Delivery versus payment, across two chains, without bridging either asset.
A restricted RWA on Base and a Cleanverse settlement unit on Monad settle under one signed intent. Neither asset leaves the chain that issued it. What crosses is authenticated settlement state — and the commitment becomes irreversible only after economic finality and a fresh compliance answer.
Assets stay put. Settlement state crosses.
Settlement does not become difficult because there are two ledgers. It becomes difficult because they do not become final at the same time.
And eligibility can change inside that gap.
Whoever moves first is exposed to a rule that has not been applied yet. Bridging solves neither half: it replaces a settlement problem with a custody problem and a wrapped supply to attack. Conduit bridges nothing.
One intent, two chains, five states.
Neither module moves. Only the state between them does.
Prepare
Base reserves the restricted RWA against this settlement id. Monad moves the settlement value into escrow. Both are sent by the participants’ own wallets.
Finalize
Each preparation publishes an authenticated message. Conduit waits for the guardian set to sign it at the finality this deployment requires, which on Base has run 999–1485 seconds.
Recheck
Cleanverse is asked again, after the wait, with no application cache in the path. The answer at prepare time is too old to authorise anything by the time finality arrives.
Commit
One irreversible decision, taken on the coordinator and carried to the other chain as an authenticated message. After this point there is no refund.
Deliver
Each leg moves locally, on the chain that issued it, to the party the signed intent named. Anyone may relay the message that authorises it.
What happens when compliance changes after COMMIT?
Most systems have no answer, because they assume eligibility is a property rather than an answer with a timestamp. This is the sequence a live settlement on the deployed protocol actually walked.
Cleanverse is asked again after finality and clears both participants. Nothing about the settlement is irreversible yet.
The coordinator records the decision and publishes it. From here the settlement can only complete or hold — there is no path back.
The issuer raises the minimum tier on the asset’s transfer rule while the settlement is in flight. This is a real transaction on Base, not a simulation.
The asset consults its own policy at the moment of transfer and refuses the receiver. The token enforces this, not Conduit.
The cash leg has already released and is not refundable. The asset leg is held rather than reverted: the commitment stands and the value stays accounted for.
A registered authority files an order under a policy that permits its class. It rests for the contest window before anything can execute.
Terminal, and derived by a verifier that reads both chains and the guardian set with no help from this server.
This is not an architecture diagram.
Canonical happy path
One signed intent, cash on Monad and a restricted RWA on Base, both legs delivered and read back from chain state alone.
Compliance changed after COMMIT
Eligible at commit time, refused at delivery time by a RuleV2 the issuer moved in between. The cash leg had already released and was not refunded; the asset leg held, and a disposition resolved it.
Settled from a browser
One intent composed, checked, signed, prepared, committed, released and settled from the settlement workspace. Every transaction was sent by a wallet in a page, with each next step decided from chain state rather than by a script.
Cleanverse is not metadata attached to Conduit. It decides whether settlement may advance.
Cleanverse identity. Whether a participant holds a pass at all, and whether it currently permits transfer on this chain.
A compliant asset. The token consults its policy on every transfer, so eligibility is enforced by the asset rather than by an application in front of it.
The transfer rule the issuer controls, on chain. It can change after a settlement commits, and on this deployment it did.
Conduit asks again after finality and mints an attestation with a lifetime shorter than the wait that produced it. A stale answer cannot authorise a COMMIT.
An HTTP 200 is not a business success, a valid:false is a refusal rather than an outage, and an outage is the absence of a decision — never a no. The console reports the answer it received, verbatim.
Wormhole moves settlement facts, not assets.
Every field is verified against the guardian set before the message is consumed, and consumption is recorded before any token moves. Anyone may relay a valid message; nobody can replay one.
Built for assets that cannot simply be sent.
Tokenized bonds
A restricted instrument whose holder register is the transfer rule.
Restricted fund units
Subscription and redemption between accounts an administrator must clear.
Private-market securities
Transfer permitted only between verified holders, checked at delivery.
Institutional treasury
Cash on one venue, the asset on another, one obligation across both.
Settle across chains without moving the assets across them.
Participate
Connect your wallet and create or join a settlement. Conduit never sees your key.
Verify
Inspect a settlement from two chain RPCs and the guardian set, without trusting this application’s database.
New wallet not eligible in the Cleanverse sandbox? That is the product working — some unknown wallets are cleared and others refused, and you will see the answer verbatim. Explore a proven settlement instead.
- SETTLED
- Both legs executed. The trade is complete.
- HELD
- Committed value awaiting a lawful resolution. One leg executed and the other cannot be delivered under current compliance rules. This is not a failure and not a refund: the commitment stands, the value is accounted for, and it moves only through an authorised disposition.
- CONTESTED
- Two authorised parties have proposed different resolutions. Nothing moves until the authority policy resolves the conflict.