Lattice
A weekend systems prototype Nevin and I built in Rust to explore cross-border payment state machines, idempotent retries, and FX order routing.
Execute a programmable payout
Compare live stablecoin-to-local-rail routes, test sub-wallet policy gates, or inject a downstream rail timeout to step through idempotent recovery.
USD → USDC on Polygon → Pix · ~117s · fee 6.78 USD
- 1Quote locked
- 2Policy gate
- 3USDC settlement
- 4Local payout
intent.ready (awaiting POST /v1/pay)- Ledger preview
- Wallet debit
- 4,200.00 USD
- All-in route fee
- 6.78 USD
- Recipient credit
- 21,385.42 BRL
- Settlement rail
- USDC (Polygon) → Pix
- Reconciliation
- Pending finality
Payouts break
after “send”
I kept getting curious about the same payment plumbing problem from different angles: working near risk and compliance at American Express, building low-latency eFX routing at Clearpool, and trading notes with friends in fintech on how clean developer APIs hide messy settlement rails underneath.
Starting a cross-border transfer is easy; ending it cleanly is the hard part. One payout crosses fiat ramps, stablecoin settlement, custody checks, FX venues, and local rails like PIX or SPEI. When a downstream rail times out, naive callers either stall or risk double-paying on retry.
Nevin and I hacked together a small Rust and Postgres prototype around a single payment intent (POST /pay with currency, amount, and destination) to test how a deterministic state machine should behave when a local rail drops a connection mid-flight: polling idempotency keys before replaying, locking quotes, and writing a balanced double-entry ledger record.
Sub-wallets and policy gates
In the sandbox model, an account holds a root balance with scoped sub-wallets for automated callers or human operators. Before a state transition dispatches settlement, a small policy engine checks per-wallet limits, allowlisted destinations, and manual sign-off thresholds.
Because both the API caller and the operator console read the exact same intent state machine, a paused or timed-out transfer can be inspected and resumed without out-of-band reconciliation.
Currency, amount, destination, wallet permissions, and manual sign-off.
Smart order routing, idempotency, timeout recovery, and ledger reconciliation.
Simulated custody, screening, fiat ramps, and local bank payout webhooks.
Math around the router
While building the state machine, we also sketched three small calculators around the router: where fixed ramp overhead crosses variable basis-point fees, how splitting an operating balance between instant payout float and T-bill yield changes net fee drag, and how to sweep a larger FX order across multiple venue books by all-in price.