Tacit gives you three independent privacy layers — each works on its own, and they stack, so you pick how much to hide:

• Shielded amount (default) — hidden in every CETCH, T_MINT, CXFER, T_AXFER, and BURN-change commitment (32-byte Pedersen commit + 8-byte HMAC-encrypted u64). In T_SWAP_BATCH, per-trader amounts stay hidden during settlement via BabyJubJub Pedersen openings inside Groth16.
• Shielded address (opt-in, blinded-pubkey commit primitive) — BIP-341-style construction commit = recipient_pubkey + blinding·G with blinding = HMAC(wallet.priv, domain || op-specific anchor). The commit doubles as Schnorr key and P2TR output key, so on-chain markers sit at per-transaction unique addresses with no apparent link to the recipient's published identity. Same crypto as BIP-340/341/352 silent payments, no new ceremony. Composes orthogonally with shielded amounts.
• Anonymous spend via mixer pool (opt-in, Bitcoin-only) — deposit a fixed-denomination UTXO into the Poseidon-Merkle pool (T_DEPOSIT), later withdraw under a Groth16 proof of unspent leaf membership (T_WITHDRAW). The withdraw recipient is unlinkable to any specific deposit; the anonymity set is the count of currently-unspent leaves at withdraw time. The same circuit underpins cBTC.zk slot semantics — every slot spend is anonymous-unique-spend by construction. This is the narrower, Bitcoin-native option (fixed denominations, a separate trusted setup) for assets that stay on Bitcoin; the cross-chain shielded pool below is the primary, amount-flexible, setup-free privacy surface and is where DeFi lives.

End-to-end: amount-hiding is on by default; address-graph unlinkability is opt-in two ways (shielded-address per transfer, or mixer-pool round-trip for full anonymity-set unlinkability). Stricter posture than Liquid CT, approaching Mimblewimble or shielded Zcash for assets that route through the pool.

What remains public:

• Asset_id. Which asset is being transferred is public (32-byte asset_id in every non-pool envelope). Surjection proofs are on the roadmap.
• Sender pubkey on non-pool transfers — visible in tx.vin[1].witness[1]; recipient needs it for ECDH blinding recovery.
• Pool participation — observers see that an address deposited or withdrew, just not which deposit corresponds to which withdrawal.
• AMM pool reserves and per-batch net deltas — public by design (cost of trustless reconstruction). Per-trader amounts within a batch are hidden.

Recipient blinding: r_recip = HMAC-SHA256(ECDH(sender_priv, recipient_pub), "tacit-blind-v1" ‖ anchor ‖ vout_LE), where anchor = first_asset_input_txid_BE ‖ first_asset_input_vout_LE. The anchor's per-tx entropy prevents cross-tx commitment correlation: without it, two transfers between the same parties at the same vout would produce identical blindings, and an observer could compute (C₁ − C₂) = (a₁ − a₂)·H to learn the difference of amounts.

Sender's change blinding: r_change = HMAC-SHA256(sender_priv, "tacit-change-v1" ‖ anchor ‖ vout_LE), where vout_LE is the change output's index in the reveal tx (typically 1 for a 2-output CXFER, but parameterized so multi-output CXFERs with N=4 or N=8 can place change at higher vouts). Deterministic from the wallet privkey so it's recoverable from chain alone.

Etcher's supply blinding: r_supply = HMAC-SHA256(etcher_priv, "tacit-etch-v1" ‖ etch_anchor), where etch_anchor = first input outpoint of the commit tx. The anchor predates the envelope (a pre-existing UTXO), breaking the cycle that would otherwise arise from anchoring on the reveal txid. Scanners read it via reveal_tx.vin[0] → fetch commit tx → commit_tx.vin[0].

Each commitment also carries an encrypted amount (8 bytes, u64 LE XOR'd with an HMAC-keystream). For CXFER outputs, the keystream uses ECDH-derived keying for recipients (so recipient can decrypt with their priv + sender pub) and self-derived keying for change. For CETCH supply, the keystream is self-derived from etcher_priv + etch_anchor — only the etcher can decrypt; observers see opaque bytes. After decryption, the wallet verifies C == amount·H + r·G; tampering with the ciphertext makes verification fail.

