Plumb by Medici

Identity that stays plumb

Plumb is a continuously reconciled identity control plane for DLT applications. It converges your identity provider and your ledger's rights model against a single declarative manifest, every 60 seconds, measuring declared state against actual and proving the measurement ran. A wall that is out of plumb has drifted from true; identity that is in plumb has been probed, measured, and found correct.

Running against live Canton networks in development (dev.medici.loan); core loop demonstrated on Midnight (local devnet, 2026-07-14).

Why Plumb exists

Identity drift fails silently

Identity infrastructure breaks without a sound. A right granted on the ledger that the identity provider no longer knows about. A principal whose declared capability quietly stopped being exercisable. A green dashboard fed by a gauge that stopped reading. Nothing alarms, because nothing checked. On a DLT application, a right that should not exist is a right someone can still use.

We built Plumb because that failure is silent by nature and, in a typical stack, nothing is watching for it. Plumb treats identity the way a control room treats a measurement — a reading only counts if the probe ran. It converges your identity provider and your ledger's rights model against one declarative manifest, every 60 seconds, and never mistakes silence for health. Ground truth over self-report.

How zero-knowledge helps

Prove the check ran — without publishing what it saw

The hard part of reconciling identity is that the state you must check is exactly the state you cannot publish: who holds which rights, and the positions and balances behind them. Midnight's zero-knowledge model meets that tension head-on. Observed state enters a Compact circuit as a private witness — the invariant it must satisfy is public, the underlying legs are not. The chain verifies the verdict, not the data.

Private by construction

Positions, balances, and principal state are supplied as private witnesses. They are proven correct without ever leaving the prover, so drift management over state you are not allowed to disclose becomes possible — not merely permitted.

Circuit-enforced correctness

Correctness is enforced by the circuit, not asserted after the fact. A proof is unforgeable unless the invariant actually holds, so a false "converged" claim fails the circuit before any proof exists. Verification is cryptographic, not a forensic reconstruction of logs.

Selective disclosure

The same construction is intended to let an operator reveal exactly what a regulator or counterparty needs from the very proof that satisfied the chain — and nothing more. The goal is compliance without a wholesale data dump.

Why this should worry you

Authorization drift isn't hypothetical

The silent failure Plumb watches for has a track record. Some of the largest losses in crypto and in the cloud trace not to a clever new exploit, but to a permission that outlived its purpose, a key nobody rotated, or a role scoped too wide — and nothing that re-checked. A few, dated and sourced.

Ronin Bridge

Roughly $540M, March 2022. A signing permission granted to one party in November 2021 was discontinued a month later — but never revoked. Once attackers were inside, that stale grant supplied the final validator signature they needed to clear the theft.

The loss ran through a permission that outlived its purpose. Post-mortem

Storm-0558

U.S. federal email, 2023. A signing key from 2016 that should have been retired was never rotated, and a scope boundary meant to keep a consumer key off enterprise systems silently stopped holding. A review board called the intrusion preventable.

A credential years past its intended life, still trusted. Analysis

Capital One

106M records; an $80M penalty, 2019. A web-application firewall held an access role scoped far wider than it needed — able to read customer data across hundreds of storage buckets. One request forgery turned that standing over-grant into a breach.

A role that could reach far more than its job required. Case study

Plumb does not claim it would have prevented these outright — something else opened each door. The claim is narrower, and it is the whole point: continuous reconciliation shrinks the window in which a permission that should be gone is still usable, and the blast radius when something else goes wrong. A reading only counts if the probe ran.

The invariant

Probed, never assumed

Plumb runs one loop, deliberately unexciting: converge, probe, heal — the same three steps every 60 seconds, so that "in plumb" means the same thing today as it did yesterday. Nothing is inferred from a dashboard; every reading is earned by a probe that actually ran.

drift=0 means "probed, no drift"— never "didn't probe"

Converge

One declarative manifest states which principals exist, and with which rights, across the identity provider and the ledger's rights model — with a deployment-substrate plane planned, not yet built. Every cycle, observed state is brought back to declared state. No cycle is optional.

