Operate / Market and custody operators

Ownership and transfer

Transfer custody or ownership without flattening the artifact, provenance, and Settlement boundaries into interface state.

ownership, custody, provenance, and transferverified artifact successor, plus optional Market or transfer coordinationComplete production checklist

Implementation rail · verified artifact successor, plus optional Market or transfer coordination

Exact execution and operator checks

01
Operator check
Bind transfer authority
Verify the proof object, current custody, transfer authority, exact recipient, operation identity, and any separate Settlement intent before mutation.
Substantive records: /learn/primitive-atlas · /reference/http-openapi
Expected: The transfer is bound to the current proof head and custodian.
02
Exact mechanic
Execute the delegated transfer
```
curl --fail-with-body --request POST "https://receiz.com/api/connect/transfers"   --header "authorization: Bearer ${RECEIZ_ACCESS_TOKEN:?RECEIZ_ACCESS_TOKEN is required}"   --header "content-type: application/json"   --data "${RECEIZ_TRANSFER_JSON:?RECEIZ_TRANSFER_JSON is required}"
```
Mechanic
POST /api/connect/transfers
Authentication and account boundary
Bearer Access Token
Exact source
receiz-docs/generated/openapi-reference.json · SHA-256 2278eb9ab1dfcc90d61d4a6f9daac1bc55e17aeeab0d2d5d39228f88654bc20a
Expected: The endpoint returns an exact transfer receipt or stable rejection.
03
Exact mechanic
Run test:market-conformance
```
pnpm test:market-conformance
```
Mechanic
pnpm test:market-conformance
Authentication and account boundary
Authorized local repository checkout; the command proves only the checked repository boundary.
Exact source
package.json · SHA-256 132f99232dfaf26f7186b73752938d1377042808f42d60d374fe7b2e57c7646b
Expected: Ownership, listing, custody, transfer, and provenance contracts pass.
04
Operator check
Inspect resulting custody
Reject stale custody, duplicate operation conflict, missing provenance append, mismatched recipient, or Settlement state presented as ownership. Verify the proof object independently.
Substantive records: /trust/conformance · /operate/public-proof
Expected: Prior and current custody, provenance, and separate Settlement state remain legible.

Complete operating anatomy

Every boundary required to ship.

Solved outcome: A transfer preserves the proof object, names prior and current custody, appends provenance, and records governed Settlement independently.
Prerequisites: Hold the exact proof object, current owner and custodian, transfer authority, recipient, provenance head, operation identity, idempotency key, and any separately governed Settlement intent.
Exact primitive: ownership, custody, provenance, and transfer
Governing law: Ownership and transfer is governed by market-conformance: A passing execution confirms the checked market ownership invariants for the exact repository state exercised. canonical-artifact-verifier: The verifier classifies the supplied artifact. Embedded subpayloads and remote responses remain subordinate. settlement-boundary: Value transition, consent, exit, and rollover remain auditable without renaming Settlement into a generic balance.
Source-of-truth order: Receiz law → sealed artifact truth → deterministic proof object state → verified durable local or register truth → authenticated snapshot → server distribution, synchronization, indexing, and publication → database, session, observability, and interface projections.
Expected artifact, receipt, or state: A transfer proof bound to object identity, prior custody, resulting custody, Kai order, provenance append, and any separate Settlement state.
Inspection: Inspect the proof object, custody chain, transfer authority, Kai Pulse, provenance append, and Settlement proof. Inspection exposes structure and receipt fields; inspection never establishes verification.
Independent verification: Independent verification for ownership-transfer: pnpm test:market-conformance && pnpm test:verification-conformance. This establishes only the ownership, custody, provenance, and transfer boundary named by the bound sources; The implementation rail remains beneath proof authority: verified artifact successor, plus optional Market or transfer coordination.
Offline behavior: A supported holder can transfer or reseal the verified artifact locally. Once the successor and custody append are admitted, the transfer is complete in that proof domain; later global publication is optional distribution of the same truth.
Identity and account boundary: Public Record Moment, Seal File, Verify, Export, and public proof reading are account-free. Identity is optional and adds continuity, custody, recovery, and governed private controls after proof admission.
Security boundary: Transition authority must bind to current custody and exact object identity; a displayed listing or session is not transfer authority.
Conformance command: pnpm test:market-conformance
Deployment checks: Qualify current-custody authorization, exact object identity, recipient binding, provenance append atomicity, idempotency, stale-head conflict, separate Settlement state, public inspection, offline history, and recovery.
Production checklist: Test unauthorized, stale-custody, wrong-object, wrong-recipient, identical replay, conflicting replay, append failure, pending Settlement, public provenance, offline custody inspection, and recovery from the prior verified head.
Rollback and containment: Containment for ownership-transfer: The transfer is rejected. Re-establish accepted custody proof or stop the operation. No custody append is admitted. Reload the verified custody head and create a new operation for changed intent. The states remain distinct and the operation is incomplete. Reconcile each receipt independently and contain further transfer until both boundaries are explicit. Preserve every stronger held artifact and admitted state while the named boundary is corrected.

Fail closed

Mutation and failure matrix

Actor is not the current authorized custodian.

Effect: The transfer is rejected.
Retry: Never infer authority from listing, session, or display state.
Recovery: Re-establish accepted custody proof or stop the operation.

Proof identity, recipient, provenance head, or idempotency payload conflicts.

Effect: No custody append is admitted.
Retry: Retry only exact identical intent.
Recovery: Reload the verified custody head and create a new operation for changed intent.

Settlement changes but ownership provenance does not, or vice versa.

Effect: The states remain distinct and the operation is incomplete.
Retry: Do not collapse one into the other.
Recovery: Reconcile each receipt independently and contain further transfer until both boundaries are explicit.

Exact authority

Claim-to-source bindings

A passing execution confirms the checked market ownership invariants for the exact repository state exercised.
scripts/test_market_conformance.tsexecutable-conformance · SHA-256 47c7ebb7eb9f3854f31dbc7266909f9e4c9726908930d236f3a76eaacae54eb7
The verifier classifies the supplied artifact. Embedded subpayloads and remote responses remain subordinate.
packages/receiz-sdk/src/artifactVerification.tsimplementation-verifier · SHA-256 c10cdba92568fea273e1d9e7a3321083d52945378ab0cc83aee9720d44f0bba3
Value transition, consent, exit, and rollover remain auditable without renaming Settlement into a generic balance.
docs/perpetual-rollover-kernel.mdnormative-doctrine · SHA-256 4cad3f91ebae948610e1292fc18854351df65edeaeb03bbd12942b6e74c89b69

One complete system

Exact execution and operator checks

Bind transfer authority

Execute the delegated transfer

Run test:market-conformance

Inspect resulting custody