HLP-2 — Hash-Linked Protocol Specification

L7-HLP-SPEC · 1. Abstract

1. Abstract

This is the technical specification of the Hash-Linked Protocol (HLP), formally the Aggregated Hash-Linked Protocol (AHLP). It describes the instrument as implemented on L7 Chain, the public settlement ledger of the Wrooms Service, readable at l7c.ai. It is not legal advice and not a securities prospectus. Binding use remains the Wrooms User Agreement §7. Binding purchase of L7C and WRO remains the Token Sale Agreement. Product legal copy: /hlp.

The Hash-Linked Protocol (HLP) is the wrap bind on L7 Chain. Its formal name is the Aggregated Hash-Linked Protocol (AHLP). A wrap does not stamp one foreign block. It folds the live head of L7C and every rail spine L7 watches into one SHA-256 digest. That digest is the wrap’s live hash — the hash-link. Hash linking is the act of folding those heads. The Hash Link Protocol is the same instrument. Short form on a seal: HLP.

HLP exists because a screenshot of one tip is not a proof that the rest of the field was live. Occupancy on L7 is 1:1 against native locked in a published vault, and the seal records the entire field at that instant. A wrap is a valid transaction that happened over the internet. Failed seal = nothing moved.

L7-HLP-SPEC · 2026.08.22-10 · p. 3 / 15

L7-HLP-SPEC · 2. History of the protocol

2. History of the protocol

HLP was developed because a wrap that stamps one foreign tip is a screenshot. L7 Chain watches many rails at once. Occupancy is 1:1 against native locked in a published vault. The bind had to answer one question at lock time: while this native was locked, what did every watched chain look like? That answer is a valid transaction that happened over the internet — a hash-link — not a dashboard of someone else’s chain.

The blueprint did not change. Five planes, data only down: Wallet → Vault → Field → Hash-link → Book. A failed plane aborts. What changed is the field, the names, and how stables enter the digest.

Stable-coin implementation. A stable is not an L1 and not an L2. It has no chain of its own. Founding and HLP-1 therefore kept USDC, USDT (Tether), and DAI off the field: they rode the venues that actually settle them, and a reviewer walked stored hashes on those hosts. That was honest about physics and weak about the wrap: a USDC occupancy did not commit a USDC record. HLP-2 puts the stable in the field without inventing a USDC chain. The record is the fold of its hosts. Ethereum, Robinhood Chain, Base, TRON, BNB, and Arbitrum still occupy their own slots. Changing a host tip changes both the host record and the stable record.

Founding     postulate — fold every live spine
Protocol     ALHP / AHLP / HLP named. Blueprint locked.
HLP-1        19 slots. Stables ride hosts. Digest = SHA-256(payload)
Short HLP    H1S-XXXXX-XXXXX-XXXXX-XXXXX  (projection)
HLP-2        22 slots. DAI · USDC · USDT are aggregated host binds

USDC bind = SHA-256(ETH:h:hash|HOOD:h:hash|BASE:h:hash)
USDT bind = SHA-256(ETH:h:hash|TRX:h:hash|BNB:h:hash)
DAI  bind = SHA-256(ETH:h:hash|ARB:h:hash|BASE:h:hash)

Planes (unchanged)
0 Wallet → 1 Vault → 2 Field → 3 Hash-link → 4 Book

HLP-1 seals still verify if they carry HLP_PAYLOAD under the 19-slot grammar. HLP-2 wraps use the 22-slot grammar. Inserting, removing, or sorting spines is a new spec version. A further change is HLP-3 and a new digest namespace. Cluster gold on the map is not the digest. Combo is.

L7-HLP-SPEC · 2026.08.22-10 · p. 4 / 15

L7-HLP-SPEC · 3. What the protocol does

3. What the protocol does

HLP answers one question at wrap time: while this native was locked, what did every watched chain look like? The protocol (1) reads the live tip of L7C, every rail spine, and the aggregated host bind of USDC, USDT (Tether), and DAI, (2) encodes those tips in a fixed order, (3) hashes the encoding, (4) writes the digest and the live heights onto the L7 seal. The home cluster of a planet is strategic context. The bind itself always covers the full field.

