Identity that stays plumb
Plumb is a continuously reconciled identity control plane for DLT applications. It converges your identity provider and your ledger's rights model against a single declarative manifest, every 60 seconds, measuring declared state against actual and proving the measurement ran. A wall that is out of plumb has drifted from true; identity that is in plumb has been probed, measured, and found correct.
Running against live Canton networks in development (dev.medici.loan); core loop demonstrated on Midnight (local devnet, 2026-07-14).
Identity drift fails silently
Identity infrastructure breaks without a sound. A right granted on the ledger that the identity provider no longer knows about. A principal whose declared capability quietly stopped being exercisable. A green dashboard fed by a gauge that stopped reading. Nothing alarms, because nothing checked. On a DLT application, a right that should not exist is a right someone can still use.
We built Plumb because that failure is silent by nature and, in a typical stack, nothing is watching for it. Plumb treats identity the way a control room treats a measurement — a reading only counts if the probe ran. It converges your identity provider and your ledger's rights model against one declarative manifest, every 60 seconds, and never mistakes silence for health. Ground truth over self-report.
Prove the check ran — without publishing what it saw
The hard part of reconciling identity is that the state you must check is exactly the state you cannot publish: who holds which rights, and the positions and balances behind them. Midnight's zero-knowledge model meets that tension head-on. Observed state enters a Compact circuit as a private witness — the invariant it must satisfy is public, the underlying legs are not. The chain verifies the verdict, not the data.
Private by construction
Positions, balances, and principal state are supplied as private witnesses. They are proven correct without ever leaving the prover, so drift management over state you are not allowed to disclose becomes possible — not merely permitted.
Circuit-enforced correctness
Correctness is enforced by the circuit, not asserted after the fact. A proof is unforgeable unless the invariant actually holds, so a false "converged" claim fails the circuit before any proof exists. Verification is cryptographic, not a forensic reconstruction of logs.
Selective disclosure
The same construction is intended to let an operator reveal exactly what a regulator or counterparty needs from the very proof that satisfied the chain — and nothing more. The goal is compliance without a wholesale data dump.
Authorization drift isn't hypothetical
The silent failure Plumb watches for has a track record. Some of the largest losses in crypto and in the cloud trace not to a clever new exploit, but to a permission that outlived its purpose, a key nobody rotated, or a role scoped too wide — and nothing that re-checked. A few, dated and sourced.
Ronin Bridge
Roughly $540M, March 2022. A signing permission granted to one party in November 2021 was discontinued a month later — but never revoked. Once attackers were inside, that stale grant supplied the final validator signature they needed to clear the theft.
The loss ran through a permission that outlived its purpose. Post-mortem
Storm-0558
U.S. federal email, 2023. A signing key from 2016 that should have been retired was never rotated, and a scope boundary meant to keep a consumer key off enterprise systems silently stopped holding. A review board called the intrusion preventable.
A credential years past its intended life, still trusted. Analysis
Capital One
106M records; an $80M penalty, 2019. A web-application firewall held an access role scoped far wider than it needed — able to read customer data across hundreds of storage buckets. One request forgery turned that standing over-grant into a breach.
A role that could reach far more than its job required. Case study
Plumb does not claim it would have prevented these outright — something else opened each door. The claim is narrower, and it is the whole point: continuous reconciliation shrinks the window in which a permission that should be gone is still usable, and the blast radius when something else goes wrong. A reading only counts if the probe ran.
Probed, never assumed
Plumb runs one loop, deliberately unexciting: converge, probe, heal — the same three steps every 60 seconds, so that "in plumb" means the same thing today as it did yesterday. Nothing is inferred from a dashboard; every reading is earned by a probe that actually ran.
Converge
One declarative manifest states which principals exist, and with which rights, across the identity provider and the ledger's rights model — with a deployment-substrate plane planned, not yet built. Every cycle, observed state is brought back to declared state. No cycle is optional.
