The flow-of-funds map

This project is a worked example of what headstreamer builds for financial institutions: a living, visual map of how funds actually flow. The subject is tokenized equities clearing. The fourteen source documents below are the frozen product requirements; this page reads them as a flow-of-funds specialist would.

The core flow, leg by leg

A tokenized equity trade has two legs that settle at different speeds on different rails.

The settlement-latency gap between the token leg (T) and the share leg (T+1 or later) is the product. Someone must bear that gap: prefunding kills capital efficiency, so milestone 1 puts it on Alpaca's balance sheet as settlement agent, backed by locates and borrows under Reg SHO and Reg T. Milestone 2 moves it to an independent CCP whose guarantee extends credit-based minting to rails outside any one firm's credit perimeter.

Who bears the risk in the gap

• M1: Alpaca, bilaterally, against its own securities-lending book. Revenue is ITN transaction fees, stock loan, and locate fees.
• M2: a mutualized default waterfall at the clearinghouse, with member deposits sized per the risk docs.
• The foil examples (3 and 5) show flows where the mint gatekeeper sits outside the credit perimeter, so the trade runs prefunded and capital idles. That idle capital is the argument for the CCP.

Transfer mechanisms in this project

Every share to token conversion is an ITN mint; every token to share conversion is an ITN redeem. Underneath, the plumbing legs are DVP settlement at DTC, DRS moves at the transfer agent, FOP transfers where a security moves without a linked cash leg, and locates or borrows where the share is not yet owned. Each mint writes a Reg SHO backing attestation onchain: owned share, locate, or borrow.

Read next

Start with 01-vision for why fragmented tokenized settlement needs a netting node, 02-core-concepts for the mechanics, and 04-tours for the five worked examples. The interactive demos replay these flows deterministically at https://ccp.headstreamer.com.

Vision

Problem

The traditional system settles T+1. Tokens settle at T. Every tokenized equity model in production, SPV wrappers, DTCC entitlement tokens, issuer-sponsored TA tokens, resolves the gap by prefunding: the share must exist and be immobilized before the token can move. Prefunding forfeits the two things that make equity market structure capital-efficient: post-trade settlement and centralized netting. Said simply: today there is no way to credit a token now and settle the share later. Until that exists, liquidity cannot flow freely between the two systems.

Why now

For the first time DTC is no longer the single hub for US equity settlement. Tokenized settlement is scattering across venues, chains, and token standards with no NSCC alternative. Without a common netting node, fragmentation is strictly worse than the status quo: each bilateral post-trade arrangement multiplies counterparty exposure and capital superadditively, O(n²) onboarding between every venue, custodian, and broker pair.

Milestones

M1 — Alpaca as settlement agent. Alpaca connects to tokenized ATSs as settlement agent, opens accounts at transfer agents, and plugs the settlement-latency gap directly: credits tokens at T backed by its own locates and borrows, settles the share leg later on whatever rail the token model requires, absorbs the timing gap on its own balance sheet and sec lending book. Bilateral. No novation, no mutualized fund, no new entity. Revenue: ITN transaction fees, stock loan, locate fees, with weekend locates as a segment no traditional prime serves. M1 is also the demand test: if venues will not route settlement through a single agent bilaterally, they will not join a CCP.

M2 — independent CCP entity (parked). The settlement-agent function spins out. Alpaca holds founders equity, does not own the entity, becomes a member on rulebook terms; Arush is CEO; clearing fees at fractions of a basis point. See 10-parked-m2.md.

The M1 → M2 bridge argument

M1's credit-based minting works only where the mint gatekeeper is inside Alpaca's credit perimeter (see 02-core-concepts.md). Rails outside the perimeter, DTCC entitlement and foreign-custodied tokens, remain prefunded under M1, and the simulator deliberately shows that pain. The M2 CCP guarantee is the instrument that extends credit-minting to those rails, because a mutualized clearinghouse undertaking is acceptable to gatekeepers that will not take a single broker's credit. The simulator's foil scenarios are therefore not incidental; they are the M2 pitch.

Core concepts

Two ledgers, two clocks

Every scenario is a bridge between a fast ledger and a slow ledger. Fast ledger: tokens and USDC, settling at T (atomic on RFQ venues, same-day windows on ATSs). Slow ledger: the share leg, settling on whatever rail the token model requires: DRS to a transfer agent register (T+N days, manual), DTC movements (DTCC hours, T+0/1), internal journal at Alpaca (instant, 24/7), foreign delivery to an external custodian (local market hours, T+2 typical). The product is whoever absorbs the gap. In M1 that is Alpaca; in M2 the CCP.

ITN

ITN (Instant Tokenization Network) is the in-kind share↔token swap layer for every token model, not a rail of its own and not SPV-specific. An ITN mint converts shares to tokens; an ITN redeem converts tokens to shares. Under the hood the share leg resolves to one of three instruments depending on where the destination register sits: internal journal if the issuer custodies at Alpaca, FOP through DTC if the issuer custodies at another US prime, DRS if the token is TA-issued and the destination is the transfer agent's register. Product language is always "ITN mint" and "ITN redeem"; journal, FOP, and DRS never surface as feature names. A common earlier confusion, now corrected: ITN is not the fast rail among competing rails; it is the swap interface every rail plugs into, and rail latency is a property of the issuer's settlement path.

The credit perimeter rule

The load-bearing rule of the whole system. Locate-based minting (credit the token now, no share exists yet) is valid wherever the mint gatekeeper sits inside Alpaca's credit perimeter. Two ways in:

1. The issuer accepts Alpaca's settlement-agent undertaking. TA-issued tokens: the transfer agent mints at T against Alpaca's guarantee that the DRS lands at T+N.
2. The issuer custodies at Alpaca. Dinari, Coinbase entitlement tokens, Robinhood's SPV: the mint is Alpaca crediting a token against its own margin logic in accounts it controls, so a locate-backed mint is just an internal credit decision.

Outside the perimeter, DTCC as issuer and GTN as foreign custodian, the gatekeeper demands a settled share delivered before minting. No undertaking, no locate, prefunded only. This is a gatekeeper property, not a token-model property: Dinari (entitlement-style, at Alpaca) supports locate mints; DTCC entitlement does not.

