The conductor's accounts

The deployment's accounts and the links a plugin makes to them, and a plugin's settings, holds and moves as core's tools show them. This is its data dictionary at contract v24: one entry for every field of its messages a plugin meets, saying what the field is for, what a value means and does not mean, what empty means, who fills it, its bounds and the operations a write must carry it on. Each entry is anchored by its name, the name a refusal's path resolves to and a declaration names, which never changes.

Its messages are declared in meridian/v1/config.proto. A field's entry is the same whatever carries it: a typed operation's parameters take the entries of the message they are made from.

Records

The messages this store keeps and answers.

Record	What it is
AccountRecord	an account of the deployment: the only thing holdings and positions are recorded against
ExternalAccountLink	which account of the deployment an external account a plugin reported is recorded against
PluginSettingsRecord	a plugin instance's settings as the dashboard and core's tools may show them: values that are not secret, which secrets are set, and who last changed each
Hold	a hold on raw records: the least time a record is kept, for an edge role or every one, and who set it
MoveRecord	one move of an edge plugin's raw records, as the conductor recorded it
ConnectivityLinkChange	one change to a connectivity plugin's availability, its ems or its users: who, when, the instance, from, to and why (contract v22, W11.21, decisions/031)
VenueAccountMapChange	one change to an ems's map of accounts to venue account codes: who, when, the ems, from, to (contract v22, W11.22, decisions/031)
VenueCatalogue	a venue's offering per venue account code, latest per code, each change its own record: order types, strategies and eligibility (contract v22, W11.20), and from v23 the execution acknowledgement the venue takes

AccountRecord

meridian.v1.AccountRecord, a record.

account_id

identifier account · since v2 · stable

Identifies an account of the deployment.

• Means: the deployment's own identifier for the account, minted when it was defined
• Does not mean: an external account's identifier at a custodian, or an account number
• Empty: never empty
• Filled: minted, by conductor

name

text · since v2 · stable

Names the account for a person.

• Means: the name a deployment admin gave it, as people in the deployment know it
• Does not mean: the custodian's name for an external account linked to it
• Empty: never empty: an account is defined with its name
• Filled: entered, by dashboard

state

enum AccountState · since v2 · stable

Says whether the account is open.

• Means: open or closed, as a deployment admin set it
• Does not mean: whether a custodian still reports it
• Empty: never unspecified on a read
• Filled: entered, by dashboard

Value	Means
ACCOUNT_STATE_UNSPECIFIED	not said; never on an account the conductor answers
ACCOUNT_STATE_OPEN	open: records may be made against it
ACCOUNT_STATE_CLOSED	closed, not deleted: an account is the subject of records that outlive it

created_at_ns

moment · since v2 · stable

Records when the account was defined.

• Means: the deployment's clock when the conductor recorded it
• Does not mean: when the account was opened at a custodian
• Empty: never 0
• Filled: decided, by conductor
• Unit: nanoseconds since the epoch

custodian

text · since v2 · stable

Says where the account is held, for a person to find it by.

• Means: free text a person entered or a linking plugin pre-filled: the institution holding the account, in the deployment's own words; counted in characters once trimmed
• Does not mean: an identifier any component resolves, or a role
• Empty: empty where nobody said
• Filled: entered, by dashboard
• Bounds: at most 200 characters; past it, refused

account_type

text · since v2 · stable

Says what kind of account it is, for a person to find it by.

• Means: free text a person entered or a linking plugin pre-filled: a retirement account, a margin account; counted in characters once trimmed
• Does not mean: what the account may do, which is never read from words
• Empty: empty where nobody said
• Filled: entered, by dashboard
• Bounds: at most 200 characters; past it, refused

owner

text · since v2 · stable

Groups the account by who owns it, for a person to find it by.

• Means: one ownership or grouping label, free text: a fund, a family member; counted in characters once trimmed
• Does not mean: a person who may see it: access is given by groups and permissions, never by this label
• Empty: empty where nobody said
• Filled: entered, by dashboard
• Bounds: at most 200 characters; past it, refused

note

text · since v2 · stable

Keeps anything else worth knowing about the account.

• Means: free text a person wrote; counted in characters once trimmed
• Does not mean: anything a component reads meaning into
• Empty: empty where nobody wrote one
• Filled: entered, by dashboard
• Bounds: at most 2000 characters; past it, refused

ExternalAccountLink

meridian.v1.ExternalAccountLink, a record.

plugin_instance_id

identifier instance · since v2 · stable

Names the plugin whose external account is linked.

• Means: the instance that reported the external account and asked for the link
• Does not mean: a person
• Empty: never empty
• Filled: decided, by conductor

external_account_id

identifier external account · since v2 · stable

Names the external account linked.

• Means: the external account as the plugin reported it (W2.8): stable across its reconnections
• Does not mean: an account of the deployment
• Empty: never empty
• Filled: as-reported, by custody

account_id

identifier account · since v2 · stable

Names the account the external account's records are recorded against.

• Means: an account of the deployment, existing or created in the same step
• Does not mean: the custodian's account number
• Empty: empty when the link was removed
• Filled: decided, by conductor

PluginSettingsRecord

meridian.v1.PluginSettingsRecord, a record.

plugin_instance_id

identifier instance · since v2 · stable

Names the instance the settings are for.

• Means: the instance as the deployment knows it
• Does not mean: a plugin's name or version
• Empty: never empty
• Filled: decided, by conductor

values

repeated message PluginSettingValue · since v2 · stable

Lists the values set that are not secret.

• Means: each setting set, as it stands, a table's rows included; a secret never
• Does not mean: the values the plugin uses, which take its defaults where none is set
• Empty: empty while none that is not secret is set
• Filled: decided, by conductor

secrets_set

repeated text · since v2 · stable

Says which secrets are set, never what they are.

