Open-source ledger

A ledger whose book anyone it concerns can check against a public anchor.

aledgent keeps accounts, balances and operations in a deterministic kernel, verifies its genesis before it takes a command, and anchors a commitment to its state on Kreivo every hour. Bloque runs it in production.

Read the guide API reference

In production at Bloque since 12 October 2026
No external audit yet
Apache-2.0 OR MIT

A transfer, answered at ReceivedPOST /v1/transfers

$ curl -X POST $INGRESS/v1/transfers \
  -H "Authorization: Bearer $TOKEN" \
  -H "client-key: payout-2026-10-13-0042" \
  -d '{"legs":[{"from":"did:aledgent:acct:…",
               "to":"did:aledgent:acct:…",
               "asset":"TSTA","amount":"125000"}],
       "reference":{"invoice":"inv-8812"}}'

202acknowledged at Received, not yet decided

{
  "operation_reference": "did:aledgent:op:…",
  "state": "Received",
  "class": "open-non-refunding",
  "terminal": false,
  "client_key": "payout-2026-10-13-0042",
  "client_key_derived": false,
  "reference": {"invoice": "inv-8812"}
}

Four ideas carry the whole system

Read these first. Everything else in the guide refines one of them.

01 · Book

A deterministic kernel

Balances live in a deterministic kernel, in exact integer minor units, and every input is kept with its reply, so the book’s state can be re-derived. A book starts from a verified genesis and takes no command until the check passes.

02 · Operations

Received, then decided

Every command gets an operation reference. A transfer is acknowledged at Received, then decided. A client key makes a retry the same operation, never a second one.

The operation lifecycle →

03 · Anchoring

A commitment on Kreivo

Every hour, and on demand, a commitment to the book’s state goes to a settlement contract on Kreivo. aledgent cannot later claim to have held another state. It says nothing about solvency.

04 · Ingress

One authenticated entry

Services call with tokens, people with passkeys, and every route is denied by default. Each command is checked against the grants its principal holds, for that account, asset and bound.

Bounds it is held to

Requirements of the specification (§11), at p99, measured inside aledgent.

Acknowledge a commandNFR-1: 50ms; A transfer, reservation or withdrawal is durably taken in and answered Received, with its operation reference.
Answer with a decisionNFR-16: 1s; Every command answered with its decision gets it, or a named refusal, from its arrival.
Complete itNFR-15: 30s; Every command reaches the state it asks for, or is refused. With an external leg, completion ends at inclusion. 30 s is the ceiling; the target is 19 s.

Where to start

IntegrateAuthenticate, send a transfer, and follow it from Received to its decision.

OperateWhat an operator watches, and how an operation that needs a human is resolved.

VerifyCheck a disclosure with crates/verify, without aledgent taking part. Today a disclosure is aledgent's signed assertion, not proof of the fact.