The commodity pipeline

Most of this documentation describes what Doré proves. This page describes what Doré is about: how a physical commodity actually moves from the ground to a buyer, who touches it, what paper is created at each step, and where financing attaches. Everything downstream — the claim schema, the archetypes, the cost model, the ceiling — is a formalization of the process on this page.

If you are new to commodity finance, read this first. If you are here for the result, jump to why the pipeline is hard.

Why financing fails

The instinct is to treat commodity finance as a shortage of money. It is not. The gap is a repeatable reason why economically attractive transactions fail to reach willing capital — and it lives in the institutional filters between commerce and money, not in the supply of either.

A trade has to cross four bridges to become fundable, and it dies if any one is missing:

A bank can therefore reject perfectly good economics. A trade with a real buyer, physical collateral and an attractive margin still fails when the ticket is too small, the borrower too new, the country limit full, the compliance burden heavy, the collateral control hard to evidence, or the legal structure simply unfamiliar. None of those are judgments about the trade.

The opportunity is the conversion layer between a real transaction and a financeable claim.

That sentence is the whole project. The stages below are what has to be converted.

The pipeline, stage by stage

Two chains run in parallel and have to stay in step: the physical chain (the metal moves) and the financial chain (someone is out of pocket until it is sold). Financing exists because the two are not synchronised — cash leaves before cash returns.

Each stage below names what happens, what paper it creates, what goes wrong, and where Doré formalizes it.

1. Production

The chain begins at a producer or mine and runs producer → trader → refiner → warehouse/custodian → buyer. The financier's exposure here is to something that does not exist yet, which is why the instrument is a prepayment: a financier or buyer prepays a producer in exchange for future deliveries, or repayment out of future sales.

Goes wrong: production failure, country risk, offtake disputes — future-asset risk in general. Formalized: CorpusProduction.lean (metal stream, production payment, NSR royalty) and the producer-prepayment instance in CorpusStructured.lean.

2. Purchase — the working-capital gap opens

The trader pays the supplier before the downstream buyer pays the trader. That timing mismatch is the entire reason commodity finance exists; everything else is machinery for making it safe to bridge.

The primer's worked example is worth stating in full because the rest of this site is calibrated against it: a trader buys $10,000,000 of eligible gold on a 1.50% gross spread — $150,000 — before freight, refining, insurance and losses.

Goes wrong: broken sale, fraud, title defect, delay, price and basis risk. Formalized: trade loan and self-liquidating structures in CorpusOpenAccount.lean; tl_double_repayment_rejected blocks paying the same obligation twice.

3. Transport, assay and refining

The metal moves and is assayed or refined. Cash stays tied up throughout, so every day here is a day of financing cost. Assay matters legally as well as physically: it is what converts "some gold" into a specified quantity and fineness that a claim can reference.

Protection, not financing: cargo and specie cover protects the goods against defined transit and storage losses. It does not automatically cover borrower default — a distinction that collapses in most pitch decks. Formalized: assay is real coverage, not a placeholder. Lot.lean carries gross and fine quantity as separate dimensions with LotWellFormed requiring fine ≤ gross, and cannot_refine_without_required_assay_evidence blocks refining without the assay certificate. Short delivery is pp_short_cargo_rejected — delivering 7 against a 10-unit right returns .quantityMismatch rather than discharging anything.

4. Warehouse and custody — the lender takes control

The commodity sits in an approved warehouse or a controlled custody arrangement, and the lender advances against it with a haircut. This is where paper becomes decisive: warehouse receipts and bills of lading.

The course names the classic failure here, and it is worth quoting because it is the single most expensive fraud in the industry (see risk and collateral): the same commodity, warehouse receipt, or receivable being pledged to multiple financiers.

Formalized, and this one is exact: whr_double_pledge_rejected — a second lender attempting a pledge over stock already pledged is refused at the world layer with a specific error, not a warning. whr_phantom_stock_pledge_rejected does the same for stock that does not exist. These are the two frauds that have killed real commodity lenders, and they are unrepresentable rather than detected.

4b. Refining, and what happens to the lender's security

Refining is a transformation: metal goes in, less metal comes out, and the difference has to be accounted rather than assumed. Lot.lean enforces conservation in each dimension separately — transformation_no_fine_creation and chain_conservation — so a tolling stage cannot mint fine metal.

The question a lender actually asks here is whether its security survives the transformation. It does, and that is proved: transform_carries_security.

5. Crossing borders

The metal passes producer country → transit → warehouse or refinery → buyer country. At each boundary the applicable law can change when ownership transfers, whether a security interest is effective, how insolvency is treated, whether proceeds can move, and who can enforce.

