Orma

Nobody can tell you what an XRPL vault share is worth, so nobody can safely lend against it. Orma prices one from the ledger; Orma Desk lends against it.

Desk · Repo · Devnet only: the lending amendments are not enabled on Mainnet.

Today every XRPL lending vault is closed-ended: capital stays locked until redemption. A holder needing XRP sooner borrows against the shares, so the lender must price a share the vault won't redeem yet. A share has three prices: the value read by all, AssetsTotal / shares; the withdrawal value, (AssetsTotal − LossUnrealized) / shares, what XLS-65's VaultWithdraw pays; and 1:1, one drop per share unit.

When the curator impairs a loan, the loss goes into LossUnrealized and AssetsTotal does not move. On Harbor-1's first impairment the value read by all stayed 1.000000 while the withdrawal value fell to 0.800000. LossUnrealized sat at its default value before it, and a field at its default value isn't stored, so the standard metadata diff misses the loss.

In private credit this is a NAV loan, and the lender hires an independent valuation agent. Orma is that agent, public and continuous. The Lending Protocol does not link a loan to collateral; Orma Desk makes that link.

Built at this event: Orma Desk

nyc-start...main, step tags 01 to 15 and 19 to 22:

• Risk ticket orma.ticket/1: what a lender overpays at the value read by all, the loss if a late loan defaults (after cover), the lock-up, how late each loan is, loan-to-value at the withdrawal value and at 1:1, and PASS or BREACHED against the risk officer's mandate (four limits, hash on Devnet). Each figure carries its formula, provenance (REAL, DECLARED, MODELLED, SIMULATED) and inputs with ledger index and hash; the browser recomputes it.
• Pledge: the borrower escrows shares of a closed-ended XRP vault into a 2-of-3 collateral account (borrower, desk, Orma agent), master key disabled.
• Countersignature: at the signing ledger the desk re-reads every input and recomputes the ticket, then countersigns the LoanSet or refuses with a named code, in a hash-chained log.
• Change preview orma.change/1: each field a transaction will change, including those PreviousFields leaves out; MATCH or MISMATCH once validated.
• Margin calls: the borrower cures one by pledging more shares; no automatic seizure.
• Loans in a Devnet test dollar standing in for RLUSD, at an XRP/USD price from three XLS-47 documents one test account relays.
• /desk: Ticket, Positions, Mandate, Universe, Feed.
• Added to the information layer: a named publisher, orma-mark, Universe, a credit-event Feed with curator statements.

Before the event (Paris, Sept. 2026)

Orma's information layer: reader, withdrawal value, XLS-47 publisher, share-metadata pointer, credential gate, API and site.

The demo

Tidewater Payments asks Harbor Credit Desk for 2 XRP against 5,000,000 Harbor-1 share units (all fictional). At ledger 6384857 (demo/desk.json) that was 50.00% loan-to-value, under the mandate's 53.44%, and if loan L2 defaulted, the file put the withdrawal value at 0.703000. The curator defaulted L2 at ledger 6389290; on 25 October the withdrawal value read 0.703000. The same request is now 56.89%: the desk refuses with 409 BREACHED, while a lender at 1:1 still reads 40.00%. A separate chain test (escrow, countersigned LoanSet, Payment from a 2-of-3 test account) is in evidence/devnet-tx/.

Rules anyone can check

Eight rules, I1 to I7 (I3a, I3b), each with a keyless command from a fresh clone. Between distinct parties, no single one, Orma included, can move pledged shares. The role engine, the browser's only write path, builds no LoanPay, tfLoanUnimpair or VaultDeposit. Orma recomputes the withdrawal price as a second implementation, held to the vault-state invariants xrpld checks after every transaction (state checks only). A keyless auditor checks the desk's decision log against Devnet.

• node src/mark/verify.mjs 0000000113268B160349A129A3343579AE8B0059C4BDC2F8 recomputes Harbor-1's withdrawal value from its MPT id against a public node, and trusts that node; a copied pointer reads SPOOFED.
• npm ci && npm test: every offline check in src/dev; node src/desk/audit.mjs --self-test runs apart.

Limits

• In the demo our server holds two of the three keys (borrower, desk), enough to move the shares.
• The agent's release rule is tested offline; no live release in the demo.
• Not built: steps 16-18 (rehearsal, OTC share purchase, phone role pages).
• Not captured yet: the L2 default, the margin-policy and dollar-terms anchors, the dollar pool.