Reg SHO

Every mint carries a backing attestation: owned share, locate, or borrow, written onchain at mint time, auditable. Backing sourcing is the minting member's problem thereafter; a recall against a borrow-backed mint is invisible to the token system because the pending obligation is source-agnostic.

Mint backings

• Borrow: member signs an MSLA with Alpaca, posts 110% collateral (some agreements 120%), pays interest, desk journals shares from lendable inventory to the member's account. Borrows settle only when Loanet and DTCC are open, so market hours only, no weekends.
• Locate: no share moves. The member's account goes short, backed by a locate, consuming Reg T buying-power capacity. ETB names: the ETB list is the locate, no fee. HTB names: the desk charges a locate fee. Works 24/7 including weekends, which is the entire weekend business.
• Owned share: the degenerate case, member already holds the share, pure delivery, no collateral regime.

Weekend policy, frozen: weekends are locate-only. Alpaca could lend from existing inventory up to the firm-wide margin-debit balance, but this is deliberately out of scope for simplicity.

The loan-to-token-borrow conversion

When a borrow-backed mint's DRS lands at the transfer agent (T+N), the outstanding share loan converts automatically to a token borrow: the member's return obligation is thereafter denominated in tokens. Interest and the 110% collateral persist, marked daily. Return paths: redeem tokens through ITN (Alpaca elects to hold the landed token as loan settlement or burn it and DRS shares back), or deliver shares from an external custodian over FOP (the ABN AMRO path), or the desk buys in.

Dimensions

The simulator has exactly three free selectors at the top of every scenario. Each selector derives exactly one property; no property depends on two selectors. Backing availability is constrained by the rail (the validity matrix below), which is a validity constraint, not a dependency between derived properties.

Selector 1: token type × issuer custody (5 values)

Token type alone does not determine the share-leg rail; where the issuer's backing custody sits relative to Alpaca does. Flattening both into one selector keeps values mutually exclusive:

Derived property: share-leg rail, which sets slow-leg latency and the mint window.

Selector 2: mint backing (3 values)

Borrow (MSLA 110%, market hours only), Locate (Reg T capacity, 24/7 where valid), Owned share (no collateral regime). Derived property: collateral regime, which drives the deposit/capacity meter. Session modifier: weekend disables borrow everywhere.

Selector 3: venue (2 values + 1 parked)

Derived property: buying-power gate, the enforcement point for mint authorization: pre-trade off-chain check versus settlement-time cryptographic check on the same underlying margin account.

Frozen validity matrix (backing × rail)

The locate column is the credit perimeter rendered as data: valid exactly where the gatekeeper accepts Alpaca's undertaking or is Alpaca. Scenario space: 5 rails × 3 backings × 2 venues = 30 states minus invalid cells; every valid combination must compose into a coherent step script because steps are modular: authorization (from venue) → collateral (from backing) → ITN mint (always, product-level) → fast-leg settlement (from venue) → slow-leg settlement (from rail) → unwind branch (borrow and locate states only).

Time-varying buying power (entitlement @ DTCC on ATS)

The credit line Alpaca quotes the ATS for a member switches on the clock:

• DTCC hours: BP = settled shares in the member's account in DTC box 3021, owned plus borrowable, mintable just-in-time.
• Outside DTCC hours: BP = tokens already in custody. No undertaking, no credit.

This clock-switching meter is a first-class simulator element (tour 3).

Curated tours

Five deterministic scripts. Each step names the actor, the action, and every ledger line that moves. The site renders one step per viewport with the network graph animating the movement and the meters updating. Unwind branches are user-selectable forks.

Tour 1: Vinyl Equity on Nasdaq ATS, borrow-backed (market hours)

Cast: Wintermute (MM, MSLA signed, also holds shares at ABN AMRO), Alpaca (sec lending desk, DTC box 3021, TA account, settlement agent), Vinyl Equity (TA, dual register: traditional + token), Nasdaq ATS, Buyer at Buyer's SA (external), HyperEVM.

1. T, trade. WNT sells 10,000 tXYZ @ $100 on the ATS. WNT holds no tokens. ATS blotter records; nothing settles.
2. T, borrow. WNT draws 10,000 XYZ under the MSLA, posts 110% = $1.10M (collateral meter starts). Desk journals shares from lendable inventory to WNT's account inside box 3021. Interest accrues.
3. T, mint + DRS. Alpaca instructs DRS of the borrowed shares toward the TA; simultaneously Vinyl mints 10,000 tXYZ against Alpaca's undertaking that the DRS lands. Reg SHO attestation: borrow. Token exists at T; share leg in flight.
4. T, ATS settlement. Alpaca as WNT's settlement agent delivers tokens onchain to the Buyer's SA wallet; USDC returns. Buyer's SA credits its customer internally, off our books. No buyer ever touches Alpaca.
5. T+N, DRS lands. Vinyl traditional register +10,000 (tokenization account); box 3021 −10,000. Share loan auto-converts to token borrow: WNT's return obligation now denominated in tXYZ. Collateral and interest persist, marked daily.
6. Unwind branches (selector):
   • Recall. Lender recalls. Desk sources the street or buys in. Onchain state frozen; the graph shows off-chain churn against an unmoving token ledger, which is the point.
   • ITN redeem. WNT buys back 10,000 tXYZ, redeems through ITN, token lands at the TA. Alpaca elects: hold token as loan settlement, or burn and DRS shares back to 3021. Loan closes, $1.10M releases, meter to zero.
   • FOP return via ABN. WNT delivers 10,000 XYZ from its ABN AMRO account to Alpaca's DTC box free of payment. Loan closes, collateral releases, shares rejoin lendable inventory. Demonstrates: the system clears even when the member's assets never lived at Alpaca. (Earlier confusion, corrected: ABN is an unwind path for the borrower's loan, not a buyer-side custodian.)

Tour 2: Vinyl Equity on Nasdaq ATS, locate-backed (Saturday)

Same trade, tTSLA, weekend. Loanet and DTCC closed; no borrow can settle.

