The Economic Stack
Chio splits the cross-org economy into a small number of dedicated Rust crates. Each one has a narrow responsibility and a clear set of types it owns. This page maps the layers and points at the entry, exit, and trust boundaries.
The Map
Eight crates carry the dedicated economy responsibilities. Four more are supporting layers that the economy crates depend on for identity, oracles, anchoring, and discovery.
rendering…
Workspace, not a monolith
Every crate ships from the same workspace, but each has its own Cargo.toml and a narrow public surface. Replacing a single layer (a different oracle backend, a different settlement substrate) means swapping one crate, not editing the kernel.
Dedicated Economy Crates
Each is purpose-built for one responsibility.
| Crate | Purpose | Key types | Depends on |
|---|---|---|---|
chio-manifest | Signed tool manifest format with pricing and SLA hints. | ToolManifest, ToolDefinition, ToolPricing, PricingModel, SignedManifest | chio-core |
chio-metering | Per-receipt cost dimensions, billing-export records, budget queries, and hierarchical budget governance. | CostDimension, CostMetadata, BillingExport, BudgetEnforcer, BudgetTree | chio-core |
chio-reputation | Deterministic local reputation scoring from a caller-provided corpus of receipts, capability lineage, and budget records. Pure and storage-agnostic; does not depend on the kernel. | LocalReputationCorpus, LocalReputationScorecard, ReputationWeights, ImportedReputationSignal | chio-core-types |
chio-underwriting | Risk classification, premium pricing, and decision outcomes for governed actions. Produces decision artifacts and appeal lifecycle records. | UnderwritingRiskClass, UnderwritingDecisionPolicy, UnderwritingDecisionOutcome, UnderwritingPremiumQuote, UnderwritingDecisionArtifact | chio-core-types, chio-appraisal |
chio-credit | Credit facilities, bonds, capital book, exposure ledger, and credit scorecards. The accounting layer for delegated risk. | CreditFacilityArtifact, CreditBondArtifact, CreditScorecardReport, ExposureLedgerReport, CreditLossLifecycleArtifact | chio-core-types, chio-underwriting, chio-appraisal |
chio-market | Liability market: provider catalog, quote and bind flow, pricing-authority envelopes, claim packages, and adjudication. | LiabilityProviderArtifact, LiabilityQuoteRequestArtifact, LiabilityQuoteResponseArtifact, LiabilityBoundCoverageArtifact, LiabilityClaimAdjudicationArtifact | chio-core-types, chio-credit, chio-underwriting |
chio-federation | Bilateral peer pinning, federation activation exchange, cross-org reputation clearing, and qualification matrices. | FederationActivationExchangeArtifact, FederationQuorumReport, FederationAntiEclipsePolicy, FederatedReputationClearingArtifact | chio-core-types, chio-listing, chio-open-market |
chio-settle | Settlement runtime over the web3 contract family: EVM escrow, Solana settlement, Chainlink CCIP cross-chain messages, x402 / Circle nanopayments / ERC-4337 helpers, and watchdog automation. | SettlementCommitment, PreparedEvmCall, CcipSettlementMessage, PreparedSolanaSettlement, X402PaymentRequirements, SettlementWatchdogJob | chio-core, chio-credit, chio-anchor, chio-link, chio-kernel |
Where new responsibilities go
New economic primitives should land in the crate that already owns the closest type. Put a new credit instrument in
chio-credit, a new coverage class in chio-market, a new oracle backend in chio-link. The kernel does not grow.Supporting Crates
Six crates provide identity, discovery, oracle, and anchoring primitives that the dedicated economy crates compose.
chio-did: self-certifyingdid:chioidentifiers and DID Document resolution. Method-specific identifier is the hex form of an Ed25519 public key. Types:DidChio.chio-credentials: Agent Passport verification. Native canonical-JSON-signed bundle with an OID4VCI projection lane derived from the native artifact. Types:AgentPassport,PortableReputationCredential,CertificationCredential.chio-link: oracle integration for cross-currency conversion (Chainlink, Pyth), sequencer health, circuit breakers. Produces canonicalOracleConversionEvidence. Types:ChioLinkOracle,ExchangeRate.chio-anchor: checkpoint anchoring over EVM root-registry, Bitcoin super-root with OpenTimestamps, Solana memos, and multi-lane proof bundle verification.chio-listing: generic registry namespace, listing, and trust-activation artifacts with a search and admissibility surface. Types:Listing,SignedListingPricingHint,ListingSearchResponse.chio-open-market: bidding and ask-response surface built on the listing registry and governance charters. Types:SignedBidRequest,SignedAskResponse,SignedAcceptedBid.