For self-derived roles (CETCH supply, MINT amount, CXFER change), blinding and keystream are derived under distinct HMAC domain tags (tacit-etch-v1 vs tacit-etch-amount-v1; tacit-mint-blind-v1 vs tacit-mint-amount-v1) so the 8-byte keystream output cannot leak any structure of the 32-byte blinding scalar.

This means share-links are optional notifications, not required for recovery. A freshly-installed wallet with only its privkey can auto-discover its full balance from chain alone — incoming CXFER transfers (via ECDH), its own CXFER change (via self-derived), and its own CETCH supply (via etch-anchor self-derived).

Everything tacit can do is one of the operations below — each is a compact instruction tucked inside an ordinary Bitcoin transaction. The tables group them by purpose; the rest of this section is reference detail.

Technically: the v1 envelope version is 0x01, and every op is a 2-tx commit/reveal pair carrying the envelope inside tx.vin[0].witness[1] of the reveal. SPEC.md §1.1 is the canonical opcode table — full assignments, drafted/reserved status, source amendment.

Core asset lifecycle

Marketplace (atomic OTC + orderbook)

Mixer (anonymous spend)

Native AMM (AMM.md)

LP-staking farms (SPEC-AMM-FARM-AMENDMENT)

Wrapper convention + trustless wrapped BTC

Trustless ETH-Bitcoin bridge (BRIDGE.md)

Wire-format examples below cover the core four (CETCH / CXFER / T_MINT / T_BURN). The remaining opcodes follow the same envelope shape with their own payload layouts and validator rules — see SPEC.md §5.7–§5.19 for the byte-exact specifications.

Marketplace primitives live in §5.7 and route through T_AXFER / T_AXFER_VAR settlement — no separate opcodes needed: atomic intents (§5.7.6 — seller publishes one signed offer, any taker claims it within 5 min and settles atomically on Bitcoin); preauth sales (§5.7.8 — seller pre-signs everything, then goes offline; any buyer settles whenever); batched preauth-take (§5.7.8.1 — buyer sweeps N preauths in ONE reveal tx, ~70% Bitcoin-fee reduction vs N separate settlements; pure flow-level optimization leveraging position-independent SIGHASH_SINGLE_ACP); variable-amount intents (§5.7.6.1 — partial-fillable seller offers); and bid intents (§5.7.7 — partial-fillable buyer offers, off-chain coordination, on-chain settlement via T_AXFER/T_AXFER_VAR). All marketplace flows share the same kernel-sig + rangeproof crypto as base CXFER; the difference is the coordination layer, not the on-chain primitive.

Rangeproofs and aggregated payloads don't fit in 80-byte OP_RETURN, so payload moves into a Taproot script-path leaf. Each operation is 2 transactions: a commit tx that creates a P2TR output committed to the envelope's leaf hash (internal pubkey = BIP-341 NUMS, so script-path is the only spend), and a reveal tx that spends the P2TR via script-path, exposing the envelope script in the witness. Indexers scan tx.vin[0].witness[1] for envelopes.

Envelope leaf script

CETCH payload (opcode 0x21) — initial issuance

The wire format treats image_uri as opaque UTF-8 bytes. The decoder accepts any valid UTF-8 ≤256 bytes — it does not enforce a URI scheme. This leaves room for future schemes (ar://, ipns://, etc.) without a wire-format change. Renderers MUST validate before display: tacit's UI accepts only ipfs://CID and bare CIDs (Qm…/bafy…), and rejects http:, https:, javascript:, data:, and other schemes. Direct https:// images are rejected on purpose — every wallet that views the asset would fetch from the issuer-controlled host, which is an IP-correlation beacon. Forcing IPFS routes traffic through the configured gateway, one fixed origin that the CSP locks down at img-src.

Asset_id = sha256(reveal_txid_BE ‖ 0_LE) (32 bytes). Supply commitment lives at vout 0 of the reveal tx. If mint_authority is all-zero, the asset is fixed-supply (BTC-style); otherwise the named pubkey can issue more via T_MINT.

CXFER payload (opcode 0x23) — confidential transfer

MINT payload (opcode 0x24) — issue more supply (mintable assets only)

commit_anchor = commit_tx.vin[0].txid_BE ‖ commit_tx.vin[0].vout_LE (the same anchor the issuer uses for the mint blinding/keystream). Binding it into mint_msg ties the issuer's signature to a specific commit/reveal pair so a witnessed mint envelope cannot be replayed into a different commit/reveal pair at an attacker's address.

