§1

Conceptual Overview

slides 1–4

§2

Building on Canton

slides 5–8

§3

Technical Deep Dive

slides 9–12

Naim Katiman

April 2026

• •Per-participant private contract store
• •Sub-transaction privacy by stakeholder set
• •Atomic multi-party state transitions via Daml choices
• •Synchroniser orders, never inspects payloads

• •Not a public broadcast L1 with global state
• •Not a permissioned chain with full replication per node
• •Not a workflow engine—no SLAs, no retries, no humans
• •Not a database—no global queries, no shared mempool

# compile + run scripts in IDE-ledger
$ daml build
$ daml test --files daml/Scripts.daml
All scripts pass: 5 / 5

# spin up a local participant + JSON API
$ daml start

# exercise from the app layer
$ curl -X POST http://localhost:7575 \
   -H "Authorization: Bearer $TOKEN" \
   -d @issue-product.json
created: ProductIssued@...

# codegen for the app
$ daml codegen ts && daml codegen java

• •No synchroniser, in-process
• •Run Daml Scripts to fake multi-party flows
• •Hot-reload templates & choices
• •App talks to JSON API on localhost

• •Real participant nodes, real sync
• •Multi-org flow with peer counterparties
• •DAR upload + party allocation
• •First time auth + KMS show up

• •Operator dependency: real SLAs, real ops
• •Contractual onboarding + party governance
• •Disaster recovery, key rotation, audit
• •Daml package upgrade procedure

-- Who must sign for the contract to exist?
template Subscription
  with
    investor : Party
    issuer   : Party
    auditor  : Party
    units    : Decimal
  where
    signatory investor, issuer
    observer  auditor

    -- Only the issuer can settle.
    choice Settle : ContractId Holding
      controller issuer
      do
        assertMsg "units > 0" (units > 0.0)
        create Holding with owner = investor; units

    -- Either party can cancel before settle.
    choice Cancel : ()
      controller investor, issuer
      do  return ()

• •One ordering domain, one set of operator SLAs
• •Atomicity is “free”—every commit is in scope
• •Latency uniform across stakeholders
• •Easier governance, easier audit, easier upgrades

• •Multiple domains, atomically composable
• •Per-domain operator + governance separation
• •Latency & failure domains scoped per domain
• •Cross-domain commits stitch via Daml choices

• •Daml package upgrades preserve existing contract IDs
• •Schema-compatible new package version uploads alongside the old
• •Choice signatures stay stable; new fields default sensibly
• •Breaking changes require an explicit migration choice on each contract

• •No shared global registry — balance lives per stakeholder set
• •No approve / transferFrom — transfers are signed multi-party choices
• •No public balance read — queries scoped to parties hosted
• •Issuer/custodian/regulator are first-class parties, not contract roles

• •Stakeholder set declared at template definition — privacy boundary, not a network policy
• •Lifecycle as enumerated choice transitions, not free-form mutations
• •Issuer holds the original; distributors and investors are explicitly added at issuance
• •Off-ledger fields (KYC docs, marketing, fee schedules) live in Postgres — ledger keeps only the truth that needs multi-party signing

• •HydraX rails mocked behind hydrax-adapter — workflow stack unblocked while engagement settles (PRD §14 Q1)
• •Product type open (PRD §14 Q3); current proposal: short-duration credit, 30–180d institutional tenor
• •No native tokenomics layer — supply, distribution, fees are operational fields, not protocol-level economics
• •Upgrade story: Daml package versioning + interfaces — isolated in rails-plane adapters

• •Anyone-can-call composition — a contract is opaque to non-stakeholders by construction
• •Global state reads — no shared mempool, no public RPC of all contracts
• •Atomic same-block flash composition across arbitrary protocols built by strangers
• •Permissionless interop with adversarial counterparties

• •Stakeholders declared at modelling time — cross-contract logic is a deliberate design step
• •"Bring parties to the contract" — workflow-svc adds the right principals at issuance so downstream choices are even possible
• •Compliance-by-construction — you cannot accidentally compose a custodian into a flow they shouldn't see
• •Atomicity preserved — the same Daml choice can mutate multiple contracts in one signed step (within a domain)

• Goworkflow-svc :7001 — orchestration, FSM
• Goapproval-svc :7002 — chains, escalations
• Goaudit-svc :7003 — immutable trail
• Gohydrax-adapter :7004 — rails (mocked)
• Gocanton-adapter :7005 — ledger I/O
• TSnotify-svc :7101 — email, webhook
• TSintegration-svc :7102 — KYC, SSO
• TSbff :7103 — aggregation, /healthz/composite

• 5 Vite + React + RTK portals: issuer (5173), distributor (5174), investor (5175), ops (5176), admin (5177)
• Tenant isolation via CSS-vars theme config injected at runtime; no shared mutable state
• Role-aware shells — not the same SPA with feature flags
• Postgres + Mongo as Railway addons; DATABASE_URL + MONGODB_URI per service env
• One health roll-up: bff /healthz/composite aggregates all 8 upstream /healthz probes
• Deploy: railway up --detach per linked service root

• •Postgres — relational read models for reporting, joins, indexed queries (subscriptions, approvals, audit, products)
• •Mongo — flexible tenant-configurable payloads, document metadata, notification envelopes
• •Daml events → canton-adapter → workflow-svc projector → both stores
• •Idempotent projections keyed on event id — replayable, no double-write

• •Single-synchroniser until atomic cross-jurisdiction flows justify multi-domain
• •Per-projection lag tracked: last-event timestamp, events/sec, error count — surfaced in admin
• •Replay-from-offset when a projection schema changes — no migration step required
• •Multi-domain trigger = cross-region operator residency, latency isolation, or supervisory partitioning