Probe

Synthetic probes prove a principal's declared capability is actually exercisable — not merely configured. A failed cycle and a clean cycle are both signals; silence is never mistaken for health.

Heal

Detected drift is converged back to the manifest, unattended. Operational status speaks control-room language: green is converged, amber is drift, red is incident.

How it works

The same loop, on two networks

Plumb converges identity the same way everywhere — converge, probe, heal. What differs is the ledger it settles on. It runs today on Canton, in development; on Midnight the same checks would become zero-knowledge circuits, and that work is an open proposal.

Canton
Canton In development

Plumb runs today on Canton — it is the reconciler that keeps Medici's own environment (dev.medici.loan) converged, every 60 seconds.

  • Converge — one manifest reconciles the identity provider and Canton's rights model.
  • Probe — synthetic probes prove a principal's declared rights are actually exercisable on the ledger.
  • Heal — drift is converged back unattended; a wipe-tested rebuild returns to green in minutes.

Runs in a development environment — not in production.

Midnight
Midnight Open proposal

On Midnight the same checks would run as zero-knowledge circuits — the verdict goes on chain, the underlying state stays a private witness.

  • Prove — observed state enters a Compact circuit privately; the chain verifies the verdict, not the data.
  • Demonstrated — drift-verdict and P/N conservation circuits ran with real proofs on a local devnet (2026-07-14).
  • Proposed — a Midnight adapter and a funded public-testnet probe are proposed; neither has been built.

Local devnet only; further work is not started, not funded.

Proof

What is demonstrated, dated and scoped

No projections, no promises — the claims below are limited to what has run, where it ran, and when.

Canton — running in development

Plumb is the identity reconciler that keeps Medici's own environment (dev.medici.loan) converged. Wipe-tested recovery: identity database dropped, every subject re-issued, ledger-side users orphaned — back to fully green with zero manual steps in about 4–6 minutes.

Measured on Medici's own dev environment (one IdP, one participant, ~15 principals); recovery time varies with principal count and topology.

Midnight — core loop demonstrated

2026-07-14, local devnet: declared manifest versus observed state, judged through a Compact circuit, with real zero-knowledge proofs for both verdicts — converged and drift. A false claim fails the circuit before any proof exists.

Local devnet only; no testnet claim is made. Further Midnight work is an open proposal — not started, not funded.

Privacy by construction

In the Midnight demonstration, observed identity state never leaves the prover — it enters the circuit as a private witness. The chain verifies the verdict, not the data. Drift management over state you cannot publish is the demand-for-privacy case.

An agent-identity stack is forming around Midnight — Passport (Midnight's consumer-onboarding product, in development), OWS (MoonPay's chain-agnostic Open Wallet Standard; no published Midnight integration as of 2026-07-14), plus the chain-neutral Legal Context Protocol. Verified against their published specifications (2026-07-14): OWS is a signing-time policy gate and LCP a per-transaction legal record — neither is a drift-management loop that continuously verifies those layers still agree with each other, with an enterprise IdP, and with what the chain actually accepts. That layer is unclaimed today (as of 2026-07-14). Plumb is built to converge into that stack, not around it.

The house

Medici — the house behind Plumb

Plumb is a product of Medici (AAA Flowers S.A., operating as Medici). Medici builds options-based index-tracking synthetic assets on Canton Network — positions constructed from options rather than debt, so there is no liquidation price by construction. Plumb began as the identity control plane inside that system and is the same software, held to the same discipline.

The Medici app

Devnet

The live application on Canton devnet: collateral splits into Protected and Amplified tokens with multi-attestation oracles, on-chain multi-sig governance, and an agent framework for supervised strategy execution.

Medici docs

Live

Architecture, contract reference, and operations documentation for the Medici system — including the identity reconciliation layer that became Plumb.

The mechanism

Research

The public research behind Medici's synthetic assets: index tracking built on options instead of debt, with the P + N conservation invariant proven in closed form.

Contact

Get in touch

hello@plumb.finance

No public mailing address is listed. Nothing here is a solicitation.