1. Reg T capacity check. TSLA is 2x qualifying: per $100 of collateral in WNT's margin account, $66 of TSLA mintable before margin call. WNT holds $1.65M; capacity $1.089M; mint of $1.0M passes. Capacity meter replaces the MSLA meter.
2. Locate. ETB name: the ETB list is the locate, no fee. HTB variant: desk charges the locate fee, revenue ticking live (the weekend-locate revenue line).
3. Mint. Vinyl mints at T on Alpaca's undertaking. WNT's Alpaca account goes short 10,000 TSLA backed by the locate; attestation written. Tokens to Buyer's SA, USDC in.
4. Weekend mark. Short marked against reference price; margin-call math live. A Sunday TSLA gap shows the call firing before any share can settle anywhere. (Weekend reference pricing is an open question; see 09-open-questions.md.)
5. Monday true-up. Three elections: desk lends (locate converts to settled borrow; collateral regime flips from Reg T capacity consumption to 110% MSLA; DRS proceeds), WNT buys shares, or WNT delivers FOP from ABN. Short flattens, capacity restores.

Tour 3: DTCC entitlement on Nasdaq ATS (the foil)

1. Tuesday 10:00 ET. WNT wants to sell 10,000 eXYZ. Clock formula: DTCC open, WNT holds 6,000 settled XYZ at Alpaca, desk can borrow 4,000, BP = 10,000. Order gated, submitted.
2. Borrow. 4,000 borrowed under MSLA, 110% on the borrowed slice, settled shares in 3021.
3. Mint, prefunded. Alpaca delivers 10,000 settled shares from 3021 to the DTCC tokenization account; DTCC mints 10,000 eXYZ. No undertaking exists anywhere in this flow.
4. ATS settles token against USDC.
5. 20:00 ET. WNT wants 5,000 more. Formula switches: BP = tokens in custody = 0. Order rejected at the gate. Split-screen against tour 1: the identical order minting on a locate at Vinyl.
6. Dinari contrast row, inline. Same custodial mint, same 20:00 order, fills: journal window is 24/7 and the locate cell is open. Isolated variable: the gatekeeper, not custodial minting.
7. Unwind, DTCC hours only: burn eXYZ, shares journal back to 3021, borrow returns.

Tour 4: Robinhood on RFQ, voucher flow

1. Intent. Buyer posts an RFQ for 10,000 rXYZ on a Fusion-style venue.
2. Voucher. Keyrock's bot requests a voucher from Alpaca. Margin logic runs; buying power sufficient; Alpaca signs a voucher for $1.0M of rXYZ mint capacity and debits BP by the same amount.
3. Quote + auction. Voucher rides inside the quote. Keyrock wins.
4. Atomic fill, one transaction. ITN contract verifies voucher signature and unconsumed capacity, mints 10,000 rXYZ to the buyer, moves USDC to Keyrock, marks the voucher spent. No fast-leg settlement window exists to margin.
5. Post-trade share leg. Keyrock's obligation settles by journal: borrowed shares (110% MSLA, weekday) or owned shares moving from Keyrock's account into the SPV custody account at Alpaca, same day.
6. Weekend variant. Same script, locate-backed voucher, Keyrock short 10,000 XYZ against Reg T capacity, Monday true-up elections as in tour 2.
7. Unwind. Buy back tokens, ITN redeem, burn, shares journal out of SPV custody, loan closes, collateral releases.

Tour 5: xStocks foreign name (tASML) at GTN, RFQ

xStocks uses GTN instead of Alpaca for foreign stocks; minting requires delivering the stock to GTN.

1. Sunday. Buyer RFQs 6,000 xASML. No voucher can authorize a mint: gatekeeper is GTN, outside the perimeter; nothing mints without ASML delivered. Keyrock quotes only token inventory, holds 4,000, fills 4,000 atomically, forgoes the rest.
2. Monday, Amsterdam open. Keyrock replenishes: buys or borrows ASML at its European prime, instructs delivery to GTN, Euroclear T+2.
3. Wednesday. GTN confirms receipt; issuer mints xASML to Keyrock's wallet; inventory restored.
4. Running meter: idle capital. Tokens held against future RFQs plus shares in transit, both financed, neither earning.

Punchline of the pair {3, 5}: both perimeter-external rails force prefunding, one gated by DTCC hours, one by foreign settlement latency; those balances are exactly what an M2 CCP guarantee converts from prefunded inventory into credit.

Collateral, buying power, meters

MSLA borrow regime

Borrow-based mints require a Master Stock Lending Agreement between the MM and Alpaca. Deposit: 110% of loan market value (some agreements 120%; simulator default 110%), posted at draw, marked daily, released at return. Interest accrues to Alpaca for the life of the loan, including after the loan converts to a token borrow at DRS landing. This deposit is the M1 collateral cost the M2 CCP later attacks (see 10-parked-m2.md).

Reg T locate regime

Locate-based mints consume margin buying power; no share moves. For a 2x qualifying stock (TSLA-class): per $100 of collateral in the account, $66 of stock mintable before margin call. The account goes short, backed by a locate, marked continuously. ETB names: the ETB list is the locate, free. HTB names: desk-priced locate fee, an Alpaca revenue line, largest on weekends when no other prime serves the flow. Open question: whether the $66 per $100 line is both initial capacity and the maintenance call line, or whether maintenance is a separate threshold to render distinctly (see 09-open-questions.md; default: single line).

Buying-power gates by venue

ATS (pre-trade credit gate). Alpaca runs the margin computation internally and communicates to the ATS the credit it honors per member. The ATS fills any order Alpaca submits. Authorization is complete before order submission; nothing onchain enforces it.

RFQ (voucher). The MM's bot requests a voucher from Alpaca; issuance debits buying power by the voucher's capacity; the voucher (signed) rides inside the quote; the ITN smart contract validates signature and unconsumed capacity at mint, inside the atomic fill, and marks it spent. Same margin account and same margin logic as the ATS gate; the enforcement point moves from pre-trade off-chain to settlement-time cryptographic.

Entitlement @ DTCC on ATS (clock-switching gate). DTCC hours: BP = settled shares in box 3021 (owned + borrowable, mintable just-in-time). Outside DTCC hours: BP = tokens in custody. Render as a formula that visibly switches at the clock boundary.

