A Graph of Graphs, Not a Chain

A public blockchain is, at bottom, a machine for putting unrelated transactions in one order.

That's what consensus is for. A quorum of nodes settles the sequence, sometimes by fee priority, sometimes by a vote tally, sometimes by the median of several witnesses' clocks, and the method matters less than the output: one order, and on most chains a global one. Every transfer, from everyone to everyone, sits in that sequence, and every participant has agreed on all of it. That's an extraordinary engineering achievement and I don't want to diminish it; I spent years working on one. It's also, for almost everything a business does, the wrong shape. I get that not every chain works exactly this way, but the model holds for almost all chains.

Consider what a single global order actually asks for. A lease between a landlord and a tenant in Manchester has to be placed in sequence against a currency trade in Singapore and a royalty payment in Nashville, and every node in the system has to process all three before any of them is final. The three facts have no parties in common, no assets in common, and no reason to know about one another. The ordering is pure overhead, paid by everyone, so that strangers who share nothing can nonetheless agree on everything.

That design made sense for its original purpose. A bearer token with no issuer, moving between people who'll never meet, needs some global referee, and a shared sequence that everyone replays is one honest way to build one. The mistake is to carry that shape over to commerce, where almost no fact is everyone's business.

Who a fact actually belongs to

Start from the other end. Every party in commerce has facts of its own: its holdings, its obligations, its history. Today those sit in that party's own systems, and only that party writes to them. Nobody else has standing to enter a line in your books, and that's correct.

On Conduit, that boundary is kept. Every party on the network has a scope of its own: a ledger of its own facts, which only it can write to, and which stays private until the party chooses to share a fact across an agreement. So far this is no more than what a company already has, with the privacy made explicit rather than assumed.

What changes is what an agreement does. An agreement between two parties links their two scopes. The facts under that agreement, who owes what to whom and what has happened so far, are held by both parties, and only by them. A third party to the same agreement joins the link; a stranger doesn't. The agreement is the thing that decides whose business a fact is, which is exactly what an agreement already does in law. The record simply follows the agreement instead of ignoring it.

The shape that falls out

Now step back and look at the whole. Many parties, each with a private scope. Many agreements, each linking the scopes of its parties. What you're looking at is a graph: the points are parties, the links are agreements, and the facts sit on the links, held by the parties at either end.

Zoom out further and the same shape repeats:

• A market is many participants with many agreements among them, dense inside and sparse at its boundary.
• An industry is a graph of its own.
• The institutions of one country form another.

Each of these agrees among its own members about its own facts, and the graphs link into one another wherever an agreement crosses a boundary. A network built this way is a graph of graphs, and there's deliberately no single chain running through it that everything is written to. If a chain is one long receipt that the whole world signs, a graph of graphs is a magical filing cabinet in every office, with a shared drawer for each agreement and the key held only by its parties.

Two consequences follow that matter in practice.

The first is that there's no global order of events, or more precisely no global order that anyone is made to agree on. The lease in Manchester is ordered against the other events under that lease, and against nothing else. Nobody has to decide whether it happened before or after the currency trade in Singapore, because no party, no asset and no obligation connects them. Ordering happens where it means something. When two facts under different agreements do need comparing, say a regulator checking that a drawdown came after the approval it depended on, the network has something a chain lacks: secured timestamps, drawn from atomic clocks and GPS on the nodes themselves. The two facts can be placed against each other in clock time without ever having been forced into one sequence.

The second is that there's no central store. The facts of a market are held by the participants in that market, each holding its own and the ones it shares. There's no place where all of it sits, which means there's no single place to breach, no operator to trust with everyone's books, and no single party whose outage stops the world.

How a record gets agreed, and who isn't asked

A shared record among parties who don't trust one another still has to be kept identical, and this is where the shape pays for itself.

Each party's ledger isn't one machine. It's held by a set of replicas, on different hardware, in different places, so that no single failure and no single operator can lose it or alter it alone. When a change to a ledger is proposed, the replicas accept it by quorum or not at all. Enough of them have to agree before anything is recorded, and a replica that's faulty or dishonest is simply outvoted by the rest. That's a well understood discipline, it's not novel. (Distributed systems people have been outvoting faulty replicas since before most of us had email.) What's distinctive is where it's applied.

Agreement happens per ledger. Never across the whole network. When the landlord and the tenant settle a quarter's rent, the two of them reach agreement with each other, and their replicas record it. The currency traders in Singapore aren't asked. They don't vote, they don't replay it, and they don't wait for it. Nobody else is asked, and nobody else waits.

Contrast that with a chain, where the cost of your transaction is paid by every participant and your transaction waits its turn behind every other transaction on earth, with its place in the sequence visible to anyone who looks. Some projects take privacy seriously, Zcash and Canton among them. The point here is about the shape rather than any one chain's disclosures. The chain's throughput is a shared resource that every agreement competes for. A graph of graphs has no such resource. Two parties can agree as fast as two parties can agree, and the hundred thousand other agreements in the network neither slow them down nor are slowed by them.

Private where it should be, public where it should be

Is such a ledger private or public? That's a question people ask, and the answer is that it's the wrong level to ask at. A chain forces one answer on everything it holds. A graph of graphs lets the answer be set per ledger, by the terms of the agreements it carries. A regulator's reporting ledger may be open to the regulated. A bilateral facility may be visible to its two parties and no one else. A public registry may be readable by anyone. The same network holds all three, because each graph agrees among its own members on its own terms, and the terms are part of the agreement rather than a property of the infrastructure.

At Conduit

This is the shape we build at Conduit. The way we build it, every party has a scope only it writes to; agreements link scopes; markets, industries and nations are graphs of those links; and the graphs link into one network with no chain through the middle of it. Replicas agree by quorum, per ledger, and nobody outside an agreement is asked to vote on it or wait for it. Whether a ledger is private or public is set by its agreements, not by the network. We're not saying a global chain was a mistake for what it was built for. We're saying commerce isn't that, and its ledger shouldn't be shaped like it.

What to do with this

The diagnosis is more portable than the vendor. If you're evaluating any shared ledger:

1. Ask who has to agree before your fact is recorded, and who has to wait. If the answer includes anyone who isn't a party to the fact, you're paying for a global referee you don't need, in privacy, in throughput and in trust.
2. Ask where the record sits. If there's one place, there's one place to breach and one operator to trust.
3. Ask whether "private or public" is a network setting or an agreement setting. It should be the second.

A fact belongs to its parties. Record it there, agree it there, and what we end up with isn't a chain.