BURN payload (opcode 0x25) — destroy supply, public amount

This is exactly how a wallet — or any independent indexer — reads the chain and works out what's real and what each balance is. Anyone can re-run these steps and reach the same answer, which is why no trusted server is needed:

1. For each wallet UTXO, fetch parent tx; read vin[0].witness[1]; decode as tacit envelope.
2. Recursively validate the outpoint: walk the ancestry back to its CETCH root, validating each step. Memoize results to keep cost O(N) over a chain of length N. Depth-bounded at 200 hops.
3. Aggregated rangeproof verification. A single bulletproof per envelope covers all m commitments (m ∈ {1,2,4,8}). The walker can additionally batch proofs across the entire ancestry into one multi-scalar multiplication via bpRangeAggBatchVerify, with random per-proof scalars α_i, β_i ensuring soundness preservation.
4. For CETCH leaves (T_CETCH): only vout 0 is the supply commitment; no kernel; the rangeproof bounds the initial supply.
5. For MINT envelopes (T_MINT): vout 0 holds the new supply commitment. Validator confirms asset_id = sha256(etch_txid ‖ 0), recursively validates the CETCH ancestor, requires mint_authority ≠ 0, and verifies the issuer's BIP-340 sig under the authority's x-only pubkey. mint_msg binds commit_anchor (the commit-tx's first input outpoint), preventing replay of the envelope into a different commit/reveal pair.
6. For CXFER nodes (T_CXFER): every input outpoint must itself recursively validate; every input's parent (CETCH/MINT/CXFER/BURN) must declare the same asset_id; the aggregated rangeproof must verify; the kernel sig must verify under (ΣC_out − ΣC_in).xonly() over the kernel msg.
7. For BURN nodes (T_BURN): same as CXFER but the verifier reconstructs E' = ΣC_out + burned_amount·H − ΣC_in. N=0 is allowed (full burn, no change output, no rangeproof).
8. Any failure anywhere in the ancestry → the UTXO is flagged as inflation attempt and excluded from balance. markAll propagates the verdict to every sibling output of a failed envelope.
9. Resolve (amount, blinding) for the commitment: try local opening first, then trial-decrypt the on-chain amount_ct (ECDH against sender pubkey for incoming, self-derived for own change/etch/mint). Verify C == a·H + r·G. If known or recovered → balance += a; if neither path works → "ghost".

v1 carries the confidential note onto an Ethereum lane and back, and lets it do more than move:

• One note, two chains. Wrap ETH or any token through the ConfidentialRouter, or bring value over from Bitcoin — both land as the same shielded note. From there it transfers, trades, or borrows, and can exit on either side.
• cUSD CDP. Borrow the protocol's own cUSD against a shielded note as collateral. Both the collateral and the debt stay hidden — positions are Pedersen-committed and proven healthy in zero knowledge, MakerDAO-style (rate accumulator, liquidation ratio), with the stability fee shipped dormant.
• cBTC. Mint cBTC against a self-custody Bitcoin lock at an oracle-free 1:1 peg (the peg is conservation, not a price feed) — no federation, co-signer, or custodian. tacBTC is its single fungible ERC-20 form.
• LP farms. Bond LP shares to earn reward emissions; rewards are either the controller's own debt asset or drawn from a pre-funded treasury, gated so a farm can never mint outside its budget.
• Trustless bridge. Bitcoin ⇄ Ethereum value moves by SP1 zero-knowledge reflection: a burn on one side is proven and reflected as a one-time mint on the other, with full provenance back to a real supply leaf and an on-chain finality gate against reorgs. No wrapped-asset IOU, no bridge multisig. The bridge is rolling out as a gated pilot (small fixed deposit sizes to start) while caps widen.
• One unified address. Publish a single tacit1… address; senders don't need to know whether you're receiving on Bitcoin or on the shielded Ethereum lane — it resolves to the right endpoint, and a send can wrap straight into a shielded note for the recipient.

Every one of these settles through the same conservation kernel as a plain transfer, so value-in equals value-out per asset, and any op can be relayed gaslessly with the fee bound inside the proof. See BRIDGE.md for the cross-chain path.

The full ZK + commitment toolkit composes across all surfaces. See CIRCUITS.md for the canonical walkthrough.

On-chain commitments — Pedersen on secp256k1

Commitments: C = a·H + r·G, additively homomorphic. H is a NUMS generator (no known discrete log w.r.t. G) derived deterministically by hash-to-curve from the seed "tacit-generator-H-v1". The protocol carries C on chain; (a, r) stay private.

