csoai/registry-harvest-xrpl-mica-lei

Free-registry harvest — XRPL issuers × MiCA × LEI

Public registers and public ledgers joined, read 2026-09-04T07:12:30Z. Every source is free, keyless and re-runnable by anyone. No part of this needed a relationship, an API key, or anyone's permission.

The finding

Of the 16 XRPL issued assets in the CSOAI reader, 5 join to a MiCA e-money-token authorisation.

Four of the five MiCA-authorised EMTs on XRPL declare no issuer `Domain` on their account root. EU authorisation and on-chain issuer disclosure are uncorrelated here, and the relationship runs opposite to the intuitive direction.

What this is not. Declaring a Domain is not a MiCA requirement, so a blank field is not non-compliance and nothing here is a compliance finding, a rating, or advice. It is one deterministic fact — is the field set — read off a public ledger. The risk verdict is UNMEASURED.

Method

• —XRPL — account_info on the validated ledger via public rippled nodes. AccountRoot flags decoded: lsfRequireAuth (allowlisting), lsfNoFreeze (freeze capability renounced), lsfGlobalFreeze. Domain hex-decoded. No model, no judgement, no score.
• —MiCA — ESMA register via the casptracker.eu mirror (CC-licensed), snapshot 2026-08-20: 331 CASPs, 23 EMT issuers, 0 authorised ARTs, 167 non-compliant warnings. This is a mirror, not ESMA directly; the ESMA CSV path in circulation returns HTML.
• —LEI — GLEIF public API. Group-head resolution by exact legal name + country + registration status. A naive first-hit name match returns wrong entities (HSBC → a US entity marked INACTIVE; Citi → India; JPMorgan → Luxembourg), so that shortcut is not used here.
• —Issuer join — name-normalised with a hand-checked alias map. The 11 non-matches are non-EU issuers that correctly hold no EMT authorisation, not lookup failures.

Also in here

lei-crosswalk.jsonl resolves all 26 banks of the CSOAI SWIFT census to group LEIs — 26/26, 24 ISSUED, one LAPSED (MUFG Bank) and one DUPLICATE (Wells Fargo). Two banks needed fulltext search; Shinhan Bank's legal name is registered in Hangul, which is why exact matching missed it.

Second pass — the register validates itself, offline

Every LEI in the ESMA CASP register can be checked with arithmetic alone: ISO 17442 is 20 alphanumeric characters whose base-36 digit expansion is mod 97 == 1. No API, no key, no permission, no network.

10 of the 335 rows in the CSV snapshot fail that check. Four are the wrong length — one ends in a full stop (89450036UW3ID72T1M84.) and two are 19 characters — and six fail the check digits outright.

Corroborated independently: all ten also fail to resolve against the GLEIF API, and every GLEIF lookup failure across the 331 mirrored rows is explained by this. There were no genuine "valid LEI, absent from GLEIF" cases.

Separately, four CASPs carry a well-formed LEI whose GLEIF registration is not current: Bitpanda (RETIRED), Cryptonow, Legend Trading and PAYTOP (all LAPSED).

Boundaries on this finding

• —The fault is present in the CSV snapshot as mirrored, not introduced by the mirror's JSON conversion — checked against source/CASPS.csv directly. It is dated 2026-08-20 and is not a live ESMA pull; the ESMA CSV path in circulation returns HTML, so a live confirmation needs someone to open the register by hand.
• —A malformed identifier in a register is a data-quality fact, not a compliance finding. It says nothing about the authorisation itself, the firm, or its conduct.
• —The raw CSV holds 335 rows; the mirror's JSON keeps 331. That gap is unexplained here and the two counts are reported separately rather than reconciled.

Correction recorded against my own first read

The warning list is not evidence of asymmetric enforcement across the EU. 165 of its 167 entries come from Italy's CONSOB — but the mirror's own note says it covers "CONSOB/IT, AFM/NL, NBS/SK only". That ratio is the dataset's stated scope, not a finding about Europe. It is recorded here because the denominator error was nearly published as a result.

No XRPL issuer measured in this dataset appears on that warning list — a clean negative, stated as one.

Third pass — one instrument, two ledgers, no way to authenticate it

EURCV is the single most ledger-verifiable bank-adjacent instrument in existence: a MiCA-authorised e-money token from a G-SIB subsidiary (Société Générale-FORGE, LEI 969500FX8K40ZDW4F377), live on four public chains. So it is the fair test of whether "on a public chain" means "verifiable".

It does not. On neither ledger can an outsider establish which issuer account is the real one.

XRPL. One issuer in our registry, rUNaS5sqRuxZz6V7rBGhoSaZiVYA3ut4UL, holding 120 trustlines. It declares no `Domain`, so the standard two-way xrp-ledger.toml check has nothing to check against. Our own identification rests on the XRPScan well-known directory — a third party, not the issuer.