Meters the site must render

1. MSLA collateral meter: posted deposit, loan MTM, 110% line, daily marks.
2. Reg T capacity meter: collateral value, consumed capacity, remaining capacity, margin-call line; weekend marks against reference price.
3. Voucher ledger: issued vouchers, capacity, spent flags.
4. Clock BP meter (tour 3): the switching formula with a visible session boundary.
5. Idle capital meter (tour 5): token inventory MTM + shares in transit MTM, both financed.
6. Locate revenue ticker (tours 2, 4 weekend variants): HTB locate fees accruing to Alpaca.

Simulator website specification

Concept

One website. Top-level navigation selects the scenario. Within a scenario, a scroll-driven narrative: each step owns a full viewport; scrolling advances the action and the settlement clock. The pedagogy is ledger-first: at every step the user sees exactly which ledger lines moved at which party, and why, with enough screen real estate to explain it. This is the design's center of gravity; visual polish serves it.

Per-step layout

• Narrative panel: what just happened, which ledger lines moved, why. Dense prose, short sentences.
• Network graph: the parties and their internal ledgers, animating the movement for this step.
• Running ledger tables: per-party balances updating step by step.
• Meters: persistent top-right; the set active depends on the scenario's collateral regime (see 05-collateral.md).
• Settlement clock: current time, session state (market hours / after hours / weekend / DTCC open-closed / Amsterdam open-closed), and in-flight items with their expected landing.

Scenario selection

Two layers. Curated tours (the five in 04-tours.md) as the primary nav, each a named story with real companies. Behind them, an advanced selector exposing the three dimensions (rail × backing × venue) with invalid cells disabled per the frozen validity matrix in 03-dimensions.md; any valid combination composes a step script from the modular step library: authorization → collateral → ITN mint → fast-leg settlement → slow-leg settlement → unwind.

Network graph (replaces hub-and-spoke)

A graph with multiple hubs, not a star. Nodes and their internal structure:

• DTCC: Cede & Co; participant boxes rendered as sub-ledgers: Alpaca's box 3021 (with per-member sub-accounts: Wintermute, Keyrock), ABN AMRO's box, the DTCC tokenization account.
• Transfer agent (Vinyl Equity): dual register, traditional and token program, side by side.
• Alpaca hub: lendable inventory, sec lending book (loans, interest, collateral), member margin accounts (with short positions and locates visible), SPV/issuer custody accounts (Robinhood, Dinari), TA account.
• HyperEVM: SA wallets, ITN contract, mint contracts, voucher registry.
• Venues: Nasdaq ATS blotter; RFQ auction.
• GTN (tour 5): foreign custody, with the Euroclear in-transit lane.
• Buyer's SA: opaque external node; internal crediting explicitly off our books.

Asset rendering, distinct at a glance: share certificates, token chips, borrow lines (dashed, interest-labeled), locate badges, collateral blocks, vouchers, USDC. In-flight instruments (DRS, FOP, Euroclear delivery) render as items moving along a lane with a landing ETA, because in-flight-ness is the product's core subject.

Determinism

Scripts are hand-authored, not generated. Every demo run is identical. The earlier React simulator prototype (seeded synthetic tape, NSCC Procedure XV comparator, rail toggle) is an M2 artifact and is out of scope for this site; do not merge the two.

Design notes

• Real names everywhere; the cast per scenario is fixed in 08-cast.md.
• Copy style: dense, direct, no filler, no em dashes.
• Tabular numerals for all figures; money formatted $1.10M style.
• The foil moments (tour 3 step 5's rejected order, tour 5's idle-capital meter) deserve deliberate visual weight; they are the argument.
• Mobile: the scroll narrative must degrade gracefully; meters collapse to a sticky summary bar.

Suggested stack

Static site, React, scroll-triggered steps (IntersectionObserver or a scrollytelling library), SVG for the network graph with CSS/JS transitions keyed to step index. No backend; all state is the deterministic script. Deploy anywhere static.

FAQ / corrections wiki

Every entry below is a misconception that actually occurred during design, with the correction. Read these before touching anything; they are the highest-density context in the folder.

Q: Is ITN one of the settlement rails, competing with DRS and DTCC entitlement? No. ITN is the in-kind share↔token swap layer for every token model. Rail latency is a property of the issuer's settlement path underneath the swap, not of ITN. The earlier three-rail simulator treated "ITN in-kind" as a rail; that was the special case where both legs sit at Alpaca and the journal makes the swap instant.

Q: What do we call the share leg when the issuer custodies at Alpaca? JNLS? It is an "ITN mint" (or "ITN redeem") in all product language, even though it is a journal under the hood. JNLS, FOP, DRS are plumbing terms and never appear as feature names.

Q: Is ABN AMRO the buyer's custodian in the external-settlement scenario? No. The buyer's side is handled by the buyer's own settlement agent receiving tokens onchain; that is ordinary tour 1. ABN enters as an unwind path: Wintermute, though an Alpaca ITN customer, closes its borrow by delivering shares from its ABN account to Alpaca over FOP. The lesson: the system clears even when the member's assets never lived at Alpaca.

Q: Is the RFQ's atomicity the structural difference from the ATS? Partly, but the deeper difference is where the buying-power gate lives. ATS: Alpaca gates pre-trade, runs margin logic internally, tells the ATS the credit it honors, and the ATS fills anything Alpaca submits. RFQ: the MM's bot mints a voucher from Alpaca that consumes buying power; the voucher rides in the quote and the ITN smart contract validates it at mint inside the atomic fill. Same margin account, two enforcement points: pre-trade off-chain versus settlement-time cryptographic.

Q: Does the share settle atomically in the RFQ flow too? No. The token mints atomically with the RFQ fill; the share settles post-trade from the MM's Alpaca account to the issuer (journal if issuer at Alpaca, FOP if at an external prime, DRS if TA-issued). The post-trade share can itself be borrowed or locate-backed.

Q: Is locate-based minting only possible on the TA-issued rail? No, an earlier over-narrow claim. The correct rule is the credit perimeter: locate mints are valid wherever the mint gatekeeper accepts Alpaca's undertaking (TA-issued) or custodies at Alpaca (Dinari, Coinbase entitlements, Robinhood SPV). Only DTCC-as-issuer and external custodians like GTN require settled shares. It is a gatekeeper limitation, not a token-model limitation.

