Volume 02 · Build Book · NASD Next Gate Series
NASD PLC NASD NEXT · GATE SERIES
~ / Home 0.0 / Strategy 0.1 / Launch 0.2 / Build 0.3 / Run 0.4 / Resolve 0.5 / Laws ⌕ Search ✎ Review
ISSUER INTELLIGENCE
what a listed CEO sees at login
847 people viewed your company profile this week 124 investors added your company to their watchlist 23 institutional investors downloaded your annual report Investor interest is up 18% after your earnings announcement 4 pension funds have shown repeat engagement with your profile Your rights issue is currently 64% subscribed Your liquidity score has improved this month AIRecommends publishing an investor update — engagement has increased significantly
VOLUME 02 OF 06 · BUILD BOOK

Objects and contracts: the build specification

v2 · 22 Jul 2026 · read after Volume 01 · canonises the tiered-attestation correction · companions: 01, 03, 04, 05
THE LOGIC WE ARE AIMING FOR

This is the map of the entire build at substrate depth. One object carries the truth, contracts distribute the liability, and the regulator's own caps underwrite every instant decision. The exchange and credit layers stand on the interfaces this book defines; their internals live in their own canonical documents.

Below: what the substrate serves upward (the interface contracts), the build order and why, the five decisions to lock before code, and the module reference. Layer map and governance: Gate Series 01.
HOW TO THINK ABOUT BUILDING IT

Build in dependency order, not feature order

The temptation is to build what demos well. The discipline is to build what everything else stands on. Five stages; each is shippable and each makes the next one honest.
1
Object store + provenance chain firstThe append-only, hash-chained event store and the object schema. No UI, no brokers, no wallet. Done when: an event written can never be edited, a read writes an event, and the chain verifies against a computed root.WHY THIS ORDER · every later module writes here; retrofitting provenance is archaeology
2
Attestation machinery secondSnapshot binding, broker key registration, the L1 auto-attest path under panel authority, the material-field void list. Done when: a broker key signs over hash #h, a name change voids it, and an ordinary append does not.WHY THIS ORDER · attestation is the legal spine; hooks and wallets hang off a signed snapshot
3
Consent hooks third, enforced at the endpointGrant tokens with scope, purpose and legal basis; the evidence API refuses without one; every pull ledgered. Done when: a pre-hook fetch attempt produces a refusal event, not data.WHY THIS ORDER · hooks gate the evidence attestation consumes; build the gate before the traffic
4
Tag, device bind and rebind fourthMint rules, dedupe idempotency, enrolled biometric, the guarded rebind path with cooling window and step-up. Done when: the rebind tabletop passes and concurrent mints resolve to one object.WHY THIS ORDER · rebind is the attack surface; it needs the ledger and attestation beneath it to be recoverable
5
Wallet rails and tier caps lastVBank issuance against the tag, L1 rails (deposit, cumulative, redemption, no outward transfer, no foreign credit), automatic upward migration. Done when: the caps are enforced in the transaction path, not the UI, and a cap breach migrates rather than blocks.WHY THIS ORDER · money moves only once identity, liability and consent are solid; the caps are the risk budget that makes stage 5 safe on day one
WHAT THE SUBSTRATE SERVES UPWARD

The interface contracts

These seven services are the boundary. The exchange and credit layers consume them; changes to them are cross-owner reviews.
I1–I7 · INTERFACES
Seven services, one boundary
ATTESTATION SVCL1 instant / full async, snapshot-bound, broker-signed. Consumed by the exchange's Trade-Ready state and the credit layer's lien attestation.
EVIDENCE APIGrant-gated, read-ledgered. Serves broker screening, exchange compliance, credit underwriting. No grant, no bytes.
TAG / BVNDLE SSOAuthentication and identity prefill for every channel. Consent per attribute, per purpose.
PANEL ALLOCATIONPublished-rule broker routing with capacity heartbeat. Powers the exchange's Trade Now; cost never dominates the formula.
CASH NODEVBank virtual accounts issued against the tag, BVN-linked at birth. Feeds the exchange's investor cash ledger and credit disbursement.
READ LEDGERProvenance events for every access, human or model. Feeds the consent centre, surveillance evidence, and audit exports.
INFERENCEIn-jurisdiction hot-path scoring for orders and margins; warm path for LTV and KYC anomaly. Every inference reads and writes on the ledger.
DECISIONS TO LOCK BEFORE CODE

