GPRU: Authorization and Routing for Private Payments
TSN architecture · GPRU
GPRU is the authorization and routing layer of the Transfer Settlement Network. It tells the network which payment may move, who may submit the next operation, and which public coordinates are valid—without holding funds or revealing a private commitment.
What GPRU does
GPRU turns a user-signed payment intent into a verifiable coordination capability. The device signs the intent, the Receiver accepts authenticated ingress, and the Node checks the canonical fields before creating work. Amount, mint, recipient, destination, fees, expiry, nonce, and commitment are bound together.
- Authorization: verifies that the user approved this exact operation.
- Routing: selects the permitted epoch and execution route without exposing private identity data.
- Replay resistance: consumes nonces, nullifiers, and one-time work atomically.
- Operator control: gives a Cranker only the capability required for its current lease.
GPRU does not hold money
GPRU never acts as a wallet, vault, or balance ledger. Token accounting belongs to the TSN epoch treasury and the TCAP private balance layer. This separation prevents a routing credential from becoming a custody credential.
From intent to settlement
- The user device signs a payment intent off-chain.
- The Node verifies the signature, canonical message, nonce, policy, and commitment.
- Mother creates one-time Settlement DNA for the authorized CrankerVault and lease.
- The Cranker submits the DNA-bound TSN transaction and pays the network fee.
- The TSN Program consumes the DNA once and records the opaque claim outcome.
What the public transaction reveals
The chain receives the authorization commitment, nullifier, expiry, epoch coordination data, and settlement coordinates required for enforcement. Private receiving roots, encrypted balance snapshots, and owner authorization material remain outside public payloads.
Privacy boundary
Crankers receive a SettlementCommitment, public payout coordinates, a permit, and expiry data. They do not receive private commitment plaintext, sender keys, payment-specific escrow accounts, or PrivateEscrowRecord accounts.
Read the TCap private balance architecture → · Read about TIN identity → · Read the TSN settlement flow →