Q: Where does Dinari custody? At Alpaca. Dinari is the entitlement-at-Alpaca case: custodial mint, journal rail, 24/7 window, locate mints valid. The entitlement-at-external example is DTCC's own tokenization program.

Q: What is the external-custodian SPV example? xStocks foreign names at GTN, which xStocks uses instead of Alpaca for foreign stocks. Minting a foreign xStock requires delivering the stock to GTN over foreign rails (Euroclear, T+2 typical, local market hours).

Q: Can members borrow on weekends? No. Loanet and DTCC are closed; no borrow settles. Alpaca could lend from existing inventory up to the firm-wide margin-debit balance, but policy keeps weekends locate-only for simplicity.

Q: What are the buying-power rules for DTCC entitlement tokens on an ATS? There is no ability to mint unbacked; a settled share must be delivered to box 3021 first, and DTCC mint/redeems happen only in DTCC hours. So the ATS credit line switches on the clock: settled shares (owned + borrowable) during DTCC hours, tokens-in-custody only outside them. Weekend sell capacity on this rail is whatever token inventory the member prefunded.

Q: What happens to a borrow-backed mint when the DRS lands? The share loan auto-converts to a token borrow. Return obligation re-denominates in tokens; interest and 110% collateral persist. Returns: ITN redeem (Alpaca elects to keep the landed token or burn and DRS shares back), FOP delivery from an external custodian, or buy-in.

Q: What happens if the lent share is recalled while the DRS is in flight? Nothing, at the token layer. The mint stands, the DRS stands; Alpaca's sec lending desk has a borrow need and sources it per normal ops. The pending obligation is source-agnostic. The simulator shows off-chain churn against a frozen onchain state deliberately.

Q: What is the Reg T locate math? For a 2x qualifying stock: $66 mintable per $100 of account collateral before margin call. ETB list is the locate (free); HTB locates are desk-priced (fee revenue, biggest on weekends).

Q: Whose collateral numbers are these, and do they survive into M2? The 110% MSLA deposit and Reg T consumption are M1 bilateral constructs. Whether the CCP still needs them, or replaces them with net portfolio margin (OCC stock-loan-program precedent), is the central M2 economic question, parked in 10-parked-m2.md.

Q: Are the buyer-side mechanics in scope? No. Buyers sit at their own settlement agents; internal crediting there is explicitly off our books in every tour.

Cast

Real names only. Assignments below are fixed per tour; the wider lists are the pool for future scenarios and member-facing materials.

Fixed tour assignments

Pools

• SPV-wrapped issuers: Ondo, Kraken xStocks, Binance bStocks, Robinhood.
• Entitlement / custodial issuers: DTCC, Dinari dShares, Coinbase, Oasis Pro.
• TA-issued: Vinyl Equity, Equiniti, Computershare, Securitize, Superstate, Broadridge.
• Market makers minting/redeeming: Wintermute, IMC, DRW, Flow Traders, Flowdesk, Tokka Labs, Elk Capital, Keyrock, Virtu, Citadel, Susquehanna.
• Venues: Nasdaq tokenized ATS, NYSE tokenized ATS, 1inch Fusion, 0x, CowSwap, li.fi; DEXs parked.
• External custodians appearing: ABN AMRO (MM's outside share source), GTN (xStocks foreign custody).

Alpaca internals that appear as graph sub-ledgers

Sec lending desk (lendable inventory, loan book, collateral), DTC box 3021 with per-member sub-accounts, member margin accounts, SPV/issuer custody accounts (Robinhood, Dinari), transfer agent account at Vinyl, ITN (mint/redeem orchestration, voucher issuance and registry).

Open questions and working defaults

Do not silently resolve these differently. Defaults are safe to build with; flag any step where the default visibly matters.

1. Reg T maintenance line. Is $66 per $100 (2x stock) both the initial capacity and the margin-call line, or is maintenance a separate threshold to render distinctly? Default: single line.
2. Weekend reference pricing. Locate-backed weekend shorts are marked against what price when primary markets are closed? Friday close plus a volatility add-on, wider haircuts, or something else. Default: Friday close, and tour 2 step 4 should visually flag the price source as an open design question.
3. Owned-share backing in the selector. Kept as the tutorial base case, or cut to preserve the clean two-mint-type (borrow/locate) framing? Default: kept, presented as the degenerate case.
4. DRS destination account (tour 1 step 3). Does the DRS name the TA's tokenization omnibus or a member-designated account at the TA? Changes the registered holder during T+N. Default: tokenization omnibus.
5. MSLA percentage. 110 vs 120 by agreement. Default: 110% everywhere in the demo.
6. DEX venue. Parked for M1; its gate would be the open-source Reg T margin smart contract, an M2 artifact. Confirmed parked.
7. Voucher expiry/partial-fill semantics. Unspent or partially spent voucher capacity: TTL, revocation, partial consumption across multiple fills. Not yet designed. Default: single-use, full-capacity-or-void, short TTL; keep the graph simple.
8. Weekend inventory lending. Alpaca can lend from existing inventory up to the firm-wide margin-debit balance, but weekends are locate-only by policy for simplicity. Decided; recorded here because the capability exists and may return.

M2: the CCP entity (parked context)

Out of scope for the M1 simulator site; load-bearing for framing, copy, and the foil scenarios. Do not build M2 features without an explicit go.

Structure decided

Independent clearing entity spun out of the M1 settlement-agent function. Alpaca holds founders equity, does not own the CCP, becomes a member on the same rulebook terms as everyone; Arush Sehgal is CEO. Independence is the product: a CCP captured by one broker-dealer never clears its competitors' flow, and neutrality is a precondition for §17A treatment. Clearing fees at fractions of a basis point; the CCP monetizes scale and float, not spread. Rulebook drafted by the new entity; it carries what code cannot (guaranty-fund assessment authority over members). Membership open: comply with Reg T margin (or adopt the published open-source margin contract for onchain venues), post the deposit, admission automatic. Foreign CSDs and Euroclear members eligible.