Where Each Layer Talks to the Kernel
The kernel signs receipts. Every economy crate either hands the kernel something to admit or consumes the receipts it emits.
| Layer | Entry / exit |
|---|---|
| Identity | Passport presented at session establishment; receipt records the identity binding. |
| Manifest | Kernel verifies SignedManifest before tools admitted; admission feeds the guard pipeline. |
| Metering | Tool reports ToolInvocationCost; cost lands in FinancialReceiptMetadata. |
| Underwriting | Pre-action policy on UnderwritingPolicyInput; decision artifact attaches as evidence; premium feeds the market. |
| Credit | Facilities and bonds referenced from capability tokens; receipts feed exposure ledger and capital book. |
| Market | Quote and coverage referenced from the governed intent; claims and adjudication cite receipt evidence. |
| Federation | Activation exchange pinned by the kernel's trust store; bilateral receipts share an intent hash across two kernels. |
| Settle | Capital instructions consumed; observed state projects back as SettlementCommitment updates to receipt settlement_status. |
| Reputation | Caller assembles a LocalReputationCorpus from receipts; score feeds underwriting and credential issuance. |
The kernel is the only signer
Economy crates produce signed artifacts (manifests, listings, passports, decision artifacts), but the kernel is the only component that signs receipts. Receipts are the source of truth every other artifact ultimately points at.
Trust Boundaries
Not every crate is inside the trusted computing base. The kernel and a small set of supporting libraries are. The rest are operator-replaceable.
Inside the TCB
chio-kernel: the only component that signs receipts and runs the guard pipeline.chio-coreandchio-core-types: canonical JSON, crypto primitives, and the receipt and capability types every other crate consumes.chio-manifest: the kernel relies on its signature verification to admit tool servers.chio-metering: cost metadata flows through here on the way into signed receipts.
Operator-replaceable
chio-link,chio-anchor,chio-settle: oracle, anchoring, and settlement adapters. Operators pick the backend; the kernel verifies embedded evidence rather than trusting the substrate.chio-underwriting,chio-credit,chio-market: policy, instruments, and coverage products. Replace the operator's book without touching the kernel.chio-federation,chio-listing,chio-open-market: bilateral policy, discovery, bidding. The kernel recognizes the artifact shapes; a buyer can skip them.chio-reputation,chio-credentials: deterministic scoring and passport issuance. Pure; nothing here lives in the TCB.
What you cannot replace
You cannot replace the kernel without re-deriving every receipt and capability invariant. You cannot replace the canonical JSON encoding without breaking signatures. You cannot replace the receipt schema without breaking every audit consumer. Treat the TCB list above as the floor.
Reading Order by Use Case
The crates compose, but you do not need to read them in dependency order. Pick by what you are building.
- Provider:
chio-manifest,chio-listing,chio-metering. See Manifests and Pricing. - Buyer:
chio-credentials,chio-open-market,chio-settle. See Passports and Discovery. - Insurer:
chio-underwriting,chio-credit,chio-market. See Underwriting, Credit Facilities, Liability Market. - Operator:
chio-federation,chio-anchor,chio-settle. See Bilateral Federation and Operating.
Version and Stability
The economy crates ship from the same workspace as chio-kernel and follow the same release rhythm. Schema identifiers are versioned per artifact type. A few examples from the source:
chio-credit/src/lib.rs
pub const EXPOSURE_LEDGER_SCHEMA: &str = "chio.credit.exposure-ledger.v1";
pub const CREDIT_SCORECARD_SCHEMA: &str = "chio.credit.scorecard.v1";
pub const CREDIT_FACILITY_REPORT_SCHEMA: &str = "chio.credit.facility-report.v1";
pub const CREDIT_BOND_REPORT_SCHEMA: &str = "chio.credit.bond-report.v1";
pub const CAPITAL_BOOK_REPORT_SCHEMA: &str = "chio.credit.capital-book.v1";chio-manifest/src/lib.rs
pub const TOOL_MANIFEST_SCHEMA: &str = "chio.manifest.v1";Schema strings are stable identifiers. A bump from v1 to v2 means a breaking change. Every signed artifact carries its schema identifier so consumers can refuse versions they do not recognize.
Where to look next
The Worked Example page traces a single procurement transaction through these layers end to end, citing each crate at the point it acts.