ADR-027 · BSE as Payment Control Plane
Status: RATIFIED · v0.2 · 2026-09-XX
Sponsor: Mamadou Ly, Founder, Managing Partner & CEO
Authority: T3 founder-consent Motion 3 (2026-09-XX), building on Motion 2 (2026-08-24)
Supersedes: none
See also: ADR-014 (seven-plane formalisation), ADR-022 (GOVCOS co-management)
Follow-on: ADR-028/029/030/031 (declared, not blocking)
1. Context
The seven-plane BLACKSWAN estate (ADR-014) comprises CMOS, PMOS, TREICHTEC, AIOS, SCFOS, HSOS, GOVCOS. Every plane can originate a payment instruction. Without a control plane, these instructions would reach rails (RTGS, Instant, ACH, correspondent banking, card/PSP, custodian/DVP, TREICHTEC-DLT) without uniform identity, entitlement, mandate, limit, screening, pricing, risk, and rail-selection enforcement.
The rails architecture workbook (2026-08-30, v0.1, 20 sheets) documents the routing matrix and confirms that TREICHTEC-DLT is one rail among seven, not "the" settlement layer. The Regulatory Positioning Statement v0.2 (2026-08-14) requires an architectural artefact that substantiates the "infrastructure supplier" claim; BSE is that artefact.
Problem. A plane-level free-for-all over rails would:
- allow rail-selection inconsistencies across planes
- allow a plane to bypass screening or mandate checks on its own authority
- allow TREICHTEC-DLT to drift into "de facto settlement layer" status, which would contradict the Regulatory Positioning Statement
- allow AIOS agents to initiate payment flows on an implicit fast path with no uniform policy enforcement
2. Decision
BSE — the BLACKSWAN Substantive Engine — is the payment control plane of the BLACKSWAN estate. Every payment instruction — regardless of originating plane, agent identity (human or AIOS), or rail destination — passes through BSE for eight resolutions before reaching a rail:
- Identity resolution
- Entitlement check
- Mandate check
- Limit check
- Screening (sanctions, PEP, jurisdictional)
- Pricing (meter application)
- Risk and SLA assignment
- Rail selection
3. Invariants (terminal)
- BSE-first ordering. No payment instruction reaches a rail before BSE resolution.
- No BSE-bypass rail. Internal transfers, testing, sovereign carve-outs, and TREICHTEC-DLT programmable settlement all pass through BSE.
- BSE metadata is a first-class message property. Every routed instruction carries the resolution artefact inline as a signed envelope.
- Sovereign carve-outs go through BSE. Exemptions are BSE policy configurations, not bypasses.
- AIOS and TREICHTEC events are BSE-mediated.
4. Seven rails (invariant)
BLACKSWAN settles on seven rails:
- RTGS
- Instant / Faster Payments
- ACH / batch
- Correspondent banking
- Card / PSP
- Custodian / DVP
- TREICHTEC-DLT
TREICHTEC-DLT is one rail among seven. It is not "the settlement layer" and no other rail is subordinate to it.
5. Consequences
- Regulatory: substantiates infrastructure-supplier posture (RPS v0.2). BLACKSWAN does not hold or move funds; BSE authorises and routes.
- Architecture: BSE joins LCGX / Gateway / Nexus as a fourth infrastructure element. BSE is not a plane.
- AIOS: agent-initiated payment flows are BSE-mediated; no fast-path bypass.
- TREICHTEC-DLT: repositioned from "settlement layer" to "one of seven rails" across all surfaces.
- Canon: additive §13 (Payment Control Plane) lands alongside this ADR, bumping the Canon to v2.2 DRAFT.
6. Follow-on ADRs (declared, not blocking)
- ADR-028 · BSE availability SLA
- ADR-029 · BSE schema versioning policy
- ADR-030 · Rail onboarding checklist
- ADR-031 · AIOS payment mandate policy
7. Authority
Ratified under T3 founder-consent Motion 3 (2026-09-XX), building on Motion 2 (2026-08-24) delegated authority. No further human sign-off required.
8. Verification
/docs/adr/027renders on prod.- Canon §13 renders on
/docs/canon/estate. - Estate-wide ADR-index shows 027 RATIFIED v0.2.
- Dashboard
/planes/shows BSE control-plane row in the infrastructure section.