Mechanics designed (earlier sessions)

• Novation at trade capture gives netting its legal basis; a middle path guarantees the DRS leg to TAs without novating market legs.
• Member bears buy-in and recall risk; every mint Reg SHO-backed with onchain attestation.
• Two-ledger CCP: fast ledger settles 4-hour cycles with atomic DVP; slow ledger is a per-member per-CUSIP signed share obligation, netted, instructed at EOD, in-flight never cancelled, reversals absorbed by CCP inventory held at the TA.
• Deposits: fast-leg VaR (z·σ·√cycle on intra-cycle net) + slow-leg VaR (z·σ·√latency on pending MTM) + HTB add-ons; fund sized cover-1 under stress. The deposit advantage over NSCC is a monotone function of mint/redeem rail speed.
• NSCC comparator: Procedure XV defensible-faithful core (99% VaR √3 MPOR, 10% gap floor, illiquid add-on, $250k minimum), with backtesting charge, MLA fine structure, and portfolio covariance deferred until real trade-tape calibration.
• A React prototype of a multi-member netting simulator with a seeded synthetic tape and rail toggle exists from earlier sessions; it is an M2 artifact, separate from the M1 scroll site.

The central M2 economic question

M1's borrow collateral is bilateral and gross: 110% MSLA per loan. Under a CCP, exposure novates and the CCP margins the member's net portfolio (settlement obligations plus open token borrows, cross-margined) at VaR-based rates; OCC's stock loan program is the precedent. The M2 headline is 110% gross bilateral collateral collapsing into single-digit-percent net portfolio margin, on top of the netting of settlement flows. Whether any MSLA-style deposit survives at all is undecided.

Open M2 decisions (from the PRD)

Novation at v1 versus guarantee-the-DRS-leg-only versus netting-service-first (none escape §17A; netting and facilitating deliveries fall inside the clearing agency definition). Exemption with self-drafted conditions filed first, full registration track in parallel, recommended sequencing. Cash leg: USDC default, issuer-risk-at-the-node concern, alternatives listed. Weekend reference pricing. Multi-chain custody gating. All in the internal PRD, which Arush holds in edited form.

The M1 → M2 sales bridge

Tours 3 and 5 of the M1 site show prefunded rails (DTCC hours gate, foreign delivery latency) as running meters of dead capital. The M2 pitch is that a mutualized CCP undertaking is the instrument gatekeepers outside any single broker's credit perimeter will accept, extending credit-minting to exactly those rails. The foil scenarios are the M2 pipeline.

M2 demonstrator: design and collateral analysis

Status: DRAFT. Designed 2026-07-08 in a working session; not yet reviewed against the internal PRD. Extends 10-parked-m2.md under an explicit go from Arush. Nothing here changes M1 scope.

What the demonstrator shows

One trading day for one broker-dealer member (Wintermute), cleared four ways. Same trades, same clock, same ledgers. The only thing that changes across modes is the collateral regime, and the star of the page is Wintermute's deposit meter.

Controls: play button (auto-advance), pause, previous/next step, step scrubber, collateral regime selector. Every party's running ledger is visible at every step, as on the M1 examples.

The tape (deterministic, all modes)

The four collateral regimes

1. M1 bilateral (baseline)

110% cash per loan, gross, marked daily. Deposit path: $1.10M after trade 1, $1.76M after trade 3, $1.85M after the +5% mark. Never releases while the token borrows stay open. Sunday: Loanet and Fedwire closed, nothing moves.

2. CCP, cash margin

Novation at capture, margin on the member's net obligation: fast-leg VaR (z·sigma·sqrt(cycle)) plus slow-leg VaR (z·sigma·sqrt(latency)) plus HTB add-on (zero here, ETB name). Illustrative rate ~7% of net MTM with sigma 2%/day, z 2.33. Peak deposit $0.09M against the M1 peak of $1.85M. Releases at delivery. Sunday: margin is bank cash; Fedwire is closed; the new order is gated until Monday. Cover-1 default fund contribution stands ($0.02M).

3. CCP, pledge at the member's custodian ("within the net")

Answering: can the MSLA deposit go away entirely if the member's inventory sits at ABN AMRO?

Yes, under the CCP, structurally like this:

• The CCP rulebook standardizes a tri-party control agreement with accepted custodians (ABN AMRO, Euroclear members). The member pledges specific inventory to the CCP; the custodian blocks it; no rehypothecation.
• The pledged asset counts against the member's net delivery obligation. Same-CUSIP pledge: the pledge IS the deliverable, pre-positioned. Price risk on the obligation and on the collateral cancel. The share is FOP'd to the CCP box next day and flows onward; the pledge extinguishes on landing.
• Cash deposit: zero. What survives: the default-fund contribution and a haircut covering the one real residual, enforcement lag. Foreclosing a pledge at a custodian on a defaulted member takes a day or two of process, and cannot happen at all outside custodian hours.
• Why this does not work bilaterally at scale: every broker would need its own control agreement with every custodian per member (the O(n²) again), and a single broker's credit committee has no mutualized fund behind the enforcement gap.

Sunday behavior: pledge notices are contractual paperwork and can be accepted on a Friday-verified balance, so the mint can clear on the guarantee; but enforcement waits for Monday and the fund covers the window. Flag this as a rulebook decision.

4. CCP, tokenized collateral in escrow (2-of-3 multisig)

The pledge with the enforcement lag removed.

• Collateral is tokenized (tokenized treasuries for margin, or tokenized inventory) and sits in an onchain escrow with three keys: member, CCP, arbitrator. Normal release: member + CCP co-sign, automated on delivery confirmation. Dispute or default: the arbitrator holds the casting vote, so CCP + arbitrator can move collateral against a defaulted or unresponsive member, and member + arbitrator can move it against a CCP error.
• Enforcement is cryptographic and instant: no custodian hours, no foreclosure process, no weekend gap. This is what makes Sunday margin possible at all: the member posts tokenized collateral in seconds and the Sunday RFQ fills.
• Legal note to verify with counsel: 2022 UCC Article 12 control of controllable electronic records should map onto multisig possession; characterization matters for perfection.
• Open items: arbitrator selection and governance (rulebook arbitration panel), oracle for delivery confirmation, smart contract risk, segregation treatment of member property held in escrow, valuation haircuts on tokenized collateral.