L7-HLP-SPEC · 2026.08.22-10 · p. 5 / 15

L7-HLP-SPEC · 4. How it works

4. How it works

1. The user selects a buyable rail and a live amount. BASE, ARB, OP, and HOOD are not wrap-from-wallet coins.
2. Connect Coinbase, MetaMask, Phantom, Ledger, Robinhood, Binance.US, OKX, Trust, or Uniswap. Quote shows receive 1:1 before the sign.
3. L7 reads the live tip of every spine in the HLP field (height + head hash), L7C first.
4. Missing or lagging spines encode as ASSET:0: (height zero, empty hash). They still occupy their slot.
5. Records join on U+007C VERTICAL LINE in the normative field order. Encoding is UTF-8.
6. digest = SHA-256(payload), 64 lowercase hex characters. That is the hash-link.
7. The wrap message carries HLP:<digest>, the readable rail line (ASSET #height), and each live record.
8. Native locks 1:1 in the published vault. L7 mints the occupancy token onto the user’s plate.
9. The L7 seal stores the digest as the wrap’s live hash. Unwrap burns the wrap and releases occupancy.

L7-HLP-SPEC · 2026.08.22-10 · p. 6 / 15

L7-HLP-SPEC · 5. Blueprint

5. Blueprint

Five planes. Wallet is outside L7. Vault holds native. Field is the live tips. Hash-link is the digest. Book is the L7 seal. Data only moves down. A failed plane aborts the wrap.

The diagram on this page is the same blueprint. Cluster gold on the rails map is the home set of a planet. Combo is the full field. HLP always hashes combo.

L7-HLP-SPEC · 2026.08.22-10 · p. 7 / 15

L7-HLP-SPEC · 6. Field specification

6. Field specification

The field is an ordered tuple. Order is part of the digest. Inserting, removing, or sorting spines is a new spec version. L7C is always index 0.

Stables are field members. Their record is an aggregated host bind: height is the sum of host tips, hash is SHA-256 of those host records. USDC → ETH · HOOD · BASE. USDT (Tether) → ETH · TRX · BNB. DAI → ETH · ARB · BASE. Host L1/L2 spines remain in the field on their own slots. USD maps to USDC for wrap encoding.

L7-HLP-SPEC · 2026.08.22-10 · p. 8 / 15

L7-HLP-SPEC · 7. Payload grammar

7. Payload grammar

Normative encoding. Implementations MUST emit this exact string before hashing. No spaces. No trailing join. Hash is the live head as L7 stored it, truncated to at most 64 hex characters; empty if unknown.

payload      = record *( "|" record )
record       = asset ":" height ":" hash
asset        = 2*8( ALPHA / DIGIT )      ; uppercase, field order
height       = "0" / %x31-39 *DIGIT      ; unsigned integer
hash         = *64HEXDIG                 ; empty when unknown
digest       = 64HEXDIG                  ; SHA-256(UTF-8(payload))
memo-tag     = "HLP" / "AHLP" / "ALHP"   ; HLP is current; others parse
payload-mark = %x0A "HLP_PAYLOAD:"       ; LF + marker, then payload
memo         = readable [ payload-mark payload ]

Example (heights abbreviated). A missing spine keeps its slot.

L7C:287:abc…|ADA:0:|APT:123:def…|ARB:497369721:f7d7…|…|XRP:106477855:5099…
digest = sha256(payload) → 64 hex
memo   = HLP <digest[0..16]> · L7C #287 · APT #123 · ARB #497369721 · …

L7-HLP-SPEC · 2026.08.22-10 · p. 9 / 15

L7-HLP-SPEC · 8. Digest construction

8. Digest construction

The protocol does not encrypt the live field. It fingerprints it. SHA-256, as specified in FIPS 180-4, takes the exact UTF-8 bytes of the payload and returns 256 bits. Those bits are written as sixty-four lowercase hexadecimal characters. That string is the wrap’s live hash — the hash-link. There is no HMAC and no salt. Honest implementations of the function return the same digest for the same payload, on any machine.

