Paxiom
Paxiom · Compliance Architecture · Drawing Set
Verifiable Records Architecture
What is recorded, where, and how to verify it independently of any Paxiom-operated infrastructure.
Project No.
PXM-001-CA
Issue
CA.01 / Rev. A
Date
2026.05.01
Drawn By
K. Luecke
Sheet CA-000 · Cover & Index

Audit trail
as a byproduct.

Paxiom emits permanent, public records of every coordinated protocol action. The architecture produces an audit trail as a byproduct of cross-chain coordination, not as a separate compliance overlay. This document specifies what is recorded, where, and how to verify it independently.

Document Type
Architecture Specificationrecording surface, not build spec
Audience
Counterparties & auditorsintegrating protocols, operators
Status
Testnetproof of concept on Sepolia, mainnet pending
Series
CA · Compliance ArchitectureCA.02 (HyperBEAM) and CA.03 (ZK) forthcoming
Companion Set
A · B · E · O · FPhase 1, Narrative, Identity, Ops, Vision
What This Is Not
Not an omission proofsee CA.01.1; addressed by CA.03
CA-000
Cover & Indexthis sheet
CA-100
Purposewhy this document exists, who it's for
CA-200
Scope and Limitswhat this proves and what it does not
CA-300
Componentsdeployed contracts and AO processes
CA-400
Reference Cyclecross-chain settlement, end to end
CA-500
Independent Verificationretrieving and confirming any recorded event
CA-600
Roadmapplanned extensions and revisions
CA-700
Referencesrelated documents and external infrastructure
CA-100 · Purpose

What this document is for.

Coordination needs first; audit trail second. The two requirements are satisfied by the same artifact, and that is what makes the architecture work.

Paxiom coordinates state across multiple chains. To do so, every protocol action must produce a record that is durable, structured, and recoverable by parties who do not share Paxiom's runtime. The records described here exist for the protocol's own coordination needs first, and as a public audit trail second.

This document is intended for readers who need to verify Paxiom's behavior independently: counterparties, auditors, integrating protocols, and operators of the system itself. It assumes familiarity with EVM events, Arweave's permanence model, and the AO actor runtime; readers who need that grounding should reference the related documents listed in CA-700.

The implementation specified here is a proof of concept on public testnets. It demonstrates the recording and verification surface against the simplest viable loan structure ahead of more complex loan structures, verifiable chain access via HyperBEAM, ZK verification of execution traces, and mainnet deployment. The forward sequence is given in CA-600 Roadmap.

CA-200 · Scope and Limits

Two records,
one correspondence.

Two sources of record exist in the Paxiom system. The value of the architecture is the verifiable correspondence between them.

The two sources

On-chain transaction logs on each operating chain are the canonical source of truth. Every protocol action that mutates state — pool borrows, repayments, fee distributions, OApp message sends and receipts — emits one or more events to the chain on which it occurred.

AO process state on Arweave is a permanent, structured mirror of those events. Each AO message records the originating chain, contract, transaction hash, block, timestamp, and event-specific fields, indexed for retrieval.

A reader queries either source independently and confirms the records agree. The procedure is specified in CA-500.

Proves What this architecture establishes CA-200 / P.01
  • Records were not altered after the fact (Arweave permanence)
  • Recorded events match the on-chain transactions they reference (anchoring via tx hash)
  • Records remain available regardless of Paxiom's operational status
  • The set of recorded events is internally consistent with the protocol's stated rules
Does Not Prove Limits of this architecture CA-200 / D.01
  • That every protocol action was logged — selective omission by an operator is not detected by this layer alone
  • The off-chain identity, authority, or intent of any party
  • The economic correctness of any individual action — only that it occurred and was recorded as described
  • That signed messages corresponded to authorized intent at the time of signing

The first limitation — selective omission — is the substantive one and is addressed in the Paxiom roadmap by ZK verification of execution traces. CA.03 (forthcoming) will specify that layer. The remaining limitations are inherent to any on-chain system and are noted here for completeness rather than as defects of this architecture.