Rangeproofs — aggregated Bulletproofs + Bulletproofs+

Bünz et al. 2017, at n=64 bits — each committed value proven to lie in [0, 2⁶⁴). A single proof covers m ∈ {1, 2, 4, 8} commitments simultaneously via the inner-product argument, witness size O(log(n·m)). On secp256k1: 688 B at m=1, 754 B at m=2, 820 B at m=4, 886 B at m=8. ~250 ms prove, ~150 ms verify in-browser per proof; the indexer batches multiple proofs into a single multi-scalar multiplication for sub-linear amortized cost. 64-bit range bounds any single Pedersen commitment to ~184 billion display units at 8 decimals.

Bulletproofs+ (Chung et al. 2022) shipped for CXFER and T_AXFER via the T_CXFER_BPP / T_AXFER_BPP / T_AXFER_VAR_BPP opcodes. ~14% smaller rangeproof witnesses at the same security level. Same wire shape as their base opcodes — the validator accepts both interchangeably.

ZK circuits — two families, one stack

All Groth16 circuits run over BN254 with Phase 1 inherited from the Polygon Hermez ceremony. Two families do all the in-circuit work:

• Anonymous unique-spend — the mixer's withdraw.circom (Poseidon-Merkle leaf membership + nullifier reveal, ~3K constraints, pot14 Phase 1). Reused without modification for cBTC.zk slot spending (T_SLOT_BURN / ROTATE / SPLIT / MERGE) — the slot's spending key K_btc = r_leaf · G_secp256k1 is derived from the leaf's own Poseidon secret, so one secret proves mixer-set membership and signs the backing BTC UTXO.
• Amount confidentiality — the AMM's three circuits (amm_lp_add 5K, amm_lp_remove 10K, amm_swap_batch 171K @ N≤16 traders; pot18 Phase 1). BabyJubJub Pedersen openings + range proofs + in-circuit AMM arithmetic (clearing-price derivation from private aggregates in the batch case).

Chain commitments live on secp256k1; in-circuit work lives on BabyJubJub (the embedded curve over BN254 Fr). A 169-byte Camenisch–Stadler sigma proof binds the two, out-of-circuit, with no trusted setup. This avoids ~1M constraints per opening that an in-circuit secp256k1 gadget would cost.

Shielded-address primitive — blinded-pubkey commits

Opt-in BIP-341-style construction: commit = recipient_pubkey + blinding · G where blinding = HMAC(wallet.priv, domain || op-specific anchor). The commit serves as both a Schnorr verification key (if the op signs under the recipient) AND a P2TR output key (so payouts go to P2TR(x_only(commit))). Hides the recipient pubkey itself — on-chain markers sit at per-transaction unique addresses with no apparent link to the recipient's published identity. Same crypto as BIP-340 / BIP-341 / BIP-352; no new ceremony. Composes orthogonally with shielded amounts; both schemes remain valid indefinitely, wallets pick at tx-build time based on the recipient's signaled capability.

Negative amounts (mod N). A "−1000" is just N − 1000 as a scalar; bulletproofs reject any value outside [0, 2⁶⁴). The proof's inner-product argument cannot be satisfied for a value that doesn't fit in 64 bits, so the verifier rejects.

Unbalanced amounts (CXFER). Even with rangeproofs, a sender holding 100 USDV could try to construct outputs (30 to recipient, 200 to themselves) — both with valid rangeproofs — and mint 130 from nothing. Kernel signatures block this:

• Sender computes excess = Σr_out − Σr_in and signs kernel_msg with priv = excess (BIP-340 Schnorr).
• Verifier reconstructs E' = ΣC_out − ΣC_in from on-chain commitments. If amounts balance, E' = excess·G and the sig verifies under E'.xonly().
• If amounts don't balance, E' = δ·H + excess·G with δ ≠ 0. Producing a valid sig would require knowing the discrete log of H w.r.t. G, which is hard since H is NUMS.
• kernel_msg = sha256("tacit-kernel-v1" ‖ asset_id ‖ N_in ‖ inputs ‖ N_out ‖ outputs ‖ burned_amount_LE), binding the sig to all relevant fields and preventing replay across txs.