• Means: the names of the secret settings, and of those held sealed, that hold a value
• Does not mean: a value, a hint of one, or whether it works
• Empty: empty while no secret is set
• Filled: decided, by conductor

updated_at_ns

moment · since v2 · stable

Says when the settings last changed, any of them; a change names it to guard against a stale read.

• Means: the time of the latest change, a clear included
• Does not mean: when any one setting changed: changes says that
• Empty: 0 while nothing was ever changed
• Filled: decided, by conductor
• Unit: nanoseconds since the epoch

declared_settings

repeated message SettingDeclaration · since v2 · stable

Carries what the plugin declared, which the form and the tools are built from.

• Means: the settings declared at the plugin's latest registration (W4.8), every value checked against them
• Does not mean: what an older version declared
• Empty: empty before the plugin has registered
• Filled: decided, by conductor

updated_by

text · since v14 · stable

Names who made the latest change.

• Means: the deployment-local subject of the person the dashboard stamped
• Does not mean: who changed any one setting: changes says that
• Empty: empty while nothing was ever changed, and for a clear a re-declaration made
• Filled: stamped, by dashboard

changes

repeated message SettingLastChange · since v17 · stable

Says, per setting, who last changed it and when, so a secret's being set is dated without its value.

• Means: one per setting ever changed, its latest change as its own record says it
• Does not mean: the history of changes, each its own record in the conductor, which no row reads yet
• Empty: empty while nothing was ever changed, and from a conductor before v17
• Filled: decided, by conductor

Hold

meridian.v1.Hold, a record.

role

text · since v16 · stable

Names the edge role the hold covers.

• Means: as set
• Does not mean: a plugin instance
• Empty: empty for a hold over every edge role
• Filled: decided, by conductor

days

integer · since v16 · stable

Says the least time a record is kept.

• Means: the least number of days, from when a record was received, as set
• Does not mean: a window
• Empty: never 0: a cleared hold is not answered
• Filled: decided, by conductor
• Unit: days

write_once

boolean · since v16 · stable

Says whether the hold needs records that cannot be altered.

• Means: as set, met by an archive with object lock
• Does not mean: a regulatory claim
• Empty: false: not enforced by the storage
• Filled: decided, by conductor

updated_by

text · since v16 · stable

Names who set the hold.

• Means: the deployment-local subject of the deployment admin the dashboard stamped
• Does not mean: an agent: an agent acts for the person, named by the delegation beside them
• Empty: never empty
• Filled: stamped, by dashboard

updated_at_ns

moment · since v16 · stable

Says when the hold was set.

• Means: the time of its latest change, its own record
• Does not mean: when it began to apply to a record
• Empty: never 0
• Filled: decided, by conductor
• Unit: nanoseconds since the epoch

acting_through_delegation

text · since v17 · stable

Names the delegation the person who set the hold acted through, beside them.

• Means: the delegation's identifier as the dashboard stamped it on the envelope: the CLI's, or an agent's through /mcp (W6.20)
• Does not mean: an actor of its own: the person is the actor, the delegation provenance
• Empty: empty where the change was made in a browser, through no delegation, and on every record before v17, each of which was
• Filled: stamped, by dashboard

client_name

text · since v17 · stable

Names the client the person who set the hold acted through, so the record reads "by the person, through that client" without a second read.

• Means: the client's registered name, as stamped beside the delegation
• Does not mean: a person's name, or anything that decides access
• Empty: empty whenever acting_through_delegation is
• Filled: stamped, by dashboard

note

text · since v17 · stable

Says why the hold was last set or changed, beside who set it.

• Means: the words of the person, or of the agent acting for them, saying why (decisions/031's why), as kept with the change; at most 2,000 characters
• Does not mean: an instruction to anyone who reads it: it is data, written by whoever made the change
• Empty: empty where none was given: a person at the page may give none, and every change before v17 carried none
• Filled: entered, by dashboard

prepared_call_id

text · since v20 · preview

Names the prepared change the change was made from (W6.27).

• Means: the PC- ID the person's request carried, stamped beside the delegation, so the record says what prepared the change as well as who made it
• Does not mean: who made it, who stays the person; or that an agent made it: a person did, from what was prepared
• Empty: empty where the change was not made from a prepared change, and on every change before v20
• Filled: stamped, by dashboard

MoveRecord

meridian.v1.MoveRecord, a record.

move

message RecordMoveRequest · since v16 · stable

Carries the move as the sidecar reported it.

• Means: the kind, the unit, its count and span, the outcome and the rule
• Does not mean: the content of a record, which no move carries
• Empty: never unset
• Filled: as-reported, by plugin

person

text · since v16 · stable

Names the person a move was done for.

• Means: the deployment-local subject from the envelope
• Does not mean: the plugin, which moves its own records
• Empty: empty for a window's move, whose rule the move names
• Filled: stamped, by sidecar

at_ns

moment · since v16 · stable

Says when the conductor recorded the move.

• Means: the record's time
• Does not mean: when the unit's records were received
• Empty: never 0
• Filled: decided, by conductor
• Unit: nanoseconds since the epoch

acting_through_delegation

text · since v17 · stable

Names the delegation the person who asked for the move acted through, beside them.

• Means: the delegation's identifier as the dashboard stamped it on the envelope: the CLI's, or an agent's through /mcp (W6.20)
• Does not mean: an actor of its own: the person is the actor, the delegation provenance
• Empty: empty where the change was made in a browser, through no delegation, and on every record before v17, each of which was
• Filled: stamped, by dashboard

client_name

text · since v17 · stable

Names the client the person who asked for the move acted through, so the record reads "by the person, through that client" without a second read.

