VigiRail: institutional payments without gas
You will understand what an institution can do on the rail today, why the sender pays no gas, and which parts of the design are not built.
Gasless by design
Send one hundred, receive one hundred.
A rail sender transfers exactly the business amount: no native VIGI to hold, no gas to price, nothing subtracted in transit. Resource control is institutional instead — each participant holds a contracted capacity counted in messages per window of blocks, so the limit is measured by the chain's own clock rather than by a clock an operator can set.
What is live
An institution can be admitted, sign, and carry a payment.
On the testnet the rail works end to end: an institution is admitted under a quorum of named authorities, holds a real post-quantum key, and moves a payment from initiation to settlement with every signature checked. The census and the verifier are real code, not a mock — which is exactly why the rest of this lesson is about what is not.
What is not built
ISO 20022 validation, the encrypted envelope and selective disclosure.
The schema registry does not exist: no shipped code validates a message against an ISO 20022 schema today, and the chain carries a commitment to a payload rather than the payload. The post-quantum envelope is specified and not performed by this build. Viewing capabilities for supervisors are a design, and the node contains no code for them at all.
Fail closed
It refuses rather than guesses.
An unavailable cryptographic backend, an unknown suite, an inactive institution, an exhausted quota or a failed signature all stop the message. No placeholder ever returns success, and the rail reports of itself that it is not committed by consensus on any network yet. Mainnet stays locked.
In short
- The sender transfers the exact business amount; capacity is contracted, not priced in gas.
- Admission, post-quantum signing and settlement work end to end on the testnet today.
- Schema validation, the encrypted envelope and selective disclosure are designed and not built.
- Every failure stops the message: nothing returns success as a placeholder.