Unbalanced amounts (BURN). Same kernel construction with burned_amount made explicit: the verifier checks E' = ΣC_out + burned·H − ΣC_in = excess·G. The public burned_amount field is bound into kernel_msg so claiming a smaller burn than was actually destroyed shifts the message and breaks the sig.

Mint forgery. Only the holder of mint_authority's private key can issue valid T_MINT envelopes for an asset. The validator fetches the parent CETCH, confirms the asset is mintable (mint_authority ≠ zero), and verifies the issuer Schnorr sig under that x-only key. The signed message binds the commit_anchor (commit-tx's first input outpoint) so an observer cannot rewrap the on-chain envelope payload into their own commit/reveal pair. The mint itself is rangeproof-bounded to [0, 2⁶⁴) per envelope; the authority can mint any number of times.

Cross-asset confusion. A sender could declare a CXFER as USDV but spend GOLDC inputs. The indexer fetches each input's parent envelope, reads its declared asset_id (across all four opcodes — CETCH, MINT, CXFER, BURN — via a unified parent-resolver), and rejects the CXFER if any input's asset_id differs from the current claim.

How heavy is it to verify a coin? In short: the work scales with how far back the coin's history runs, it's cached so you pay only once per session, and a slow check never threatens correctness — only speed. The detail:

Recursive validation is O(chain depth) on a cold cache, depth-bounded at 200 hops. With aggregated bulletproofs and batched verification, the practical cost is dominated by BIP-340 Schnorr verification (kernel sigs + mint sigs) across the ancestry, not rangeproofs (~150 ms verify per BP, batched into one multi-exp across the full walk). Memoization keeps subsequent scans O(new UTXOs) within the same session. For a fresh wallet on mobile, deep ancestries (≥50 hops) will still be slow; production deployments benefit from a persistent validation cache or a shared indexer service. Cryptographic correctness holds without either; the gain is purely UX.

Tacit's Groth16 circuits rely on trusted-setup ceremonies — and every artifact is published openly on IPFS as a public good: the Powers-of-Tau lineage, each circuit's final zkey, the verifying keys the dapp pins, and the Bitcoin-block beacon that seals each ceremony. Anyone can re-derive the pinned verifying key from the bundle and confirm the dapp trusts exactly what the ceremony produced. Soundness needs only one honest contributor; privacy (zero-knowledge) never depends on the ceremony at all.

Mixer ceremony — withdraw.circom

Phase 1 from the Polygon Hermez pot14 Powers of Tau; Phase 2 with 2,227 contributors, sealed by a beacon over Bitcoin block 948824 (finalized 2026-05-11). One circuit proves anonymous unique-spend, reused unchanged for cBTC.zk slot operations.

Pinned VK

sha256 760829334a…ce933af

Ceremony bundle

ipfs://bafybeidq2…ltxy2u (ptau · zkey · vkey · transcript)

AMM ceremony — three circuits

Three independent Phase 2 chains under one shared pot18 Phase 1, each receiving thousands of contributions, all sealed by a single beacon over Bitcoin block 951267. Pool reserves are public; the circuits only hide per-trader amounts.

Pinned VK bundle

ipfs://bafkreibjpe…iomp4

Ceremony bundle

ipfs://bafybeiheww…niuam (per-circuit zkeys · vkeys · transcripts)

The Ethereum-lane surfaces — the confidential pool, cBTC, and the reflection bridge — use setup-free cryptography (Bulletproofs+ and SP1 proofs), so they need no ceremony at all. See CIRCUITS.md for the full circuit walkthrough.

The reviews are deliberately transparent and reproducible — each report pins the exact commit and cites file:line, and the maintainer responses live in the repo. Representative closed items:

• Bitcoin coinbase witness-commitment binding and merkle/txid malleability guards.
• Delegated-prover authorization — every op's amounts, recipient, fee, and output owner bound in an op-specific proof context, so a relayer/proving box can't redirect, skim, or strand a note.
• Cross-chain burn→mint provenance + the consumed-nullifier freshness gate against double-spend.
• Collateral oracle bounds, fee-free relayed settles, and the in-guest swap-batch verifier.

Read the GPT-5.5 Pro final review →  ·  Opus 4.8 Ultracode hardening run →  ·  All reports & responses →

Independent model reviews, not a certification by a named firm — the value is the adversarial coverage, the public transcripts, and commit-pinned responses anyone can re-check.