8.1 · Per-plane BSE-wiring artefacts (seven-plane sequence · CLOSED 2026-08-31)
Each plane in the estate carries a docs/bse-wiring.md artefact under its own repository, stating its posture toward BSE (submitter, composer, consumer, or governed surface), its surface classes, its envelope contract, and its rail bias. All seven artefacts are design-only and change no plane posture (all remain STANDBY · IN-MEMORY ONLY · HOLD · NO-GO; isLiveGo=false unchanged).
| # | Plane | Role | Repo | PR | Merge SHA | Merged |
|---|---|---|---|---|---|---|
| 1 | CMOS · Falcon capital-markets | BSE submitter | BlackswanCapitalMarketsOS | #51 | 47551275 | 2026-08-31 22:31 UTC |
| 2 | PMOS · Swan Nest private-markets | BSE submitter | BlackswanPrivateMarketsOS | #143 | b63a47ea | 2026-08-31 22:38 UTC |
| 3 | HSOS · hedge-sovereign | BSE submitter (governed-surface framing) | BlackswanHedgeSovereignOS | #216 | ccc90d01 | 2026-08-31 22:43 UTC |
| 4 | AIOS · 24-app agent plane | BSE composer | BlackswanAIOS | #62 | 2480a171 | 2026-08-31 22:50 UTC |
| 5 | TREICHTEC · nine-DLT plane | BSE-rail consumer (rail 7 + sub-rails 7.01-7.09) | BlackswanTreichtecDLT | #11 | b3a9218b | 2026-08-31 22:56 UTC |
| 6 | SCFOS · working-capital plane | BSE submitter (three-sided market, Pivot × Country) | BlackswanSCFOS | #3 | eabcdb21 | 2026-08-31 23:05 UTC |
| 7 | GOVCOS · governed surface | BSE gate-5 evidence provider (Role A) · sovereign-owned submission (Role B) · attestation-ledger back-write (Role C) | BlackswanGOVCOS | #5 | 316a53c9 | 2026-08-31 23:13 UTC |
Sequence-closure invariants (satisfied by the artefacts above, verified by inspection at merge):
- Every plane declares BSE-first ordering and no-bypass rail (Canon §13.2 invariants 1-2).
- Every plane carries BSE envelope metadata forward as first-class message property (Canon §13.2 invariant 3).
- Every plane routes sovereign carve-outs through BSE, never around it (Canon §13.2 invariant 4).
- Every plane treats AIOS-composed and TREICHTEC-consumed events as BSE-mediated (Canon §13.2 invariant 5).
- Governed surfaces (HSOS-governed rows, GOVCOS) declare the four GOVCOS-specific complementary invariants where applicable: dual signature before gate 1, no-instance-no-dependency, statutory-mandate irrevocability, attestation-ledger completeness (introduced in GOVCOS §5.6-5.9, non-normative for the other planes).
8.2 · Estate coverage matrix
| Rail (Canon §13.1) | CMOS | PMOS | HSOS | AIOS | TREICHTEC | SCFOS | GOVCOS |
|---|---|---|---|---|---|---|---|
| 1. RTGS | ✓ | ✓ | ✓ | via | — | ✓ | ✓ dominant |
| 2. Instant/Faster Payments | ✓ | ✓ | ✓ | via | — | ✓ dominant | (retail-scale G2) |
| 3. ACH/batch | ✓ | ✓ | ✓ | via | — | ✓ dominant | (retail-scale G2) |
| 4. Correspondent | ✓ | ✓ | ✓ | via | — | ✓ dominant | ✓ (G7/G8 cross-border) |
| 5. Card/PSP | ✓ | — | — | via | — | ✓ (Tier 1) | — |
| 6. Custodian/DVP | ✓ | ✓ | ✓ | via | — | (receivables-tok) | ✓ (G1/G3/G4 security-legged) |
| 7. TREICHTEC-DLT (7.01-7.09) | ✓ | ✓ | ✓ | via | consumer contract | (7.09 DLT TF post-HOLD-lift) | (7.05 DLT SL post-HOLD-lift) |
✓ = declares eligibility · via = routes through the composed destination plane · — = not typically in scope · rail 7 remains on HOLD.
8.3 · Follow-on artefacts (declared, non-blocking)
The following follow-on ADRs are queued but do not block ADR-027 closure:
- ADR-028 (provisional) · BSE control-plane repository stand-up
- ADR-029 (provisional) · BSE eight-resolution reference implementation contract
- ADR-030 (provisional) · BSE policy configuration schema (sovereign carve-outs, meter, SLA rules)
- ADR-031 (provisional) · BSE observability and audit-trail retention
- ADR-032 (provisional) · BSE ↔ GOVCOS Role A query protocol (from GOVCOS §6)
- ADR-033 (provisional) · BSE ↔ GOVCOS Role C back-write protocol (from GOVCOS §6)
None of these gate live activation of any plane; live activation is deferred plane-by-plane pending regulatory approval per the BLACKSWAN infrastructure stance point 7 (2026-08-27).
ADR-027 · BSE as Payment Control Plane · RATIFIED v0.2 · §8 amended 2026-08-31 (seven-plane sequence closed) · sponsor Mamadou Ly, Founder, Managing Partner & CEO.