Stellar. Eight distinct issuers publish an asset with the code `EURCV`. On Stellar an asset is the pair (code, issuer), so the code alone identifies nothing. And the pattern inverts what you would expect:

The only issuer configured like a regulated one — allowlisting, revocable authorisation and clawback all enabled — publishes no domain at all. Four of the six that do publish a domain point at DNS names that do not resolve.

The issuer's own domain resolves nothing either. sgforge.com serves neither /.well-known/stellar.toml nor /.well-known/xrp-ledger.toml — both 404. Those are the two standard machine-readable mechanisms by which an issuer states which addresses are its own.

What this does and does not say

• —It does not say any of these accounts is fraudulent, an impersonation, or unauthorised. Several may be test issuances, mirrors, or unrelated projects reusing a four-letter code, and that is exactly the point: from public data you cannot tell.
• —It does not say Société Générale-FORGE has done anything wrong. Publishing a toml is not a MiCA requirement and its absence is not non-compliance.
• —It does not identify SG-FORGE's official Stellar address. Nobody can, from these sources.
• —Checked mechanisms are named exactly, so the claim is falsifiable: if SG-FORGE publishes its addresses somewhere else, one link overturns this and the finding should be withdrawn.

What it does say is narrow and deterministic: the standard on-chain mechanism for binding an issuer to an identity is unused here, on both ledgers, by the instrument with the strongest reason to use it. "On a public chain" and "independently verifiable" are not the same property, and this is the measurement that separates them.

Fourth pass — the pattern is systemic, and it is a stale pointer, not a missing one

Ticker collision on Stellar is the norm, not the EURCV exception. Distinct issuers publishing the same asset code:

Ten of the thirteen euro/dollar EMT codes checked are claimed by more than one issuer. A ticker on Stellar carries no identity at all; only the (code, issuer) pair does.

So the two-way domain binding is the only thing that can disambiguate — and it mostly is not completed. On XRPL, of 16 instruments:

• —10 declare no `Domain`, so the check cannot start.
• —6 declare one. Four complete the binding — RLUSD (ripple.com), OUSG (ondo.finance), and Braza's USDB and BBRL (tokens.brazacripto.com.br) all serve an xrp-ledger.toml naming the issuer back.
• —Two do not: Bitstamp and Circle both declare a domain that returns 404 for the toml.

Only 4 of 16 XRPL instruments are fully bound to an identity by the standard mechanism.

The Circle case is the instructive one

Circle declares circle.com on both ledgers. circle.com serves neither /.well-known/xrp-ledger.toml nor /.well-known/stellar.toml — both 404. But a valid Stellar binding does exist: centre.io/.well-known/stellar.toml returns 200 and names Circle's canonical Stellar issuer back.

That is not a missing proof. It is a stale pointer — the on-chain declaration points at circle.com while the proof lives at centre.io, the legacy CENTRE consortium domain. The binding is completable only by someone who already knows to look there, which is precisely the out-of-band knowledge the mechanism exists to remove.

Note also circle.io/.well-known/stellar.toml returns 200 and does not name this issuer — a third domain in the same family with a different answer.

What this changes about the EURCV finding

It makes it less about one issuer and more about the mechanism. Publishing the binding works and is cheap: Ripple, Ondo and Braza all do it correctly today. The gap is not technical capability. It is that the largest regulated issuers either point somewhere stale (Circle) or declare nothing at all (Société Générale-FORGE, on both ledgers).

Boundary, unchanged: none of this is a compliance finding. Serving a toml is not required by MiCA or by any regulator. It is the ecosystem's own standard for saying "this address is mine", and this measures who uses it.

Lid: 22 axes measured · 14 model fleets · 3 public leader scores · 8 fact runs · TIE is TIE · not a certificate.

<!-- csoai-capability-densify-2026-09-14-tui7 -->

Capability + living GET (TUI7 distribution 2026-09-14)

SUPERSEDED: typed Hub triples LIVE (re-GET /api/hub-cards → counts.*) (and prior 885/900/937/1113/1182/1185) — do not re-paste. Hub cite = live GET only.

Live board: GET https://councilof.ai/api/gspc → quote totals.public_count / totals.lid (22·22·0 derived, never typed as a frozen paste)
Hub cards: GET https://councilof.ai/api/hub-cards → quote counts.cells / counts.measured / counts.unmeasured LIVE (no typed Hub triple)
Hub bank: https://huggingface.co/datasets/csoai/gspc-hub-cards
Free verify: https://councilof.ai/gspc-verify
Discovery: GET https://councilof.ai/.well-known/x402.json (live · Base · USDC)
OX discovery resources: councilof 0/60 honest — do not invent rows
Measurement, never certification. Printer only — no axis mine on ZeroGPU. A100 COLD.

