Protocol Responsibilities

A clear division of responsibility between transfer identity, private-state protection, and asset settlement.

TSN separates identity, private-state validation, and custody-related settlement checks so that a single component does not decide every part of a payment.

Layer	Responsibility	Boundary
TIP	Manages transfer identities, including TINs, and their routing information.	A TIN is an identity, not a wallet key or a balance account.
GPRU	Guards the integrity and privacy of the user’s private state presented to TCAP.	A proof does not grant custody or independently authorize payment.
TCAP	Governs accepted assets and liquidity, then applies authorized balance changes.	TCAP is the asset and settlement authority.
TSNP	Enforces the on-chain protocol rules for authorized settlement.	An instruction only has the guarantees its checks establish.
TSN services	Coordinate request intake, verification, and transaction delivery.	Service status is distinct from an on-chain result.

For a balance-changing action, GPRU is intended to prove that the hidden state is current and that the proposed transition follows from it. TCAP checks the applicable asset, authorization, and liquidity conditions, then applies the authorized transition atomically. This keeps state protection separate from control of funds.

The hidden-head proof path is not established end to end. TIN settlement is designed without a public pointer from funding to a recipient TIN or between successive settlements; shared TIP and TCAP roots are protocol-wide rather than per-TIN identity references. Public funding shows the sender, amount, and protocol destination, not the hidden TIN recipient. Direct wallet-to-wallet transfers expose both endpoints. A TIN-to-wallet exit exposes its output wallet and amount, but does not publish the source TIN. The security overview describes these boundaries; protocol implementation and integration decisions belong in the repository documentation.