Initial commit: AS4/411 directory and discovery service for Sankofa Marketplace

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/protocols/dtc.md

@@ -0,0 +1,44 @@
+# DTC / Digital Securities (DTCC Ecosystem)
+
+## Overview
+
+DTC and DTC-related messaging cover securities post-trade and custody. Participants include broker-dealers, custodian banks, and clearing members. Directory use is often **client-owned configuration**; public directory availability is limited.
+
+## Scope
+
+**Identity mapping** (LEI, BIC, participant IDs) plus **contractual endpoint profiles**. Optional import from customer-managed config (files or APIs). Do **not** claim automated discovery unless an authoritative or licensed directory feed exists. Prefer routing artifacts and admin API for participant/endpoint maps.
+
+## Identifier Taxonomy
+
+| Type | Description | Scope |
+|------|-------------|--------|
+| `lei` | Legal Entity Identifier | Public/registry |
+| `bic` | Bank Identifier Code (SWIFT) | Market identifier |
+| `dtc.participantId` | DTC/internal participant ID | Tenant/confidential |
+| `dtc.accountId` | Custody/account ID (proprietary) | Tenant/confidential |
+
+Historical: `duns` (D&B) where still in use.
+
+## Endpoint Profiles
+
+| Profile | Protocol | Description |
+|---------|----------|-------------|
+| `dtcc-mq` | MQ | DTCC connectivity / message system |
+| `sftp.*` | SFTP | File-based instructions |
+| `https.*` | HTTPS/AS2/AS4 | API or EDI over HTTP |
+
+Address format is vendor- or channel-specific (queue name, path, URL).
+
+## Capability Taxonomy
+
+- `securities.settlement.*` — Settlement instructions and messages.
+- `securities.corpactions.*` — Corporate actions.
+- `securities.assetservices.*` — Asset servicing.
+
+Used in resolution to match service context (e.g. request for settlement instructions).
+
+## Tenancy and Confidentiality
+
+- **Strong tenant scoping:** DTC and account identifiers are frequently confidential. Resolution must be scoped by tenant; no cross-tenant leakage.
+- **Prefer integration via client-owned configuration:** Ingest from client-provided files or APIs rather than assuming a public directory. Use [routing artifacts](../architecture/data-model.md) and admin API for participant/endpoint maps.
+- **Audit:** All access to DTC-related participant and endpoint data must be audited.