A clearing switch is only as trustworthy as the messages it accepts. Before any cross-org authorize / clear / dispute / reverse routes issuer↔provider, its envelope is validated like an ISO-8583 message: the right mandatory fields for that type, a protocol version the switch speaks, an idempotency key on anything side-effecting. Anything malformed is rejected — the switch never routes a bad envelope.
Honest scope. This is the deterministic message validator + routing decision — the on-the-wire contract a federated switch would enforce. EcoCloud does not yet run a live cross-org switch (that's infrastructure, not a kernel); this defines and checks the envelope so members can agree on one format. It composes with the ACS lifecycle (authorize→clear→settle), the idempotency model, and the netting kernel (clearing the accepted messages). Source: flowdesk-switch-kernel.js.