cip: add Multi-VM CIP-56 Bridge Pattern (Informational)

[hilarl]

cip: add Multi-VM CIP-56 Bridge Pattern (Informational)

Summary

This PR opens an Informational CIP specifying a deterministic two-phase
commit pattern for non-Canton Layer-1 ledgers to settle holding transfers
against CIP-56 holding contracts on Canton, via an attestation-based
cross-chain messaging layer. Wormhole NTT is the worked example; the
pattern is transport-agnostic and the conformance properties (§6) are
satisfied by Wormhole NTT, Chainlink CCIP, LayerZero V2, and IBC light
clients alike.

The pattern composes three existing primitives — a CIP-56 holding
contract on Canton, an external-L1 lock/unlock primitive, and an attested
cross-chain message — into a two-phase commit. Phase B maps onto CIP-56's
two-step transfer flow exactly: B2 creates a TransferInstruction and
B3 is the destination party's accept / reject. No new template, no
new choice, no change to CIP-56 or the DAML standard library.

The CIP is filed as Draft. Per CIP-0000, the author has not
self-assigned a number; the editor will assign one on merge.

This is the first in a four-part stack of contributions covering, in
order: (A) the multi-VM bridge pattern in this PR; (B) decentralized AI
training and inference settlement on Canton; (C) agentic identity and
mandate-bound payments on Canton; (D) TEE-attested confidential compute
receipts on Canton. Each is filed as a separate CIP and may be reviewed
independently.

What this CIP specifies

• Normative conformance properties for source-L1 lock semantics, the
  cross-chain attestation, the destination-side CIP-56 two-step transfer,
  replay protection, and rollback paths (§2, §5, §6).
• A Bridge-Lock / Bridge-Refund wire-format schema (§4) that conformant
  implementations MUST use, distinct from the CIP-56 meta field.
• A reserved meta namespace tenzro.network/bridge.* for the
  Canton → external-L1 direction (§3), populated by DSC on the
  destination TransferInstruction.
• A failure-modes table (§7) covering ten distinct failure pathways,
  each with its terminal-state resolution.
• Forward-compatibility provisions for the v2 packages defined in
  CIP-112 (splice-api-token-{holding,transfer-instruction}-v2 and the
  allocation-instruction / allocation-request / allocation-allocation
  v2 packages).

What this CIP does NOT propose

• No changes to CIP-56, the DAML standard library, the Canton protocol,
  or the Global Synchronizer.
• No new on-chain templates or choices.
• No specific bridge transport. Conformance is stated against abstract
  properties in §6.

Reference implementation

The pattern is shipped on the Tenzro Network testnet. Live endpoints
documented in §Reference implementation of the CIP body.

Source under crates/tenzro-bridge/src/{canton,wormhole,router}.rs and
crates/tenzro-vm/src/daml/cip56.rs at
tenzro/tenzro-network.

File layout

The CIP lives at cips/cip-hilarl-Multi-VM-Bridge.md. The directory
convention used by numbered CIPs (cip-XXXX/) is also acceptable, with
the file moved on number assignment.

Process notes

• Status: Draft (author-controlled per CIP-0000).
• Type: Informational. The CIP introduces no normative requirements on
  Canton itself — only on bridge implementations that wish to claim
  conformance.
• License: Apache-2.0 (per CIP-0000 acceptable-license list).
• Number: not self-assigned. Slug: cip-hilarl-Multi-VM-Bridge.
• Composes against: CIP-0056 (cited in Requires:).
• Forward-composes against: CIP-0112 (v2 packages).

---

Signed-off-by: Hilal Agil hilal@tenzro.com