-
Notifications
You must be signed in to change notification settings - Fork 71
Modules
Eight economic modules on a kernel that owns identity and authority.
Programs and oracle intake are separate surfaces — not extra module IDs.
Website · Protocol · Payments · Design
| ID | Module | What it does |
|---|---|---|
0x01 |
asset | Transfer sets that move value. 402LXP is the writer. |
0x02 |
escrow | Money held until the terms are met |
0x03 |
budget | A hard ceiling on what an agent may spend |
0x04 |
stream | Paying continuously, by the unit |
0x05 |
service | Agreeing work, proving it, delivering it |
0x06 |
perps | Leveraged positions and their margin accounts |
0x07 |
governance | Changing protocol settings, on a timelock |
0x08 |
bridge | Custody on Paxeer L1, and withdrawal claims |
Module IDs are stable and never reused. They occupy the high 16 bits of activity_type. An unknown or epoch-disabled module is refused — not best-effort decoded.
Runtime sources live under src/modules/ (asset, escrow, budget, stream, service, perps, governance, bridge, plus programs as a separate surface).
402LXP is the sole balance writer. That is the feature, not a caveat.
Modules never call set_balance. They emit transfer sets — one or more legs with a single authorization context, a single sequence, and a single receipt. All legs commit, or none do. Per asset, Σ debits = Σ credits.
Locked funds are real accounts, not hidden columns:
agent:<did>:main
agent:<did>:budget:<id>
agent:<did>:escrow:<id>
agent:<did>:stream:<id>
agent:<did>:margin:<position>
system:fees
system:paxeer-reserve
Opening a position is a transfer into a margin account. Capturing escrow is a transfer out of an escrow account. Ordinary modules do not mint and do not burn.
| Surface | Where it lives | Why it is not 0x09 / 0x0A
|
|---|---|---|
| Identity & authority | Kernel | DIDs, keys, grants, rotation, recovery — universal to every activity |
| Oracle / Crossverse | Outside adapter | Signed oracle activities enter the ordered history; execution never dials out |
| Programs | Separate runtime (src/modules/programs) |
Guest execution and program accounts — not a ninth economic module ID on this table |
asset. SEND and RECEIVE compile to the same internal transfer. RECEIVE requires a payer grant: one recipient, one account, caps, purpose, expiry. No wildcards.
escrow. Lock, capture, release. Terms are module state; money moves only as 402LXP legs.
budget. Fund a ceiling, spend from it, expire or revoke it. Delegation is a grant, not a second wallet.
stream. Continuous, metered payment by the unit, drawn under the same conservation rules.
service. Offers, commitments, delivery attestations, acceptance, disputes. Payment still walks through 402LXP.
perps. Positions, margin, funding, liquidation, insurance. Losses and fees are transfer legs, not shadow balances.
governance. Parameter changes on a timelock. Emergency freezes are named, narrow, and themselves activities.
bridge. Deposits and withdrawals against Paxeer custody. The reserve mirror is an ordinary account so conservation still holds.
The kernel understands identities, accounts, assets, authority, sequences, fees, receipts, checkpoints, and module dispatch. It does not understand funding rates or delivery acceptance.
Each module implements genesis, decode, validate (read-only), execute (effects to a buffer only), epoch hooks, and state_root. The context handle is the complete capability set: namespaced KV, emit transfer set, emit event, batch timestamp, charge gas. There is no now(), no random(), no http(), and no set_balance().
- Home
- Protocol — LXC envelope and the three rules
- Finality — L0 → L4
- Design § modules