Bridges

What a “bridge” is (and what it isn’t)

A bridge is how you show a fact or represent an asset on another chain—without breaking the single source of truth on EDMA. We keep one home for each claim: EDMA is canonical for PoV-backed units and milestone facts. Other chains may hold representations that must reconcile back to the claim_id here.

Short rule: EDMA home, others mirror. No bridge can bypass PoV, One-Claim, or No EMT, no funds.

A. Scope

• Bridgeable

  • EDM (ERC-20): canonical on EDMA; wrapped EDM on other chains via standard lock/mint or burn/mint.

  • Tokens marketplace assets (Energy/Carbon/Attributes): wrapped representations only; the EDMA token remains canonical.

• Not bridgeable

  • EDSD: platform-bound stable; exits use the cash-out module (bank rails), not bridges.

  • Trade milestones (EMTs) & EDSD slices: facts live on EDMA; you can relay proofs, but you don’t “bridge” money states off-rail.

B. Outbound representations

Goal: show an EDMA token somewhere else without letting it be double-used.

1. Lock on EDMA — the original token is locked (non-transferable) and tagged “exported”.

2. Mint on destination — a wrapped token (wToken) is minted 1:1 referencing the EDMA claim_id and pov_hash.

3. Use on destination — trade or use within that ecosystem as a representation.

4. Return or settle:

   • Burn on destination → Unlock on EDMA (repatriate).

   • Retire on destination → submit a finality proof back to EDMA; EDMA records a compensating retirement (append-only) and permanently locks/burns the original here.

Safety rails

• Wrapped tokens must carry the EDMA claim_id; bridges enforce one active representation per claim.

• If the destination can’t provide a finality proof, the retirement must be executed on EDMA; destination burns only annotate.

Fees & burns

• No protocol fee/burn for the act of bridging.

• Fees/burns remain tied to settlement/retirement. If retirement is finalized on EDMA (home), the 4% fee and 50% EDM burn occur here. If destination retires with a valid finality proof, EDMA records a compensating retirement; economic accounting remains single-sourced to EDMA’s ledger.

C. Inbound proofs/representations

• Inbound proof (no representation): an external chain proves a retirement or claim that EDMA recognizes as equivalent to a mirror (Section 13.1). EDMA links it to a single claim_id, freezes duplicates, and records a compensating entry if needed.

• Inbound wrapped token: a foreign representation burns there and mints the canonical token here, bound to a claim_id. First-seen inside EDMA still applies: the first finalization here wins; later attempts link or are refused.

Invariants

• EDMA never creates two independent claims for the same fact.

• All inbound actions must bind to one claim_id (or be refused).

D. Message security & finality

• Finality: outbound unlocks and inbound mints wait for destination economic finality (e.g., challenge window for optimistic targets; validity/confirmed block depth for zk/POS targets).

• Bridging proofs:

  • Native bridge (recommended): EDMA’s canonical bridge contracts verify proofs using light-client libraries or trusted connectors under governance.

  • Third-party bridges: allowed only if governance approves their proof model; all messages are tagged with nonce, domain, claim_id, pov_hash and checked for replay.

• Replays/doubles: One-Claim on EDMA still prevents duplicate finalizations even if a bridge misbehaves. The second inbound for the same claim_id is a no-op and raises a conflict flag.

E. First-seen interplay

Bridges follow the first-seen rules (Section 13.2): EDMA measures first-seen by finalization here. External timestamps inform freeze/replace decisions but don’t override EDMA’s claim_id ownership. If a foreign chain presents a prior finalization, EDMA treats it like a registry mirror—binds or freezes until corrected—never as a second on-EDMA claim.

F. Failure modes & recovery

• Stuck destination / paused bridge: representations remain locked at origin; no unlock without proof of burn. Ops can escalate via governance; EDMA can mark the representation as FROZEN and offer re-mint via an alternate path once proof is provided.

• Conflicting inbound proofs: EDMA freezes, opens a revocation case, and requires the external system to resolve—append-only lineage records the fix.

• Bridge compromise: governance can revoke the connector, freeze all pending messages from that domain, and require alternative proofs (status page + inclusion lists keep settlement flows alive on EDMA).

G. What you can bridge

Item	EDMA role	Bridge action	Notes
EDM	Native ERC-20	Lock on EDMA → Mint on dest; Burn on dest → Unlock on EDMA	Standard token bridge; not tied to PoV
Token (Energy/Carbon/Attr.)	Canonical on EDMA	Lock on EDMA → Mint wrapped on dest; Burn proof → Unlock or Compensating retire	Always bound to claim_id
EMT / EDSD state	Non-transferable fact / platform stable	Not bridged	Relay proofs only; money states remain on EDMA
Proof (attestation, retirement)	Evidence/meta	Relay proof → Mirror/annotate on EDMA	No value created; no fees

H. API & events

• POST /v1/bridge/export — lock a token on EDMA; emits export ref; destination mints wrapped token.

• POST /v1/bridge/import — present foreign burn/finality proof; EDMA unlocks or mints canonical token.

• GET /v1/bridge/status/{ref} — state machine: LOCKED | MINTED_DEST | BURNED_DEST | UNLOCKED_OR_CANONICAL.

Webhooks:

• bridge.export.locked — token locked at origin (claim_id, token_id).

• bridge.import.minted — canonical on EDMA (or unlocked).

• bridge.message.frozen — message ignored (revoked connector / replay) with reason.

• bridge.conflict.opened — inbound proof conflicts; mirror/freeze path started.

I. Governance knobs

• Approve/revoke bridge connectors and light-client libraries; rotate keys; publish slippage/timeouts for conversion related to burn half (Fee Router handles burns; bridges don’t).

• Set domain allowlists, message nonce windows, max message age, and fail-safe behavior (freeze vs ignore).

• Cannot weaken: PoV, One-Claim, must-fund, Locked→Unlocked on proof, 50% burn.

J. Operator checklist

• Treat EDMA as home for PoV assets; bridge only when there’s a compelling venue need.

• Expect lock on origin before mint elsewhere; expect burn proof before unlock.

• For retirements, prefer EDMA; if retiring elsewhere, ensure a finality proof comes back so EDMA records the compensating entry.

• Never bridge EDSD; use cash-out after schedule completion.

Plain recap

Bridges let you show EDMA’s facts and assets on other chains without creating second truths. Tokens export as wrapped assets tied to EDMA’s claim_id; unlocks require burn proofs; mirrors reconcile external serials one-to-one. EMTs and EDSD don’t bridge—money stays on-rail. Fees and 50% burns stay tied to settlement/retirement, not bridging. First to finalize on EDMA owns the claim here; everything else binds or freezes until it agrees. One rail, one claim—everywhere.