• Means: the client's registered name, as stamped beside the delegation
• Does not mean: a person's name, or anything that decides access
• Empty: empty whenever acting_through_delegation is
• Filled: stamped, by dashboard

ConnectivityLinkChange

meridian.v1.ConnectivityLinkChange, a record.

connectivity_instance_id

identifier instance · since v22 · preview

Names the connectivity plugin instance whose link changed.

• Means: an instance holding connectivity, as the deployment launched it
• Does not mean: the ems it is linked to, which the link itself names
• Empty: never empty
• Filled: decided, by conductor

from_link

message ConnectivityLink · since v22 · preview

Says what the link was before the change.

• Means: its availability, its ems and its users as they stood before
• Does not mean: the placements made through it, which stay as they were
• Empty: unset for the upgrade's own record, when no connectivity plugin was available or linked
• Filled: decided, by conductor

to_link

message ConnectivityLink · since v22 · preview

Says what the link became.

• Means: its availability, its ems and its users from the change
• Does not mean: a grant of the connectivity role, which the deployment's access records
• Empty: never unset
• Filled: entered, by dashboard

note

text · since v22 · preview

Says why the change was made.

• Means: the admin's words, kept with the change, at most 2,000 characters
• Does not mean: an instruction to anyone who reads it
• Empty: empty where none was given at the page
• Filled: entered, by dashboard
• Bounds: at most 2000 characters; past it, refused

VenueAccountMapChange

meridian.v1.VenueAccountMapChange, a record.

ems_instance_id

identifier instance · since v22 · preview

Names the ems instance whose map changed.

• Means: the ems that sent the mapping, as its sidecar stamped it
• Does not mean: the admin it acted for, whom the record names as who
• Empty: never empty
• Filled: stamped, by sidecar

from_mapping

message VenueAccountMapping · since v22 · preview

Says what the mapping was before the change.

• Means: the connectivity plugin, venue account code and account as they stood before
• Does not mean: the facts already placed by it, which keep their account
• Empty: unset where the code had no mapping before
• Filled: decided, by conductor

to_mapping

message VenueAccountMapping · since v22 · preview

Says what the mapping became.

• Means: the connectivity plugin, venue account code and account from the change
• Does not mean: an account the ems was not granted, which is refused
• Empty: unset where the mapping was removed
• Filled: entered, by ems

VenueCatalogue

meridian.v1.VenueCatalogue, a record.

connectivity_instance_id

identifier instance · since v22 · preview

Names the connectivity plugin the catalogue came from.

• Means: the stamped publisher's instance (W11.20)
• Does not mean: the venue
• Empty: never empty
• Filled: stamped, by conductor

venue_account_code

text · since v22 · preview

Names the venue account code the catalogue is for.

• Means: a code the plugin's ems mapped; the conductor keeps the latest per code
• Does not mean: an account ID
• Empty: never empty
• Filled: as-reported, by connectivity

order_types

repeated message VenueOrderType · since v22 · preview

Lists the order types the venue offers.

• Means: each with the times in force it takes; what is not listed is rejected unsupported if sent
• Does not mean: a capability declared about the role
• Empty: empty where the venue lists none
• Filled: as-reported, by connectivity

strategies

repeated message VenueStrategy · since v22 · preview

Lists the broker's strategies.

• Means: each with its parameters, on FIXatdl's model
• Does not mean: an ems's in-house strategies
• Empty: empty where the broker has none
• Filled: as-reported, by connectivity

eligibility

repeated message VenueEligibility · since v22 · preview

Lists the venue's eligibility per instrument.

• Means: fractionable, shortable, borrow status and an options level, as stated
• Does not mean: a check the book makes
• Empty: empty where the venue states none
• Filled: as-reported, by connectivity

execution_acknowledgement

enum ExecutionAcknowledgement · since v23 · preview

Says what the connectivity plugin sends its venue when the ems accepts a venue-originated fill or answers it DK (W11.20, W11.23, W11.24).

• Means: the venue's rules of engagement for the session behind the code, declared beside its order types, where the ems already reads them
• Does not mean: a record of an acknowledgement sent, which is never kept: FIX answers BN with nothing
• Empty: unspecified where the plugin says nothing, read as none: the venue is not told
• Filled: as-reported, by connectivity

Value	Means
EXECUTION_ACKNOWLEDGEMENT_UNSPECIFIED	not said, as a v22 catalogue is: read as EXECUTION_ACKNOWLEDGEMENT_NONE, the venue not told
EXECUTION_ACKNOWLEDGEMENT_NONE	the venue takes neither message: nothing is sent at an accept or a DK, and the ems's page says the venue is not told before a DK
EXECUTION_ACKNOWLEDGEMENT_BN	the venue takes FIX's ExecutionAcknowledgement (35=BN): ExecAckStatus Accepted at an accept, Don't know / Rejected with DKReason at a DK
EXECUTION_ACKNOWLEDGEMENT_DONT_KNOW_TRADE	the venue takes FIX's DontKnowTrade (35=Q) at a DK, and nothing is sent at an accept, Q having no accept

Accounts

meridian.v1.Accounts, a message.

accounts

repeated message AccountRecord · since v2 · stable

Lists the deployment's accounts a plugin may link an external account to.

• Means: each account's identifier, name, state, custodian, type, owner and note; read only acting for an admin of the plugin in a session opened by Manage (W6.4)
• Does not mean: what any account holds: no holdings are carried
• Empty: empty when the deployment has no account
• Filled: decided, by conductor

LinkExternalAccountRequest

meridian.v1.LinkExternalAccountRequest, a message.

plugin_instance_id

identifier instance · since v2 · stable

Names the plugin asking for the link.