Goes wrong: title uncertainty; a lien or pledge not created, perfected, or correctly ranked; borrower or custodian insolvency; sanctions and AML ineligibility; enforcement uncertainty across forums. Formalized — partly, and this is the weakest stage in the development. The legal question is covered: LegalIR.lean binds every rule to a hashed source and eval_unsourced_never_feasible proves the engine cannot return a favourable verdict from law it has not read. The physical border is not: there is no customs event, no export-licence gate, no freight leg, no Incoterm, and ActorRole.transporter exists but no theorem uses it. Transport and customs appear in the development only as basis-point placeholders in the cost model. Stated here rather than left for a reader to discover.

6. The draw and monitoring loop

Stages 3 to 7 are not a straight line — a control loop runs across them, and it has five steps:

1. the borrower requests a draw;
2. independent evidence confirms eligible collateral exists;
3. financing is released only up to the permitted advance rate;
4. release of collateral requires repayment or authorised substitution;
5. monitoring updates exposure as inventory moves.

Formalized: CorpusLink.lean computes monitor verdicts from settlement receipts, so link_verdicts_immune_to_world_events holds — a violation cannot be laundered by reassigning a beneficiary or discharging the obligation somewhere else. The advance-rate limit is a well-formedness constraint on the architecture itself, not a runtime check.

7. Sale, then repayment

The sale to the buyer or offtaker is the commercial event that produces repayment cash; where it has already generated an invoice, receivables finance and factoring attach here. Proceeds then repay the advance through a waterfall.

The primer completes its example here, and this is the number that reframes the whole business: the 14-day financing cost is approximately $42,200 — that is $10m at 11% for 14 days — leaving roughly $107,800 of the $150,000 spread. Financing cost is incurred only for the days capital is actually outstanding, which is why velocity, not rate, is the lever.

Formalized: settlement_never_premature — a facility cannot settle before its due time; rd_double_sale_rejected and fac_route_double_sale_rejected block selling the same receivable twice.

8. Aggregation into an investable product

Once credit is aggregated, an SPV separates the operating borrower from the investment claim, and a waterfall allocates cash and losses across senior, mezzanine and junior/first-loss tranches.

Formalized: CorpusPools.lean instances tranching (trn_waterfall_allocates_loss, trn_junior_blocked_under_stress) over the generic Waterfall.distribute, and LiquidationWaterfall.sol implements the rulebook order onchain. NAV share redemption is separate, in Strategy.lean — burn_payout_le_nav. The instanced tranching is two-layer senior/junior; mezzanine is expressible in the n-layer distributor but is not instanced.

9. Distress, if it comes

If the transaction fails, the cost stack continues: workout, collections, security enforcement, insurer claim, asset realisation, dispute resolution. The course is blunt about the trap: a 90-day claim waiting period can reduce ultimate credit loss while leaving a severe short-term liquidity gap. Solvency and liquidity are different failures.

Formalized — and here is an honest limit. The recovery amounts are covered: insuranceRecovery, reinsuranceRecovery, stacked_protection_le_loss and no_double_recovery all bound what protection can pay. The recovery timing is not. The 90-day delay is carried as insClaimDelayDays in the deck environment and is then proved to be read by nothing — eval_arch_ignores_unmodeled_params. So the sharpest distress lesson in the course is deliberately recorded as outside the model rather than quietly assumed into it.

The other timing mismatch

There is a second clock, and it is the one that kills deals that survive everything above. A transaction may need cash in days, while diligence, investment committees, documentation, subscriptions and settlement take weeks or months.

That is the same velocity problem as stage 7, moved to the capital side, and it is where a protocol has a structural advantage over a committee. Not because onchain capital is cheaper — it is often dearer — but because it can arrive on the timescale the trade actually runs on.

Does the trade pay for itself?

With the stages named, the question becomes measurable — and the answer is sharp enough to deserve its own page. The unit economics works it through: why a commodity borrower compares your coupon to its return on capital rather than to a bank rate, why the completed pipeline does not finance itself at a 1% margin on a 30-day cycle, and why time beats price by roughly six to one.

How much of the corpus is executable

One ratio belongs on this page rather than buried in a report: of the 100 archetypes recorded in the encyclopedia, 29 are executable Lean instances and the rest are records only. A record fixes the archetype's structure, parties and intended compilation; an instance runs it against the kernel and proves its positives and negatives. When this documentation says an archetype is covered, check which of the two is meant.