MERIDIAN

A treasury desk that runs at 03:14, with a named human behind every large movement.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Corporate treasury. Nine subsidiaries, three currencies, one liquidity desk that also works at night.
• PSP and marketplace payouts. Thousands of small payouts a day, each inside a per-merchant ceiling.
• Fund operations. Rebalancing with a named human behind every threshold breach.
• Intercompany netting. Month-end netting as a continuous process instead of a spreadsheet week.

The problem

A corporate treasury runs on humans copying numbers between systems that do not trust each other, and the control model is a spreadsheet of who is allowed to approve what. Every organisation that has tried to automate it has hit the same wall: the moment software can move money without a person in the loop, nobody can answer the question the auditor asks, which is not "was it correct" but "who is liable."

The system

MERIDIAN is a treasury desk of thirty-one agents operating across three sovereign frames and eleven cloud registries. It runs continuously. At 03:14 the liquidity sentinel notices the Frankfurt operating account will breach its floor inside six hours and proposes a cross-frame swap, and the swap desk books it. The desk cannot move that much alone. It is the treasury’s own sub-agent: it holds no wallet, spends the treasury’s purse, and books each movement as a contract whose release answers to the treasurer’s mandate as that mandate stands at that moment. Its capability permit, cut that morning by the treasury agent, caps any single movement at 1,000,000 units and carries a daily budget debited atomically on the money axis, so two agents cannot both spend the last of it. Above 250,000, a release also waits for the treasurer herself. The swap it wants is 400,000.

So it does what a junior does. Its release waits on a mandate held by a named human being, who is asleep, and whose phone rings. The screen shows the canonical facts of the transfer as the server computed them, not as the requesting agent described them. She puts her thumb on the sensor. That unlocks a key inside the phone’s enclave which signs the hash of those facts, and the signature carries a bit set by the authenticator itself confirming a human was verified, a bit covered by the signature so it cannot be forged by the software asking for it. The swap settles at 03:16. The fee is carved by the same rail that moves the money. The ledger entry is signed, replayable, and identical on both frames.

By 06:00 the desk has moved value across nine accounts, rebalanced two pools, and settled fourteen invoices. Total supply of every currency involved is unchanged to the eighteenth decimal place, and an auditor nobody at MERIDIAN controls has verified that independently, four times, while they slept.

The cast and their ceilings

The flow, step by step

1. 03:14. The floor breach is six hours out. The sentinel proposes a swap.
2. The desk asks for 400,000. Above 250,000, a named human confirms.
3. Over the threshold. The release waits on the mandate, and a phone rings.
4. A thumb on a sensor. The enclave signs the facts as the server computed them.
5. Cleared, inside the mandate scope.
6. The route crosses the pools at 03:16.
7. The receiving frame credits the account.
8. Every leg lands on the ledger, signed.
9. An auditor nobody here controls confirms conservation. Again.

Each need, mapped to a live primitive

The attack this chamber refuses: The compromised desk

The attack. swap-desk is compromised and attempts a 2,000,000 unit transfer to an address the operator controls.

Why it fails. resolve_capability intersects the permit’s caveats with the issuer’s current authority and clamps against the per-movement cap of 1,000,000 before anything is written. The request never reaches the money.

What actually happens. No escrow movement, no event emitted, no fee. Delta unchanged, because deny-only gates sit in front of the money by construction. There is nothing to unwind.

The attack this chamber refuses: The compromised human

The attack. The treasurer’s own account is taken over, so the operator revokes her flag from the console. Her mandates are still on disk. The desk asks again.

Why it fails. Effective authority is re-derived on every request and never snapshotted. A revoked flag means every mandate leaning on it conveys nothing on the next request. No permit rotation, no session hunt.

What actually happens. The agent she underwrote is inert within one request. Nothing it attempts clears the gate, and every refusal is on the ledger.

Deep architecture

This is the shape MERIDIAN takes in a real estate: your sovereign frame beside a counterparty frame, the federation fabric between them, and your existing systems underneath. Nothing here is a box drawn for a slide. Every zone is a deployment, every edge is a rail that exists, and the trace below replays the transaction the page has been describing all along.

The deployment, traced

1. Market data feeds the sentinel. It watches floors and ceilings; it cannot move a unit.
2. The sentinel proposes a rebalance to the desk. A proposal is not an order.
3. The treasurer’s mandate stands behind the desk: scope, ceiling, presence.
4. The desk’s authority is checked at the gate on this very request: roles, spend policy, the mandate’s clamp.
5. Approved. The desk escrows the route; its daily budget debits atomically.
6. One movement, one event, append-only.
7. The leg crosses the fabric with an idempotency key. A retry can never double it.
8. The counterparty frame credits exactly once, under its own law.
9. Their desk confirms the counter-leg.
10. Their ledger writes the same settlement. Two sovereign books, one truth.
11. Evidence exports to your books as signed events, not screenshots.

Adoption, phase by phase

Discover: Nothing of yours changes yet.

