vault record of what was matched, routed and charged, for independent reconciliation. | Proposed |
No deployed addresses, ABI downloads or repository links exist for these modules. They are specification, not software you can call.
What happens when a check fails?
- Stale price data
- The adapter's freshness window has elapsed. The candidate is blocked and the intents must be repriced before a batch can be proposed again.
- Expired intent
- A vault's authorization window closed. The intent leaves the batch; the remaining intents are re-planned rather than settled on stale authority.
- Wrong asset identity
- Two Stock Tokens with similar names are not interchangeable. An identity mismatch rejects the batch instead of crossing unrelated inventory.
- Price-limit failure
- If settlement would breach any participating vault's price limit, the batch reverts. A mandate is never exceeded to make a batch fit.
- Failed external execution
- If the residual leg fails or fills outside its bounds, the internal transfers revert with it, so no partial settlement is left behind.
Atomic reversion is stated here as a design requirement. It has not been implemented, tested on a testnet, or formally verified.
Deliberate boundaries
The design uses existing secondary Stock Tokens only. It assumes no ability to issue underlying shares, no access to Robinhood brokerage capital, and no hedging through private Robinhood rails. Every proposed advantage has to come from coordinating inventory that vaults already intend to trade.