Domain Atlas — Reserve Bank & Two-Tier Currency Demo

A monetary-policy committee mints currency, two banks issue their own retail dollars against it, customers pay each other and each other's banks, an independent auditor checks the books, and a fraud gets clawed back — seven real, live acts, nothing staged.

This page plays every party in a two-tier currency system at once — the committee, both banks, three customers, and an independent auditor — the same "one tab, several identities" trick the suspend/clawback demo already uses. Every step below is a genuine, live call to this domain's own server: real fungible balances (SPEC.md §5.4), real committee-approved minting, real bank-to-customer and customer-to-customer payments (§5.4's split mechanism), a real cross-currency settlement at a Trading Station (§7), a real independent attestation (§5.11), and a real suspend-then-clawback of a fraudulent balance (§5.3, §5.12). No admin login anywhere on this page — everything below reaches a self-serve stand-in for whichever authority a step needs, the same way every other demo on this site does.

How the real thing works, briefly

A reserve/central bank normally issues currency directly only to commercial banks — reserve balances, "wholesale" money — never to the public. Commercial banks then extend money to individuals and businesses as deposits, which are technically the bank's own liability, not the central bank's, though ordinarily treated as interchangeable. Real central-bank digital currency projects mostly keep this same two-tier shape: the central bank issues wholesale digital currency to banks, and the banks handle all the retail distribution. Below, "Example Reserve Authority," "Example Bank Alpha," and "Example Bank Beta" are fictional stand-ins playing exactly those three roles — nothing here is modeled on, or represents, any real institution.

One honest limitation, stated plainly rather than glossed over: Bank Alpha and Bank Beta below are both, for now, currencies issued by this one demo domain's own key, playing both bank roles — not two genuinely separate, independently-run domains. The Trading Station settlement in Act 5 runs the exact same, unmodified code that would clear a trade between two truly independent banks' currencies — nothing about that endpoint is issuer-specific — so it's real proof of the mechanism, just not yet proof of two separate live domains actually doing it. That would need a second real deployment with its own domain and signing key, which is a genuine next step, not a limitation of the protocol itself.

Act 1 — the committee approves new reserves

Currency isn't minted unilaterally: a monetary policy committee has to reach its own K-of-N threshold first, reusing the exact same multi-signature mechanism the treasury-approval demo already proves out (SPEC.md §6.2's signed-payload mechanism) — just pointed at a different class and a different recipient.

Act 2 — wholesale issuance to the two banks

The Reserve Authority splits part of its own Reserve Credit balance straight to each bank (SPEC.md §5.4) — exactly what a central bank crediting a commercial bank's reserve account actually is: an accounting entry, not a "transfer" in the retail sense (fungible balances in this protocol move by splitting, never by the unique-item transfer endpoint).

Act 3 — retail conversion

Each bank spends part of its own held Reserve Credits to buy its own retail currency — SPEC.md §5.8's generic purchase mechanism, the same one every purchasable class on this site already uses, 1 Reserve Credit to 1 retail dollar. What a customer eventually holds is the bank's own retail currency — the bank's liability, not the Reserve Authority's — the same real-world distinction between central-bank reserves and an ordinary deposit.

Act 4 — money reaches actual customers

Each bank credits one customer's account (another split), and then that customer pays a second person directly — an ordinary, everyday, same-bank payment, using the identical mechanism a bank just used on them a moment earlier. Nothing about split cares whether the sender is a bank or a person.

Act 5 — a bank-to-bank trade

Alice only holds Alpha Dollars; Bob only holds Beta Dollars. A Trading Station (SPEC.md §7) matches and atomically settles the two — the same open-listing mechanism the plaza's own market already uses for iron/silver/gold, run here across two different currencies instead. Both sides need this domain's Trading Station membership first, joined the same one-click way every other membership on this site already is.

Act 6 — an independent audit

A separate reviewer identity this domain also controls — the same "independent reviewer" stand-in the attestation demo uses (SPEC.md §5.11: a real second key, never the one that issues currency) — examines Bank Alpha's own held Reserve Credit balance and signs an attestation that it's sufficient to back what Bank Alpha has issued. The attestation is a small, independently-verifiable credential in its own right, not this page's own say-so.

Act 7 — a fraud, then a clawback

Bank Beta's own operational key gets compromised. The attacker uses it to do something that looks completely ordinary — split off a large chunk of Bank Beta's legitimate Beta Dollar balance — straight to a wallet they control. Nothing here is fabricated: this is a real, valid, correctly-signed split, exactly like the ones Acts 2–4 already ran. What makes the difference is what happens next.

Act 8 — a sibling domain must also sign off

The same K-of-N mint as Act 1, except the approvers are other DOMAINS' own servers, not individual officers simulated in this one tab. A domain's approval can only ever come from that domain's own server — it has to sign with that domain's own issuer key — so this is the one genuinely new interaction model on this page, not another officer-committee variant. Picture "Example Reserve Authority" and "Example Reserve Authority — Northern Branch" as two separately-run, separately-hosted parts of the same institution: a mint only goes through once both branches' own infrastructure signs off, so no single compromised branch can mint alone.

Unlike every other act on this page, this one needs a real admin login — on this domain's own admin panel, and on the sibling domain's own admin panel too. That's not an oversight: a domain's own signature can only come from that domain's own server, which this page has no way to act on behalf of. Open /atlas-admin/ on each domain in its own tab to actually co-sign below.

Sibling domain address (host, optionally with port) Reserve Credits to mint, once both domains approve

Verify any credential from this page, independently

Paste any credential's raw JSON below — copy one from a "View raw credential" details box above. This runs entirely in your own browser: it fetches this domain's public key and revocation list, the same two public files anyone could fetch directly, then checks the signature and looks the id up in the revocation list.

Can't try Act 8 yourself? Here's a real one that already happened

Act 8 needs a real admin login on two separately-run domains, so most visitors can't complete it themselves. Below is a real consortium mint request, fetched live right now from evtec.co.za's own server — not a screenshot, not staged. The same ungated read Act 8 itself polls, pointed at one specific id that's already run to completion: both evtec.co.za and domain-atlas.co.za really signed it, and it really minted the credential shown.

Every identity on this page (the committee, both banks, all three customers, the fraudster) is an ordinary ECDSA keypair generated fresh in your own browser tab, exactly like every other demo on this site — no accounts, nothing stored server-side beyond the credentials themselves. Suspend and clawback reuse the same self-serve stand-in for admin authority the suspend/clawback demo already introduced, widened to cover these currency classes too. Back to the plaza.

A reserve bank, two commercial banks, and no wallet in sight