NASD NEXT · GATE SERIES · 01 · BUILD BOOK

Objects and contracts: the build specification

v2 · 22 Jul 2026 · canonises the tiered-attestation correction · companions: 02, 03, 04

THE LOGIC WE ARE AIMING FOR

One object carries the truth. Contracts distribute the liability. Tiered attestation makes speed safe, because the regulator's own caps underwrite every instant decision. Everything else in this product is a lens over that.

Below: the build order and why it is that order, the five decisions to lock before code, and the module reference for executional detail.

HOW TO THINK ABOUT BUILDING IT

Build in dependency order, not feature order

The temptation is to build what demos well. The discipline is to build what everything else stands on. Five stages; each is shippable and each makes the next one honest.

Object store + provenance chain firstThe append-only, hash-chained event store and the object schema. No UI, no brokers, no wallet. Done when: an event written can never be edited, a read writes an event, and the chain verifies against a computed root.WHY THIS ORDER · every later module writes here; retrofitting provenance is archaeology

Attestation machinery secondSnapshot binding, broker key registration, the L1 auto-attest path under panel authority, the material-field void list. Done when: a broker key signs over hash #h, a name change voids it, and an ordinary append does not.WHY THIS ORDER · attestation is the legal spine; hooks and wallets hang off a signed snapshot

Consent hooks third, enforced at the endpointGrant tokens with scope, purpose and legal basis; the evidence API refuses without one; every pull ledgered. Done when: a pre-hook fetch attempt produces a refusal event, not data.WHY THIS ORDER · hooks gate the evidence attestation consumes; build the gate before the traffic

Tag, device bind and rebind fourthMint rules, dedupe idempotency, enrolled biometric, the guarded rebind path with cooling window and step-up. Done when: the rebind tabletop passes and concurrent mints resolve to one object.WHY THIS ORDER · rebind is the attack surface; it needs the ledger and attestation beneath it to be recoverable

Wallet rails and tier caps lastVBank issuance against the tag, L1 rails (deposit, cumulative, redemption, no outward transfer, no foreign credit), automatic upward migration. Done when: the caps are enforced in the transaction path, not the UI, and a cap breach migrates rather than blocks.WHY THIS ORDER · money moves only once identity, liability and consent are solid; the caps are the risk budget that makes stage 5 safe on day one

DECISIONS TO LOCK BEFORE CODE

Five decisions, each cheap now and structural later

What an attestation binds to

DECIDEImmutable evidence snapshot by chain hash, never “the object”. This one line is the difference between a legal instrument and a vibe.

OWNERGTPP + counsel

The material-field list

DECIDEExactly which field changes void attestations (name, BVN, DOB, legal capacity) and which append harmlessly (consent, accounts, address evidence). Short list, versioned, counsel-signed.

OWNERGTPP + counsel

Key custody

DECIDEBroker keys are broker-held, HSM-backed, registered at panel onboarding. The platform orchestrates and never signs for a broker: liability separation is only as real as signing separation.

OWNERCISO

Where the caps live

DECIDETier caps enforce in the transaction path. UI reflects; it never enforces.

OWNEREngineering lead

What the platform never stores raw

DECIDEBVN tokenised in the index, touched raw only transiently at NIBSS verification; evidence documents in a separately-keyed vault with only hashes on the object. Blast radius over perimeter.

OWNERCISO

THE MODULES

Reference: objects and contracts

The executional detail per module. Five objects, three contracts.

O1 · IDENTITY OBJECT

One evidence container, addressed by tag

The record of who an investor is and how that is known.

INVARIANTSIdempotent hydration (nothing re-asked, anywhere) · append-only, hash-chained provenance · reads are events, platform and insider included

GATESMint = NIBSS verify + eligibility + dedupe · mutation = evidence event · material mutation = void + re-attest

O2 · ATTESTATION

Tiered, snapshot-bound, broker-signed

Canonised correction: attestation has levels matching the SEC tiers. L1 is instant and automated under panel authority (the Commission requires no documentary evidence at L1; BVN-verified data exceeds it). Full attestation lands when screening completes. The three-minute wallet is L1-attested: real broker-of-record from birth, instant, capped. The caps are the broker's bounded exposure for attesting before screening finishes.

STATESPENDING → L1-ATTESTED → FULL · or FROZEN-AT-L1 (screening failed: caps hold, exit ramp) · or VOIDED (material change)

RE-ATTESTATIONA delta decision over a mostly-unchanged chain: seconds, not a restart

O3 · CONSENT HOOK

A grant token, enforced at the endpoint

NDPA consent as machinery: armed at mint, fired one tap per broker, captured with scope, purpose, timestamp and legal basis.

TWO BASESThe share runs on consent; the broker's retained CDD copy runs on legal obligation. Withdrawal kills future access; the five-year retention survives it. Encode both or the first erasure demand finds the gap.

READ LEDGEREvery pull is a provenance event; “who has seen my data” is a query

O4 · TAG

The address, the device, the rebind

Minted once, presented on return, bound to a device key. The tag is an address, not a secret.

REBINDBVN re-verify + liveness against the enrolled template · notify old device and VBank rail · cooling window · step-up before first withdrawal · hard rate limits. The recovery path is the attack path.

O5 · WALLET / CASH NODE

Broker custody above, VBank rail beneath

Broker-custody wallet by market design; VBank virtual account issued against the tag at attestation, BVN-linked at birth so the funding-source rule holds by construction.

TIER RAILSL1: ₦20k a deposit · ₦200k cumulative · ₦30k daily · no outward transfers · no foreign credits. Migration upward automatic and mandatory.

C1 · PANEL AGREEMENT

The standing offer

Broker's standing offer + platform's authority for L1 auto-attestation.

MUST CONTAINAcceptance criteria (broker-set) · L1 authority and caps · broker-held pause switch · capacity signalling · minimum panel size as launch precondition · allocation formula · full-attestation SLA

C2 · CLIENT AGREEMENT

One tap that is actually a contract

Presented explicitly at confirm. Standing offer, two acceptances, both parties free to refuse.

SWAPMake-before-break, always; holdings never broker-less. Attestation swaps in seconds; the CSCS transfer runs on its own honest clock, and the UX never confuses the two.

C3 · RELIANCE TERMS

Producibility as a duty

SEC reliance conditions as service levels: full evidence trail on demand, each broker ultimately responsible for its own CDD, the platform an evidence source and never an attestor.

TESTEDQuarterly evidence-pull drill per broker. Producibility is proven, not asserted.

What not to build yet: every read-side lens (statements, dashboards, reports) waits. They are cheap once the object is rich and impossible to trust before it. Build the truth first; render it later.