The payload is built before it is hashed. One record is emitted for each of the twenty-two field members, in HLP-2 order, with L7C first. Each record is the asset, a colon, the live height, a colon, and the head hash: ASSET:height:hash. The records join on a single U+007C VERTICAL LINE. There are no spaces, no URI encoding, and no trailing join. A missing or lagging spine still occupies its slot as ASSET:0: with an empty hash. Tickers stay uppercase. Order is part of the digest. Inserting, removing, or sorting a spine is a new specification and a new namespace.

USDC, USDT (Tether), and DAI are neither layer-one chains nor layer-two spines. The protocol does not invent a USDC chain. For each stable the live tips of its hosts are read first — USDC from Ethereum, Robinhood Chain, and Base; USDT from Ethereum, TRON, and BNB; DAI from Ethereum, Arbitrum, and Base. The stable’s height is the sum of those host heights. The stable’s hash is SHA-256 of those host records, joined in that host order. The hosts remain in the field on their own slots. If Ethereum’s tip moves, both the ETH record and the USDC record change.

Then the payload is hashed: digest = SHA-256(UTF-8(payload)). The function pads the payload to 512-bit blocks, mixes them through sixty-four rounds into eight 32-bit words, and emits thirty-two bytes. That digest is stored as the wrap’s live hash on the book. The memo also carries HLP_PAYLOAD, so a later reader holds the preimage. The readable line of heights — L7C #n · ETH #n · USDC #n — is not the digest. The stored-block totals a reviewer walks on a planet, including USDC as Ethereum plus Robinhood Chain plus Base, are history. They are not the hash-link.

The rails cannot be recovered from the sixty-four hex characters. SHA-256 is one-way. Verification is reconstruction. A reviewer reads HLP_PAYLOAD from the seal, hashes those exact bytes, and compares the result to the stored live hash. A match accepts the hash-link as a valid transaction that happened over the internet. A mismatch fails the seal. If the payload is missing, heights can be reported and the digest cannot be rebuilt. SHA-256 is never decoded. It is only re-hashed.

Short HLP does not truncate this digest. After the sixty-four hex characters exist, the field is braided — a live mask, a per-slot mix of height, head, and ticker, a fold of digest, braid, and mask — and encoded as twenty Crockford characters tagged H1S. That code is a projection a person can speak and copy. It is not a substitute for SHA-256. Occupancy remains one-to-one against native locked in the published vault. A failed seal moves nothing.

1. Build one record per field member, in field order, even if height is zero.
2. Join those records with a single U+007C. Do not URI-encode. Do not lowercase tickers.
3. Hash the UTF-8 bytes with SHA-256 and emit lowercase hex, sixty-four characters. Do not HMAC. Do not salt.
4. Store that hex as the wrap’s live hash. The readable rail line is not the digest.
5. Stored-block totals on a planet, including USDC as Ethereum plus Robinhood Chain plus Base, are history. They are not the hash-link.

L7-HLP-SPEC · 2026.08.22-10 · p. 10 / 15

L7-HLP-SPEC · 9. Cluster and combo

9. Cluster and combo

Cluster is the strategic home of a planet: L7C, its own spine (or host spines for a stable), companions on the home network, and the native spine of every venue where that coin is buyable. Combo is the Cartesian max: every member of the field. HLP hashes combo. Cluster is displayed gold on the map so a reviewer can see why that planet sits where it sits. Changing cluster gold does not change the digest. Changing field order does.

L7-HLP-SPEC · 2026.08.22-10 · p. 11 / 15

L7-HLP-SPEC · 10. Wrap lifecycle

10. Wrap lifecycle

1. open — quote fee and 1:1 receive, commit HLP field, build the wrap message, wait for wallet signature.
2. signed — native transfer toward the published vault is in flight.
3. sealed — vault observed, occupancy minted 1:1, L7 seal written with live hash = digest and HLP_PAYLOAD.
4. failed — any plane abort. No mint. No occupancy. Nonce cannot reprint.
5. unwrap — burn wrap, release native. New HLP commit may annotate the release; it does not rewrite the original digest.
6. verify — open /tx/{hash}. Rebuild SHA-256(payload) and match the stored digest.