• Means: the instance the sidecar was launched to serve
• Does not mean: anything a plugin may choose: it can link only the external accounts it reported
• Empty: a plugin leaves it empty; its sidecar sets it
• Filled: stamped, by sidecar

external_account_id

identifier external account · since v2 · stable

Names the external account to link, or whose link to remove.

• Means: an external account this plugin reported (W2.8)
• Does not mean: an account of the deployment
• Empty: never empty: refused naming the external account
• Filled: as-reported, by custody
• Required on: LinkExternalAccount from v2

account_id

identifier account · since v2 · stable

Names an existing account to link the external account to.

• Means: an account of the deployment the conductor holds
• Does not mean: a new account's name
• Empty: empty when the request names a new account, or removes the link; never set beside new_account_name
• Filled: entered, by custody

new_account_name

text · since v2 · stable

Names a new account for the conductor to create and link in one step.

• Means: the name a person chose; only a deployment admin may create an account this way
• Does not mean: the custodian's name for the external account, which a person may start from
• Empty: empty unless the request creates an account; never set beside account_id
• Filled: entered, by custody

new_account_custodian

text · since v2 · stable

Says where a new account is held.

• Means: the new account's custodian, as AccountRecord.custodian says, which the plugin may pre-fill from what its source reported
• Does not mean: an edit of an existing account's, which only W6.3 makes
• Empty: empty where nobody said; ignored unless new_account_name is given
• Filled: entered, by custody
• Bounds: at most 200 characters; past it, refused

new_account_type

text · since v2 · stable

Says what kind of account a new account is.

• Means: the new account's type, as AccountRecord.account_type says, which the plugin may pre-fill
• Does not mean: an edit of an existing account's
• Empty: empty where nobody said; ignored unless new_account_name is given
• Filled: entered, by custody
• Bounds: at most 200 characters; past it, refused

new_account_owner

text · since v2 · stable

Groups a new account by who owns it.

• Means: the new account's owner, as AccountRecord.owner says
• Does not mean: an edit of an existing account's, or who may see it
• Empty: empty where nobody said; ignored unless new_account_name is given
• Filled: entered, by custody
• Bounds: at most 200 characters; past it, refused

new_account_note

text · since v2 · stable

Keeps anything else worth knowing about a new account.

• Means: the new account's note, as AccountRecord.note says
• Does not mean: an edit of an existing account's
• Empty: empty where nobody wrote one; ignored unless new_account_name is given
• Filled: entered, by custody
• Bounds: at most 2000 characters; past it, refused

AccessEntry

meridian.v1.AccessEntry, a message.

role

text · since v15 · stable

Names the role of the plugin the entry grants a level on.

• Means: a role from the deployment's fixed list that the plugin holds, as its sidecar last reported; an entry naming a role the plugin no longer holds holds nothing and is flagged
• Does not mean: a part the plugin names for itself, or a grant on the bus, which the plugin's roles' generated grants decide
• Empty: empty only on an entry for a plugin holding no role; refused empty on a plugin holding one once the one-time rewrite has run
• Filled: entered, by dashboard

AccessRecords

meridian.v1.AccessRecords, a message.

known_plugins

repeated message KnownPluginRoles · since v15 · stable

Gives the dashboard each known plugin's roles, so it folds grants per role and mints each role's entry in the claims.

• Means: every plugin a sidecar has reported, with the roles it was launched with as its sidecar last reported them, launched through the dashboard or installed by the chart, running or stopped
• Does not mean: who holds those roles, which the access groups say
• Empty: empty before any sidecar has reported, and from a conductor before v15
• Filled: decided, by conductor

connectivity_links

repeated message ConnectivityLink · since v22 · preview

Gives the dashboard each connectivity plugin's standing link, so its pages show them after a reload and dashboard__read_plugin_access answers them (W11.21).

• Means: each connectivity plugin instance's availability, the ems it is linked to and its users, as the conductor keeps them; filled for the dashboard only
• Does not mean: the link's history, which the conductor keeps as each change's own record
• Empty: empty while no connectivity plugin is available or linked, and from a conductor before v22
• Filled: decided, by conductor

venue_account_maps

repeated message VenueAccountMap · since v22 · preview

Gives the dashboard each ems's venue account map, so its page shows the mappings after a reload and dashboard__read_plugin_access answers them (W11.22).

• Means: each ems instance's mappings of book accounts to the venue account codes they trade under at its connectivity plugins, as the conductor keeps them; filled for the dashboard only
• Does not mean: the map's history, which the conductor keeps as each change's own record
• Empty: empty while no ems has mapped an account, and from a conductor before v22
• Filled: decided, by conductor

KnownPluginRoles

meridian.v1.KnownPluginRoles, a message.

plugin_instance_id

identifier instance · since v15 · stable

Names the plugin instance.

• Means: the instance as its sidecar reported it
• Does not mean: a version or an image
• Empty: never empty
• Filled: decided, by conductor

roles

repeated text · since v15 · stable

Lists the roles the plugin was launched with.

• Means: roles from the deployment's fixed list, as the plugin's sidecar last reported them
• Does not mean: the roles its metadata asked for, where a launch approved otherwise; or anything a person holds
• Empty: empty for a plugin holding no role
• Filled: decided, by conductor
• Bounds: at most 13 items; past it, refused

SetPluginSettingsRequest

meridian.v1.SetPluginSettingsRequest, a message.

plugin_instance_id

identifier instance · since v2 · stable

Names the plugin instance whose settings change.

