No-Intermediary Pair Settlement

Mechanism

The mechanism treats settlement as a co-signed observation rather than as a third-party-brokered transfer. Each of the two parties to a matched pair holds a credentialed identity issued by a recognized authority. When the parties have agreed on the substantive terms of the settlement, each constructs a half-record describing the obligation it undertakes and the obligation it discharges, signs that half-record under its credentialed identity, and exchanges the signed half-record with the counterparty over the coordination channel.

The architecture composes the two signed half-records into a single settlement record whose admissibility is evaluated structurally: the signatures must verify against the credentialed identities at the time of signing, the obligations expressed in the two halves must be reciprocal in the manner declared by the matched-pair class to which the settlement belongs, and any class-declared admissibility predicates (for example, balance preconditions, jurisdictional preconditions, identity-class preconditions) must evaluate to admissible against the present state. When all three conditions are satisfied, the composed record enters lineage as a settled pair commitment, and downstream consumers can rely on the record without further attestation by an intermediary.

Verification is therefore structural rather than attestational. Either party, or any later auditor with access to the credentialed-identity infrastructure and the lineage chain, can re-evaluate the same admissibility predicates against the same record and reach the same conclusion. No intermediary's representation is on the critical path of validity.

Operating Parameters

The operating parameters of the primitive are organized around four declared quantities. The first is the credential-class envelope: each matched-pair class declares which credential classes are admissible on each side of the pair, and the architecture rejects half-records whose signing identities fall outside the declared envelope. The second is the reciprocity predicate: the class declares the structural relationship that must obtain between the two halves (for example, equal-and-opposite obligation transfer, conditional release against delivery, or schedule-of-payments matched against schedule-of-services). The third is the admissibility-window parameter: each half-record carries a validity window outside of which composition cannot occur, ensuring that a stale half-record cannot be replayed against a counterparty whose state has since changed. The fourth is the lineage-retention parameter: the architecture declares the minimum retention horizon for settled pair records, balancing audit obligations against storage cost.

A matched-pair class is therefore fully specified by these four parameters together with its identifier, its human-readable description, and the dispute-resolution affordances declared for the class. The disclosed primitive admits all four parameters as values that may be set by the authority owning the class, and the architecture enforces the values structurally without requiring per-settlement intermediary judgment.

Alternative Embodiments

Several alternative embodiments are contemplated and fall within the disclosure. In a first alternative, the two half-records are constructed and signed asynchronously rather than in a single exchange, with the architecture holding each signed half in escrowed lineage until its counterpart arrives; this embodiment supports settlement across high-latency or intermittently-connected channels. In a second alternative, the matched-pair class declares an optional credentialed observer whose signature is not required for admissibility but, when present, raises the evidentiary weight of the settled record for downstream consumers; the observer is structurally optional rather than structurally required, preserving the no-intermediary character. In a third alternative, the settlement composes more than two half-records under a declared multi-half topology, with the architecture treating the topology as a generalization of the bilateral case and applying the same structural admissibility tests pairwise across the composed halves.

A fourth alternative embodiment specifies an offline mode in which both half-records are constructed locally without coordination-channel access, signed under cached credential material, and exchanged over an out-of-band channel for later admission to the lineage chain. A fifth alternative embodiment introduces a declared fall-back to escrow where, if either party's credentialed identity is revoked between half-record signing and composition, the architecture diverts the partially-composed settlement into a declared escrow procedure rather than discarding it silently.

Composition With the Broader Architecture

The no-intermediary primitive composes with the rest of the coordination architecture by exposing settled pair records to the same lineage, audit, and dispute mechanisms that apply to any other admissible coordination event. Optional intermediaries may still participate, but they participate as declared services with credentialed identities of their own: a credentialed observer that countersigns for evidentiary weight, an escrow agent that holds collateral against a class-declared release condition, or a dispute resolver that admits appeals under the class-declared dispute affordance. In each case the intermediary's role is structurally additive rather than structurally required, and the absence of any such intermediary does not impair settlement validity.

The primitive also composes with the matched-pair taxonomy, which admits new pair-relationship classes through declared class definitions rather than through bespoke integration. Charging-station-to-vehicle settlement, tolling-gantry-to-vehicle settlement, autonomous-vehicle-to-infrastructure settlement, drone-to-airspace settlement, and vessel-to-port settlement are all admitted by declaring the relevant class with its credential-class envelope, reciprocity predicate, admissibility window, and retention horizon. The architecture itself does not require modification to admit a new class.

