GPRU + TCAP: How TSN Separates Auth and Balance
The Authorization and Private Balance Architecture of TSN
Modern payment networks need two protections at once: a verifiable authorization path and a private balance path. TrustLink Labs separates those responsibilities across GPRU, TSN, and TCAP.
Abstract
GPRU provides authorization and routing without custody. TCAP provides policy-bound private balance state through commitment-linked encrypted snapshots. The TSN Program coordinates epoch treasury obligations and consumes Mother-rooted Settlement DNA exactly once. Together, these layers create a payment system in which the operator can submit an authorized transaction without receiving the sender’s keys, private commitment, or payment-specific account history.
1. The authorization problem
A payment authorization is stronger than a destination address. It must bind the amount, mint, recipient, fees, route, expiry, nonce, and settlement commitment. GPRU canonicalizes those fields and lets the Node reject any mutation before a Cranker receives work.
2. Mother-rooted Settlement DNA
Mother creates a one-time DNA voucher for a specific authorized CrankerVault and lease. The permit carries the opaque commitment, public settlement coordinates, nullifier, and expiry. On success the TSN Program consumes the DNA permanently. A second Cranker cannot reuse or redirect it.
3. The private balance path
TCAP stores a public tip commitment and sequence, not a plaintext balance. After a valid credit, the owner stores an encrypted snapshot keyed by the new commitment. A private read fetches the tip, loads the matching ciphertext, verifies its hash and sequence, and decrypts locally. The protocol never needs to publish the balance to coordinate the transition.
4. Epoch treasury coordination
Funding enters an epoch treasury rather than a payment-specific escrow object. The epoch ledger tracks aggregate obligations and opaque claim state. Settlement and refund are mutually exclusive: the first valid operation writes the claim outcome, and finalization requires that pending liability reaches zero.
5. Operator and privacy boundaries
Crankers pay fees and submit transactions, but they do not receive sender keys, TIN master material, private commitment plaintext, escrow accounts, or PrivateEscrowRecord PDAs. The Node and Mother retain encrypted private context; the chain enforces the one-time authorization capability.
Conclusion
GPRU makes authorization portable, TCAP makes private balance state usable, and TSN makes settlement accountable. The result is a protocol architecture for identity-aware, privacy-preserving payment infrastructure rather than a thin transfer wrapper.
TIN identity · GPRU documentation · TCAP documentation · TSN settlement flow