CA-300 · Components

The deployed recording surface.

Five live components on public testnets. Two contracts on each operating chain, plus the AO Compliance Process and AO Consensus Process on Arweave. Mainnet equivalents pending per CA-600.

Component Network Address / Process ID Status
Testnet only — these contracts are deployed to Optimism Sepolia and Base Sepolia for proof-of-concept evidence. Do not interact with these addresses from a mainnet wallet.
PaxiomOApp Optimism Sepolia 0x5fE0c2d112cf4E579271DD1f864C86dC193a1d0F Live
PaxiomOApp Base Sepolia 0x607DB3774343Abc650Ef31d9414bCA9D24b0C254 Live
PaxiomPool Optimism Sepolia 0x28321b5030B4E03ACCBD4236D1a97E01A7a9fc92 Live
AO Compliance Process Arweave / AO w_MR7QlkfuRcfd3TQJPD1pzMwU5yEEyLMDjO0Ql8_5I Live
AO Consensus Process Arweave / AO b-SlkvSm8FnADwSupRxlAXN6rezSnosjVakMmpfd_w0 Live

All addresses are testnet. Verification procedures in CA-500 use these addresses directly; readers should substitute mainnet addresses once D.01 (mainnet deployment) is complete.

CA-400 · Reference Cycle

Cross-chain settlement.

The reference event is the first cross-chain loan settlement coordinated by Paxiom. Capital is deployed on both chains in parallel; execution is synchronized via the AO Compliance Process; a final data frame is written to Arweave as the permanent record.

The diagram below shows the architectural shape only. Concrete contract calls, message contents, and the per-chain execution sequence are pending and will be specified in Rev B.

AO COORDINATOR initiates simultaneous execution on both chains coordination coordination CHAIN A Optimism Sepolia execution leg [ to be specified ] CHAIN B Base Sepolia execution leg [ to be specified ] OApp cross-chain messaging AO observes both legs · writes settled state ARWEAVE final data frame · permanent record
FIG. CA-400.1Cross-chain coordination architecture, abstract. AO initiates and observes; chains execute in parallel and exchange messages via OApp; AO writes the final consolidated data frame to Arweave. Concrete sequence and contract calls to be specified in Rev B.

The cycle proceeds in three phases.

  1. Coordination

    The AO Compliance Process initiates execution by dispatching coordination signals to both chains. The two legs of the cycle are scheduled to execute in parallel rather than sequentially, removing the latency window in which one leg could complete without the other.

  2. Execution

    Each chain executes its leg locally, exchanging cross-chain messages via the LayerZero OApp where state on one chain depends on confirmation from the other. AO observes both legs as they progress.

  3. Settlement

    Once both legs are confirmed, AO writes a single consolidated data frame to Arweave summarizing the cycle: the chains involved, the contracts called, the transaction hashes on each side, and the final state. The data frame is permanent and queryable independently of Paxiom-operated infrastructure.

Implementation Note AO normalizes custom tag names to lowercase CA-400 / N.01

AO normalizes custom tag names to lowercase on receipt. EventType becomes eventtype; TxHash becomes txhash. Queries against AO process state must use the lowercased forms. This is a property of the AO runtime, not of Paxiom; documentation that asserts the mixed-case tag names will fail to match.

CA-500 · Independent Verification

Verifying without
trusting Paxiom.

A reader who does not trust Paxiom-operated infrastructure can verify any recorded event using only public infrastructure. The procedure is independent of any single block explorer or AO front-end.

Four steps. Both records must exist and agree for the event to be considered verified.

  1. Retrieve on-chain event

    Query any RPC provider or public block explorer for the relevant chain using the contract address and transaction hash. Decode the event using the published contract ABI.