Five decisions, each cheap now and structural later

D1
What an attestation binds to
Immutable evidence snapshot by chain hash, never "the object". This one line is the difference between a legal instrument and a vibe.OWNER · GTPP + COUNSEL
D2
The material-field list
Exactly which field changes void attestations (name, BVN, DOB, legal capacity) and which append harmlessly (consent, accounts, address evidence). Short list, versioned, counsel-signed.OWNER · GTPP + COUNSEL
D3
Key custody
Broker keys are broker-held, HSM-backed, registered at panel onboarding. The platform orchestrates and never signs for a broker: liability separation is only as real as signing separation.OWNER · CISO
D4
Where the caps live
Tier caps enforce in the transaction path. UI reflects; it never enforces.OWNER · ENGINEERING LEAD
D5
What the platform never stores raw
BVN tokenised in the index, touched raw only transiently at NIBSS verification; evidence documents in a separately-keyed vault with only hashes on the object. Blast radius over perimeter.OWNER · CISO
THE MODULES

Reference: objects and contracts

The executional detail per module. Five objects, three contracts.
O1 · IDENTITY OBJECT
One evidence container, addressed by tag

The record of who an investor is and how that is known.

INVARIANTSIdempotent hydration (nothing re-asked, anywhere) · append-only, hash-chained provenance · reads are events, platform and insider included
GATESMint = NIBSS verify + eligibility + dedupe · mutation = evidence event · material mutation = void + re-attest
O2 · ATTESTATION
Tiered, snapshot-bound, broker-signed

Canonised correction: attestation has levels matching the SEC tiers. L1 is instant and automated under panel authority (the Commission requires no documentary evidence at L1; BVN-verified data exceeds it). Full attestation lands when screening completes. The three-minute wallet is L1-attested: real broker-of-record from birth, instant, capped. The caps are the broker's bounded exposure for attesting before screening finishes.

STATESPENDING → L1-ATTESTED → FULL · or FROZEN-AT-L1 (screening failed: caps hold, exit ramp) · or VOIDED (material change)
RE-ATTESTATIONA delta decision over a mostly-unchanged chain: seconds, not a restart
O3 · CONSENT HOOK
A grant token, enforced at the endpoint

NDPA consent as machinery: armed at mint, fired one tap per broker, captured with scope, purpose, timestamp and legal basis.

TWO BASESThe share runs on consent; the broker's retained CDD copy runs on legal obligation. Withdrawal kills future access; the five-year retention survives it. Encode both or the first erasure demand finds the gap.
READ LEDGEREvery pull is a provenance event; "who has seen my data" is a query
O4 · TAG
The address, the device, the rebind

Minted once, presented on return, bound to a device key. The tag is an address, not a secret.

REBINDBVN re-verify + liveness against the enrolled template · notify old device and VBank rail · cooling window · step-up before first withdrawal · hard rate limits. The recovery path is the attack path.
O5 · WALLET / CASH NODE
Broker custody above, VBank rail beneath

Broker-custody wallet by market design; VBank virtual account issued against the tag at attestation, BVN-linked at birth so the funding-source rule holds by construction.

TIER RAILSL1: ₦20k a deposit · ₦200k cumulative · ₦30k daily · no outward transfers · no foreign credits. Migration upward automatic and mandatory.
C1 · PANEL AGREEMENT
The standing offer

Broker's standing offer + platform's authority for L1 auto-attestation.

MUST CONTAINAcceptance criteria (broker-set) · L1 authority and caps · broker-held pause switch · capacity signalling · minimum panel size as launch precondition · allocation formula · full-attestation SLA
C2 · CLIENT AGREEMENT
One tap that is actually a contract

Presented explicitly at confirm. Standing offer, two acceptances, both parties free to refuse.

SWAPMake-before-break, always; holdings never broker-less. Attestation swaps in seconds; the CSCS transfer runs on its own honest clock, and the UX never confuses the two.
C3 · RELIANCE TERMS
Producibility as a duty

SEC reliance conditions as service levels: full evidence trail on demand, each broker ultimately responsible for its own CDD, the platform an evidence source and never an attestor.

TESTEDQuarterly evidence-pull drill per broker. Producibility is proven, not asserted.

What not to build yet: every read-side lens (statements, dashboards, reports) waits. They are cheap once the object is rich and impossible to trust before it. Build the truth first; render it later.

NASD Next Gate Series · prepared with VFD Group (GTPP) · 22 Jul 2026 · series: 00 Build Strategy · 01 Launch Plan · 02 Build Book · 03 Run Book · 04 Resolutions · 05 The Laws
← Volume 01 · Launch Plan Volume 03 · Run Book →
FEEDBACK · VOLUME 02
{{ composingTitle }}
remembered for next time · visible to the committee
Cancel Save feedback
NASD PLC · 9TH FLOOR, UBA HOUSE, 57 MARINA, LAGOS · REGULATED BY THE SEC, NIGERIA PREPARED WITH VFD GROUP · GTPP · THE OBJECT IS THE PRODUCT; THE APP IS A LENS OVER IT