Multichain Orchestration Architecture (C4)

Document ID: GOS-80-CHAIN-MULTICHAIN-C4 Version: 0.1.0 Status: DRAFT Owner Role: CHAIN_OFFICER Last Review Date: 2026-03-04 Next Review Date: 2026-04-04

Scope

• Mint execution on external token chain
• Milestone anchoring on Algorand
• Kafka-based orchestration with core-ledger truth boundary

Container View

flowchart LR
  A[Core Ledger Service] -->|Outbox events| B[(Kafka)]
  B --> C[Mint Orchestrator]
  C --> D[Policy Gate]
  D --> E[Mint Executor\nTarget Chain Adapter]
  E --> F[Signer Boundary\nHSM or KMS]
  E --> G[Execution Chain RPC]
  B --> H[Algo Anchor Service]
  H --> I[Algorand Adapter]
  I --> J[Signer Boundary\nHSM or KMS]
  I --> K[Algod\nTestnet or Mainnet]
  C --> L[(Orchestration Store)]
  H --> L
  C --> M[(Audit Hash Chain)]
  H --> M
  B --> N[DLQ Handler]

Component Responsibilities

• Core Ledger Service

  • Emits canonical lifecycle events through transactional outbox.
  • Remains write-path truth source.

• Mint Orchestrator

  • Consumes milestone approval events.
  • Produces deterministic intent identity and saga steps.
  • Applies idempotency and retry policy.

• Mint Executor

  • Submits mint transaction to target execution chain.
  • Records confirmations and reorg-safe state transitions.

• Algo Anchor Service

  • Anchors milestone and mint confirmation hashes to Algorand.
  • Persists anchor metadata and linkage to intent.

• Signer Boundary

  • Isolated key custody and signing endpoint.
  • No private keys in application code.

• Kafka

  • Event transport and ordering by intent key.
  • Replay and DLQ workflow support.

Sequence View

sequenceDiagram
  participant Ledger as Core Ledger
  participant Kafka as Kafka
  participant Orch as Mint Orchestrator
  participant Exec as Mint Executor
  participant Chain as Execution Chain
  participant Anchor as Algo Anchor Service
  participant Algo as Algorand

  Ledger->>Kafka: milestone.approved
  Kafka->>Orch: milestone.approved
  Orch->>Kafka: mint.requested
  Kafka->>Exec: mint.requested
  Exec->>Chain: submit mint tx
  Chain-->>Exec: tx confirmed
  Exec->>Kafka: mint.confirmed
  Kafka->>Anchor: mint.confirmed
  Anchor->>Algo: submit hash anchor
  Algo-->>Anchor: anchor confirmed round
  Anchor->>Kafka: anchor.confirmed

Reliability Rules

• Partition key: intentId
• Idempotency key: intentId plus step code
• Confirmation thresholds are chain-specific and configurable
• Every state transition is audit-hash-chained
• Every failure path emits typed reason codes and DLQ event when retry budget ends