Confidential DeFi

Confidential DeFi — two SDK surfaces, one admission model (whitelist · boundCallHash / defiVenueMulticallBoundCalldataHash · conservation · atomicity).

Naming ladder (two languages — intentional)

Layer	Speaks	Examples
Custody (SDK / product)	Transient note vs position deed	`defi.prepareTransientOperation` · `defi.preparePositionOperation` · `methods.defiTransient` · bag `defiExecutionDeadline`
Mechanism (contracts / circuits / shared prove)	DefiVenue multicall	`executeDefiVenueMulticall` · `defi_venue_multicall_v2` · pin `defiVenueMulticallExecutorAddress` · seal field `defiVenueMulticallExecutionDeadline` · session mode `defi_venue_multicall`

Do not rename mechanism pins to “Transient.” Product prepare bags use only defiExecutionDeadline (mechanism seal field remains defiVenueMulticallExecutionDeadline).

Custody-symmetric verbs (binding): defi.prepareTransientOperation ↔ defi.preparePositionOperation. Config: methods.defiTransient. defiOperation is the slim circuit name: defi_aave_v3_open_borrow_position · defi_aave_v3_repay_borrow_position · defi_aave_v3_adjust_borrow_position_add_collateral · defi_aave_v3_adjust_borrow_position_borrow_more · defi_aave_v3_close_borrow_position · defi_aave_v3_close_borrow_position_after_repay. Unknown ids fail closed.

Sandbox MetaMask Evidence may spend under operator gates — Evidence ≠ claim-matrix enabled (claims-register · Sandbox).

Surface	Settlement object	Kohaku extra	Venues (MVP scope)
Transient	fixed-value asset note	`defi.prepareTransientOperation`	Uniswap V3 swap · Aave supply/withdraw
Position	dynamic-value position deed	`defi.preparePositionOperation`	Aave borrow: open · borrow more · add collateral · repay · close

SDK settle loop (wallet-submit MVP)

Integrator happy path (Sandbox sketches):

tenebraeSdk.defi.prepareTransientOperation | preparePositionOperation
  → broadcast.privateOperation
  → waitForSdkTransactionReceipt

Registry tree roots, init-owned pins (chain id · gateway · DefiVenue executor · Aave pool on Sepolia; on Anvil also mock venue + production-prove flags when lab pins resolve), and position identity (vault · commitment · ownership hub root) load inside the sandbox SDK client wrap when omitted — do not restate them on every prepare call. Pin deployment once on SDK Config / Protocol setup.

Sandbox sketches teach op-specific prepare args only: defiOperation, token faces, amounts / min-floors, optional openFromVenueReceiptCollateral, and defiExecutionDeadline as now + 24h (unix seconds). That TTL is the DefiVenue batch seal expiry (bound into the proof; gateway checks >= block.timestamp) — it covers UltraHonk prove + wallet confirm + inclusion. It is not a Uniswap router deadline (SwapRouter02 exactInputSingle has none). Far-future orientation pins stay on Evidence/Call harnesses only. Lab prove-mode / harness labels (livePrepare, chainTargetId, venue toggles) stay off client sketches. Integrators must deploy DefiVenue admission (executor on gateway), unlock, and hold a private note for tokenIn before prepare.

Min-floors (binding): Transient ops have one declared output leg → bag field outputMinFloorWei. That value is the proof / admission floor (declaredOutputMinFloorAmounts); Uniswap cookbooks map it to router amountOutMinimum. It is not a quoter expected fill. Position ops name role-specific floors (borrowedAssetOutputMinFloorWei · collateralOutputMinFloorWei) because open / borrow-more / close have asymmetric asset roles on the same bag.

tenebraeSdk.defi.prepareTransientOperation({
  defiOperation: string; // 'defi_uniswap_v3_swap' | 'defi_aave_v3_supply_deposit' | 'defi_aave_v3_supply_withdraw'
  tokenInAddress: string;
  tokenOutAddress: string;
  amountIn: bigint; // required on live Sepolia / production prove (> 0; no silent lab default)
  outputMinFloorWei: bigint; // declared output min-floor (proof/admission)
  defiExecutionDeadline: bigint; // unix seconds; production: now + ~24h batch-seal TTL (not Uniswap router)
}): Promise<PrivateOperation>

tenebraeSdk.defi.preparePositionOperation({
  defiOperation: string; // 'defi_aave_v3_open_borrow_position' | 'defi_aave_v3_repay_borrow_position' | 'defi_aave_v3_adjust_borrow_position_add_collateral' | 'defi_aave_v3_adjust_borrow_position_borrow_more' | 'defi_aave_v3_close_borrow_position' | 'defi_aave_v3_close_borrow_position_after_repay'
  tokenInAddress: string;
  tokenOutAddress: string;
  // open / add / receipt-collateral open: required > 0 (aToken note spend face)
  collateralAmountWei: bigint;
  borrowAmountWei: bigint; // close: debt face (use 0n after full repay); open / borrow_more: > 0
  // required on live open / borrow_more (> 0; no silent = borrowAmountWei)
  borrowedAssetOutputMinFloorWei?: bigint;
  // required on live close (> 0; no silent = collateralAmountWei)
  collateralOutputMinFloorWei?: bigint;
  // repay: required > 0
  repayAmountWei?: bigint;
  defiExecutionDeadline: bigint; // unix seconds; production: now + ~24h batch-seal TTL
}): Promise<PrivateOperation>

Method	Intent	Maturity
`defi.prepareTransientOperation`	Transient note custody (swap · Aave supply/withdraw); sandbox client fills config pins + roots when omitted	Anvil MockDefiVenue + Sepolia live prove (in-package transient DeFi prove; mechanism DefiVenue multicall)
`defi.preparePositionOperation`	Aave borrow (open · borrow more · add collateral · repay · close); sandbox client fills config pins + roots + vault/commitment + ownership hub root when omitted	Same — CREATE2 vault identity and deed-hub tip are session/open-mint owned; rotate / close need the unlock session that opened the deed

Patterns: Embed patterns · maturity ceiling: Stack · Sandbox.

MethodsFull method index.SandboxTune sketches · MetaMask Evidence.

Naming ladder (two languages — intentional)​

SDK settle loop (wallet-submit MVP)​

Next​

Naming ladder (two languages — intentional)

SDK settle loop (wallet-submit MVP)

Next