Bellside answers that from paperwork, not from a price. Every sleeve is re-read against its custody filing, its transfer-agent register and its venue attestation — and the badge you see is computed at the moment you load the page.
Every asset arrives with a number it hopes you won’t check.
Bundled register: twelve sleeves whose evidence files are entered by hand, four of them deliberately adverse so the deriver is provably running. Last, change and volume come from a public quote feed; the badge is derived from the paperwork, not from the price. Nothing on this page is investment advice.
Click any row to open its dossier. Nothing here is a stored label — badge, band and staleness are derived on read and thrown away.
| Sleeve | Class | Last | Change | Prem. | Integrity | Signal band | Register |
|---|
What the desk actually holds on the selected sleeve: wrapper mechanics on the left, the derived reading and the evidence ledger on the right.
Five stages, run on every read. The pipeline is short on purpose — a long one hides where the judgement happened.
Transfer-agent register, custodian statement, fund-administrator NAV file, venue notice, chain observation.
evidence[] { tier, source, claim, polarity, observedAt }Paperwork outranks operator, operator outranks external. Within a tier, the freshest document wins.
paperwork 3 > operator 2 > external 1Each sleeve carries a freshness window. A filing older than the window stops counting, however good it was.
age > window → unverifiedIntegrity is the worst of four readings, never the average. Averaging lets a strong custody number bury a broken redemption queue.
score = min(signals) × 100The reading is printed with the classifier version that produced it, then thrown away. Nothing is cached, nothing is stored.
bellside-listing/1.0.0Press coverage and chain indexers are useful and neither is admissible on its own — in either direction. An indexer can tell you supply is flat; it cannot tell you the shares behind that supply are still registered to the wrapper. So an external-only file resolves to unverified whether the claim is flattering or damning.
The inverse rule matters just as much: an operator’s own adverse notice is enough to move a sleeve to review, but not to delisted. Only a filing does that. A venue can be wrong about its own queue; a transfer agent’s suspension notice is a document with a signature on it.
The section above describes the ruleset. This one executes it. Every line below is printed from a live call into the same engine.js the test suite runs — no transcript, no recording. Press the button and it derives a different sleeve.
Three admissible tiers and one that is explicitly not. Each tier lists the documents the desk will actually read.
Documents produced by a party with a legal obligation attached to being wrong. This is the only tier that can settle a listing in either direction.
can produce · listed · delisted
The issuer or the venue describing its own state. Useful, self-interested, and never final.
can produce · review
Third-party observation. Reads the surface, not the register.
cannot settle a listing
The one input this register refuses to treat as evidence. A sleeve trading tight to reference tells you the market has an opinion, not that the shares behind it are still registered. Price appears on this page as context and never touches the badge — which is why a sleeve can print a clean tape and still read delisted two columns to the right.
never an input to the badge
The mechanics behind every sleeve on the desk, stated plainly enough to argue with.
Four ways to get equity exposure on-chain, compared on the parts that decide whether you can trust the number.
| Bellside register | Synthetic / perp | Wrapped IOU | Traditional broker | |
|---|---|---|---|---|
| Backing | Registered share or fund unit at a custodian | Collateral pool plus an oracle | Issuer promise, off-register | Registered share at a broker |
| Proof you can read | Transfer-agent extract, custodian statement, NAV file | Oracle feed and pool balance | Issuer dashboard | Statement on request |
| Status source | Derived on read from evidence | Liveness of the oracle | Stored flag set by the issuer | Internal, not exposed |
| Stale-paperwork behaviour | Reads unverified and says why | Keeps quoting | Keeps showing green | Not surfaced to you |
| Composite scoring | Weakest signal binds | None | None | None |
| Redemption | Against the custodian, stated window | Cash settlement only | Issuer discretion | Sell and settle |
| Voting rights | No — wrapper is the holder | No | No | Yes |
| Honest weakness | Only as good as the last filing it received | Oracle and collateral risk | Pure counterparty risk | Hours, borders, minimums |
Twelve sleeves on the desk today: ten single-name equities and two index sleeves carried as fund units.
Issuer marks are shown to identify the underlying company and imply no endorsement, affiliation or partnership. Bellside is an independent project and is not affiliated with any issuer, venue or Robinhood.
Where this actually is. The engine is real and tested; the intake feeds are not wired yet.
Isomorphic engine with a 67-assertion suite: tier ladder, staleness gate, weakest-binds reconciliation over 3,000 randomised cycles, and a guard that the two derived vocabularies never share a word.
Twelve sleeves rendered from derived output, four deliberately adverse fixtures, dossier with a full evidence ledger, 60-second remark cadence.
Today an operator types each filing in by hand. Next is a signed intake endpoint so a transfer agent or administrator can post a filing directly, with the document hash carried into the badge.
Publish each read’s hash so a badge can be checked against the ruleset version that produced it, after the fact.
More sleeves, more issuers, and a public disagreement log for when the desk’s reading and an issuer’s statement diverge.
The ones a desk actually asks before it trusts a register.
score = min(signals) × 100 means the printed score always reconciles with the worst printed row, and the binding label moves on its own to whichever reading is actually lowest.unverified and the reason states the age and the window — for example, a 47-day filing against a 30-day window. It does not fall to delisted: nothing adverse was filed, the desk simply stopped having current proof. Those are different claims and the register keeps them apart./api/quotes — a same-origin proxy over a public quote endpoint, refreshed every 30 seconds and cached for 30. Premium is computed against the previous close from that same feed. The pill in the header reads live quotes when it is connected and bundled tape when it is not, so the page never quietly passes stale numbers off as fresh ones. What is not from a feed: the evidence files behind the badges, which an operator types in. That is deliberate — the badge is derived from paperwork, so a price feed must not be able to move it.localStorage, sessionStorage or IndexedDB. Browser storage is device-locked and evaporates on a cache clear, a browser update or a new device — which makes it the wrong place for anything a user would be annoyed to lose. When watchlists ship they will sit behind an account on a backend that follows you across devices.unverified — which is correct, and also unhelpful if you wanted an answer. The register would rather say "I do not currently know" than round a stale document up to a green badge, and that trade-off is the whole design.