# The Corridor Table Standard **Status: PROPOSED · v0.1 DRAFT · not yet ratified by any standards body.** This document is published for comment and as the basis for submission to a trade-finance standards body (e.g. ICC, BAFT). It describes a format, not a set of prices, and Mirror asserts no endorsement it has not received. --- ## 1. Why a standard, and why an open one Two banks can only reconcile a trade blindly if they band its value against **the same table**. That table — which price bands, which matching windows, which locator scheme, which tolerance, under which legal basis — is the one genuinely multi-party artifact in an otherwise bilateral protocol. Agreeing it ad hoc is a months-long negotiation and a miniature cold-start: the exact friction that has sunk cross-institution trade networks before. An **open, ratifiable corridor-table format** converts that friction into a moat. When the format is a published standard, lighting up corridor N+1 is a countersignature rather than a committee, any conformant implementation interoperates, and no single vendor owns the definition. This document specifies that format. It deliberately does **not** specify any prices: the standard is the shape of the table; the values inside it are ratified by the participating banks, never by Mirror and never by this document. **Non-goals.** This standard invents no prices, publishes no benchmark, and names no goods. A corridor table with nonsense edges produces nonsense bands — that is the ratifying parties' responsibility, checked by their governance, not by the format. --- ## 2. The corridor table object A corridor table is a canonical JSON object. Every field is load-bearing; a table missing or malforming any of them is **invalid**, never silently defaulted (fail-closed, in the AML direction — an unreadable table must never yield a clean reconciliation). | Field | Type | Meaning | |---|---|---| | `product` | string (ASCII) | The corridor's product/commodity label, ratified by the parties. Opaque to the operator. | | `version` | integer ≥ 1 | Monotonic version. A new version is a new table; bands never mutate in place. | | `edges` | array of distinct finite numbers, ≥ 1 | The band boundaries. Sorted canonically before use; duplicates are refused. | | `corridor_id` | string | **Derived** from `edges`, never trusted from a claim. If supplied, it must equal the derivation or the table is rejected. | | `tolerance` | integer ≥ 0 | The match-window width in bands, applied at the operator as a set union. Non-negative; out of range → invalid. | | `windows` | object | Per-role matching windows (how long each leg has to arrive). A missing or inverted window → invalid. | | `locator_scheme` | enum | One of the registered locator schemes, defining how the two banks derive the same opaque join key for a shipment. | | `legal_basis` | string | The basis for sharing the parties **assert** (e.g. a 314(b) registration, an AMLR Art. 75 arrangement). Asserted here; coverage is checked elsewhere. | | `effective_from` | timestamp | When the ratified table comes **in force**. Ratified ≠ in force; a table with a future effective time is frozen until then. | | `valid_until` | timestamp, optional | When the table **stops** judging (a time-bound corridor). Carried on the proposal, so it is ratified with the table. After it, a reconciliation naming the table is refused (`table_expired`) rather than judged under another version; a renewal is a new version. An unreadable value refuses the proposal — it never becomes an unbounded table. | | `closed` | boolean | Whether the table is the half-open range `(first edge, last edge]`. On a **closed** table a value outside that range commits markers that match nothing, so it can never clear; on an open one the outer bands run to zero and to infinity, and two legs both in the top band agree at any ratio. Anything but a boolean refuses the proposal. A new corridor must be closed. | | `max_ratio` | number > 1 | The **match ceiling**: the widest price ratio a clear on this corridor may stand for. A clear whose window is wider is held (`match_ceiling`). Only a closed table can meet a ceiling. A new corridor must carry one of at most 1.5, and its widest band at tolerance 0 must fit under it. | | `reference` | object, optional | A **ratio corridor**: the edges are a published ratio table (`ratio-5`, `ratio-10`, `ratio-20`) and each leg bands price ÷ R, where R is the exact median of a quorum of cited public figures. The object is `{ table, sources, quorum, max_spread, rule }`: citations only, never a figure. Its id is `rs:` + SHA-256 of its canonical form. With `reference`, the edges must be exactly that table and `closed` must be true. See [ratio corridors](/ratio-corridors). | ### 2.1 `corridor_id` derivation `corridor_id` is a deterministic function of the sorted `edges` alone (SHA-256 over the canonical edge list). Two banks that independently hold the same edges derive the same id without coordinating a label — the id is how their commitments join, so it can never be a free-text claim. A table that carries a `corridor_id` inconsistent with its edges is refused outright: a table cannot claim one identity and band under another. --- ## 3. Ratification and the book A corridor table becomes authoritative only through **quorum countersignature**. A charter binding the table is endorsed by a quorum of at least two distinct ratifying members; a quorum of one is not a quorum. Endorsements fold deterministically into an **append-only book** — the corridor's constitution — so that years later a supervisor can ask "under exactly which table, ratified by whom, and when, was this trade reconciled?" and get a signed, offline-verifiable answer. History is preserved by construction; a ratified table is never edited, only superseded by a new version. Lifecycle: **proposed → ratified → in force → superseded/retired.** Each transition is a signed event; the book folds them in order; nothing is mutated retroactively. --- ## 4. Interoperability and conformance The point of a standard is that an implementation built inside Bank A's core stack lands a leg in **byte-identical** commitments to the same leg banded by Bank B, or the blind reconciliation is comparing apples to noise. An implementation is **conformant** when it reproduces the reference commitment vectors for a given table exactly. Conformance earns a signed certificate; there is no partial pass. This lets the format spread through vendors who never integrate with Mirror directly — a vendor that emits conformant commitments to its own customers propagates the standard. --- ## 5. Honest boundaries of the standard - The table defines **bands, not exact values.** Reconciliation against it proves same-band agreement, never equality of prices. - A ratified table encodes only what the parties agreed; a **wrong table produces wrong bands**, and the standard cannot tell. Table correctness is the ratifying parties' governance responsibility. - `legal_basis` is **asserted**, not established, by the table. Whether that basis actually covers a given exchange is checked outside the format. - This standard is a **proposal.** It has not been ratified by any standards body, and Mirror claims no such ratification. --- ## 6. Reference implementation A dependency-free reference implementation of table validation, `corridor_id` derivation, charter endorsement, the append-only book, and the conformance vectors is published with the protocol specification. Every construct in this document maps to a deterministic, individually-tested kernel; the reference is the normative tie-breaker for any ambiguity in the prose above.