> ## Documentation Index
> Fetch the complete documentation index at: https://trust-link-tsn.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# Mother Node: Verification and Authorization Boundary
> The TSN Node verifies signed intents, coordinates the epoch treasury, holds encrypted payment bindings, and signs Mother-rooted DNA permits.
**In plain English:** The Mother Node is TSN’s coordination and verification role. The current implementation is `tsn-node`: it checks that a signed intent is valid, holds the encrypted payment binding, coordinates the epoch treasury, and signs the short-lived Mother-rooted DNA permits that authorize Cranker Nodes to settle. It is the only party that sees plaintext bindings.
## Node role
**Status: Live on Devnet.** Hosted at `https://tsn-node.wasmer.app`.
The Mother Node:
* verifies canonical signatures, expiry, nonce and replay rules
* verifies amounts, commitments, and the recipient route commitment and version
* creates the durable verified payment record
* **redacts recipient identity** from that record
* stores the encrypted payment binding off-chain
* derives the opaque keyed slot with HMAC-SHA256
* signs Mother-rooted DNA permits for Cranker Nodes
* authorizes refunds when an intent expires
## What the Node sees (and what it does not expose)
**Sees, encrypted, in Node-only storage:**
* Recipient route, sender refund destination
* Funding lineage, amount, mint, epoch, payment hash
**Sees, transiently, to derive slot and permit:**
* Recipient TIN inside the initial signed request
* Route binding
**Never exposes:**
* Plaintext binding to Receiver, Cranker, or the chain
* The encryption key
* The Node-only route reference (used only once, expires quickly)
## Work lifecycle
```text theme={null}
RECEIVED
→ NODE_VERIFYING
→ VERIFIED
→ CRANKER_LEASED
→ SUBMITTED
→ CONFIRMED
```
`REJECTED` is terminal for invalid work. A lease expiring returns eligible work to the queue but never grants a cranker authority to alter the plan.
## Mother-rooted DNA permit
For each lease, the Node signs a permit binding:
* opaque slot
* commitment digest, random nonce, nullifier
* Mother-rooted epoch treasury and ledger
* CrankerVault, recipient, mint, amount
* lease id, version, expiry
* authorization expiry
The permit is what makes the settlement instruction valid. Without it, the TSN program rejects the transaction before token movement.
## Refund authorization
**Status: Live on Devnet.**
If an intent expires without settlement, the Node signs a refund permit against the same opaque slot. The first valid refund initializes and consumes the slot as `REFUNDED` and returns the exact amount from the epoch treasury to the sender's authorized refund destination.
## Related
An independent operator process that submits Mother-Node-authorized work.
Program-level settlement instructions.
End-to-end sequence diagram.
Privacy boundaries and Devnet status.