The commodity pipeline

Most of this documentation describes what Doré proves. This page describes what Doré is about: how a physical commodity actually moves from the ground to a buyer, who touches it, what paper is created at each step, and where financing attaches. Everything downstream — the claim schema, the archetypes, the cost model, the ceiling — is a formalization of the process on this page.

If you are new to commodity finance, read this first. If you are here for the result, jump to why the pipeline is hard.

Why financing fails

The instinct is to treat commodity finance as a shortage of money. It is not. The gap is a repeatable reason why economically attractive transactions fail to reach willing capital — and it lives in the institutional filters between commerce and money, not in the supply of either.

A trade has to cross four bridges to become fundable, and it dies if any one is missing:

A bank can therefore reject perfectly good economics. A trade with a real buyer, physical collateral and an attractive margin still fails when the ticket is too small, the borrower too new, the country limit full, the compliance burden heavy, the collateral control hard to evidence, or the legal structure simply unfamiliar. None of those are judgments about the trade.

The opportunity is the conversion layer between a real transaction and a financeable claim.

That sentence is the whole project. The stages below are what has to be converted.

The pipeline, stage by stage

Two chains run in parallel and have to stay in step: the physical chain (the metal moves) and the financial chain (someone is out of pocket until it is sold). Financing exists because the two are not synchronised — cash leaves before cash returns.

Each stage below names what happens, what paper it creates, what goes wrong, and where Doré formalizes it.

1. Production

The chain begins at a producer or mine and runs producer → trader → refiner → warehouse/custodian → buyer. The financier's exposure here is to something that does not exist yet, which is why the instrument is a prepayment: a financier or buyer prepays a producer in exchange for future deliveries, or repayment out of future sales.

Goes wrong: production failure, country risk, offtake disputes — future-asset risk in general. Formalized: CorpusProduction.lean (metal stream, production payment, NSR royalty) and the producer-prepayment instance in CorpusStructured.lean.

2. Purchase — the working-capital gap opens

The trader pays the supplier before the downstream buyer pays the trader. That timing mismatch is the entire reason commodity finance exists; everything else is machinery for making it safe to bridge.

The primer's worked example is worth stating in full because the rest of this site is calibrated against it: a trader buys $10,000,000 of eligible gold on a 1.50% gross spread — $150,000 — before freight, refining, insurance and losses.

Goes wrong: broken sale, fraud, title defect, delay, price and basis risk. Formalized: trade loan and self-liquidating structures in CorpusOpenAccount.lean; tl_double_repayment_rejected blocks paying the same obligation twice.

3. Transport, assay and refining

The metal moves and is assayed or refined. Cash stays tied up throughout, so every day here is a day of financing cost. Assay matters legally as well as physically: it is what converts "some gold" into a specified quantity and fineness that a claim can reference.

Protection, not financing: cargo and specie cover protects the goods against defined transit and storage losses. It does not automatically cover borrower default — a distinction that collapses in most pitch decks. Formalized: assay is real coverage, not a placeholder. Lot.lean carries gross and fine quantity as separate dimensions with LotWellFormed requiring fine ≤ gross, and cannot_refine_without_required_assay_evidence blocks refining without the assay certificate. Short delivery is pp_short_cargo_rejected — delivering 7 against a 10-unit right returns .quantityMismatch rather than discharging anything.

4. Warehouse and custody — the lender takes control

The commodity sits in an approved warehouse or a controlled custody arrangement, and the lender advances against it with a haircut. This is where paper becomes decisive: warehouse receipts and bills of lading.

The course names the classic failure here, and it is worth quoting because it is the single most expensive fraud in the industry: the same commodity, warehouse receipt, or receivable being pledged to multiple financiers.

Formalized, and this one is exact: whr_double_pledge_rejected — a second lender attempting a pledge over stock already pledged is refused at the world layer with a specific error, not a warning. whr_phantom_stock_pledge_rejected does the same for stock that does not exist. These are the two frauds that have killed real commodity lenders, and they are unrepresentable rather than detected.

4b. Refining, and what happens to the lender's security

Refining is a transformation: metal goes in, less metal comes out, and the difference has to be accounted rather than assumed. Lot.lean enforces conservation in each dimension separately — transformation_no_fine_creation and chain_conservation — so a tolling stage cannot mint fine metal.

The question a lender actually asks here is whether its security survives the transformation. It does, and that is proved: transform_carries_security.

