Skip to main content
TSN separates transfer identity, private-state verification, and asset settlement so that each has a clear authority boundary.

​
Identity stays separate from custody

TIP manages transfer identities. A TIN gives a sender a recipient identifier to resolve; it is not a wallet key or a place where tokens are held. The owner remains responsible for authorizing wallet actions.

​
Private state is checked before settlement

GPRU is designed to guard the integrity and privacy of a user’s private state as it is presented to TCAP. Its proof should show that the hidden state is current and that the proposed transition follows from it. TCAP governs accepted assets and liquidity, then applies authorized changes atomically. GPRU does not hold funds or replace TCAP’s checks.

​
Claims match evidence

A protocol description, source implementation, successful build, deployment, and confirmed transaction are different kinds of evidence. Public materials state feature limitations plainly and do not describe a capability as active until its end-to-end behavior is verified. Each TIN settlement is designed as a new opaque record without a public pointer from funding or its private predecessor; the owner retains the lineage, while TSNP/TCAP verify the proof without learning the hidden TIN link. Shared roots and timing do not create that pointer. Direct wallet transfers expose their endpoints. A TIN-to-wallet exit exposes the output wallet and amount, but does not publish the source TIN. The hidden-head proof path is not established end to end, so this design is not yet an operational guarantee. Detailed proof and deployment verification belongs in the repository documentation.