Four eyes, two layers
A database CHECK refuses a self-approved batch, and a 3-of-5 multisig holds the operator role. Two controls, two threats — neither substitutes for the other.
Ownership is recorded on-chain and verifiable by anyone. Money never touches the chain — subscriptions, rent and exits all move in INR through bank rails, and the registry records the consequence.
It answers “who owns this, and what happened to it?” It never moves money. One tokenised property lives on exactly one chain, and there is one registry write per settled trade — money moves first, the record follows.
Served live from /health. The control plane’s write routes
(pause, resume, renew) are not reachable from the public internet — they are
unauthenticated by design until the capability layer lands, so nginx refuses
them outright.
| Layer | State | Evidence |
|---|---|---|
Schema & controls11 migrations · 27 tables · append-only history |
Verified | db:verify — 12 probes all controls fire |
Solidity contracts7 contracts, immutable — no proxies |
Tested | forge test — 24 passed replay guard reverts |
Registry & indexercheckpointed, single-instance, DB-leased |
Running | deployed to the dev chain checkpoint advancing |
Settlement & custodyorchestrator, escrow ledger, HSM signing |
Not started | Phase 1 remainder |
Real money · real usersINR rails, KYC, consent architecture |
Blocked | launch gate 0 of 12 |
Consent cannot be collected retroactively. If one real PAN number entered this system before the consent architecture existed, that processing was unlawful at the moment it happened, and no later change fixes it. Everything here runs on synthetic identities and a local development chain.
This deployment exists so the engineering can be exercised end to end. It is not open for investment, it holds no client funds, and it is not an offer of any security.
Every gate must pass. There is no partial credit and no override. Mainnet is a fresh genesis, not a data promotion — testnet records are discarded deliberately and properties are re-registered from verified legal records.
A database CHECK refuses a self-approved batch, and a 3-of-5 multisig holds the operator role. Two controls, two threats — neither substitutes for the other.
One batch id is simultaneously the queue job id, a Postgres unique constraint, and an on-chain replay guard. A retry is safe at every layer.
The audit log, consent records, ledger entries and chain events refuse UPDATE and DELETE at the database level, not in application code.
Two indexers on one checkpoint would skip ownership events silently. A database lease enforces it, so a config drift cannot defeat it.
At every control level, including a full freeze, an investor can still see their own holdings. A hard rule, not a policy choice.
No proxies and no admin who can rewrite ownership. Changing a contract means an explicit, auditable, four-eyed migration.