Skip to content
aledgent by bloquealedgent by bloquealedgent

14. Open questions

Commit
5ca6b8a
Version
0.4.27
Status
draft
Rendered
2026-10-17T19:30:18Z
Source
SPEC.md, last changed in 5ca6b8a

A question that blocks a V0 story or requirement MUST be closed before V0’s spec freeze. Any other MUST be closed before v1.0.0.

ID Question Blocks
OQ-5 May the identities that draw on one pooled account (REQ-LA-6) belong to different integrating parties? If so, what does each party see of the pool (REQ-PV-2)? REQ-LA-6, REQ-PV-2, §7
OQ-6 Closed by amendment 0009: the client key’s uniqueness domain is the integrating party, and it never expires. The same key from two principals of one integrating party is refused, and counts as an integration failure (REQ-OP-10). —
OQ-7 Closed by amendment 0002: coordinates are native to the settlement layer and carry the operation reference (REQ-SL-8). —
OQ-9 Closed by amendment 0002: by an opaque account reference the deployment resolves (REQ-SL-7). —
OQ-10 Closed by amendment 0002: positions, anchors and the sequenced record, and nothing about any holder (REQ-SL-10). —
OQ-11 Closed by amendment 0009: anchoring is hourly, and on demand when the operator asks or when a disclosure concerns entries that no final anchor covers yet (REQ-PR-1). —
OQ-12 Closed by amendment 0009: yes. Holder and agent credentials may reach aledgent directly, and everything enters through the one authenticated entry (REQ-AU-21). —
OQ-13 Closed by amendments 0002 and 0004. An account may change custody mode after opening (REQ-AU-11). There is no single unit of owned custody. An identity holds a set of credentials. Any of them exercises owner authority, unless it is scoped to some accounts (REQ-AU-20). —
OQ-14 Closed by amendment 0003. Recovery uses a recovery authority that is not the operator, a successor after a delay, and an optional recovery credential the holder keeps (REQ-AU-15–REQ-AU-18). Guardian thresholds and “no recovery” are not offered (REQ-AU-19, REQ-AU-9). Each deployment chooses who its recovery authority is. —
OQ-17 Closed by amendment 0012: conversion is not an aledgent operation. It is a redemption and an issuance by the integrating party, two operations, with no atomicity between them (§13). —
OQ-21 Closed by amendment 0009: the identities principal opens identities, and is the operator unless another principal plays that role; accounts are also opened by the identity that owns them (REQ-ID-6, OQ-64). The integrating party keeps its own record of the identifiers it serves, and holds its own agents’ credentials (REQ-AG-4). —
OQ-22 Closed by amendment 0002 by REQ-AR-6. —
OQ-23 For V0, is a disclosure that is aledgent’s signed assertion acceptable, with an independently checkable construction deferred? REQ-PR-6, REQ-DS-3, DEF-3
OQ-24 Closed by amendment 0020: yes. A multi-leg submission is a caller-facing transfer, atomic as one unit; its maximum is declared by the deployment and published (limits()); a caller splits anything larger into separate submissions (REQ-CS-10). —
OQ-25 Is a multi-leg operation atomic on the book even when it cannot be atomic on the settlement layer? What does aledgent record when the settlement layer applies some legs and not others? REQ-KER-10, REQ-SO-3
OQ-30 Must external settlement work in more than one asset from day one? REQ-SL-2, Epic E
OQ-31 Is there anything on top of anchoring, such as a reserve attestation or a prefunding commitment, that would let the operator make a solvency statement instead of a consistency one? REQ-PR-3, §4.6
OQ-32 If settlement with a peer is periodic, what is the window? What limits the credit exposure that builds up inside it? DEF-1
OQ-33 Is a peer-institution arrangement in scope at all for V0? DEF-1
OQ-35 Closed by amendment 0009: at least Received (accepted), Reserved and Final (confirmed), each with what the caller is expected to do (REQ-OP-12). Every other transition is pushed as well (OQ-67). —
OQ-36 Which clock is authoritative for an operation’s timestamps: aledgent’s, the runtime’s, or the settlement layer’s? May a derived timestamp be earlier than its own batch? REQ-PO-2, NFR-11, US-H3
OQ-41 Is NFR-2’s volume the right commitment, and what growth assumption is behind it? NFR-2, NFR-3
OQ-51 Closed by amendment 0009: aledgent relays to the destination the caller supplies, authenticated by a code over the body under a secret shared with each recipient, and signs nothing (REQ-EV-4). The recipient registers both through the command surface (OQ-66). —
OQ-52 Closed by amendment 0009: every kind of principal needs a push contract; polling is not an acceptable primary contract (REQ-EV-7). —
OQ-56 What is aledgent optimising for, in one sentence? Without an answer, every boundary argument is a matter of taste, because there is no criterion to settle it. Every boundary and scope decision
OQ-58 Closed by amendment 0009: aledgent is its own authority for identity and the authoritative registry of existence; the integrating party is the authority for who a holder is (REQ-ID-7, §4.2). It is not permissionless: the deployment’s own configuration is the operator’s alone. What registering an integrating party records was OQ-65, closed by amendment 0011. —
OQ-60 Is the initial-state load (REQ-RC-4) a one-time operator action? Or is it a standing capability that an integrating party may use to bring its own book across? REQ-RC-4, US-K5
OQ-61 Closed by amendment 0007: a command that reserves is acknowledged at Received within NFR-1’s bound, like every other command. Its decision, reserved or refused, reaches the caller by query and notification (REQ-CS-3, AC-C1.1). —
OQ-62 Closed by amendment 0006: without mechanical proof, two distinct principals may only release a Needs-Review operation, never capture it, because capturing would book an entry before the external leg is final (REQ-RC-5 step 3, INV-10). —
OQ-63 Closed by the owner’s rulings of 2026-10-02 (d-oq63, f-oq63): capture, release, issue and redeem are answered with their decision, not acknowledged at Received (REQ-CS-8, NFR-16). —
OQ-64 Closed by amendment 0009: identities are opened only by the identities principal, the operator or whoever plays that role; ledger accounts by the identities principal and by the identity itself, for its own further accounts (REQ-ID-6, US-A2). —
OQ-65 Closed by amendment 0011: the operator registers an integrating party with the principals tied to it, and ties principals to it later; a principal belongs to at most one party, and one tied to none is its own client-key domain (REQ-ID-7, REQ-OP-10). —
OQ-66 Closed by amendment 0009: the recipient registers its notification destination and the secret it shares with aledgent through the command surface, and replaces them the same way (REQ-EV-4). —
OQ-67 Closed by amendment 0009: every state transition is pushed (REQ-EV-1). —
OQ-68 Open requirement (amendment 0022, ruling a0022-q4): a re-founded book continues its venue’s anchor sequence where it stands, which works only while no value is bound there. Resetting a venue’s anchoring for a re-founded book, by the venue’s own governance, is desired of a later venue, as a relay chain’s governance sets a parachain’s current head: the earlier book’s anchors stay where they are, and the new book’s anchors start afresh. Not required of V0’s venue. REQ-PR-1, REQ-PR-3, INV-19

Identifiers missing from this table were withdrawn before the first freeze. They are not reused.

© 2026 Pagos Cube LLC · Code: Apache-2.0 OR MIT · agents/: AGPL-3.0-or-later · Docs: CC-BY-4.0