canister coord://offchain/genie/program/vault_one@v1/0d47ccc2fb7f2c0d · v1 · artifact root 0x0d47ccc2fb7f2c0d620ab867849fa209f1cc7b791b90267a5fcb1066e08f1462 · previous none (first version) · superroot at publish not sealed yet
sealed cases that reached it: 0 — sealed cases that reached this word (the store counts, never reads)
// generated by genie import from lang/gen/tenant-vaults.json (lifecycle, flows, arm) — the ONE vault (lang/cue/vault.cue): a tenant vault from requested to retired, one value move of an armed vault, the flows it may take.
genie vault_one v1
about "The ONE vault: a tenant vault from requested to retired, each move by its party; an armed vault's value move from plan to acked; money enters only at the vault or its top-up and leaves only by its spend or a withdrawal"
use guard tenant-consent owner-arm kms-sign-only fixed-addresses value-cap day-cap idempotent-payouts recipient-filter
agent tenant_vault is "one tenant vault of the ONE vault, taifoon.vault.lifecycle.v1"
states requested provisioned funded armed frozen withdrawn retired
start requested
final retired
move requested -> provisioned guard tenant-consent effect record
move provisioned -> funded when deposit.seen == true effect record
move funded -> armed guard tenant-consent effect record
move provisioned -> frozen when by == "tenant" guard tenant-consent effect record
move funded -> frozen when by == "tenant" guard tenant-consent effect record
move armed -> frozen when by == "tenant" guard tenant-consent effect record
move provisioned -> frozen when by == "layer" guard owner-arm effect record
move funded -> frozen when by == "layer" guard owner-arm effect record
move armed -> frozen when by == "layer" guard owner-arm effect record
move frozen -> armed guard tenant-consent effect record
move funded -> withdrawn act box signs vault-box release(bytes32) guard tenant-consent kms-sign-only fixed-addresses effect act
move armed -> withdrawn act box signs vault-box release(bytes32) guard tenant-consent kms-sign-only fixed-addresses effect act
move frozen -> withdrawn act box signs vault-box release(bytes32) guard tenant-consent kms-sign-only fixed-addresses effect act
move withdrawn -> retired guard tenant-consent effect record
move frozen -> retired guard tenant-consent effect record
next requested provisioned "provision: vault/setup: derived or byo; the mapping {tenant, vault, role, a | byo_ref, addresses} recorded on vault:index"
next provisioned funded "fund: the tenant's own wallet funds the top-up or vault address; the producer lane observes it (coord never moves money in)"
next funded armed "arm: vault/arm true with the sign_policy hash and the one debit authorization (GRID per call / day / month)"
next provisioned frozen "freeze: vault/revoke or vault/arm false: signing stops except a withdrawal to the registered address; a pending withdrawal-address change is cancelled (audit V6)"
next provisioned frozen "freeze-layer: the platform's emergency stop (audit V28): every freeze by the layer is an audit record naming its reason; it never moves money"
next frozen armed "unfreeze: the tenant's owner key re-arms under the same authorization hash"
next funded withdrawn "withdraw: to the address registered at provision (a new address waits 24 h and needs the owner key); sweeps vault, topup and spend; signed by …"
next withdrawn retired "retire: the index stays allocated and retired; a byo ciphertext is destroyed after the tenant confirms"
agent value_move is "one value move of an armed vault (taifoon.vault.intent.v1): fund-again, sign, sweep, spend, debit"
states plan checked reserved signed_node sent acked refused
start plan
final acked refused
failed refused
move plan -> checked when kind in "fund-again,sign,sweep,spend,debit" guard value-cap day-cap effect record
move checked -> reserved guard idempotent-payouts effect record
move reserved -> signed_node act box signs vault-box Sign(bytes32) guard owner-arm kms-sign-only recipient-filter effect act
move signed_node -> sent when sent == true effect record
move sent -> acked when ack.seen == true effect record
move * -> refused when rule.failed == true
refuse rule "a refusal names the rule of the policy that held the move; nothing is signed"
next plan checked "fund-again: a later deposit; the vault stays armed (audit V5)"
next plan checked "sign: a tenant act: plan → checked → reserved → signed → sent → acked (taifoon.vault.intent.v1); refusals name their rule"
next plan checked "sweep: a deposit on the vault's dedicated top-up address is swept into the vault address (the only way money enters besides earnings)"
next plan checked "spend: the vault funds its spend address within the spend caps; the spend address pays only the payees of its allowlist: GRID onto the vault's …"
next plan checked "debit: metered energy in GRID under the debit authorization; legs our_fee (+ venue_fee); a pipe record the tenant reads"
knowledge
policy "deposit: outside → topup — the tenant (or anyone) sends money to the dedicated top-up address"
policy "sweep: topup → vault — the box sweeps the top-up address into the vault (move sweep)"
policy "earn: earnings → vault (seller_share) — what the tenant earns lands in the vault: trading and market-making proceeds, sold inference …"
policy "fund-spend: vault → spend — the vault tops up its spend address within spend.per_day (move spend)"
policy "grid: spend → x-api-key (our_fee) — the spend address buys GRID onto the vault's own x-api key (POST /v1/access/topup; 100 …"
policy "settle-cost: spend → settler (settler_cost) — the coord streamers that carry the vault's envelopes (the EVM carrier, an outside settler) …"
policy "fees: spend → layer (our_fee) — metered energy and fees under the one debit authorization"
policy "withdraw: vault → withdraw_to — the tenant's withdrawal to the registered address"
policy "withdraw-topup: topup → withdraw_to — an unswept deposit leaves with the withdrawal (audit V28)"
policy "withdraw-spend: spend → withdraw_to — the spend address's residue leaves with the withdrawal (audit V28)"
rule "an arm is the current owner's VaultArm signature over the policy hash, at most 30 days, a strictly increasing nonce"
symptom "a vault does not sign" caused_by "it is not armed, the arm expired or the policy hash differs" fixed_by "the owner key signs a fresh arm over the current policy hash"