TapeFoundry
Architecture
Four contracts, each owning one piece of state. Nothing is custodial, and no contract can rewrite another's data.
The contract graph
| Contract | Owns | Who can write |
|---|---|---|
Parts 0x9039e4cd6ceba37522382eb1ad8076ba38c975dc | Gate balances per address | Anyone who pays mintPrice |
Processor 0x5a4eaff589c9e410260a61d658a893876710ba83 | Circuits: owner, netlist, gate count | Anyone who holds the gates |
Registry 0xb69215ce68792eca5672b49196868369555ea181 | Drawing hashes and edition numbers | The processor, through claim |
Wrapper 0xB4A7B988B77Bd7b29E56F42229464a8dD72361bF | TFD tokens and the original↔wrapped mapping | Anyone who owns a raw circuit |
One purchase, four state transitions
1 parts.mint(0, gates) balance[you] += gates
2 processor.tapeout(netlist, …) balance[you] -= gates
circuits[id] = {owner, netlist, gates}
3 registry.claim(epoch, d, cpu, id) editions[cpu][id] = {epoch, d, n}
4 wrapper.wrap(epoch, d, cpu, id) original[tfd] = {…}
ownerOf(tfd) = youStep 4 is optional. Steps 1–3 are the card; step 4 is a display layer for external marketplaces.
Why this decomposition
| Boundary | What it buys |
|---|---|
| Parts separate from processor | A failed tapeout leaves your gates intact instead of refunding them through a contract we wrote. |
| Processor separate from registry | Numbering logic can change per series without touching the circuit data. |
| Registry separate from wrapper | The wrapper verifies against the registry, so a copied netlist cannot be wrapped as ours. |
| No router | No moment where a contract we deployed holds user funds. |
What is immutable, and where
mintPriceandsupplyCapon the parts contract are set at deployment.- A circuit's netlist and gate count are written once, at tapeout.
- Edition caps live in the registry per drawing and are enforced on claim.
- The wrapper is the only contract with an owner-controlled surface: royalties, labels, per-drawing caps, accepted processors, registry pointer.
Trust boundaries
The processor, parts and registry are deployed by the TapeOut protocol; we cannot upgrade them. The wrapper is ours. That asymmetry is deliberate: the parts that hold assets are not under our control, and the part that formats metadata is.
Reading the system without our frontend
Every state transition above is a standard contract call. Any wallet, script or other frontend can perform the same sequence; the site is a convenience, not a gatekeeper.