5. Crossing borders

The metal passes producer country → transit → warehouse or refinery → buyer country. At each boundary the applicable law can change when ownership transfers, whether a security interest is effective, how insolvency is treated, whether proceeds can move, and who can enforce.

Goes wrong: title uncertainty; a lien or pledge not created, perfected, or correctly ranked; borrower or custodian insolvency; sanctions and AML ineligibility; enforcement uncertainty across forums. Formalized — partly, and this is the weakest stage in the development. The legal question is covered: LegalIR.lean binds every rule to a hashed source and eval_unsourced_never_feasible proves the engine cannot return a favourable verdict from law it has not read. The physical border is not: there is no customs event, no export-licence gate, no freight leg, no Incoterm, and ActorRole.transporter exists but no theorem uses it. Transport and customs appear in the development only as basis-point placeholders in the cost model. Stated here rather than left for a reader to discover.

6. The draw and monitoring loop

Stages 3 to 7 are not a straight line — a control loop runs across them, and it has five steps:

1. the borrower requests a draw;
2. independent evidence confirms eligible collateral exists;
3. financing is released only up to the permitted advance rate;
4. release of collateral requires repayment or authorised substitution;
5. monitoring updates exposure as inventory moves.

Formalized: CorpusLink.lean computes monitor verdicts from settlement receipts, so link_verdicts_immune_to_world_events holds — a violation cannot be laundered by reassigning a beneficiary or discharging the obligation somewhere else. The advance-rate limit is a well-formedness constraint on the architecture itself, not a runtime check.

7. Sale, then repayment

The sale to the buyer or offtaker is the commercial event that produces repayment cash; where it has already generated an invoice, receivables finance and factoring attach here. Proceeds then repay the advance through a waterfall.

The primer completes its example here, and this is the number that reframes the whole business: the 14-day financing cost is approximately $42,200 — that is $10m at 11% for 14 days — leaving roughly $107,800 of the $150,000 spread. Financing cost is incurred only for the days capital is actually outstanding, which is why velocity, not rate, is the lever.

Formalized: settlement_never_premature — a facility cannot settle before its due time; rd_double_sale_rejected and fac_route_double_sale_rejected block selling the same receivable twice.

8. Aggregation into an investable product

Once credit is aggregated, an SPV separates the operating borrower from the investment claim, and a waterfall allocates cash and losses across senior, mezzanine and junior/first-loss tranches.

Formalized: CorpusPools.lean instances tranching (trn_waterfall_allocates_loss, trn_junior_blocked_under_stress) over the generic Waterfall.distribute, and LiquidationWaterfall.sol implements the rulebook order onchain. NAV share redemption is separate, in Strategy.lean — burn_payout_le_nav. The instanced tranching is two-layer senior/junior; mezzanine is expressible in the n-layer distributor but is not instanced.

9. Distress, if it comes

If the transaction fails, the cost stack continues: workout, collections, security enforcement, insurer claim, asset realisation, dispute resolution. The course is blunt about the trap: a 90-day claim waiting period can reduce ultimate credit loss while leaving a severe short-term liquidity gap. Solvency and liquidity are different failures.

Formalized — and here is an honest limit. The recovery amounts are covered: insuranceRecovery, reinsuranceRecovery, stacked_protection_le_loss and no_double_recovery all bound what protection can pay. The recovery timing is not. The 90-day delay is carried as insClaimDelayDays in the deck environment and is then proved to be read by nothing — eval_arch_ignores_unmodeled_params. So the sharpest distress lesson in the course is deliberately recorded as outside the model rather than quietly assumed into it.

The other timing mismatch

There is a second clock, and it is the one that kills deals that survive everything above. A transaction may need cash in days, while diligence, investment committees, documentation, subscriptions and settlement take weeks or months.

That is the same velocity problem as stage 7, moved to the capital side, and it is where a protocol has a structural advantage over a committee. Not because onchain capital is cheaper — it is often dearer — but because it can arrive on the timescale the trade actually runs on.

Does the pipeline pay for itself?

With the stages named, the question becomes measurable. It is answered below, and the answer depends entirely on two numbers.

Why the pipeline is hard

The financial model charged a borrower a coupon, a protocol fee and monitoring. A real gold cycle also pays for a vault, secure freight, specie cover, a responsible-sourcing audit, customs, and a correspondent bank that moves money twice per cycle.

Adding them — with deliberately modest numbers, so that any failure would be structural rather than pessimism — produces the sharpest result in the whole development.

