NASD OTC Securities ExchangeA Self-Regulatory Organisation, registered with and
regulated by the Securities and Exchange Commission, Nigeria
NASD NEXT · GATE SERIES · VOLUME 02 OF 06 · BUILD BOOK

Objects and contracts: the build specification

v2 · 22 Jul 2026 · volume 02 · read after Volume 01 · canonises the tiered-attestation correction · companions: 01, 03, 04, 05
THE LOGIC WE ARE AIMING FOR

This is the map of the entire build at substrate depth. One object carries the truth, contracts distribute the liability, and the regulator's own caps underwrite every instant decision. The exchange and credit layers stand on the interfaces this book defines; their internals live in their own canonical documents.

Below: what the substrate serves upward (the interface contracts), the build order and why, the five decisions to lock before code, and the module reference. Layer map and governance: Gate Series 01.
HOW TO THINK ABOUT BUILDING IT

Build in dependency order, not feature order

The temptation is to build what demos well. The discipline is to build what everything else stands on. Five stages; each is shippable and each makes the next one honest.
Object store + provenance chain firstThe append-only, hash-chained event store and the object schema. No UI, no brokers, no wallet. Done when: an event written can never be edited, a read writes an event, and the chain verifies against a computed root.WHY THIS ORDER · every later module writes here; retrofitting provenance is archaeology
Attestation machinery secondSnapshot binding, broker key registration, the L1 auto-attest path under panel authority, the material-field void list. Done when: a broker key signs over hash #h, a name change voids it, and an ordinary append does not.WHY THIS ORDER · attestation is the legal spine; hooks and wallets hang off a signed snapshot
Consent hooks third, enforced at the endpointGrant tokens with scope, purpose and legal basis; the evidence API refuses without one; every pull ledgered. Done when: a pre-hook fetch attempt produces a refusal event, not data.WHY THIS ORDER · hooks gate the evidence attestation consumes; build the gate before the traffic
Tag, device bind and rebind fourthMint rules, dedupe idempotency, enrolled biometric, the guarded rebind path with cooling window and step-up. Done when: the rebind tabletop passes and concurrent mints resolve to one object.WHY THIS ORDER · rebind is the attack surface; it needs the ledger and attestation beneath it to be recoverable
Wallet rails and tier caps lastVBank issuance against the tag, L1 rails (deposit, cumulative, redemption, no outward transfer, no foreign credit), automatic upward migration. Done when: the caps are enforced in the transaction path, not the UI, and a cap breach migrates rather than blocks.WHY THIS ORDER · money moves only once identity, liability and consent are solid; the caps are the risk budget that makes stage 5 safe on day one
WHAT THE SUBSTRATE SERVES UPWARD

The interface contracts

These seven services are the boundary. The exchange and credit layers consume them; changes to them are cross-owner reviews.
I1–I7 · INTERFACES

Seven services, one boundary

ATTESTATION SVCL1 instant / full async, snapshot-bound, broker-signed. Consumed by the exchange's Trade-Ready state and the credit layer's lien attestation.
EVIDENCE APIGrant-gated, read-ledgered. Serves broker screening, exchange compliance, credit underwriting. No grant, no bytes.
TAG / BVNDLE SSOAuthentication and identity prefill for every channel. Consent per attribute, per purpose.
PANEL ALLOCATIONPublished-rule broker routing with capacity heartbeat. Powers the exchange's Trade Now; cost never dominates the formula.
CASH NODEVBank virtual accounts issued against the tag, BVN-linked at birth. Feeds the exchange's investor cash ledger and credit disbursement.
READ LEDGERProvenance events for every access, human or model. Feeds the consent centre, surveillance evidence, and audit exports.
INFERENCEIn-jurisdiction hot-path scoring for orders and margins; warm path for LTV and KYC anomaly. Every inference reads and writes on the ledger.
DECISIONS TO LOCK BEFORE CODE

Five decisions, each cheap now and structural later

D1

What an attestation binds to

DECIDEImmutable evidence snapshot by chain hash, never “the object”. This one line is the difference between a legal instrument and a vibe.
OWNERGTPP + counsel
D2

