Service and Protocol Boundaries

The limits of application, verification-service, transaction-submission, proof, and settlement authority.

TSN services coordinate payment work, but the settlement programs enforce the on-chain rules. The sender authorizes the payment, services verify and route the request, and a Cranker submits the authorized transaction. Only successful program execution on Solana confirms the corresponding state change.

GPRU guards the integrity and privacy of the user’s private state presented to TCAP. TCAP governs assets, reserves, and liquidity, then applies an authorized transition atomically. A service response or a GPRU proof alone cannot move funds.

The hidden-head proof path is not established end to end. Each TIN settlement is designed as a new opaque record without a public pointer from funding or its private predecessor; the owner retains the lineage, while TSNP/TCAP verify the proof without learning the hidden TIN link. Shared roots and timing do not create that pointer. Public transaction metadata remains visible. Direct wallet transfers expose their endpoints. A TIN-to-wallet exit exposes its destination and amount, but not its source TIN; activity from the output wallet remains public. This page explains user-facing trust boundaries; service credentials, deployment, and operation are covered in the repository documentation.