CLAWBANK

Drawing CB-ARCH-001 · Rev A · 1 Nov 2026

System architecture

Five planes. Each sheet under them is one guarantee: who the principal is, which balance is real, what is allowed to sign, and which repeat is forbidden. ClawBank is not a bank. Sheet 10 says where the drawing stops.

Assembly Index API reference

Sheets
00–10
Status
Public plate
Subject
Planes and boundaries
Audience
The reader of the docs

Zones

The same five, on every sheet. Hatch is the zone. A red dash is a path that does not exist.

Scroll. The next layer seats onto the die.

L0 SUBSTRATE CB-ARCH-001
01 Custodial book Stablecoin credit from fiat. Not a ledger.
02 Base Primary EVM. USDC, ETH, CLAWBANK.
03 Second EVM Same address. Separate state.
04 XRP Ledger Its own account. XRP and RLUSD.

Four balances. Not one number.

L1 KEYS CB-ARCH-001
01 Key domain One relationship per principal.
02 EVM address Valid on every EVM domain.
03 Payments account Distinct. On the XRP Ledger.
04 Gas Sponsorship is an operational control.

One EVM address. A separate payments account.

L2 GATE CB-ARCH-001
01 Credentials Session, bearer, child token, messaging.
02 Movement Sends, escrow funding, yield deposits.
03 Metered calls A separate budget. Unpaid failure is free.
04 Own domains A bridge is recorded. It is not a spend.

Two governors. They are not the same cap.

L3 JOBS CB-ARCH-001
01 Identity The principal, and each company scope.
02 Durable jobs A restart continues the same work.
03 Records Status in the database. Documents elsewhere.
04 Evaluators Pure. They do not talk to a venue.

Evaluators do not call a venue.

L4 CHANNELS CB-ARCH-001
01 Application The product surfaces.
02 HTTP API The same domain model.
03 Agent protocol A delegated caller. Same gate.
04 Messaging The mobile channel. Same gate.

No channel reaches a ledger on its own.

  1. L0 · Settlement

    Moving value between domains is a tracked transfer. A balance query names which domain.

  2. L1 · Signing enclave

    Keys sign. The enclave does not choose the operation.

  3. L2 · Policy

    A credential can narrow authority. It cannot widen it. A signature comes after policy.

  4. L3 · Control plane

    One domain model sits behind every channel. Jobs and records live here.

  5. L4 · Experience

    Four channels call one control plane. A delegated agent and the principal hit the same gate.

Sheet index

  1. Fig. 01 Channels
  2. Fig. 02 The gate
  3. Fig. 03 Wallet roles
  4. Fig. 04 Fiat rails
  5. Fig. 05 Settlement and bridging
  6. Fig. 06 One tick
  7. Fig. 07 Capital programs
  8. Fig. 08 Obligations
  9. Fig. 09 The firm
  10. Fig. 10 Limits of the drawing

Fig. 01

Channels

A person and a delegated agent operate one control plane, and every value movement crosses the same gates.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 Person Any of the four channels. 02 Delegated agent Same gate. Cannot widen it. 03 Application Product surfaces. 04 HTTP API Routes and tokens. 05 Agent protocol Tools. Same core. 06 Messaging Mobile channel. 07 Control plane Identity, jobs, records. One domain model. 08 Policy In front of a signature. 09 Signing enclave Signs. Does not decide. 10 Settlement Book, Base, second EVM, XRP Ledger. 11 External institutions Fiat, filing, ceremony, lending, arbitration, execution. Unnamed. No logos. No direct path from a channel. allowed
  • A channel does not call a settlement domain. Policy sits between them.
  • External institutions stay unnamed. Operator tooling is internal, and it is not on this sheet.
Fig. 01 Channels CB-ARCH-001 Sh. 01

Fig. 02

The gate

A credential can narrow authority and cannot widen it. A signature is requested only after policy.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 Request Principal or delegated agent. 02 Scope check Narrows. Does not widen. 03 Movement governor Sends, escrow funding, yield deposits. 04 Metered-call budget Separate from movement. Unpaid failure costs nothing. 05 Enclave policy Second box. Inside the key domain. 06 Signature Only after both boxes. not a path
  • App-side evaluation and key-domain policy are separate boxes. Drawing the path is not a claim about which operational mode is refusing today.
  • A bridge between the principal's own domains is recorded and is not counted as a spend. Metered calls use the other governor.
Fig. 02 The gate CB-ARCH-001 Sh. 02

Fig. 03

Wallet roles

"The wallet" is three roles. A balance query names which one.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 Fiat-in transit Receive only. Deposit instructions. Credits the custodial book. 02 Fiat-out transit Withdrawal address. A linked account. Same book, leaving. 03 Self-custody The key that signs. Inventory, positions, and yield sit here. 04 Key domain One enclave relationship. One EVM address on every EVM domain. A distinct account on the XRP Ledger. 05 Read models — do not sum Custodial book. On-chain balances. Tracked-token list.
  • One EVM address is valid on Base and on the second EVM domain. The XRP Ledger account is a different address.
  • Gas for the principal's transactions can be sponsored. That is an operational control, not a second balance.
Fig. 03 Wallet roles CB-ARCH-001 Sh. 03

Fig. 04

Fiat rails

Fiat is a transit rail into or out of a stablecoin balance. The two ways in do not land in the same wallet.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 Identity approval Bank rail only. 02 Instructions What to pay. 03 Inbound fiat External institution. 04 Book credit Stablecoin on the book. 05 Linked account Already approved. 06 Withdrawal address Fiat-out transit. 07 Conversion External institution. 08 Payout Leaves to the account. 09 Card purchase The other way in. Does not touch the book. 10 Self-custody wallet Where that purchase lands.
  • Identity approval sits on the bank rail. The card rail does not credit the custodial book.
Fig. 04 Fiat rails CB-ARCH-001 Sh. 04