The headline the demonstrator lands

Same day of trading: $1.85M locked indefinitely (M1) versus $0.09M released next morning (CCP cash) versus $0 cash with inventory doing the work (pledge) versus $0 cash and the weekend served (escrow). The deposit collapse is the M2 pitch; regimes 3 and 4 are the answer to whether any MSLA-style deposit survives: as cash, no; as a haircut plus a default-fund contribution, yes.

Illustrative numbers, fixed for determinism

XYZ $100. Sigma 2%/day. z 2.33 (99%). Cycle 4h. Slow-leg latency 1 day. Margin rate ~7% of net MTM. Default fund contribution $0.02M standing. Wintermute inventory at ABN: 15,000 XYZ. All figures are demonstrator placeholders, not calibrated; calibration on real trade tape is deferred per 10-parked-m2.md.

Rulebook skeleton

Status: DRAFT skeleton, 2026-07-08. Article headings and one-line scopes only. The rulebook is drafted by the new entity; it carries what code cannot. Not legal advice; counsel drafts the real one.

Article I. Definitions

Member, clearing fund, margin, obligation, cycle, slow leg, ITN mint, ITN redeem, backing attestation, pledge, escrow, arbitrator.

Article II. Membership

Open admission: margin compliance (Reg T, or adoption of the published open-source margin contract for onchain venues), deposit posted, adherence signed. Admission automatic on completion. Foreign CSDs and Euroclear members eligible. Withdrawal and wind-down notice periods.

Article III. Novation

The clearinghouse becomes counterparty at trade capture on connected venues. Open decision, recorded: novation at v1 versus guarantee of the DRS leg only versus netting-service-first. All three sit inside the clearing agency definition; the choice is commercial, not jurisdictional.

Article IV. Settlement

Fast ledger: 4 hour cycles, atomic delivery against payment, net. Slow ledger: one signed per-member per-CUSIP obligation at end of day. In-flight instructions are never cancelled; reversals absorbed by clearinghouse inventory at the transfer agent.

Article V. Margin

Fast-leg VaR plus slow-leg VaR plus HTB add-ons, on the net. Calibration on real trade tape. Intraday calls. Acceptable forms: cash, pledged securities under a control agreement at an accepted custodian, tokenized collateral in the standard 2-of-3 escrow.

Article VI. Collateral regimes

Control agreement terms per custodian. Escrow contract address per chain. Weekend pledge notices against last-verified balances: accepted or not, and on what haircut. This is the open weekend-enforcement question; the fund covers the gap if accepted.

Article VII. Guaranty fund

Risk-based contributions. Sized cover-1 under stress. Investment policy for fund assets. The deposit earns; the entity monetizes scale and float, not spread.

Article VIII. Default management

Declaration triggers. Waterfall: defaulter margin, defaulter fund contribution, clearinghouse capital tranche, mutualized fund, capped assessments (proposed ordering). Close-out and hedging authority. Escrow seizure procedure: clearinghouse plus arbitrator keys.

Article IX. Assessments

Authority to assess surviving members, capped. Timing and notice.

Article X. Backing attestations

Every mint attested onchain at mint time: owned, locate, or borrow, with source reference. Buy-in and recall risk stays with the minting member.

Article XI. Arbitration

Standing panel. The panel's key is the third key in every member escrow; it signs only when member and clearinghouse disagree, and its onchain signatures are the audit trail of every dispute.

Article XII. Amendments

Rule filing process tracks the regulatory posture: while exempt, notice and comment to members plus the Commission's exemption conditions; if registered, 19b-4 rule filings.

Regulatory pathway

Status: DRAFT for design discussion, 2026-07-08. Not legal advice. Extends 10-parked-m2.md, which records the strategic choice: exemption application with self-drafted conditions first, full registration track in parallel.

Why §17A applies

Exchange Act §3(a)(23) defines a clearing agency to include anyone who acts as an intermediary in making payments or deliveries in connection with securities transactions, or who provides facilities for comparison and netting. Netting settlement obligations and facilitating deliveries both sit squarely inside the definition. None of the three service models under consideration (novation at v1, DRS-leg guarantee only, netting-service-first) escapes it. Tokenized equities are still equities.

The two tracks

Track A, first: exemption under §17A(b)(1) and §36. The Commission may conditionally or unconditionally exempt a clearing agency from registration. File an application with self-drafted conditions: volume caps, member eligibility limits, reporting undertakings, fund sizing commitments, wind-down plan. Precedent exists for conditional clearing agency exemptions. This gets a working, supervised entity years earlier and generates the operating record the full registration wants.

Track B, parallel: Form CA-1 registration as a covered clearing agency. The long pole. Standards below apply in full. The exemption record becomes the exhibit file.

Rule 17Ad-22(e) mapped to the design

The covered clearing agency standards, and where this design already answers them. DRAFT mapping for discussion.

Adjacent regimes

• Reg SHO. Every mint carries an onchain backing attestation: owned, locate, or borrow. Rule 204 close-out timelines map onto slow-leg landing times; fails surface on the attestation registry rather than in a reconciliation.
• Reg T. Member margin compliance is an admission requirement; onchain venues can adopt the published open-source margin contract instead.
• 15c3-3. Member property in escrow: possession-or-control analysis for tokenized collateral held under a 2-of-3 contract where the member cannot move funds unilaterally. Needs counsel; the control agreement analog is the argument.
• UCC Articles 8 and 12. The 2022 amendments recognize control of controllable electronic records. The multisig escrow's key arrangement is the control; perfection follows. State adoption status matters for choice of law.
• Cash leg. USDC default per the PRD, with the issuer-risk-at-the-node concern recorded. Alternatives (deposit tokens, tokenized MMFs, Fed-adjacent rails) stay open.

Sequence, illustrative

1. Pre-filing meetings with the Division of Trading and Markets. Bring the demonstrator; the deterministic replay is the point.
2. Exemption application: conditions self-drafted, M1 operating data attached as the demand evidence.
3. Comment period and condition negotiation.
4. Exempt operations begin: volume-capped, reporting live.
5. Form CA-1 filed in parallel, exhibits built from the exempt operating record.
6. Full registration; conditions sunset.

The onchain clearinghouse: HyperEVM as master ledger

Status: DRAFT architecture, 2026-07-09. Design only; no implementation yet. Extends 10-parked-m2.md and 11-m2-demonstrator.md.

