CZAC (Cross-Zone Atomic Channel) is Sigil’s messaging primitive between organisation zones. It provides ordered delivery, exactly-once semantics, and on-chain dispute resolution for high-frequency communication that would be too expensive to settle per-message.

​
Channel lifecycle

PhaseTransaction
OpenOpenCzacChannel — both parties deposit.
SendSendCzacMessage — message signed by sender; recipient counter-signs.
UpdateMessages update the running balance.
CloseCloseCzacChannel — settles to the final state.
DisputeChallengeCzacChannel — opens the 7-day window.

​
State

Each channel record contains:
FieldTypeDescription
channel_id[u8; 32]BLAKE3 of (party_a, party_b, asset, nonce).
party_a / party_bDidThe two participants.
assetAssetClassMINT, custom token, or zone-local asset.
deposit_a / deposit_bu128Initial deposit per side.
last_sequ64Highest committed sequence number.
running_balance(u128, u128)Current net balance per side.
statusenumOpen, Disputed, Closing, Closed.
dispute_window_start_heightu64Height the dispute window opened, if any.

​
Message format

pub struct ChannelMessage {
    pub channel_id: [u8; 32],
    pub seq: u64,
    pub kind: MessageKind,
    pub from: Did,
    pub to: Did,
    pub amount: u128,
    pub payload: Vec<u8>,
    pub signatures: [Signature; 2], // party_a and party_b
}
Each message is signed by both parties off-chain. Only the dispute or close transaction settles on-chain.

​
Dispute

Either party may submit a dispute with their proposed final state. The counterparty has seven days to respond with a higher-sequence-number signed message. Whichever side has the highest valid seq wins.
OutcomeEffect
No response within windowThe challenger’s state is final.
Counterparty submits a higher-seq stateThe newer state is final.
Both sides submit conflicting states at the same seqThe transaction reverts; manual arbitration through governance.

​
Atomicity

The “atomic” property: opening, sending, and closing all settle in a single transaction. Either both sides debit and credit, or neither does. Partial settlement is impossible.

​
Example: payment channel

A pays B in micro-MINT increments. The channel opens with each side depositing 10 MINT. They exchange 1,000 signed messages off-chain, each shifting a small amount. After business hours, either side submits CloseCzacChannel and the final balances settle in one transaction. The 1,000 intermediate messages never touch the chain. See Open a payment channel for the full recipe.

​
Limits

LimitValue
Max simultaneously open channels per zone10,000
Min deposit per side1,000,000 micro-MINT (1 MINT).
Max message payload64 KiB.
Dispute window7 days.

​
Implementation

  • CZAC types: node/sigil-czac/src/types.rs.
  • CZAC executor: node/sigil-node/src/executor_czac.rs.
  • CZAC durable state: node/sigil-node/src/czac_durable.rs.

​
See also