TRUNK

Inter-carrier settlement per event instead of per quarter, on a record neither side can edit.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Interconnect carrier. Per-event settlement instead of quarter-end reconciliation warfare.
• MVNO. Wholesale reconciliation that arrives already reconciled.
• Roaming clearing. Both sides sign the same entry, and the ledger deduplicates.
• A2P and SMS aggregation. Inflated counters end in quarantine, not in court first.

The problem

Two carriers terminate each other’s traffic all month, then spend the next quarter disputing whose counters are right. The settlement is a negotiation because the record is two records.

The system

TRUNK is a settlement mesh of 14 carrier registries. Each interconnect event settles as it happens: the terminating side is paid per event, the fee lands with the receiver, and the same signed entry exists on both frames because both emit it and the ledger deduplicates on an idempotency key. There is no month-end file exchange, because there is no month-end state to reconcile.

A carrier that starts inflating counters is not sued first; it is contained first. Its licence suspends, its ability to move value in the mesh ends within a sync cycle, and every historical entry it ever signed stays intact for the lawyers.

The cast and their ceilings

The flow, step by step

1. CDRs arrive from mediation, exactly as they already do. The switches never see the ledger.
2. Each interconnect event settles as it happens. Not a file. Not a quarter.
3. The terminating side is paid per event, and the fee lands with the receiver.
4. Both sides emit the same signed entry.
5. The ledger deduplicates on the idempotency key. Two frames, one record, nothing left to reconcile.
6. And the relationship itself is a bilateral licence: revocable in one action, without a lawsuit.

Each need, mapped to a live primitive

The attack this chamber refuses: The inflated counter

The attack. In March a peer’s counters start growing three percent faster than its traffic. Nothing dramatic; just enough to be worth it at quarter scale.

Why it fails. There is no quarter to hide in. Every event settles alone, both sides emit the same signed entry, and the ledger deduplicates on the idempotency key, so a claimed event with no twin is visible the day it is claimed, attributable to a named counter. The desk suspends the licence, and the peer’s ability to move value in the mesh ends within a sync cycle.

What actually happens. Containment arrives before the lawyers do, and every entry the peer ever signed stays intact for them. The mesh’s other corridors settle through the incident untouched.

Deep architecture

TRUNK at deployment scale: carrier A’s frame on the left, carrier B’s on the right, and the interconnect between them reduced to a fabric that settles per event. The mediation layer keeps feeding CDRs exactly as it does today; the switches never see the ledger. What disappears is the month-end file exchange, because there is no month-end state to reconcile. The trace replays one interconnect month that never needed one.

The deployment, traced

1. Traffic terminates all month. The switches never see the ledger; mediation is where the counters live.
2. CDRs arrive from the mediation layer, exactly as they already do.
3. Each interconnect event settles as it happens. Not a file. Not a quarter.
4. Both sides emit the same signed entry, and the ledger deduplicates on the idempotency key.
5. Settlement crosses the interconnect under the same key. A retry can never double it.
6. The terminating side is paid per event, and the fee lands with the receiver.
7. Their counters metered the same call.
8. Their ledger holds the same entry. Two frames, one record, nothing left to reconcile.
9. The relationship itself is a bilateral licence on the mesh, revocable without a lawsuit.
10. In March, a peer starts inflating counters. The desk moves to suspend its licence.
11. The quarantine bites within a sync cycle: its ability to move value ends, and every entry it ever signed stays intact for the lawyers.

Adoption, phase by phase

Discover: One interconnect, re-read per event.

• Runs. Nothing. One month of CDRs from one interconnect, replayed as per-event settlements.
• Agents. None. Wholesale and revenue assurance compare the replay to the invoice they actually argued about.
• Integrates. Nothing. Mediation and switching are untouched.
• Deliberately not yet. No registry, no licence, no settlement.
• Proof that gates the next phase. The replayed month lands within reconciliation tolerance of the settled invoice, and both teams can name where every difference comes from.

Pilot: One peer, shadow settlement.

• Runs. One registry per carrier, single VM each, federated bilaterally for this interconnect only.
• Agents. Metering and settlement roles on both sides. The licence lever exists and is drilled.
• Integrates. Mediation feeds both sides live; settlement runs in shadow beside the existing process.
• Deliberately not yet. No real money. The quarterly process still runs, now with a rival it has to match.
• Proof that gates the next phase. A full billing cycle in which the shadow ledger and the legacy reconciliation agree, or every disagreement is attributed to a named counter.

Production: The interconnect settles itself.

• Runs. Sovereign frames at both carriers. About nine containers each, beside the mediation layer.
• Agents. The full cast; both sides emit; the ledger deduplicates; fees land receiver-side by construction.
• Integrates. Mediation in production; finance reads the ledger instead of exchanging files.
• Deliberately not yet. The rest of the interconnect estate. One peer at production proves the pattern.
• Proof that gates the next phase. A quarter closes with zero reconciliation files exchanged on this interconnect and an auditor reading both frames to the same total.

Federation: Fourteen carriers, one mesh, no clearing house.

• Runs. Unchanged. Each new peer is a bilateral federation.
• Agents. Per-peer licences bound exposure; quarantine is the containment, courts are the appeal.
• Integrates. Each new interconnect is a signed card and a licence, not a project.
• Deliberately not yet. Nothing structural. Growth is peers.
• Proof that gates the next phase. A misbehaving peer is quarantined within a sync cycle, and the mesh’s other thirteen corridors settle through the incident untouched.

Sizing

One terminated call, CDR to both ledgers

sequenceDiagram
  participant Med as mediation (A)
  participant MA as metering-a
  participant TEGA as TEG A
  participant XT as cross-registry settle
  participant TEGB as TEG B (their frame)
  participant ESA as ledger A
  participant ESB as ledger B
  Med-->>MA: CDR, as today
  MA->>TEGA: settle per event (receiver-side fee)
  TEGA->>XT: cross-frame leg (idempotency key)
  XT->>TEGB: terminating side credited, exactly once
  TEGA-->>ESA: signed entry
  TEGB-->>ESB: the same signed entry
  Note over ESA,ESB: both sides emit; dedup on the key; nothing to reconcile
  Note over XT: an inflating peer is licence-suspended within a sync cycle

Topology, as declared

flowchart LR
  Med["mediation layer"] -.->|"CDRs, as today"| MA["metering-a"]
  MA -->|"settle per event"| T["per-event settle<br/>receiver-side fee"]
  T -->|"terminating side paid"| TB["their TEG"]
  T -->|"signed entry"| L[("both ledgers<br/>dedup on key")]
  TB -->|"the same entry"| L
  D["interconnect-desk"] -.->|"licence suspend"| Q{"economic quarantine"}
  Q -.->|"value stops, history survives"| TB

Standing it up

• Infrastructure. One registry per carrier. Interconnect partners federate bilaterally.
• Agents. Metering and settlement roles per interconnect.
• Integration. The mediation layer. The switches never see the ledger.

What this does not claim

• TRUNK settles between machines that already trust their own metering. It does not arbitrate radio truth, and it is not a clearing house licence.