Idempotence: a reused nonce, a replayed proof, or a second submit of the same wrap message MUST NOT mint twice, pay twice, or rewrite a height. Occupancy MUST NOT exceed what that foreign wallet still holds at observation time.

L7-HLP-SPEC · 2026.08.22-10 · p. 12 / 15

L7-HLP-SPEC · 11. Verification

11. Verification

1. Open the wrap seal on l7c.ai (/tx/{hash}). Confirm memo tag HLP (AHLP and ALHP are the same protocol). Short HLP begins H1S-.
2. Read HLP_PAYLOAD from the seal. If missing, this wrap predates live HLP-1 payloads — heights are on the memo only.
3. Rebuild payload in field order. Empty hash if a height is 0.
4. SHA-256 the payload. Compare to the seal’s live hash. Pass or fail is shown on the explorer.
5. Confirm amount, plate, asset, and published vault. Confirm the wrap is layer-1 occupancy, not an L7C/WRO mint. Occupancy cannot exceed the live wallet.
6. Walk stored hashes on a planet separately. Consecutive height and parent = prior hash. That walk is history, not the wrap digest.

L7-HLP-SPEC · 2026.08.22-10 · p. 13 / 15

L7-HLP-SPEC · 12. Short HLP (HLP-S)

12. Short HLP (HLP-S)

The 64-hex digest is the bind. Short HLP is a compact, speakable projection of that bind. It is not a truncation of SHA-256. It is a braid of the live field, checksummed, then encoded. Changing a live height, a head hash, or which spines were live changes the short code.

1. Mask: 22 bits. Bit i is 1 iff field[i] height > 0. L7C is bit 0. Packed in 24 bits.
2. Braid: 44 bytes. For each slot, 16-bit mix = (height ⊕ height>>16) ⊕ first two bytes of that head ⊕ ticker CRC.
3. Fold: SHA-256(digest_bytes || braid || mask as 3 bytes), take 7 bytes (56 bits).
4. Pack 12 bytes: version 1 · mask 24-bit · fold 56-bit · CRC-8 of the first 11 bytes.
5. Encode 96 bits as 20 Crockford Base32 characters (no I, L, O, U). Display H1S-XXXXX-XXXXX-XXXXX-XXXXX.
6. Verify: decode, check CRC and version, recompute fold from payload, compare. The 64-hex digest still has to match SHA-256(payload).

H1S-7K3MQ-W9QP4-R2NPX-C8K7M
20 chars · 96 bits · Crockford
Full digest remains 64 hex on the book

I, L, O, and U are not in the alphabet. Paste may map I/L → 1, O → 0. Short HLP is indexed on the memo so the book can find a wrap by H1S code. It does not replace the 64-hex digest. Every seal also has a book locator tagged L7B, packed from height and the seal hash. L7B is the line on the book. H1S is the wrap bind. They are not interchangeable.

L7-HLP-SPEC · 2026.08.22-10 · p. 14 / 15

L7-HLP-SPEC · 13. Non-goals and versioning

13. Non-goals and versioning

• Not a price oracle. Not a screenshot. Not a TVL sum.
• Not a wrap of BASE, ARB, OP, or HOOD as coins.
• Not a security, share, or claim on Wrooms.
• Not a third-party certification of Bitcoin, Ethereum, or any foreign RPC.
• A delayed foreign node is a sync state. HLP binds the tips L7 had at seal time.
• This specification is HLP-2. HLP-1 was the 19-spine field without USDC, USDT, and DAI. A further change to field membership or record grammar is HLP-3 and a new digest namespace.

Related: /hlp · /audit · /contracts · /tokenomics · /whitepaper · /sale · /agreement §7. Questions: hello@wrooms.ai.

L7-HLP-SPEC · 2026.08.22-10 · p. 15 / 15