Skip to main content
This page describes the live settlement path from TSN to TCAP. The current implementation is credit-only: TCAP advances the tip commitment after verifying a TSN ConfidentialSettlement authorization receipt. Confidential debits and exits are not live and remain proof-gated. The CrankerVault payout path is historical TSN architecture and is not part of the live TCAP credit flow.

​
Credit-only path overview

After funding is confirmed, the Node constructs the TCAP credit authorization. The TSN authorization signer marks the transition as ConfidentialSettlement. The transaction sequence is:
TCAP owns the tip and credit transition. TSN remains responsible for epoch treasury, lease, and settlement coordination.

​
ConfidentialSettlement ABI

TSN and TCAP share one authorization contract. The required fields are:
ConfidentialSettlement required fields

​
TcapCreditAuthorizationV1 handoff

The Node constructs the additive handoff with exactly these fields:
This handoff never enters CrankerVault payout logic. It contains no token account, escrow account, public amount, debit, or exit instruction.

​
TSN CPI wrapper

The TSN CPI wrapper creates the AcceptedIntentV1 PDA, derives the root from a canonical field sequence, checks every bound field, and consumes the intent after the TCAP CPI succeeds. TCAP stores the same fields in its receipt and requires a ConfidentialSettlement transition before credit can consume it. A caller cannot supply an unrelated root or use a GPRU signature alone. The authorization is Mother-rooted and checked on chain.

​
Snapshot binding

After credit_tcap_tin_tip_v1 succeeds, the owner-authorized Node/Mother path stores an encrypted snapshot envelope under the opaque new_commitment. The private reader fetches the public tip, loads that envelope, decrypts locally, verifies the envelope bindings and commitment hash, and only then returns balances. The commitment binding is deliberately one-way:

​
What is visible and what is private

The chain stores program accounts, commitments, sequence values, token IDs, policy commitments, scoped authorization commitments, nullifiers, and validity windows needed for enforcement. It does not store plaintext receiving roots, private balance values, master seeds, or snapshot plaintext.
Earlier drafts incorrectly referenced TSN_PRIVATE_SLOT_SETTLEMENT_V1 as a template name. The correct authorization is a ConfidentialSettlement receipt with the fields listed above. Do not use the retired template name in any integration.