Distinction From Prior Art

Prior art in electronic settlement falls broadly into three families: clearing-house architectures in which a central operator brokers settlement between counterparties; escrow architectures in which a custody agent holds asset-equivalent value pending bilateral release conditions; and distributed-ledger architectures in which a consensus protocol substitutes for the central operator while still requiring multi-party validation of each settlement. Each family places a third party (or a quorum standing in for one) on the critical path of settlement validity.

The disclosed primitive is structurally distinct in that the critical path of validity is the co-signed observation of the two transacting parties themselves, evaluated against class-declared admissibility predicates. No central operator brokers the settlement, no custody agent holds asset-equivalent value, and no consensus quorum validates the settlement. The architecture admits intermediaries as optional declared services rather than as structurally required participants. This places the primitive outside the architectural envelope of clearing-house, escrow, and distributed-ledger settlement as those terms are understood in the prior art.

Extended Considerations

Several extended considerations bear on the practical deployment of the primitive. The first concerns identity revocation between half-record signing and composition: because the architecture verifies signatures against credentialed identities at the time of signing and at the time of composition, a half-record signed under a credential that is revoked before composition is treated as inadmissible by default. The class may declare an alternative behavior in which a revoked credential whose revocation post-dates the signing instant is admitted under a declared revocation-tolerance window, so that ordinary transactional friction does not surface as systemic settlement failure. The lineage chain records the credential state observed at each verification instant so that a later auditor can re-derive the same admissibility decision.

The second consideration concerns reciprocity-predicate expressiveness. The disclosed primitive admits reciprocity predicates ranging from simple equal-and-opposite obligation transfer through conditional release-against-delivery to schedule-of-payments matched against schedule-of-services. The architecture composes the reciprocity predicate with the admissibility-window predicate so that schedule-bearing settlements may declare per-schedule-element windows rather than a single composition window over the entire settlement. This admits realistic operational patterns in which earlier schedule elements settle against earlier service performance while later schedule elements remain pending against later service performance.

The third consideration concerns dispute affordance. Even though no intermediary is required on the critical path of settlement validity, the class may declare a dispute affordance under which either party can raise a dispute against a settled record within a class-declared dispute window. The dispute affordance is structurally additive: the original settled record remains valid in lineage, and the dispute itself enters lineage as an additional admissible event, with the class-declared dispute resolver (which may be a credentialed third party, a panel, or a structural rule) producing a resolution record that links to both. The architecture does not require the dispute resolver to participate in the original settlement and does not require dispute affordance to be declared at all; classes that decline to declare a dispute affordance are admitted, modeling final-on-settlement transaction patterns.

A further consideration concerns the lineage-retention parameter and its interaction with privacy obligations. Settled pair records often contain commercially or personally sensitive information, and class-declared retention horizons must therefore balance audit reach against the duration of exposure. The disclosed primitive admits two mechanisms that decouple retention duration from exposure duration. The first is a redaction profile that, after a class-declared exposure horizon, retains a cryptographic commitment to the settlement record while purging the underlying content; the commitment supports later integrity verification against a presented copy without itself disclosing the content. The second is a sealed-disclosure profile in which the full record is retained under encryption keyed to an authority that may release it only under declared conditions (legal process, explicit party consent, or expiration of a sealed-disclosure window). Both profiles preserve the structural admissibility of audit while bounding ordinary exposure, and both are declared at the class level so that a counterparty entering a settlement can read in advance how its data will be retained.

The fourth consideration concerns interoperability with regulated settlement venues. Where a counterparty operates under a regulatory regime that requires intermediary attestation (for example, certain banking, securities, or cross-border payment flows), the primitive can be composed with such an attestation as a declared observer service: the regulated intermediary's signature is added to the settlement record as a declared evidentiary signal without altering the structural validity of the underlying co-signed observation. This composition admits the primitive into mixed-regulation operating environments without compromising the no-intermediary character in unregulated lanes.

Disclosure Scope

The disclosure encompasses the mechanism, operating parameters, and alternative embodiments described above, together with the composition affordances that connect the primitive to the broader matched-pair taxonomy and coordination architecture. The disclosure is not limited to any particular transport, signature scheme, credential authority, or class taxonomy, and is intended to read on any implementation in which a bilateral commitment between two credentialed parties is composed into a settled record without a structurally-required intermediary on the critical path of validity. Specific application classes (charging, tolling, direct commerce, civil-infrastructure operations between credentialed parties) are recited as exemplary and not as limiting.