Skip to main content
GPRU (Guarded Privacy Routing Unit) guards the integrity and privacy of a user’s private state as that state is presented to TCAP. For a balance-changing action, its proof is intended to show that the hidden state is current and that the proposed transition follows from it. This gives GPRU a verification role, not custody of funds. TCAP governs accepted assets, authorization, reserves, and liquidity, and applies a valid transition atomically. A GPRU proof by itself cannot move tokens or authorize a payment.

​
What the proof is intended to establish

  • The submitted private state is the current state for the action.
  • The proposed change follows from that state and the authorized action.
  • The private identity and state witness need not be disclosed in plaintext to the verifier.
These are the design goals of the hidden-head proof. The proof flow is not currently established as an end-to-end settlement capability, so applications must not present it as an active guarantee.

​
Identity privacy and public-chain visibility

The native-credit ABI hides the recipient route/head witness and does not encode a plaintext TIN or private predecessor pointer. The owner retains its record lineage. Shared roots, public statement fields, encrypted Memo bytes, accounts, timing and funding wallets remain observable; the design does not establish that metadata or authorized Node/application knowledge cannot correlate payments. Confidential debit/exit remains a separate unverified execution path. For the cryptographic contract, circuit artifacts, and integration decisions, see the GPRU documentation in the repository.