• Runs. Nothing in your estate. A workstation and a read-only account on the public network.
• Agents. None. Your team walks the tutorial tracks and reads a live ledger.
• Integrates. Nothing. The ERP, the OMS and the banks stay exactly as they are.
• Deliberately not yet. No money, no mandates, no frame.
• Proof that gates the next phase. Your team executes one sandbox transfer end to end and reads it back from the event ledger without asking anyone.

Pilot: The desk exists, at pocket size.

• Runs. One hosted registry seat, or a 9-container frame on a single VM if policy requires walls from day one.
• Agents. liquidity-sentinel and swap-desk under IRONKEY roles; the treasurer holds a Cockpit mandate with pilot ceilings.
• Integrates. Order intents in via the SDK; evidence exports to a review folder beside the ERP.
• Deliberately not yet. No production funds. Ceilings at pocket size. No external counterparty.
• Proof that gates the next phase. A month of paper flow in which every movement reconciles from the event ledger alone, with zero manual corrections.

Production: Your frame, your law, real ceilings.

• Runs. A sovereign frame in your datacenter: registry, TEG, EventStore, identity fabric.
• Agents. The full cast under liability clamps; every agent mTLS-attested; the reconciler reads and can never move.
• Integrates. ERP receives signed evidence continuously; market data feeds the sentinel; the OMS submits intents.
• Deliberately not yet. One settlement corridor only. The federation license is held; the wider mesh stays dark on purpose.
• Proof that gates the next phase. The first production corridor settles with a supply delta of zero on both frames, independently audited.

Federation: Growth becomes configuration.

• Runs. Unchanged infrastructure. More peers.
• Agents. Unchanged cast; per-corridor spend policies bound what each counterparty can reach.
• Integrates. Each new counterparty is a signed card and a license, not an integration project.
• Deliberately not yet. Nothing on this path requires new software.
• Proof that gates the next phase. N corridors, one invariant: every frame’s books balance to zero drift, continuously, in public.

Sizing

The settlement path, as messages

sequenceDiagram
  participant OMS as OMS / intent
  participant Desk as swap-desk
  participant Gate as authority gate
  participant TEG as your TEG
  participant Fab as federation fabric
  participant PTEG as their TEG
  participant ES as event ledger
  OMS->>Desk: order intent (pair, size)
  Desk->>Gate: authority check (roles, mandate)
  Gate-->>Desk: clamped approval
  Desk->>TEG: escrow leg (idempotency key)
  TEG-->>ES: escrow event, append-only
  TEG->>Fab: cross-frame settle
  Fab->>PTEG: credit, exactly once
  PTEG-->>Fab: confirmation
  Fab->>TEG: settled
  TEG-->>ES: settlement + evidence chain
  ES-->>OMS: signed evidence export

Topology, as declared

flowchart LR
  SD["swap-desk agent"] -->|"contract release"| REG["registry (FastAPI)"]
  REG -->|"X-Capability-Token"| GATE{"resolve_capability<br/>caveats and budget"}
  GATE -->|"over threshold"| PUSH["push approval<br/>device enclave"]
  PUSH -->|"WebAuthn ES256, uv bit"| GATE
  GATE --> TEG["TEG layer<br/>atomic transfer + fee"]
  TEG -->|"/teg/fx/route"| FX["FX pools<br/>frame to frame"]
  TEG -->|"TokensTransferred<br/>TransactionFeeCollected"| ES[("event store<br/>immutable, CQRS")]
  ES --> AUD["independent auditor<br/>delta = 0"]

Standing it up

• Infrastructure. A frame of your own, booted from the free licence and pre-built images. Or use a hosted registry and write nothing.
• Agents. 4 to 6 roles. The SDK carries A2A routing, payment verification, and credentials.
• Integration. Your bank connectivity and your ERP. This is the long pole and we will not pretend otherwise.

Runs beside what you already have

• SAP, Oracle or NetSuite ERP. The ERP keeps the ledger of record. Treasury agents read exposure through its own APIs and post journal entries back; nothing bypasses your close.
• Bank connectivity (SWIFT, EBICS, host-to-host). Payment agents prepare and reconcile; the existing bank channels execute. The mandate gate signs before anything reaches a channel.
• The treasury management system. Runs beside the TMS through the parallel phase. Both see the same cash movements, and the two ledgers are compared line by line until one of them has proven itself on the desk.

A full sovereign frame is nine containers and boots in about two minutes, on anything from a Raspberry Pi to a rack. That is cheap enough to run the whole system in parallel with the legacy stack: the old system keeps running, real work mirrors onto the rails, and you compare ledgers until the evidence settles the argument. Nothing is ripped out.

Planned: a public proxy library. Free, ready-made connectors for the systems above and whatever else a merge needs, so the bridge is an import, not an integration project.

What this does not claim

• MERIDIAN is not a bank, a payment institution, or a custodian of fiat.
• The fiat lane is purchase-only, has no withdrawal path by deliberate design, and is off on most deployments.
• Nothing here is a regulatory authorisation and nothing here is legal advice.