Probe
Synthetic probes prove a principal's declared capability is actually exercisable — not merely configured. A failed cycle and a clean cycle are both signals; silence is never mistaken for health.
Heal
Detected drift is converged back to the manifest, unattended. Operational status speaks control-room language: green is converged, amber is drift, red is incident.
The same loop, on two networks
Plumb converges identity the same way everywhere — converge, probe, heal. What differs is the ledger it settles on. It runs today on Canton, in development; on Midnight the same checks would become zero-knowledge circuits, and that work is an open proposal.
Plumb runs today on Canton — it is the reconciler that keeps Medici's own environment (dev.medici.loan) converged, every 60 seconds.
- Converge — one manifest reconciles the identity provider and Canton's rights model.
- Probe — synthetic probes prove a principal's declared rights are actually exercisable on the ledger.
- Heal — drift is converged back unattended; a wipe-tested rebuild returns to green in minutes.
Runs in a development environment — not in production.
On Midnight the same checks would run as zero-knowledge circuits — the verdict goes on chain, the underlying state stays a private witness.
- Prove — observed state enters a Compact circuit privately; the chain verifies the verdict, not the data.
- Demonstrated — drift-verdict and P/N conservation circuits ran with real proofs on a local devnet (2026-07-14).
- Proposed — a Midnight adapter and a funded public-testnet probe are proposed; neither has been built.
Local devnet only; further work is not started, not funded.
What is demonstrated, dated and scoped
No projections, no promises — the claims below are limited to what has run, where it ran, and when.
Canton — running in development
Plumb is the identity reconciler that keeps Medici's own environment (dev.medici.loan) converged. Wipe-tested recovery: identity database dropped, every subject re-issued, ledger-side users orphaned — back to fully green with zero manual steps in about 4–6 minutes.
Measured on Medici's own dev environment (one IdP, one participant, ~15 principals); recovery time varies with principal count and topology.
Midnight — core loop demonstrated
2026-07-14, local devnet: declared manifest versus observed state, judged through a Compact circuit, with real zero-knowledge proofs for both verdicts — converged and drift. A false claim fails the circuit before any proof exists.
Local devnet only; no testnet claim is made. Further Midnight work is an open proposal — not started, not funded.
Privacy by construction
In the Midnight demonstration, observed identity state never leaves the prover — it enters the circuit as a private witness. The chain verifies the verdict, not the data. Drift management over state you cannot publish is the demand-for-privacy case.
An agent-identity stack is forming around Midnight — Passport (Midnight's consumer-onboarding product, in development), OWS (MoonPay's chain-agnostic Open Wallet Standard; no published Midnight integration as of 2026-07-14), plus the chain-neutral Legal Context Protocol. Verified against their published specifications (2026-07-14): OWS is a signing-time policy gate and LCP a per-transaction legal record — neither is a drift-management loop that continuously verifies those layers still agree with each other, with an enterprise IdP, and with what the chain actually accepts. That layer is unclaimed today (as of 2026-07-14). Plumb is built to converge into that stack, not around it.
Medici — the house behind Plumb
Plumb is a product of Medici (AAA Flowers S.A., operating as Medici). Medici builds options-based index-tracking synthetic assets on Canton Network — positions constructed from options rather than debt, so there is no liquidation price by construction. Plumb began as the identity control plane inside that system and is the same software, held to the same discipline.
The Medici app
DevnetThe live application on Canton devnet: collateral splits into Protected and Amplified tokens with multi-attestation oracles, on-chain multi-sig governance, and an agent framework for supervised strategy execution.
Medici docs
LiveArchitecture, contract reference, and operations documentation for the Medici system — including the identity reconciliation layer that became Plumb.
The mechanism
ResearchThe public research behind Medici's synthetic assets: index tracking built on options instead of debt, with the P + N conservation invariant proven in closed form.
Get in touch
No public mailing address is listed. Nothing here is a solicitation.