• Means: the instance as the deployment knows it, launched or installed by the chart
• Does not mean: a plugin's name or version
• Empty: never empty
• Filled: entered, by dashboard

values

repeated message PluginSettingValue · since v2 · stable

Lists the settings set or replaced.

• Means: each a declared setting's name and the value set, a table's rows written as its text; a secret's value only as a person typed it at the Settings form, never through /mcp
• Does not mean: every setting the plugin holds: one not named is left as it is
• Empty: empty where the change only clears
• Filled: entered, by dashboard

cleared

repeated text · since v2 · stable

Lists the settings cleared.

• Means: declared settings' names whose values are removed, so the plugin's default applies; a secret cleared as the form's Clear does
• Does not mean: settings left unset by not being named
• Empty: empty where nothing is cleared
• Filled: entered, by dashboard

note

text · since v17 · stable

Says why the settings changed, kept with the change's record.

• Means: the words of the person, or of the agent acting for them, saying why (decisions/031's why); at most 2,000 characters, as a note on an instrument record
• Does not mean: an instruction to anyone who reads it: it is data, written by whoever made the change
• Empty: empty where a person at the page gave none; never empty through /mcp, which refuses a change without one
• Filled: entered, by dashboard

against_updated_at_ns

moment · since v17 · stable

Guards a change against a stale read.

• Means: the settings record's updated_at_ns as it was read; the conductor refuses the change, naming this field, where the record has changed since, a record never saved included
• Does not mean: when the change is made
• Empty: 0: against a record read as never saved, refused once anything has been saved for the instance (contract v18); through /mcp it is required, and refused by name when left out
• Filled: entered, by dashboard
• Unit: nanoseconds since the epoch

Changes: v18, clarified: 0 is a read of a record never saved, checked as any read is: refused once anything has been saved, where before v18 a change naming 0 went unchecked (v17's security review, I1, ruled 2026-10-09).

PluginSettingValue

meridian.v1.PluginSettingValue, a message.

name

text · since v2 · stable

Names a setting the plugin declared.

• Means: the declared setting's name (W4.1)
• Does not mean: its label, which a person reads
• Empty: never empty
• Filled: entered, by dashboard

value

text · since v2 · stable

Carries the value set.

• Means: the value as its declared type reads it, a table's rows as their written text; on the record, never a secret's
• Does not mean: a value a plugin chose for itself, or a default, which is never stored
• Empty: never empty: clearing names the setting in cleared
• Filled: entered, by dashboard

SettingLastChange

meridian.v1.SettingLastChange, a message.

name

text · since v17 · stable

Names the setting.

• Means: a declared setting's name, a secret's included
• Does not mean: its value
• Empty: never empty
• Filled: decided, by conductor

changed_by

text · since v17 · stable

Names who last changed the setting.

• Means: the deployment-local subject of the person the dashboard stamped
• Does not mean: who last changed any other setting
• Empty: empty for a clear a re-declaration made
• Filled: stamped, by dashboard

changed_at_ns

moment · since v17 · stable

Says when the setting last changed.

• Means: the time of its latest change, set or cleared; for a secret, when it was set
• Does not mean: when the plugin received it
• Empty: never 0
• Filled: decided, by conductor
• Unit: nanoseconds since the epoch

acting_through_delegation

text · since v17 · stable

Names the delegation the person who last changed the setting acted through, beside them.

• Means: the delegation's identifier as the dashboard stamped it on the envelope: the CLI's, or an agent's through /mcp (W6.20)
• Does not mean: an actor of its own: the person is the actor, the delegation provenance
• Empty: empty where the change was made in a browser, through no delegation, and on every record before v17, each of which was
• Filled: stamped, by dashboard

client_name

text · since v17 · stable

Names the client the person who last changed the setting acted through, so the record reads "by the person, through that client" without a second read.

• Means: the client's registered name, as stamped beside the delegation
• Does not mean: a person's name, or anything that decides access
• Empty: empty whenever acting_through_delegation is
• Filled: stamped, by dashboard

note

text · since v17 · stable

Says why the setting last changed, beside who changed it, so an agent reads the reason a page shows.

• Means: the words of the person, or of the agent acting for them, saying why (decisions/031's why), as kept with the change; at most 2,000 characters; where the store backfilled or redacted the record, its own words saying so
• Does not mean: an instruction to anyone who reads it: it is data, written by whoever made the change
• Empty: empty where none was given: a person at the form may give none, and every change before v17 carried none
• Filled: entered, by dashboard

prepared_call_id

text · since v20 · preview

Names the prepared change the change was made from (W6.27).

• Means: the PC- ID the person's request carried, stamped beside the delegation, so the record says what prepared the change as well as who made it
• Does not mean: who made it, who stays the person; or that an agent made it: a person did, from what was prepared
• Empty: empty where the change was not made from a prepared change, and on every change before v20
• Filled: stamped, by dashboard

hint

text · since v20 · preview

Helps a person tell which secret is set.

• Means: the secret's last four characters, kept apart from it by the conductor when it was set, never derived from it again (W6.11)
• Does not mean: the value, which is never read back, delivered elsewhere or logged
• Empty: empty for a setting that is not secret, a secret shorter than 16 characters, and every secret set before v20
• Filled: derived, by conductor
• Bounds: at most 4 characters; past it, refused

SetHoldRequest

meridian.v1.SetHoldRequest, a message.

role

text · since v16 · stable

Names the edge role the hold covers.

• Means: one of decisions/028's edge roles; another is refused, naming it
• Does not mean: a plugin instance, or a person's role
• Empty: empty for a hold over every edge role
• Filled: entered, by dashboard

days

integer · since v16 · stable

Sets the least time a record is kept.

