Skip to main content
In plain English: TSN is the settlement and authorization coordination layer. It owns the epoch treasury, verifies Mother-rooted DNA permits, initializes and consumes opaque EpochClaimSlot PDAs, pays recipients from cranker vaults, and processes refunds. It does not hold a balance ledger. TCAP does that.

​
What TSN owns

  • Epoch Treasury. A protocol-controlled token account that receives funding and holds aggregate pending liability. Not a user balance container.
  • EpochClaimSlot PDA. Derived from the epoch treasury and an opaque slot key. Initialized by the first valid settlement or refund. Stores SETTLED or REFUNDED state and the successful cranker.
  • Cranker vault reimbursement. After a cranker pays a recipient, TSN reimburses that exact cranker vault for the exact amount, only if the Mother-rooted permit checks out.
  • Refund path. If a settlement expires, Node/Mother signs a refund against the same slot. First writer wins.

​
Funding

Funding sends tokens only to the epoch treasury token account and increments aggregate pending liability. Funding creates no payment account, escrow account, commitment PDA, or public payment identifier.

​
Settlement (payout)

Status: Live on Devnet.
Node signs a permit binding:
  • opaque slot
  • commitment digest, random nonce, nullifier
  • Mother-rooted epoch treasury and ledger
  • CrankerVault, recipient, mint, amount
  • lease id, version, expiry
  • authorization expiry
Cranker submits the exact leased transaction. TSN atomically:
  1. Checks the Node permit, lease, slot state, nullifier, treasury liability.
  2. Pays the recipient from the CrankerVault.
  3. Reimburses that exact CrankerVault for the exact amount.
  4. Marks the slot SETTLED and records the successful cranker.
The cranker cannot change amount, token, recipient binding, commitments, sequence, policy, nullifier, or expiry. Any change breaks the permit.

​
Refund

Status: Live on Devnet.
Refund uses the same opaque slot as settlement. The first valid refund initializes and consumes the slot as REFUNDED and pays the authorized refund destination from the epoch treasury. After SETTLED or REFUNDED, any later operation against the slot fails before token movement.

​
Epoch close

An epoch can close only when pending liability is zero and every slot is resolved.

​
Cranker registration

Status: Live on Devnet.
Crankers are registered with the TSN program and each has a program-owned CrankerVault. Crankers can be funded, unfunded, and have a funding policy set. A cranker cannot rewrite a permit.

​
What TSN never sees

  • Plaintext receiving roots
  • Private balance values
  • Recipient TIN inside the tip transition
  • Payment intent IDs on the privacy-safe credit path

TIN

Payment identity and route discovery.

GPRU

Non-custodial authorization and routing.

TCAP

Private balance accounting: credit, debit, exit.

Architecture

End-to-end sequence diagram.