The gravitational pull of the middle layer
Every coordination layer faces the same temptation. It sits between systems, it can see more than any of them, and each individual absorption looks like a simplification.
Holding a balance is easier than reconciling with a rail. Caching inventory is faster than querying a registry. Storing a copy of the evidence avoids a network hop. One decision at a time, the coordinator becomes a ledger, a registry, and an evidence store — and now it is the single point of truth for domains it does not actually govern.
Sinera draws the line explicitly: no component should silently assume control of another state domain. It is worth being concrete about which domains those are and why the separation is load-bearing rather than decorative.
Four domains, four owners
ATP owns commercial lifecycle state. Whether a commitment is authorized, active, completed, failed, or disputed. Who may act on it. Whether it reached a terminal outcome. This is the one thing ATP is the system of record for.
Settlement rails own value transfer. Whether funds actually moved, when, and with what finality characteristics. ATP determines when settlement may proceed under the active commercial rules. It does not perform the transfer and does not hold the authoritative record of it.
Asset registries own resource state. Quantity, availability, ownership of the underlying thing. A commitment can reference an asset without the protocol becoming the registry for it.
Evidence providers own external records. Proof of delivery, acceptance, usage, inspection. These are attributable records supplied by parties with standing to supply them.
The separation is not aesthetic. It reflects a fact about authority: each of these domains has a real-world owner with legal and operational responsibility for it. A protocol that stores a shadow copy has not acquired that responsibility — it has acquired a copy that can disagree with the authority, without any mechanism for deciding which is right.
The specific failure of merging settlement
Settlement is the domain most often absorbed, and the merger is worth examining because the reasoning is superficially strong.
If the protocol holds funds, it can guarantee that payment and state transition happen together. No partial failure, no reconciliation, no case where the commitment says completed but the money did not move.
Here is what that guarantee costs.
The protocol becomes a custodian. Custody carries jurisdiction-specific obligations that have nothing to do with lifecycle semantics. The technical design question becomes a regulatory one in every market simultaneously.
Rails stop being substitutable. Different commitments settle sensibly through different instruments — stablecoins, bank transfer, card, credit terms. A protocol that has internalized settlement has internalized one settlement model, and every new instrument is a protocol change rather than an adapter.
Finality gets flattened. Settlement finality varies by rail: some are probabilistic, some are reversible for a window, some are final on confirmation. A protocol that owns settlement has to pick a finality model, and it will be wrong for some rails.
Keeping the domains separate means ATP expresses the commercial condition — this commitment permits settlement now — and the rail expresses the value fact. The two are related by evidence, not by shared storage.
Coordination without ownership
If ATP does not own these domains, what does the coordination consist of?
It consists of conditions and evidence. A commitment's terms describe what must be true for a transition to be permitted. Evidence from the domain owner establishes whether it is true. ATP evaluates the condition and records the transition, with attribution.
The commitment does not contain the inventory count; it references the registry that does. It does not contain the payment; it references the settlement evidence. What ATP contributes is the part no individual domain can supply on its own: an authoritative, attributable answer to what is the state of this commercial commitment, which is exactly the question that has no owner in current infrastructure.
Why this survives contact with integration work
The abstract argument for state-domain separation is easy to accept and easy to erode. The erosion happens during integration, when a specific rail is slow, or a registry is unreliable, or an evidence provider has an awkward API, and a cache would fix it today.
The discipline that helps is asking what happens when the cache and the authority disagree — because they will. If the answer is "the authority wins and we re-sync", the cache is a performance detail. If the answer is "we act on our copy", the domain has been absorbed regardless of what the architecture diagram says.
What this does not claim
It does not mean ATP is thin. Lifecycle progression, authorization, finality, disputes, recovery, beneficiary integrity, and settlement coordination are substantial responsibilities. The claim is about scope, not size.
It does not eliminate integration work. Adapters translate business actions into commitments and return normalized evidence. That work is real and it does not go away — it gets located somewhere principled instead of being smeared through the protocol.
It does not assume the other domains are well-behaved. Registries go stale, rails fail, evidence arrives late or not at all. Separation does not prevent this. It makes the failure attributable to the domain that owns it, rather than surfacing as an unexplained inconsistency in the coordinator.
The test
A protocol that coordinates commerce should be answerable for a narrow question and clear about the ones it declines.
For Sinera the narrow question is the state of a commercial commitment. The declined questions are: did the money move, does the seller have stock, and did the delivery happen. Those have owners already. What they lacked was a layer that could reason across them without becoming them.
Further reading: the Sinera Lightpaper covers the architecture and state-ownership model. The Technical Whitepaper covers settlement and asset independence, evidence adapters, and the on-chain / off-chain execution boundary.