Skip to main content
In plain English: GPRU is authorization and routing only. It tells TSN and TCAP what may happen, for how long, and where the authorized work may go. It never holds funds, balances, or custody keys. A GPRU signature alone cannot move custody.

​
Why GPRU exists

TSN and TCAP need to know that a transfer is authorized without exposing who authorized it. GPRU carries:
  • scoped permissions (what the transfer is allowed to do)
  • commitments (predecessor and successor)
  • validity window
  • one-time nullifier material
  • policy commitment and scope commitment
It carries none of: token accounts, private keys, balances, custody, or payment intent identifiers on the privacy-safe path.

​
What GPRU is bound to

The privacy-safe authorization ABI carries:
  • opaque authorization_digest
  • validity window (valid_after_slot, expires_at_slot)
  • predecessor and successor commitments (previous_commitment, new_commitment)
  • sequence, token_id
  • policy_commitment, gpru_scope_commitment
  • one-time nullifier
It intentionally excludes payment intent identifiers, recipient TINs, settlement commitments, epoch roots, accepted-intent records, and TCAP authorization receipts.

​
Where GPRU sits

Status: Live on Devnet as the authorization layer for TCAP tip credits.
GPRU is not a program. It is the authorization envelope that TSN produces and TCAP consumes. TSN registers the authorization; TCAP validates the digest against a PDA-signed CPI from the approved TSN program. The sender’s payment intent and the recipient’s GPRU / TCAP transition are not joined by a protocol-level on-chain payment identifier. The privacy-safe path does not pass an intent commitment, recipient TIN, settlement commitment, accepted-intent root, epoch receipt, or TCAP authorization receipt into the TCAP credit instruction. It also does not create a per-transfer nullifier account. Timing, amount, and wallet-level correlations remain outside GPRU’s guarantee.

​
What remains bound for safety

  • Governed asset check
  • Active policy
  • GPRU scope commitment
  • Validity window
  • Previous commitment and next sequence
  • Transition nullifier
The tip’s monotonic sequence and previous commitment provide successor continuity without a durable per-transfer receipt account.

​
Boundary rules

  • GPRU cannot spend, exit, mutate a tip, or drain a liquidity pool.
  • A GPRU signature is not a spend proof.
  • A hash-only or placeholder payload is not a spend proof.

TSN

Settlement coordination and epoch treasury.

TIN

Payment identity and route discovery.

TCAP

Private balance accounting.

Architecture

End-to-end sequence diagram.