The honest question for anything holding value: what do you actually have to trust? Here it is surface by surface — what's enforced by math alone, and the few places where a key holder or a setup ceremony is assumed honest.

Issuer at CETCH. The initial supply commitment is hidden, so no kernel-sig constraint applies — the issuer chooses any value in [0, 2⁶⁴). The dApp publishes the (supply, blinding) opening by default — embedded in the asset's IPFS metadata blob (content-addressed) and pinned to the discovery worker as a cache. Anyone verifies C == supply·H + r·G against the on-chain commitment, no issuer trust required. Issuers explicitly opt out of attestation only if they have a reason to keep the total confidential; the dApp surfaces that as a deliberate uncheck.

Mint authority for mintable assets. If mint_authority ≠ 0 in the CETCH envelope, that x-only pubkey can issue additional supply via T_MINT envelopes — bounded only by 2⁶⁴ per envelope, unlimited in count. Standard signature-gated mint pattern: holders trust the mint-authority key not to be abused, and compromise of that private key means uncapped inflation. The dApp auto-attests every mint by default so supply remains publicly auditable. Fixed-supply CETCHes (mint_authority all-zero) cannot be expanded — for those, etch-time attestation gives provably and permanently public supply.

T_PETCH (permissionless mints). No issuer trust at all. The deploy declares cap_amount, mint_limit, and an optional height window; deployer receives zero tokens. Each T_PMINT reveals (amount, blinding) on chain, so cumulative supply against the cap is auditable from chain alone — no attestation channel needed.

Mixer + cBTC.zk (Groth16 + Phase 2 ceremony). Both share the same withdraw.circom primitive. Soundness rests on ≥ 1 honest contributor in the Phase 2 ceremony; privacy (zero-knowledge) is unconditional and does not depend on the ceremony. The canonical v1 mixer ceremony (Phase 2, beacon-finalized 2026-05-11, 2,227 contributors) is hardcoded in the dApp as the trust anchor; cBTC.zk slots reuse the same vk. cBTC.zk's BTC anchor is cryptographic — the slot's spending key is derived from a mixer leaf's secret — so no federation and no co-signer.

AMM circuits (Phase 2 ceremony sealed). The three AMM circuits ran independent Phase 2 chains under one shared pot18 Phase 1, sealed by one Bitcoin-block beacon (block 951267); the artifacts are published (see Ceremony artifacts). Same ≥ 1-honest-per-circuit assumption as the mixer. Pool reserves are virtual public quantities the indexer tracks — no UTXO holds any pool's funds, so no party can rug. The constant-product invariant is plain arithmetic on public reserves; Groth16 binds hidden per-trader amounts to public batch deltas.

tacBTC (ETH-escrow backed). One fungible ERC-20 form of wrapped BTC, minted against cBTC.zk Bitcoin locks plus a CollateralEngine ETH escrow. Two trust legs: the BTC anchor at L1 (cryptographic — cBTC.zk's slot lock works as long as Bitcoin + Groth16 + secp256k1 hardness hold) and the ETH collateral substrate (economic — the escrow stays over-margined relative to BTC). Same shape as MakerDAO's ETH-collateralized stablecoins; not the same shape as wBTC's BitGo + auditors.

tETH bridge (Groth16 + Ethereum root check). Every T_BRIDGE_DEPOSIT is client-side verified before the dApp accepts it: the Groth16 proof in the OP_RETURN envelope is re-verified against the canonical VK, and the ethRoot is checked against the Ethereum mixer contract's isKnownDepositRoot via eth_call to public RPCs (no API key required). Invalid proofs or fabricated roots are rejected before entering local state. The worker performs the same root check during indexing. Fake tETH cannot circulate — it's caught at every layer. On the withdrawal side, SP1-verified Bitcoin inclusion + Groth16 burn proof + bind hash + pool balance solvency all pass independently. Bridge deposit notes and shielded withdrawal UTXOs are both deterministically derived from HMAC(privkey, domain || index) — recoverable from privkey alone, no backup file required. See BRIDGE.md.

After issuance. No participant can inflate (kernel sig blocks unbalanced CXFER / T_AXFER / T_BURN; T_PMINT caps are chain-auditable; AMM circuits bind hidden amounts to public deltas), burn covertly (BURN's burned_amount is public and bound into the kernel msg), or substitute assets (asset_id consistency checked across every input's parent envelope). Recursive client-side validation guarantees this independent of any indexer's honesty.