[DeFi][FIN-02][M1] Enforce authentic pool custody, asset identity and LP supply #52

Implementation ownership — protocol-first, no finance-specific compiler feature

Primary implementation layer: application/protocol (on-chain CKB Lock/Type Scripts). The deliverables are ordinary CellScript protocol packages and their execution evidence, not Pool/LPReceipt language keywords, resource-type magic or compiler-recognised financial action names.

Implementation shape: define the pool and LP state as author-defined schema/resources, with explicit asset Type Script and pool identity commitments. Write custody enforcement in the actual reserve-controlling Script(s), and LP issuance/burn/conservation in the actual LP/pool transition policies. Use existing consume/create/transition, typed CKB views, exact handles and transaction-group validation; coordinate real input/output/CellDep layouts through existing ProtocolBundle. A generated builder assembles the transaction but cannot authorise a reserve spend or bypass LP accounting.

Acceptance interpretation: show that all financial invariants are verified by executing Scripts and the complete transaction verifier, with malicious builder inputs. If the present language cannot express a required business-neutral transaction selection/ownership rule, demonstrate a minimal failing example and propose a separate general runtime/compiler issue; do not add special lowering keyed to pool, reserve or mint_lp.

Compiler-change gate (all FIN work): This issue does not authorise finance-specific grammar, IR, opcodes, codegen branches or hidden protocol semantics. First try existing general CellScript constructs. Any genuinely missing general capability needs a minimal failing application, a non-financial use case, its own narrow issue and independent checker/ABI/resource/gate acceptance as required by #43 §2.2. Application correctness and builder convenience are distinct from language support.

Parent umbrella: #43 (FIN-02 / M1, custody and identities). Status: proposed, not accepted or deployment-authorised.
Owner role: protocol implementation. Independent reviewer: unassigned; name in FIN-01/M0. Do not infer an existing review or waiver.

Dependencies

• Hard entry gate: FIN-01/M0 in [DeFi][Application/Protocol] EVM-class finance on CKB with CellScript #43: revalidate compiler/CKB/asset evidence, choose an exact-deployment topology, name owners/reviewers and freeze proposed bounds.
• Co-develop with FIN-03: agree numeric asset, reserve, fee and share domains before freeze. Neither issue needs to wait for the other's full closure to begin.
• Downstream: FIN-04 complete pool/LP lifecycle and FIN-06 order escrow rely on this issue's accepted custody/identity contract.
• Reuse closed [Candidate][Consensus runtime] Implement executable bounded Cell-group consumption #7/[Candidate][Consensus runtime] Implement executable bounded output-plan correspondence #8 (bounded Cell consumption/output correspondence), [Architecture][Builder] Add an artifact-only multi-Script ProtocolBundle #9/[Language design] Model typed cross-Script transaction roles without runtime linkage #10/[Language/ABI] Bind runtime Script values to verified package interfaces #11 (ProtocolBundle/closed roles/exact handles), [0.30][Runtime] Complete typed bounded CKB transaction-view and syscall adapters #24/[0.30][Security] Define cryptographic capability and authorization-domain contracts #25 (transaction views/authority), [0.30][Acceptance] Build the canonical Rust-comparable CKB business corpus #26 (business fixtures). [0.32][Language/ABI] Stabilize generic compatible-open Script and verifier handles #28/[0.32][ProtocolBundle] Stabilize runtime-selected open cross-Script roles #29 compatible-open roles are not prerequisites for exact-deployment v1.

Scope

1. Freeze [DeFi][Application/Protocol] EVM-class finance on CKB with CellScript #43 decisions D01–D07 and D13–D15: two distinct genuine enforcing test-asset profiles and explicit xUDT/sUDT modes; full Type Script and chain/deployment identities; reserve inventory and custody; uniquely anchored pool; LP issuance/conservation; fixed fee and numeric domains (with FIN-03); permanently locked minimum shares; explicit upgrade restrictions; occupied/refundable capacity and unsolicited asset/surplus treatment.
2. Specify each operation's concrete transaction topology: Lock/Type Script groups, source/index scope, Cells, witnesses, CellDeps, state transitions, fee/change, capacity payer and conservation. Identify the actual enforcing Script for each reserve spend and LP mint/burn.
3. Make recognised reserve spending impossible without its authentic matching pool transition. Builder/inventory omissions and unrelated Cell observations must not bypass on-chain custody.
4. Make LP supply an enforced on-chain invariant: ordinary transfer/split/merge preserves supply; every mint/burn requires its matching pool transition; standalone LP destruction rejects even when there are no LP outputs; locked minimum cannot be redeemed or destroyed.
5. Jointly with FIN-03 implement [DeFi][Application/Protocol] EVM-class finance on CKB with CellScript #43 §11.1: genuine test assets → unique pool and LP → one generated swap → authorised LP redemption, preserving exact predecessor lineage.

Acceptance

• Versioned design/decision record freezes D01–D07/D13–D15, role topology, numeric ceilings and no-bypass arguments.
• Whole-transaction CKB execution proves initialisation, swap and redemption over real enforced assets, with reserve/share conservation and capacity accounting.
• Reserve-only spend, missing pool state, substituted asset/Script, forged LP, unauthorised mint/burn, standalone share destruction, locked-minimum destruction, omitted/duplicated roles and wrong recipient each reject at the intended boundary. Use valid holder authorisation for standalone-burn negatives.
• Generated builder and an independent financial model match actual transaction bytes/state outcomes; no hand-replacement of generated contract verifiers.
• Archive source/compiler/checker/ELF/CellDep/transaction/node identities, adversarial results, preliminary cycles/VM stack/bytes/capacity and unavailable observations.
• Appropriate independent-checker mutations, applicable dev/CI/backend gates and explicit review disposition recorded before implementation acceptance.

Scope exclusions

FIN-04 owns the full bidirectional pool/LP lifecycle. FIN-07/08 own economic settlement. No concentrated liquidity, Oracle, lending, market liquidity, public stablecoins or production deployment. Compiler changes require concrete business-neutral gaps, never special cases for names like swap.

Authoritative detail: #43 §§2, 4–7, 11–12.

Dependency cross-links (confirmed GitHub issues)

Depends on: #43 FIN-01/M0. Joint design with: #53 FIN-03 (numeric domains). Required by: #54 FIN-04 (complete AMM/LP) and #56 FIN-06 (escrowed orders). The FIN-02/03 first continuous pool/swap/redemption exercise is joint, so neither author should claim its acceptance unilaterally.

Umbrella dependency graph and authoritative financial acceptance: #43.