Rework the figures and the D2 seizure scope in the cross-chain stablecoin RI - #102
Merged
Conversation
The cross-chain stablecoin architecture carried one 45-line sequence diagram for inbound bridging, the inbound refund, and outbound redemption. It sat at the top of section 3, so no flow's prose had a figure beside it. Split it into three, each placed with the text it describes: - inbound credit, before the numbered steps in section 3.1; - inbound refund, after the refund-exclusivity rules in section 3.1, now showing the expiry condition, the quorum's read of the credited-lock registry, and the escrow's reuse of the redemption verifier; - outbound redemption, before the numbered steps in section 3.3, with the burn and the claim creation in one shaded transaction. Correct two outbound arrows. The redemption attestation is a Canton contract that the attester set observes, so the gateway creates it rather than sending it to the attesters. The attesters sign it off-ledger with their external-chain keys and hand it to a submitter; they never submit to the escrow themselves. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Section 2 opened with two facts and then three dense tables, so a reader met fifteen roles before any statement of what holds them together. State the spine instead: an attester signature and a lock's nonce are the only things that cross the chain boundary, the settlement batch is the hub, and supply enters at the attested mint and leaves at the burn. Then say what each of the three subsections contributes. Both facts from the old opener are kept. The single Token Standard V2 registry moves into the hub sentence, and the compliance attestation and the identity credential are now named with the action each one gates. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The fifteen roles interleaved Canton parties, off-Canton processes, and an external-chain contract, so a reader building a party model had to filter the table row by row. Group them into two tables: the ten Canton parties, then the four off-ledger processes and the lock escrow. Each row's text and the relative order within each group are unchanged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The seizure scope rested on a contradiction. Section 3.6 claimed the same sweep reaches a holding that already settled, while the component status listed that sweep as remaining work. Resolve it toward what the token standard defines. The standard gives the owner's side of every asset movement to the owner and leaves the provider-versus-owner authorization split to each registry, so a forced transfer over a settled holding is a choice a registry defines for itself. The rail asks for no such choice, which keeps it usable by any CIP-0112 registry. State the boundary in section 3.6, record it in the scope table, and correct the three statements that depended on the wider reading: D3 no longer calls credited value D2's surface, the redemption path names each path's authority instead of saying the capability "only unlocks", and the compromised-key row now leads with the fact that neither key reaches a credited holding. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
0xNeshi
changed the title
pepebndc
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Figures
One 45-line sequence diagram at the top of section 3 covered inbound bridging,
the refund, and outbound redemption, so no flow's prose had a figure beside it.
Split into three, each next to the text it describes, plus a new one for the D2
seizure path. Two outbound arrows were wrong: the redemption attestation is a
Canton contract the attester set observes, and the attesters sign it off-ledger
rather than submitting to the escrow themselves.
Section 2 now states the rail's organizing idea before its three tables, and the
15-row role table is split into Canton parties and off-ledger actors.
D2 seizure scope
The part worth reviewing. Section 3.6 claimed the seizure sweep reaches a
settled holding; 1.3 listed that sweep as remaining work.
Resolved toward what the token standard defines: the standard gives the owner's
side of every movement to the owner and leaves the provider-versus-owner
authorization split to each registry, so a forced transfer over a settled holding
is a choice a registry defines for itself. This rail asks for none, which keeps
it usable by any CIP-0112 registry.
So D2 acts on an allocation and the holdings it locks, and the rail offers no
on-ledger control over wTOK once it settles. D3 no longer calls credited value
"D2's surface", and 4.3 leads with the bound this earns: neither the admin key
nor the Custodian key reaches a credited holding.