The borrower is a physical trader

A commodity borrower does not compare your coupon to a bank's rate. It compares it to its return on capital: margin per cycle times turns per year. A 1% net margin on a 30-day cycle is a 12% return; the same margin on a three-week cycle is 17%.

Two consequences follow, both proved. Velocity is a price lever — a shorter cycle strictly raises the sustainable coupon. And capital is never satiated: while the coupon sits below the return on capital, the coupon charge never exceeds what the capital earns, at any scale. More capital is always wanted.

The result

At a 1% margin on a 30-day cycle, the completed pipeline does not finance itself.

The decomposition matters more than the verdict. The borrower began with 25 basis points of slack. The fee stack adds 45 — alone an overrun. But the settlement rail's five days cost a further 150 basis points of gross return, because a 30-day cycle turns twelve times a year and a 35-day cycle only ten.

Time beats price roughly six to one. The correspondent bank is the sharpest actor in the pipeline, and it appeared in no earlier model.

The frontiers

Rather than tune inputs until the model clears, the development reports where it clears:

• Velocity, at a 1% margin: a 30-day cycle fails; 21 days clears.
• Margin, at 30 days: 1.0% and 1.2% fail; 1.5% clears.
• Coupon: no coupon clears both sides at 1% and 30 days. Cutting to 7% wins the borrower but leaves the protocol 179 basis points against a 400-point cost base.
• Scale: making that work needs a cost base under 179 bps — roughly $112m of reserve.

One term helps, and it is proved: because the operator owns the refinery, an intra-group refining fee leaves the group's capacity to service the note unchanged.

Every pipeline cost here is unverified. What is claimed is the frontier. The failure is conditional on two numbers only the operator can supply: margin per cycle, and cycle length.

The frontier now meets a document

The frontiers above were published because no source supplied the two numbers. The founder primer does supply them, inside a worked example — and that example clears comfortably.

At 1.50% over a 14-day cycle, with every fee charged and the rail's five days added, the completed pipeline returns 2,137 basis points of gross against 920 of full cost. That is 2.3× cover, against a 1%/30-day case that fails outright. Nor is it near an edge: holding the margin, the cycle can stretch to 35 days before it fails; holding the cycle, the margin can fall to 0.65%.

So the negative result is a statement about that cycle, not about physical gold trade. Both published frontiers are now bracketed by a document rather than open at one end.

One caution, stated because it is the honest one. This is a teaching example inside a sourced document, not the operator's disclosed economics. It moves the two coordinates from "no source at all" to "attributable and quoted"; it does not make them the operator's numbers, and the calibration used elsewhere on this site is deliberately left where it was. The primer says the same thing in its own words: capital velocity explains the economics; it does not prove safety.

Three places this comparison is looser than it looks

An adversarial pass over this page found three seams worth stating plainly, because each one moves a headline number.

The rail's five days may already be inside the fourteen. The course states 14 days as the whole cycle before the trader receives cash back, and gives no settlement-rail delay anywhere. The model adds 5 rail days on top. That is conservative — dropping the addition would raise the worked deal's gross from 2,137 to roughly 2,925 bps — but the 150-bps rail cost that drives "time beats price six to one" is an assumption stacked on a course figure that may already contain it, not a measurement.

The financing rates sit on different bases. The course charges 11% annual simple on the full $10m purchase. The model charges a 10% coupon on a 75% advance, plus protocol and monitor fees, giving 875 bps of NAV. Those are different rates on different denominators, and nothing here reconciles them — so the $42,200 above and the basis-point results below are adjacent, not comparable.

The optimum advances more than the course's example. The published optimum runs a 75% advance rate; the course's worked deal caps at 70% with a 30% haircut, and its short-tenor example runs 50%. Gross return is linear in the advance rate, so every headline number on this page inherits that 5-point difference. The model has no collateral-haircut field at all — the haircut machinery lives in the borrowing base (itemNetValue, draw_within_borrowing_base) and is uncalibrated.

None of these breaks a proof. Each is a modelling choice that a reader comparing our numbers to the course's would otherwise have to reverse-engineer.

How much of the corpus is executable

One ratio belongs on this page rather than buried in a report: of the 100 archetypes recorded in the encyclopedia, 29 are executable Lean instances and the rest are records only. A record fixes the archetype's structure, parties and intended compilation; an instance runs it against the kernel and proves its positives and negatives. When this documentation says an archetype is covered, check which of the two is meant.