  2. Retrieve AO message

    Query Arweave's GraphQL endpoint at https://arweave.net/graphql, filtering by the AO process ID and the event type tag (lowercased per CA-400 / N.01). The endpoint returns the AO message and its tags.

  3. Confirm tx hash correspondence

    The txhash tag of the AO message must equal the on-chain transaction hash retrieved in step 1. If the values differ, the AO message does not correspond to the claimed on-chain action.

  4. Confirm event field correspondence

    The event-specific fields in the AO message must equal the decoded fields of the on-chain event. If both sources exist and agree, the event is verified.

Three outcomes

Both records exist and agree. The event is verified. This is the expected outcome for a healthy system.

Only the on-chain record exists. The AO mirror was not written. The event is treated as a recording gap. Operationally this should trigger an investigation into the AO Compliance Process; from a verification perspective the on-chain record stands as canonical.

Only the AO record exists. No corresponding on-chain transaction. The AO record is unverified and should be disregarded. An AO message without an anchor in chain state is, by definition, a claim about an action that did not occur.

Rev B Worked example pending CA-500 / N.01

A worked example with concrete tx hashes, AO message IDs, and a runnable GraphQL query will be added in the next revision. Until then, the procedure above can be exercised against any of the components listed in CA-300.

CA-600 · Roadmap

Planned extensions.

The implementation specified in this document is a proof of concept on public testnets. The following items are planned in sequence; each will be specified in its own document as it is implemented.

  • CA.01 / Rev B Worked verification example with concrete tx hashes and runnable GraphQL query Next
  • P.01 Complex loan structures: multi-asset positions, variable timeouts, partial repayments Planned
  • CA.02 Verifiable chain access via HyperBEAM — reduces external RPC providers as a trust and availability vector Planned
  • CA.03 ZK verification of execution traces; addresses selective-omission limitation noted in CA-200 Planned
  • D.01 Mainnet deployment of all components currently on Sepolia testnets Planned
  • S.01 Capacity, drawdown, and rebalance accounting Planned
CA-700 · References

Related documents.

Companion documents in the Paxiom drawing set and external infrastructure this architecture depends on.

Within the drawing set

A-Series Phase 1 Blueprint. The build specification for the current phase. Service 02 (sync committee verification) is the first product to ship; this compliance architecture is the audit substrate it lands on. Open the Phase 1 Blueprint.

B-Series Project Narrative. The broader project context. Verifiable records sit within the larger Paxiom thesis at the level of architectural commitment. Open the Project Narrative.

O-Series Operations Runbook. Procedural infrastructure for incident response and routine operations. The recording surface specified here is the source of evidence for post-incident review per O-900. Open the Operations Runbook.

E-Series Key Custody & Identity. How signing authority is partitioned and rotated. Off-chain identity is explicitly out of scope for this architecture (per CA-200); the E-series specifies the layer that handles it. Open the Key Custody Blueprint.

F-Series Phase 2 Vision Brief. The forward arc. Phase 2 customers in regulated industries are the primary consumers of the audit posture this architecture establishes. Open the Phase 2 Vision Brief.

External infrastructure

LayerZero OApp. The cross-chain messaging primitive used between operating chains. docs.layerzero.network.

AO & Arweave. Permanent storage and autonomous compute substrate that hosts the AO Compliance Process and AO Consensus Process. cookbook.arweave.dev.

Source code and deployment artifacts. github.com/k-luecke.

Revision log

Rev. A — 2026.05.01. Initial issue. Seven sheets covering purpose, scope and limits, components, the cross-chain reference cycle, the independent verification procedure, the forward roadmap, and references. Status: testnet proof of concept.

Rev. B will add the worked verification example with concrete tx hashes, AO message IDs, and a runnable GraphQL query. Subsequent revisions will track mainnet deployment and the introduction of CA.02 (HyperBEAM-mediated chain access) and CA.03 (ZK execution-trace verification).