• Means: the least number of days a record is kept anywhere, storage or archive, from when it was received; at most 36,500
• Does not mean: a window, which a plugin admin sets within it
• Empty: 0 clears the hold
• Filled: entered, by dashboard
• Unit: days

write_once

boolean · since v16 · stable

Asks for records that cannot be altered.

• Means: met only by an archive with object lock for the hold's length; refused where the archive cannot lock
• Does not mean: a regulatory claim: the deployment says what it enforces, never that a rule is met
• Empty: false: the hold is the deployment's policy, not enforced by the storage
• Filled: entered, by dashboard

note

text · since v17 · stable

Says why the hold is set, changed or cleared, kept with the change's record.

• Means: the words of the person, or of the agent acting for them, saying why (decisions/031's why); at most 2,000 characters, as a note on an instrument record
• Does not mean: an instruction to anyone who reads it: it is data, written by whoever made the change
• Empty: empty where a person at the page gave none; never empty through /mcp, which refuses a change without one
• Filled: entered, by dashboard

SetDatasetLicenceRequest

meridian.v1.SetDatasetLicenceRequest, a message.

dataset

identifier dataset · since v18 · preview

Names the dataset licensed.

• Means: a dataset a launched instance's catalogue declares; another is refused
• Does not mean: a vendor's product
• Empty: never empty
• Filled: entered, by dashboard

licence

message DatasetLicence · since v18 · preview

Carries the terms a deployment admin sets.

• Means: the terms, confirming or replacing the catalogue's default; its dataset and author are the request's and the dashboard's, whatever it carries
• Does not mean: a claim that the deployment meets the vendor's terms
• Empty: never unset
• Filled: entered, by dashboard

note

text · since v18 · preview

Says why the licence changed, kept with the change's record.

• Means: the words of the person, or of the agent acting for them
• Does not mean: an instruction to anyone who reads it: it is data
• Empty: empty where a person at the page gave none; never empty through /mcp, which refuses a change without one
• Filled: entered, by dashboard

SetDatasetEntitlementRequest

meridian.v1.SetDatasetEntitlementRequest, a message.

dataset

identifier dataset · since v18 · preview

Names the dataset.

• Means: a dataset a launched instance's catalogue declares
• Does not mean: a vendor's product
• Empty: never empty
• Filled: entered, by dashboard

instance

identifier instance · since v18 · preview

Names the plugin instance entitled.

• Means: a launched instance
• Does not mean: a person
• Empty: never empty
• Filled: entered, by dashboard

allowed

boolean · since v18 · preview

Says whether the instance may read the dataset.

• Means: true entitles it; false withdraws it
• Does not mean: a licence to keep rows
• Empty: false withdraws the entitlement
• Filled: entered, by dashboard

fields

repeated text · since v18 · preview

Narrows the entitlement to some fields.

• Means: fields by their dictionary entries, each an entry of the dataset's data types, or refused
• Does not mean: what the dataset fills
• Empty: none: every field
• Filled: entered, by dashboard
• Bounds: at most 64 items; past it, refused

note

text · since v18 · preview

Says why the entitlement changed.

• Means: the words of the person, or of the agent acting for them
• Does not mean: an instruction to anyone who reads it: it is data
• Empty: empty where a person at the page gave none; never empty through /mcp
• Filled: entered, by dashboard

SetConnectivityAvailableRequest

meridian.v1.SetConnectivityAvailableRequest, a message.

connectivity_instance_id

identifier instance · since v22 · preview

Names the connectivity plugin made available or withdrawn (W11.21).

• Means: an instance holding connectivity; one that does not is refused INVALID_ARGUMENT naming it
• Does not mean: an ems
• Empty: never empty
• Filled: entered, by dashboard

available

boolean · since v22 · preview

Says whether the instance is available to link.

• Means: a deployment admin's, at the page only (access); nothing is available by default
• Does not mean: a link to an ems, which the ems's admin makes
• Empty: false withdraws it
• Filled: entered, by dashboard

note

text · since v22 · preview

Says why, kept with the change's record.

• Means: the deployment admin's words, at most 2,000 characters as the change record's note
• Does not mean: an instruction to anyone who reads it
• Empty: empty where none was given at the page
• Filled: entered, by dashboard
• Bounds: at most 2000 characters; past it, refused

LinkConnectivityRequest

meridian.v1.LinkConnectivityRequest, a message.

connectivity_instance_id

identifier instance · since v22 · preview

Names the connectivity plugin linked or unlinked (W11.21).

• Means: an available instance; one already linked to another ems is refused REFUSAL_REASON_CONNECTIVITY_LINKED, one not available FAILED_PRECONDITION
• Does not mean: an ems
• Empty: never empty
• Filled: entered, by dashboard

ems_instance_id

identifier instance · since v22 · preview

Names the ems the connectivity plugin is linked to.

• Means: the ems plugin admin's own ems; unlinking leaves the placements already made as they are
• Does not mean: a second ems: each connectivity plugin is linked to exactly one
• Empty: empty unlinks it
• Filled: entered, by dashboard

users

repeated message ConnectivityUser · since v22 · preview

Says who may route through it.

• Means: the whole set, replacing the last: persons, service accounts and user groups of the ems's
• Does not mean: a grant of a role, which access per role records
• Empty: empty: nobody may route through it
• Filled: entered, by dashboard

note

text · since v22 · preview

Says why, kept with the change's record.

• Means: the ems admin's words, at most 2,000 characters as the change record's note
• Does not mean: an instruction to anyone who reads it
• Empty: empty where none was given at the page
• Filled: entered, by dashboard
• Bounds: at most 2000 characters; past it, refused

MapVenueAccountRequest

meridian.v1.MapVenueAccountRequest, a message.

connectivity_instance_id

identifier instance · since v22 · preview

Names the connectivity plugin the mapping is at (W11.22).