 

Council of AI — GSPC + Hub printer

• —Living board: https://councilof.ai/api/gspc — quote totals.public_count / totals.lid (never invent MEASURED)
• —Hub cite: https://councilof.ai/api/hub-cards — re-GET; quote counts.* (typed LIVE (re-GET /api/hub-cards → counts.*) SUPERSEDED 2026-09-14)
• —Hub dataset bank: https://huggingface.co/datasets/csoai/gspc-hub-cards
• —Verify free: https://councilof.ai/gspc-verify
• —x402 discovery: https://councilof.ai/.well-known/x402.json
• —Catalog: https://councilof.ai/api/x402
• —Free door (amount 0): https://councilof.ai/api/free-door
• —Jail goldbank: https://huggingface.co/datasets/csoai/gspc-jail-goldbank
• —Human: free + x402 PAYG · Coming—Paddle not live · never Stripe
• —Agents: payTo is merchant receive — never the signer
• —Self-settle proves the rail; stranger revenue is separate (do not invent buyers)
• —Measurement, not certification. Never sell a rank. Never certify.

Any Hub x402.json in a CSOAI printer is a byte-mirror of the living well-known GET — not a second authority. <!-- /csoai-capability-densify-2026-09-14-tui7 -->

Measurement, not certification. Issued by CSOAI Ltd (England & Wales, Companies House 16939677). Attribution for the MiCA mirror: CASP Tracker, <https://casptracker.eu>.

<!-- csoai-hubcard-v2 -->

The live board is the authority

  

GET https://councilof.ai/api/gspc — quote totals.public_count. This Hub card is a printer of that GET, never a second engine. If the fetch fails the honest answer is UNCHECKABLE — never a fabricated 0.000. Status words: LOADING / UNREACHABLE / UNMEASURED / UNCHECKABLE.

Lid: 22 axes measured · 14 model fleets · 3 public leader scores · 8 fact runs · TIE is TIE · not a certificate.

This repository: NOT A BOARD MEASUREMENT — this repository is a corpus, mirror or door published by CSOAI. It carries no axis score. The measured slots live on the board GET below.

What is in this repository

manifest.jsonl is derived from this repository's own file tree at 2026-09-05T12:52:39Z; it lists every file with its size, its blob hash and a direct URL, so an agent can enumerate the repo without cloning it.

Citation

@misc{csoai_gspc_registry_harvest_xrpl_mica_lei,
  title        = {registry-harvest-xrpl-mica-lei — Council of AI / GSPC},
  author       = {{CSOAI Ltd}},
  year         = {2026},
  doi          = {10.5281/zenodo.21991104},
  howpublished = {Hugging Face Hub, \url{https://huggingface.co/datasets/csoai/registry-harvest-xrpl-mica-lei}},
  note         = {Live board: https://councilof.ai/api/gspc. Measurement, not certification.}
}

Measurement, not certification. Issued by CSOAI Ltd (England & Wales, Companies House 16939677), 3rd Floor, 86–90 Paul Street, London EC2A 4NE. Card refreshed 2026-09-05T12:52:39Z. <!-- /csoai-hubcard-v2 -->

<!-- csoai-capability-densify-2026-09-14-tui7 -->

Capability + living GET (TUI7 distribution 2026-09-14)

SUPERSEDED: typed Hub triples LIVE (re-GET /api/hub-cards → counts.*) (and prior 885/900/937/1113/1182/1185) — do not re-paste. Hub cite = live GET only.

Live board: GET https://councilof.ai/api/gspc → quote totals.public_count / totals.lid (22·22·0 derived, never typed as a frozen paste)
Hub cards: GET https://councilof.ai/api/hub-cards → quote counts.cells / counts.measured / counts.unmeasured LIVE (no typed Hub triple)
Hub bank: https://huggingface.co/datasets/csoai/gspc-hub-cards
Free verify: https://councilof.ai/gspc-verify
Discovery: GET https://councilof.ai/.well-known/x402.json (live · Base · USDC)
OX discovery resources: councilof 0/60 honest — do not invent rows
Measurement, never certification. Printer only — no axis mine on ZeroGPU. A100 COLD.

 

Council of AI — GSPC + Hub printer

• —Living board: https://councilof.ai/api/gspc — quote totals.public_count / totals.lid (never invent MEASURED)
• —Hub cite: https://councilof.ai/api/hub-cards — re-GET; quote counts.* (typed LIVE (re-GET /api/hub-cards → counts.*) SUPERSEDED 2026-09-14)
• —Hub dataset bank: https://huggingface.co/datasets/csoai/gspc-hub-cards
• —Verify free: https://councilof.ai/gspc-verify
• —x402 discovery: https://councilof.ai/.well-known/x402.json
• —Catalog: https://councilof.ai/api/x402
• —Free door (amount 0): https://councilof.ai/api/free-door
• —Jail goldbank: https://huggingface.co/datasets/csoai/gspc-jail-goldbank
• —Human: free + x402 PAYG · Coming—Paddle not live · never Stripe
• —Agents: payTo is merchant receive — never the signer
• —Self-settle proves the rail; stranger revenue is separate (do not invent buyers)
• —Measurement, not certification. Never sell a rank. Never certify.

