Mother Node: Verification and Authorization Boundary

The TSN Node verifies signed intents, coordinates the epoch treasury, holds encrypted payment bindings, and signs Mother-rooted DNA permits.

In plain English: The Mother Node is TSN’s coordination and verification role. The current implementation is tsn-node: it checks that a signed intent is valid, holds the encrypted payment binding, coordinates the epoch treasury, and signs the short-lived Mother-rooted DNA permits that authorize Cranker Nodes to settle. It is the only party that sees plaintext bindings.

Node role

Status: Live on Devnet. Hosted at https://tsn-node.wasmer.app.

The Mother Node:

• verifies canonical signatures, expiry, nonce and replay rules
• verifies amounts, commitments, and the recipient route commitment and version
• creates the durable verified payment record
• redacts recipient identity from that record
• stores the encrypted payment binding off-chain
• derives the opaque keyed slot with HMAC-SHA256
• signs Mother-rooted DNA permits for Cranker Nodes
• authorizes refunds when an intent expires

What the Node sees (and what it does not expose)

Sees, encrypted, in Node-only storage:

• Recipient route, sender refund destination
• Funding lineage, amount, mint, epoch, payment hash

Sees, transiently, to derive slot and permit:

• Recipient TIN inside the initial signed request
• Route binding

Never exposes:

• Plaintext binding to Receiver, Cranker, or the chain
• The encryption key
• The Node-only route reference (used only once, expires quickly)

Work lifecycle

RECEIVED
  → NODE_VERIFYING
  → VERIFIED
  → CRANKER_LEASED
  → SUBMITTED
  → CONFIRMED

REJECTED is terminal for invalid work. A lease expiring returns eligible work to the queue but never grants a cranker authority to alter the plan.

Mother-rooted DNA permit

For each lease, the Node signs a permit binding:

• opaque slot
• commitment digest, random nonce, nullifier
• Mother-rooted epoch treasury and ledger
• CrankerVault, recipient, mint, amount
• lease id, version, expiry
• authorization expiry

The permit is what makes the settlement instruction valid. Without it, the TSN program rejects the transaction before token movement.

Refund authorization

Status: Live on Devnet.

If an intent expires without settlement, the Node signs a refund permit against the same opaque slot. The first valid refund initializes and consumes the slot as REFUNDED and returns the exact amount from the epoch treasury to the sender’s authorized refund destination.

Related

Cranker Node

An independent operator process that submits Mother-Node-authorized work.

TSN Layer

Program-level settlement instructions.

Architecture

End-to-end sequence diagram.

FAQ

Privacy boundaries and Devnet status.