• Means: one linked to the sending ems, or refused REFUSAL_REASON_CONNECTIVITY_NOT_ALLOWED
• Does not mean: a venue
• Empty: never empty
• Filled: as-reported, by ems

venue_account_code

text · since v22 · preview

Carries the venue account code mapped.

• Means: a code once per plugin: one mapped on that plugin already is refused ALREADY_EXISTS
• Does not mean: an account ID
• Empty: never empty
• Filled: as-reported, by ems

account_id

identifier account · since v22 · preview

Names the book account the code trades under.

• Means: an account the deployment admin granted the ems's instance (W6.30), or refused REFUSAL_REASON_ACCOUNT_NOT_LINKABLE with FAILED_PRECONDITION
• Does not mean: an external account a custody plugin links: those are suggestions at most, never the map (Q42)
• Empty: empty removes the mapping
• Filled: entered, by ems

ems_instance_id

identifier instance · since v22 · preview

Names the ems whose map changes.

• Means: the sending instance, stamped by the sidecar
• Does not mean: the admin it acts for, whom the change records as who
• Empty: stamped on every mapping; whatever the plugin sent is replaced
• Filled: stamped, by sidecar

VenueOrderType

meridian.v1.VenueOrderType, a message.

order_type

enum OrderType · since v22 · preview

Names an order type the venue offers.

• Means: converted at the edge from the venue's own definitions
• Does not mean: a FIX tag, which stays at the edge
• Empty: never unspecified
• Filled: as-reported, by connectivity

Value	Means
ORDER_TYPE_UNSPECIFIED	not said
ORDER_TYPE_MARKET	at the market
ORDER_TYPE_LIMIT	at its limit price or better
ORDER_TYPE_STOP	a market order once its stop price triggers
ORDER_TYPE_STOP_LIMIT	a limit order once its stop price triggers
ORDER_TYPE_REQUEST_FOR_QUOTE	an RFQ order: its quotes and outcomes are slice C's, on its placement

times_in_force

repeated enum TimeInForce · since v22 · preview

Lists the times in force the order type takes.

• Means: as the venue states them
• Does not mean: the order's own
• Empty: empty where the venue states none
• Filled: as-reported, by connectivity

Value	Means
TIME_IN_FORCE_UNSPECIFIED	not said
TIME_IN_FORCE_DAY	for the day: the book expires it at the close (W11.13)
TIME_IN_FORCE_GOOD_TILL_CANCELLED	until cancelled
TIME_IN_FORCE_GOOD_TILL_DATE	until its expire date
TIME_IN_FORCE_GOOD_TILL_TIME	until its kill time
TIME_IN_FORCE_IMMEDIATE_OR_CANCEL	what fills at once, the rest cancelled
TIME_IN_FORCE_FILL_OR_KILL	all at once or none
TIME_IN_FORCE_AT_THE_OPEN	at the opening
TIME_IN_FORCE_AT_THE_CLOSE	at the close

stated_at_ns

moment · since v22 · preview

Says when the venue stated it.

• Means: the time the entry was stated
• Does not mean: when the conductor kept it
• Empty: never 0
• Filled: as-reported, by connectivity
• Unit: nanoseconds since the epoch

VenueStrategy

meridian.v1.VenueStrategy, a message.

kind

enum StrategyKind · since v22 · preview

Says which of the contract's kinds the broker's strategy is.

• Means: VWAP, TWAP, POV or IS, where it is one
• Does not mean: the broker's name for it
• Empty: unspecified where it is none of the contract's kinds
• Filled: as-reported, by connectivity

Value	Means
STRATEGY_KIND_UNSPECIFIED	not said
STRATEGY_KIND_VWAP	the broker's volume-weighted average price strategy
STRATEGY_KIND_TWAP	the broker's time-weighted average price strategy
STRATEGY_KIND_POV	the broker's percentage-of-volume strategy
STRATEGY_KIND_IS	the broker's implementation-shortfall strategy

name

text · since v22 · preview

Names the broker's strategy.

• Means: the broker's name for it, as published
• Does not mean: a contract kind
• Empty: never empty
• Filled: as-reported, by connectivity

stated_at_ns

moment · since v22 · preview

Says when the broker stated it.

• Means: the time the entry was stated
• Does not mean: when the conductor kept it
• Empty: never 0
• Filled: as-reported, by connectivity
• Unit: nanoseconds since the epoch

parameters

repeated message StrategyParameter · since v22 · preview

Lists the strategy's parameters.

• Means: as FIXatdl's Parameter elements describe them; the fixTag and wireValue stay at the edge
• Does not mean: a FIX tag: an ems never meets one
• Empty: empty where it takes none
• Filled: as-reported, by connectivity

StrategyParameter

meridian.v1.StrategyParameter, a message.

name

text · since v22 · preview

Names the parameter.

• Means: its name, as FIXatdl's Parameter gives it
• Does not mean: a FIX tag
• Empty: never empty
• Filled: as-reported, by connectivity

type

enum StrategyParameterType · since v22 · preview

Says the parameter's type.