Any Hub x402.json in a CSOAI printer is a byte-mirror of the living well-known GET — not a second authority. <!-- /csoai-capability-densify-2026-09-14-tui7 -->

<!-- csoai-openx402-free-cite-2026-09-14 -->

OpenX402 + free discovery (cite only · never invent OX resource rows)

OpenX402 server: Council of AI · https://councilof.ai · payTo 0x212686404a7d1e1fd88f35ed6200c3af7a78ae31
Servers API: GET https://openx402.ai/api/servers (LIVE row · registered 2026-09-14 · Base tx 0x0eb1ead995e235a2…)
Whitelist: GET https://facilitator.openx402.ai/whitelist/0x212686404A7D1E1fD88F35eD6200c3aF7A78ae31 → whitelisted true
OX discovery resources: GET https://facilitator.openx402.ai/discovery/resources → councilof still 0/60 (no free advertise API; settle-through required — do not invent rows)
Estate well-known: GET https://councilof.ai/.well-known/x402.json → 10 resources · mode live
OpenAPI: https://councilof.ai/openapi.json
Free-door: https://councilof.ai/api/free-door (402 amount 0 · bazaar)
Free crawl: https://councilof.ai/api/feeds/provider-diff (200 JSON · not a paid OX resource)
Catalog: https://councilof.ai/api/x402
Measurement, never certification. Self≠revenue. Never clone PayAI.

Owner: N-Sites spray onto HF leftovers / registry printers. OX discovery stays 0 until settle-through — never invent. Stamp 2026-09-14T03:29Z.

<!-- csoai-smithery-e1e2-honest-2026-09-14 -->

Smithery / MCP door (measured 2026-09-14 — not a certification)

• —Primary free MCP door: https://councilof.ai/mcp — GET 200; tools/list = 12 tools (matches registry tools[] for csoai/gspc-mcp).
• —Smithery primary listing: https://smithery.ai/server/csoai/gspc-mcp · registry https://registry.smithery.ai/servers/csoai/gspc-mcp — deploymentUrl=https://gspc-mcp--csoai.run.tools → GET/POST 401 `invalid_token` (Smithery auth required). Prefer the public door above; do not treat run.tools as the free door.
• —Stale duplicate: https://smithery.ai/server/csoai/gspc · registry https://registry.smithery.ai/servers/csoai/gspc — tools[] includes phantoms measure|verify|jail-probe|enter-arena (not on live /mcp); deploymentUrl=https://gspc--csoai.run.tools also 401. Prefer archive/unlist; keep only csoai/gspc-mcp.
• —Registry write: PATCH/DELETE need Authorization — no free write without Nick Smithery login (HARD BLOCKER if token absent).
• —Measurement only. Never invent that Smithery was fixed. Never certify. <!-- /csoai-smithery-e1e2-honest-2026-09-14 -->

<!-- csoai-signed-archive-awareness-2026-09-14 -->

Signed measurement archive (free cite · never a grade)

Living board: GET https://councilof.ai/api/gspc → 22 axis · 22 measured · lid: 22 axes measured · 14 model fleets · 3 public leader scores · 8 fact runs · TIE is TIE · not a certificate.
Signed card index: GET https://councilof.ai/signed/card_index.json → n_cards=335 · schema csoai.gspc-card-index/0.1
How to verify (stranger): https://councilof.ai/signed/HOW-TO-VERIFY.md
Free verify UI: https://councilof.ai/gspc-verify/
Example SIGNED card: https://councilof.ai/signed/cards/cff1aaf070acb97c224177809856bc20310f4958eb44bdffab7d4b04836535f4.json
Hub census (≠ board ≠ card_index): GET https://councilof.ai/api/hub-cards → 131/131/0
HF printers: https://huggingface.co/datasets/csoai/gspc-hub-cards · https://huggingface.co/datasets/csoai/gspc-jail-goldbank
Supply-led: CSOAI measures public systems independently first; sells delivery/freshness/monitoring/integration/replay/extra compute — never grades or favourable results.
Measurement credential, never certification. Free refresh only.

Owner: N-Sites — free paste onto HF/Kaggle printers. Hub LIVE 131 (kill 1191/1196). card_index n=335. Never invent VC/revenue. Stamp 2026-09-14T10:37Z.