The idea in one paragraph

HyperEVM hosts the master ledger. Collateral and settlement assets sit in CCP-controlled escrows on whatever chain they natively live on (Ethereum, Base, Solana, others) and at off-chain custodians (ABN AMRO, Euroclear members). Assets never cross chains. The only thing that crosses chains is authority: proof that the master ledger recorded a settlement as final. Spokes obey the hub.

The load-bearing distinction: authority moves, assets do not

This is not a bridge. There is no lock-and-mint, no wrapped assets, no pooled liquidity. A compromised authority channel can at worst trigger a wrongful release on one spoke, bounded by that escrow's balance and its rate caps. It can never inflate supply. Most of the catastrophic bridge failure modes are absent by construction.

Components

1. ClearingLedger (HyperEVM, the hub). The book of record:

• Novation book: obligations recorded at trade capture. Member positions stored as salted commitments, not plaintext. The public ledger shows roots and aggregates; plaintext lives with the CCP, the member, and the regulator. Selective disclosure, because no market maker will tolerate its net short being public.
• Cycle engine records: every 4 hours the fast leg nets and settles atomic DVP on HyperEVM itself (tokens and cash live here natively; this is the one place assets and ledger share a chain).
• Obligation lifecycle: open, netted, instructed, FINAL, or DEFAULTED. Finality marks come from slow-leg oracles: transfer agent DRS confirmations, custodian FOP confirmations.
• Settlement tickets: on FINAL (or DEFAULTED), the ledger records a ticket, the validation code. Fields: hub chain id, hub ledger address, spoke chain id, spoke escrow address, obligation id, kind (release or seize), beneficiary, amount, single-use nonce, expiry. Bound to exactly one escrow on one chain, so no cross-spoke replay.
• Hash-chained ledger root: every record advances one running commitment. The daily root is the audit artifact: file it, replay the day deterministically, reproduce it.

2. Authority transport (the only thing that crosses chains). A contract cannot sign; it records. Signatures or proofs attest to what it recorded:

• v0, attestor quorum: a 2-of-3 set (CCP operational key, the arbitrator, an independent auditor) watches finalized HyperBFT blocks and co-signs the exact ticket bytes the hub recorded. The CCP alone cannot release anything the ledger did not record. This is the escrow's casting-vote arbitrator generalized cross-chain, and it is the property a regulator wants: the ledger is the control, no unilateral operator power.
• v1, zk state proof: the spoke verifies a proof of the hub contract's storage under HyperBFT finality (SP1 or Helios-class light clients). No signer exists at all. Same ticket format, swap the verifier module, no escrow migration.
• The verifier on each spoke is a module chosen per escrow, upgradeable only by member plus CCP under timelock. General message buses (LayerZero, Hyperlane, CCIP) can be one more verifier implementation; do not marry one.

3. Spoke escrows (any chain). Hold member collateral in native assets. redeem(ticket, proof) checks: this chain, this escrow, the expected hub, unexpired, unused nonce, quorum or proof valid; then transfers to the beneficiary (member on release, CCP recovery on seizure) and burns the nonce. Each escrow keeps the human 2-of-3 (member, CCP, arbitrator) as the manual fallback: business continuity if the hub or the channel halts, with post-hoc reconciliation under the rulebook.

4. Off-chain custody, same rail. The control agreement at ABN or a Euroclear member names "a ticket signed under the hub root" as the standard release instruction. One authorization format serves onchain escrows and SWIFT-side custodians. The pledge regime and the escrow regime unify under one ledger.

5. Reconciliation loop. Spoke Redeemed receipts and custodian confirmations relay back to the hub, which closes records and advances the root. A keeper posts spoke balance attestations; divergence between hub-expected and spoke-actual pauses new tickets for that spoke.

One cycle, end to end

1. Trades novate at capture; the hub records commitments.
2. Every 4 hours the fast leg nets and settles atomic DVP on HyperEVM.
3. End of day, the slow leg nets to one signed obligation per member per asset: instructed.
4. The slow leg lands; the oracle confirms; the hub marks FINAL and advances the root.
5. The hub records release tickets for the margin securing those obligations, wherever it sits.
6. Attestors co-sign the finalized tickets; anyone (usually the member's bot) redeems on each spoke; collateral releases. Default path identical with seize tickets to CCP recovery.
7. Receipts reconcile back; the daily root closes; the root is the regulatory filing.

Failure containment

• Quorum compromise: per-spoke daily release caps, per-ticket amount ceilings, short expiries, large releases routed through an optimistic delay window with veto. Upgrade path to zk proofs removes the quorum entirely.
• Hub or channel halt: the manual 2-of-3 on each escrow keeps collateral movable; rulebook governs reconciliation after.
• Spoke chain halt: obligations against that spoke pause; the guaranty fund covers the gap exactly as it covers custodian enforcement lag in the pledge regime.
• Finality discipline: attestors sign only HyperBFT-finalized state. Single-slot finality is why HyperEVM can hold the hub role at all; there is no reorg ambiguity to attest around.

Why HyperEVM is the hub

Deterministic single-slot finality for the attestation predicate, low latency for 4 hour cycles, and colocation: the fast-leg venues and the ITN mint rails already live there. The ledger sits where the fastest settlement happens; everything slower hangs off it.

Regulatory mapping

17Ad-22(e)(8) settlement finality: finality is a recorded, timestamped, replayable state transition on the hub. (e)(17) operational risk: the deterministic replay reproduces the root bit for bit. The rulebook designates the hub as the official books and records (UCC Article 8 securities intermediary analysis); spoke escrows are control under Article 12. Daily root filed under the exemption's reporting conditions.

Open questions

1. Attestor set composition and rotation; whether the auditor seat is a firm or a foundation.
2. zk light client maturity on HyperBFT; timeline for v1.
3. Optimistic window parameters: threshold amount, delay, who can veto.
4. Non-EVM spokes: canonical ticket byte layout that Solana programs verify cheaply (ed25519 quorum variant).
5. Privacy: commitment scheme details, and whether regulators get a standing view key or per-request disclosure.
6. Whether the fast-leg cycle itself ever moves off 4 hours, and what that does to margin.