Skip to main content
In plain English: The Mother Node is TSN’s coordination and verification role. The current implementation is tsn-node: it checks that a signed intent is valid, holds the encrypted payment binding, coordinates the epoch treasury, and signs the short-lived Mother-rooted DNA permits that authorize Cranker Nodes to settle. It is the only party that sees plaintext bindings.

​
Node role

Status: Live on Devnet. Hosted at https://tsn-node.wasmer.app.
The Mother Node:
  • verifies canonical signatures, expiry, nonce and replay rules
  • verifies amounts, commitments, and the recipient route commitment and version
  • creates the durable verified payment record
  • redacts recipient identity from that record
  • stores the encrypted payment binding off-chain
  • derives the opaque keyed slot with HMAC-SHA256
  • signs Mother-rooted DNA permits for Cranker Nodes
  • authorizes refunds when an intent expires

​
What the Node sees (and what it does not expose)

Sees, encrypted, in Node-only storage:
  • Recipient route, sender refund destination
  • Funding lineage, amount, mint, epoch, payment hash
Sees, transiently, to derive slot and permit:
  • Recipient TIN inside the initial signed request
  • Route binding
Never exposes:
  • Plaintext binding to Receiver, Cranker, or the chain
  • The encryption key
  • The Node-only route reference (used only once, expires quickly)

​
Work lifecycle

REJECTED is terminal for invalid work. A lease expiring returns eligible work to the queue but never grants a cranker authority to alter the plan.

​
Mother-rooted DNA permit

For each lease, the Node signs a permit binding:
  • opaque slot
  • commitment digest, random nonce, nullifier
  • Mother-rooted epoch treasury and ledger
  • CrankerVault, recipient, mint, amount
  • lease id, version, expiry
  • authorization expiry
The permit is what makes the settlement instruction valid. Without it, the TSN program rejects the transaction before token movement.

​
Refund authorization

Status: Live on Devnet.
If an intent expires without settlement, the Node signs a refund permit against the same opaque slot. The first valid refund initializes and consumes the slot as REFUNDED and returns the exact amount from the epoch treasury to the sender’s authorized refund destination.

Cranker Node

An independent operator process that submits Mother-Node-authorized work.

TSN Layer

Program-level settlement instructions.

Architecture

End-to-end sequence diagram.

FAQ

Privacy boundaries and Devnet status.