The material-field list

DECIDEExactly which field changes void attestations (name, BVN, DOB, legal capacity) and which append harmlessly (consent, accounts, address evidence). Short list, versioned, counsel-signed.
OWNERGTPP + counsel
D3

Key custody

DECIDEBroker keys are broker-held, HSM-backed, registered at panel onboarding. The platform orchestrates and never signs for a broker: liability separation is only as real as signing separation.
OWNERCISO
D4

Where the caps live

DECIDETier caps enforce in the transaction path. UI reflects; it never enforces.
OWNEREngineering lead
D5

What the platform never stores raw

DECIDEBVN tokenised in the index, touched raw only transiently at NIBSS verification; evidence documents in a separately-keyed vault with only hashes on the object. Blast radius over perimeter.
OWNERCISO
THE MODULES

Reference: objects and contracts

The executional detail per module. Five objects, three contracts.
O1 · IDENTITY OBJECT

One evidence container, addressed by tag

The record of who an investor is and how that is known.

INVARIANTSIdempotent hydration (nothing re-asked, anywhere) · append-only, hash-chained provenance · reads are events, platform and insider included
GATESMint = NIBSS verify + eligibility + dedupe · mutation = evidence event · material mutation = void + re-attest
O2 · ATTESTATION

Tiered, snapshot-bound, broker-signed

Canonised correction: attestation has levels matching the SEC tiers. L1 is instant and automated under panel authority (the Commission requires no documentary evidence at L1; BVN-verified data exceeds it). Full attestation lands when screening completes. The three-minute wallet is L1-attested: real broker-of-record from birth, instant, capped. The caps are the broker's bounded exposure for attesting before screening finishes.

STATESPENDING → L1-ATTESTED → FULL · or FROZEN-AT-L1 (screening failed: caps hold, exit ramp) · or VOIDED (material change)
RE-ATTESTATIONA delta decision over a mostly-unchanged chain: seconds, not a restart
O3 · CONSENT HOOK

A grant token, enforced at the endpoint

NDPA consent as machinery: armed at mint, fired one tap per broker, captured with scope, purpose, timestamp and legal basis.

TWO BASESThe share runs on consent; the broker's retained CDD copy runs on legal obligation. Withdrawal kills future access; the five-year retention survives it. Encode both or the first erasure demand finds the gap.
READ LEDGEREvery pull is a provenance event; “who has seen my data” is a query
O4 · TAG

The address, the device, the rebind

Minted once, presented on return, bound to a device key. The tag is an address, not a secret.

REBINDBVN re-verify + liveness against the enrolled template · notify old device and VBank rail · cooling window · step-up before first withdrawal · hard rate limits. The recovery path is the attack path.
O5 · WALLET / CASH NODE

Broker custody above, VBank rail beneath

Broker-custody wallet by market design; VBank virtual account issued against the tag at attestation, BVN-linked at birth so the funding-source rule holds by construction.

TIER RAILSL1: ₦20k a deposit · ₦200k cumulative · ₦30k daily · no outward transfers · no foreign credits. Migration upward automatic and mandatory.
C1 · PANEL AGREEMENT

The standing offer

Broker's standing offer + platform's authority for L1 auto-attestation.

MUST CONTAINAcceptance criteria (broker-set) · L1 authority and caps · broker-held pause switch · capacity signalling · minimum panel size as launch precondition · allocation formula · full-attestation SLA
C2 · CLIENT AGREEMENT

One tap that is actually a contract

Presented explicitly at confirm. Standing offer, two acceptances, both parties free to refuse.

SWAPMake-before-break, always; holdings never broker-less. Attestation swaps in seconds; the CSCS transfer runs on its own honest clock, and the UX never confuses the two.
C3 · RELIANCE TERMS

Producibility as a duty

SEC reliance conditions as service levels: full evidence trail on demand, each broker ultimately responsible for its own CDD, the platform an evidence source and never an attestor.

TESTEDQuarterly evidence-pull drill per broker. Producibility is proven, not asserted.

What not to build yet: every read-side lens (statements, dashboards, reports) waits. They are cheap once the object is rich and impossible to trust before it. Build the truth first; render it later.