Transaction Lifecycle
From Intent to Proof
A transaction inside StratX is not processed — it is governed. Every step is policy-bound, auditable, and fail-closed. What follows is the complete path of a single instruction through the supervisory control plane.
The Intent
Bob makes a purchase. Somewhere, a structured instruction is formed — a description of what should happen, who authorized it, and under what conditions. Before anything else occurs, the orchestration engine validates that instruction completely: schema conformance, source authentication, duplication check.
A malformed or unauthenticated instruction never reaches the decision layer. The intent is either well-formed or it does not exist.
The Rules
StratX does not decide what is permissible. That decision was made before this transaction — by the institution's compliance team and the applicable jurisdictional authority — and encoded into a versioned, signed policy file.
At this gate, the instruction is evaluated against those rules. Three checks run: jurisdiction, sanctions screening, authorization tier. StratX enforces the outcome. It does not interpret, override, or negotiate it.
The Options
The orchestration engine identifies available corridors. It does not pick the fastest or cheapest route first — it eliminates non-compliant corridors first. What remains is a set of corridors that all satisfy the policy constraints.
From those, the institution's own directive determines the selection: a deterministic, policy-bound function that produces the same output for the same inputs every time. There is no hidden preference. There is no optimization that operates outside policy bounds.
The Confirmation
Route selection and rail health are evaluated separately by design. A corridor that was healthy at selection time may have degraded by dispatch time. SCADA confirms the selected corridor's current state — latency, availability, anomaly signals — immediately before handoff.
If the corridor has degraded, the transaction halts. Not reroutes. Halts. A partial execution on a compromised corridor is a worse outcome than no execution.
The Boundary
The authorized instruction reaches the execution boundary. This is where StratX's role ends. The system dispatches the instruction to the selected rail — it does not execute it. Execution requires the institution's own signing authority: hardware-backed, institution-controlled, outside StratX's administrative domain.
StratX holds no keys. It signs nothing. It cannot move value unilaterally. The boundary is structural, not contractual.
The Record
Every decision produces a proof. Approved or denied, executed or halted — the outcome is immutably recorded. The proof carries the policy hash that governed the decision, the decision outcome, and a timestamp. It is anchored to an independent target.
A transaction without a proof is not considered complete. The audit record is not a feature — it is a system invariant.
The Oversight
The proof is immediately accessible to authorized regulatory observers through the Regulatory Interface Module. The RIM is a read-only surface — it has no mutation endpoints by design. A regulator with RIM access can verify the policy that governed the decision, retrieve the proof artifact, and confirm the outcome.
They cannot modify any of these things. They cannot access the execution layer. Oversight without control is not a limitation — it is the correct architecture for a non-controlling regulatory surface.