Fig. 05

Settlement and bridging

Moving value between domains is a tracked transfer with a single submission. Slow delivery is not a reason to send it again.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 Custodial book Not on these paths. 02 Base Primary EVM. 03 Second EVM Same address. Other state. 04 XRP Ledger Own account. XRP, RLUSD. 05 Submitted Not yet broadcast. 06 Source confirmed One submission. 07 Delivering Still the same transfer. 08 Delivered Terminal. 09 Failed Before the source confirms. 10 Refunded Ledger path only. After a stall. ledger ledger path do not submit again
  • EVM to EVM: lock or burn, then a message, then mint. One transfer in flight. After the source confirms, the transfer does not become a failure, and there is no refund.
  • Base and the XRP Ledger: route, submit, and poll to a terminal state. Polling is the mechanism. A transfer that is not polled can refund. The source is still not submitted again.
  • The custodial book is not on either path.
Fig. 05 Settlement and bridging CB-ARCH-001 Sh. 05

Fig. 06

One tick

A strategy is a scheduled process in the control plane. It does not take custody. A restart cannot apply the same fill twice.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 Schedule 02 Evaluate Pure. 03 Quote 04 Policy 05 Sign 06 Broadcast 07 Apply fill Confirmed only. 08 Hold No trade. Still success. 09 Inside the control plane Scheduler, pure evaluators, market cache, execution gate. Evaluators do not talk to the venue. 10 Bounds Inventory stays in the principal's wallet. State advances when the fill confirms.
  • Hold is a successful outcome. Inventory stays in the principal's wallet. The fee is inside the swap.
  • The incentive program reuses this runtime and is drawn on the next sheet.
Fig. 06 One tick CB-ARCH-001 Sh. 06

Fig. 07

Capital programs

Three capital treatments share a wallet and a screen. They do not share a risk or a payout.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 Inventory provision Single asset in. A balancing swap. A position is minted. Price impact is checked first. One composition in flight. A retry folds leftover inventory. A share of pool fees. Not a percent of volume. 02 Third-party yield The rate is variable. Principal can be lost. ClawBank takes a client fee. ClawBank does not provide the yield. Signed with the existing key. One movement in flight. 03 Incentive accounting Deployed value, sampled in time. A fixed pot. A vesting stream. Principal is not locked. Stopping is penalty-free. Projected is not distributable. This is not staking.
  • Generalized inventory on the primary domain and the single-pool flow on the second domain are the same pattern.
Fig. 07 Capital programs CB-ARCH-001 Sh. 07

Fig. 08

Obligations

A signature, a funded escrow, a bearer claim, and a filing are different objects.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 Agreement Draft, dispatch, ceremony, vaulted artifact. A signature is not the funds. 02 Programmable escrow Milestones: submit, approve, reject, terminate. A ruling comes from outside. Payout is a separate step. Funds stay off the arbitration venue. 03 Bearer claim Fund, reveal the code once, redeem. The code is the right. Identity is not. Reclaim by the sender, or a sweep at expiry. 04 Formation Priced quote. Declared wallet. The payment has to match. The reconciler survives a missed callback. Repository holds the documents. The database holds the timeline.
  • Agreements and programmable escrow share a context and do not share a mechanism. Conditional transfer is a third object. Formation is a fourth.
Fig. 08 Obligations CB-ARCH-001 Sh. 08

Fig. 09

The firm

A company is a scope on the same principal. It is not a formed legal entity, and it is not a second wallet.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
01 One principal The same identity. 02 Many scopes A company is a scope. 03 Not a second identity Not a legal entity. Not a second wallet. 04 Document loop Tasks write documents. Documents steer later work. Chat is not the record. 05 Operating surface Authored site. Domain: pay, then register. Audience. Distribution queue. 06 Issued instrument One per company. Fee routing is fixed at quote. Whole supply, locked pool. Address comes from the chain event. 07 Communications A handle is an address. Instant, mail, directory. A stalled channel stays local.
  • Formation is sheet 08. Strategy lives in documents. Chat is not the record.
  • Another company is what a seat pays for. Inference is not billed, and it is not drawn as a meter.
Fig. 09 The firm CB-ARCH-001 Sh. 09

Fig. 10

Limits of the drawing

The flattering version and the accurate version are the same drawing. Anything parked, paused, or outside this system is not on a sheet.

  • Principal
  • Control plane
  • Signing enclave
  • Settlement
  • External
  1. 01

    ClawBank is not a bank. Fiat enters and leaves through an external institution. The custodial book and the self-custody wallet are different balances.

  2. 02

    Trading inventory, liquidity positions, and yield deposits sit in the principal's own wallet.

  3. 03

    Yield comes from third-party lending. The rate is variable. Principal can be lost. ClawBank takes a client fee. It does not provide the yield.

  4. 04

    The incentive program is not staking. A figure taken while the period is open is projected, not distributable. Principal is not locked.

  5. 05

    A liquidity position earns a share of pool fees proportional to its inventory. It does not earn a fixed percent of volume.

  6. 06

    Conversational memory is advisory. Balances and status are read live.

  7. 07

    An operating company is a scope. It is not a formed legal entity. Formation is the other capability.

  8. 08

    Card checkout on company sites is paused. Inference is not billed. Neither is drawn.

  9. 09

    App-side spend evaluation and key-domain policy are separate controls. The sheets draw the path. They do not assert which operational mode is refusing today.

  10. 10

    Capabilities that are off, paused, or not owned by this system are omitted, including where drawing them would overclaim.

Fig. 10 Limits of the drawing CB-ARCH-001 Sh. 10