Protocol objects

Luvion uses versioned objects and domain-separated canonical encoding. Canonical binary encoding is the signed representation, while JSON provides transport and inspection. Unknown or unsupported schema versions fail closed.

Policy

A pilot policy fixes the tenant, policy identifier and version, and one or more operation rules. The implemented treasury rule binds:

Field	Meaning
network	CAIP-2-style network identifier, such as eip155:1
account_id	Partner-defined protected account identifier
asset_id, decimals	Asset identity and exact atomic-unit scale
max_atomic_units	Maximum permitted amount as a canonical decimal string
allowed_destinations	Exact allowlist for the pilot
required_approvals	Number of eligible approvals required
approver_ids	Actors eligible under this policy version
authorization_ttl_s	Validity window after authorization
prohibit_initiator_approval	Enforces initiator and approver separation

Operation submission

The implemented API accepts an idempotency_key, network, protected account, asset, amount, destination, and a 32-byte external payload hash. The server adds the authenticated initiator identity and server time.

{
  "idempotency_key": "pilot-transfer-001",
  "network": "eip155:1",
  "account_id": "treasury-primary",
  "asset_id": "usdc",
  "amount": {"atomic_units": "250000", "decimals": 6},
  "destination": "eip155:1:0x1111",
  "payload_hash": "1717171717171717171717171717171717171717171717171717171717171717"
}

An identical authenticated retry returns the original record. Reusing the key with changed business fields returns a conflict.

Authorization intent

The authorization intent binds the stable request ID, action, network, account, optional asset/amount/destination, policy hash, approval-context hash, validity window, nonce, and external payload hash. Changing any protected field changes the intent digest.

Signing request

The signing request adds the signature scheme, key ID and epoch, threshold, strictly ordered participant identifiers, evidence hash, and issue time. This prevents a valid signature for one signer set, policy, epoch, or evidence bundle from being silently reused for another.

Authorization certificate

The certificate contains the complete signing request plus the backend public key, signature, and transcript hash. Execution verifies structure, backend identity, signature integrity, validity time, and exact intent binding.

Execution result

The adapter receives the stable request ID as its idempotency key. A completed result binds the external operation ID, external status, receipt hash, and provider-specific evidence fields. An uncertain result remains reconcilable and must not be treated as a confirmed failure or silently submitted again.

Evidence export

The export contains the exact policy, validated request record, deterministic record digest, event-chain head, execution or validation receipt when present, and optional independent witness receipt. Public reports must exclude bearer tokens, private key material, and private infrastructure configuration.

Stability

These implemented v0.1 pilot objects support design review and controlled validation. General availability follows interface stabilization, backwards-compatibility review, and partner acceptance.