Secure-Mint registry.

SecureMintPolicy {
  // keyed on-chain by the 20-byte token address
  asset_id: String,         // CAIP-19 reserve asset (not the key)
  reserve: u128,
  circulating: u128,
  por_feed_id: String,      // e.g. chainlink:<feed_addr> or tenzro:<did>
  attester_did: String,
  attestation_hash: Hash,
  attested_at: u64,
  ttl_secs: u64,            // 0 disables freshness check
  heartbeat_secs: u64,      // live-feed gate (distinct from ttl_secs); 0 disables
  mint_window_cap: u128,    // max mint per rolling window; 0 = uncapped
  mint_window_secs: u64,    // velocity window length; 0 disables
  paused: bool,             // per-token issuance circuit breaker
}

check_and_mint(token, amount, now)
  // fail-closed gate order:
  // 1. policy must exist (no policy = reject)
  // 2. not paused (per-token) and global pause not tripped
  // 3. now - attested_at <= ttl_secs (if ttl_secs > 0)
  // 4. feed live: now - attested_at <= heartbeat_secs (if > 0)
  // 5. velocity: window_minted + amount <= mint_window_cap (if cap > 0)
  // 6. circulating + amount <= reserve
  // -> atomically increments circulating + window tally, returns policy

TokenizedEquityProfile {
  cct_pool_address: Option<Address>,
  por_feed_id: String,
  underlying_caip19: String,
  isin: String,
  cusip: String,
  per_share_ratio: (u128, u128),
  last_corporate_action: Option<Hash>,
}

// Stored alongside the policy for tokenized-equity-class assets so corporate
// actions (dividends, splits, re-symbolization) can be applied
// atomically by the multi-VM token layer.

tenzro_setSecureMintPolicy {
  token, asset_id, reserve, circulating?, por_feed_id,
  attester_did, attestation_hash, attested_at, ttl_secs,
  heartbeat_secs?, mint_window_cap?, mint_window_secs?, paused?
}
tenzro_clearSecureMintPolicy { token }
tenzro_secureMintApply { token, amount }      // atomic increment
tenzro_secureMintRecordBurn { token, amount } // bounded decrement (rejects > circulating)

// circuit breakers — admin-token gated
tenzro_setSecureMintPaused { token, paused }  // per-token
tenzro_setGlobalIssuancePause { paused }      // halts mint across all tokens

tenzro_getSecureMintPolicy { token }
tenzro_secureMintCheck { token, amount }   // would the mint succeed?

An issuer can operate a stable unit on top of the Secure-Mint floor. Issuance is tiered: the hard reserve invariant (circulating + amount ≤ reserve) is enforced by the underlying Secure-Mint policy, while a leaky-PI controller tunes the issued buffer between the floor and the attested ceiling. Registration is gated by the issuer API-key scope; the reserve invariant binds regardless of the key.

StableAssetPolicy {
  issuer: Address,            // 20-byte controller
  unit_token: Address,        // the stable unit
  symbol: String,
  reserve_source:             // custodial attestation or on-chain vault
    | { kind: "custodial",      attester_did, asset_caip19 }
    | { kind: "on_chain_vault", vault, asset_caip19 },
  por_feed_id: String,        // proof-of-reserve feed
  allowed_rails: [String],    // x402 | ap2 | mpp | visa_tap | mastercard | tempo | open_standard | native
  settlement_dst: Address,
}

tenzro_registerStableAsset {            // issuer scope
  issuer, unit_token, symbol, reserve_source,
  por_feed_id, allowed_rails, settlement_dst
}
tenzro_getStableAsset    { issuer, unit_token }
tenzro_mintStableAsset   { issuer, unit_token, amount }   // bounded by reserve floor
tenzro_redeemStableAsset { issuer, unit_token, amount }