CADASTRE

A title chain that cannot fork, and conveyance money that moves exactly once, at completion.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Land registry authority. A sovereign frame under your law, not a vendor tenancy.
• Conveyancing practice. Completion funds in escrow both sides can watch.
• Mortgage lender. Charges recorded on a chain that cannot be quietly edited.
• Title insurer. Price the risk from a replayable history, not archive boxes.

The problem

A property transfer is a week of held breath: money in flight between accounts, a title that is true in one database and pending in another, and a fraud window exactly as wide as the gap between the two. The registry that could close the gap cannot become a tenant in anyone’s platform, so the gap persists.

The system

CADASTRE is a land registry operating its own sovereign frame in its own datacenter, under its own statute. Every parcel’s history is an append-only chain: grants, transfers, charges, discharges, each entry signed, each replayable. Completion day for parcel 4471 is not a wire race. The buyer’s funds sit in escrow visible to both conveyancers; the transfer entry and the release are one atomic completion; and the money moves exactly once, with the idempotency machinery absorbing every retry the banks’ systems throw at it.

A change to the register is never an anonymous database write. It is an act by a named registrar whose mandate is re-derived on every request, recorded with an authority snapshot, behind presence proof above the routine threshold. When a forged discharge attempt arrives in March, it does not fail quietly in a log. It fails loudly at a gate, on a ledger the fraud unit reads, with the attempt itself preserved as evidence.

The cast and their ceilings

The flow, step by step

1. Completion funds sit in escrow both conveyancers can watch.
2. The transfer instrument arrives at the registrar gate.
3. A named registrar signs, mandate re-derived on this very request.
4. The chain gains one atomic entry. History cannot fork.
5. The money moves exactly once, at completion, retries absorbed.

Each need, mapped to a live primitive

The attack this chamber refuses: The forged discharge

The attack. A fraudster with a stolen conveyancer credential submits a discharge of the lender’s charge, clearing the path to sell a mortgaged property.

Why it fails. A register change is an act by a named registrar mandate, not a database write a credential reaches. The submission arrives without the registrar’s re-derived authority and without the lender as principal on its own charge, and it parks at the gate as recorded evidence.

What actually happens. The charge stands, the sale cannot complete against it, and the fraud unit reads the refusal on the same day rather than the loss a year later.

Deep architecture

CADASTRE deployed: the registry authority runs its own frame under its own statute; conveyancers and lenders act from theirs; the banks’ retry-prone payment systems hit an idempotent rail that absorbs them. A change to the register is never an anonymous database write, and completion day is not a wire race. The trace replays parcel 4471, funding to atomic completion, with one forged discharge failing loudly on the way.

The deployment, traced

1. Completion day for parcel 4471. The buyer’s funds arrive ahead, not in a wire race.
2. The banks’ systems retry as they always do. The rail absorbs every retry; nothing doubles.
3. The escrow lands, visible to both conveyancers.
4. The buyer’s conveyancer claims completion from its own registry.
5. The seller’s conveyancer delivers the title side of the same act.
6. The lender lodges its discharge with evidence attached. In March, a forged one arrives here too.
7. The fabric couriers the signed lodgements in. The forged discharge fails loudly at the gate, and the attempt itself is preserved as evidence.
8. The registrar’s mandate is re-derived on this very request: named, present above the routine threshold, recorded.
9. The transfer entry and the release are one atomic completion. There is no moment where one exists without the other.
10. The act joins the parcel’s chain: signed, replayable, forever.
11. The purchase money moves exactly once.
12. The seller’s side is credited on its own frame.
13. The fraud unit reads the refusals ledger, where failed attempts are evidence, not log noise.

Adoption, phase by phase

Discover: The register’s acts, re-read as a chain.

• Runs. Nothing. One parcel class redrawn as act types, authority rules and completion conditions.
• Agents. None. Registrars and counsel decide which acts need presence, and write the answer down.
• Integrates. Nothing. Survey systems remain authoritative for geometry, now and later.
• Deliberately not yet. No chain, no escrow, no gate.
• Proof that gates the next phase. One parcel’s full history re-expressed as signed acts, and the registry confirms the chain replays to the current title.

Pilot: One parcel class, shadow completions.

• Runs. A single-VM frame at the authority. One conveyancing firm connects with a seat.
• Agents. registrar mandate live at pilot ceilings; conveyancer agents lodge; fraud-watch reads.
• Integrates. Completions run in shadow beside the statutory process; nothing binds yet.
• Deliberately not yet. No statutory effect. The paper process still governs; the shadow has to earn its keep.
• Proof that gates the next phase. Fifty shadow completions land atomically with the money model matching the statutory outcome on every one.

Production: The authority’s frame, under the statute.

• Runs. The authority’s sovereign frame on its own hardware. About nine containers, under its own law.
• Agents. The full cast; every register change behind the re-derived mandate; presence above the routine threshold.
• Integrates. Conveyancers and lenders federate in; the banks keep their systems and lose their wire races.
• Deliberately not yet. Statutory recognition of the chain is the legislature’s act, not this deployment’s claim.
• Proof that gates the next phase. A completion audit reconstructs a month of parcels from the chain alone, and the fraud unit cites a refused forgery as court-ready evidence.

Federation: Matters cross firms without crossing trust.

• Runs. Unchanged. Firms and lenders bring frames or seats.
• Agents. Matter histories travel with the parties entitled to them.
• Integrates. Each new firm is a signed card and a licence.
• Deliberately not yet. Cross-jurisdiction title is a treaty question, deliberately out of scope.
• Proof that gates the next phase. A new firm completes its first matter in its first week, and the authority never provisioned it anything by hand.

Sizing

One completion, funding to atomic act

sequenceDiagram
  participant CVB as conveyancer-buyer
  participant Bank as bank rails (retrying)
  participant XT as cross-registry pay
  participant Gate as authority gate
  participant Reg as registrar (presence)
  participant TEG as completion escrow
  participant Chain as title chain
  Bank->>XT: funds, with retries
  XT->>TEG: lands exactly once
  CVB->>Gate: completion claim (via lodgement relay)
  Gate->>Reg: mandate re-derived, presence required
  Reg-->>Gate: signed, recorded
  Gate->>TEG: atomic completion: entry + release as one act
  TEG-->>Chain: the act, append-only, replayable
  Note over Gate: a forged discharge fails loudly here and becomes evidence

Topology, as declared

flowchart LR
  B["buyer conveyancer"] -->|"fund completion escrow"| TEG["TEG escrow"]
  S["seller conveyancer"] -->|"transfer instrument"| G{"registrar gate<br/>mandate + presence"}
  R["registrar (human)"] --> G
  G -->|"one atomic entry"| ES[("title chain<br/>append-only, replayable")]
  TEG -->|"exactly-once at completion"| OUT["funds to seller"]
  L["lender charges"] -.->|"principal-only discharge"| G

Standing it up

• Infrastructure. The authority’s own frame: 9 containers on its own hardware, under its own statute.
• Agents. 5 roles. Conveyancers connect through their own registries, federated.
• Integration. Cadastral maps and survey systems stay authoritative for geometry; the protocol carries title acts, authority and money.

What this does not claim

• CADASTRE implements a register’s acts; it does not decide property law, and statutory registration effects remain defined by statute.
• No claim about any jurisdiction’s land registration regime. The mechanism serves the authority that adopts it.