• Means: FIXatdl's parameter types, in the contract's spelling
• Does not mean: a contract field's type
• Empty: never unspecified
• Filled: as-reported, by connectivity

Value	Means
STRATEGY_PARAMETER_TYPE_UNSPECIFIED	not said
STRATEGY_PARAMETER_TYPE_INT	FIXatdl's Int_t: a whole number
STRATEGY_PARAMETER_TYPE_FLOAT	FIXatdl's Float_t: a decimal number
STRATEGY_PARAMETER_TYPE_QTY	FIXatdl's Qty_t: a quantity
STRATEGY_PARAMETER_TYPE_PRICE	FIXatdl's Price_t: a price
STRATEGY_PARAMETER_TYPE_PRICE_OFFSET	FIXatdl's PriceOffset_t: an offset from a price
STRATEGY_PARAMETER_TYPE_AMOUNT	FIXatdl's Amt_t: an amount
STRATEGY_PARAMETER_TYPE_PERCENTAGE	FIXatdl's Percentage_t: a percentage
STRATEGY_PARAMETER_TYPE_BOOLEAN	FIXatdl's Boolean_t: true or false
STRATEGY_PARAMETER_TYPE_CHAR	FIXatdl's Char_t: one character
STRATEGY_PARAMETER_TYPE_STRING	FIXatdl's String_t: text
STRATEGY_PARAMETER_TYPE_UTC_TIMESTAMP	FIXatdl's UTCTimestamp_t: a moment
STRATEGY_PARAMETER_TYPE_LOCAL_MARKET_DATE	FIXatdl's LocalMktDate_t: a date in the market's zone

required

boolean · since v22 · preview

Says whether the parameter is required.

• Means: FIXatdl's use="required"
• Does not mean: a default
• Empty: false: optional
• Filled: as-reported, by connectivity

min_value

text · since v22 · preview

Says the parameter's least value.

• Means: in the type's text form, FIXatdl's minValue
• Does not mean: a bound the book enforces
• Empty: empty where unbounded below
• Filled: as-reported, by connectivity

max_value

text · since v22 · preview

Says the parameter's most value.

• Means: in the type's text form, FIXatdl's maxValue
• Does not mean: a bound the book enforces
• Empty: empty where unbounded above
• Filled: as-reported, by connectivity

allowed_values

repeated text · since v22 · preview

Lists the values allowed.

• Means: FIXatdl's EnumPair values, in the type's text form
• Does not mean: wire values, which stay at the edge
• Empty: empty where any value of the type is allowed
• Filled: as-reported, by connectivity

default_value

text · since v22 · preview

Says the parameter's default.

• Means: FIXatdl's initValue, in the type's text form
• Does not mean: a value the ems must send
• Empty: empty where none
• Filled: as-reported, by connectivity

VenueEligibility

meridian.v1.VenueEligibility, a message.

instrument_id

identifier instrument · since v22 · preview

Names the instrument.

• Means: the deployment's instrument ID
• Does not mean: a venue's symbol
• Empty: never empty
• Filled: as-reported, by connectivity

fractionable

boolean · since v22 · preview

Says whether the venue takes fractional quantities.

• Means: as the venue states for the account
• Does not mean: a quantity's scale
• Empty: false where the venue does not state it fractionable
• Filled: as-reported, by connectivity

shortable

boolean · since v22 · preview

Says whether the venue takes a short sale.

• Means: as the venue states for the account
• Does not mean: a locate
• Empty: false where the venue does not state it shortable
• Filled: as-reported, by connectivity

stated_at_ns

moment · since v22 · preview

Says when the venue stated it.

• Means: the time the entry was stated
• Does not mean: when the conductor kept it
• Empty: never 0
• Filled: as-reported, by connectivity
• Unit: nanoseconds since the epoch

borrow_status

enum BorrowStatus · since v22 · preview

Says the venue's borrow status (W11.18).

• Means: easy or hard to borrow, as the venue states
• Does not mean: data's lists in the lake, which are kept too, a plugin choosing which to read
• Empty: unspecified where the venue states none
• Filled: as-reported, by connectivity

Value	Means
BORROW_STATUS_UNSPECIFIED	not stated
BORROW_STATUS_EASY_TO_BORROW	easy to borrow, as the venue states
BORROW_STATUS_HARD_TO_BORROW	hard to borrow, as the venue states

options_level

integer · since v22 · preview

Says the options level for the account.

• Means: the level the venue states
• Does not mean: a level of access in the deployment
• Empty: 0 where none
• Filled: as-reported, by connectivity
• Unit: the venue's options levels

VenueCatalogueEvent

meridian.v1.VenueCatalogueEvent, a message.

catalogue

message VenueCatalogue · since v22 · preview

Publishes the venue's catalogue for a code (W11.20).

• Means: kept by the conductor, latest per code, each change its own record; heard by the ems and the oms
• Does not mean: a capability
• Empty: never unset
• Filled: as-reported, by connectivity

publisher_instance_id

identifier instance · since v22 · preview

Names the connectivity plugin that published it.

• Means: stamped by the sidecar
• Does not mean: anything the plugin chooses
• Empty: stamped on every catalogue; whatever the plugin sent is replaced
• Filled: stamped, by sidecar

ReadVenueCatalogueRequest

meridian.v1.ReadVenueCatalogueRequest, a message.

connectivity_instance_id

identifier instance · since v22 · preview

Names the connectivity plugin whose catalogue is read.

• Means: one the reader routes to
• Does not mean: a venue
• Empty: never empty
• Filled: as-reported, by ems

venue_account_code

text · since v22 · preview

Names the code whose catalogue is read.

• Means: a code; one the plugin has not published is answered empty, not refused
• Does not mean: an account ID
• Empty: never empty
• Filled: as-reported, by ems

ReadVenueCatalogueReply

meridian.v1.ReadVenueCatalogueReply, a message.

catalogue

message VenueCatalogue · since v22 · preview

Answers the latest catalogue for the code.

• Means: as the conductor keeps it
• Does not mean: a history
• Empty: unset where the plugin has not published one for the code
• Filled: decided, by conductor

---

Generated from boundaries/fields.json in meridian-schema at a6a0af7, contract v24.