Yield payouts
can't be public.

Solana is a public blockchain. Every instruction, every account mutation, every token transfer is permanently recorded and indexed within seconds. That permanence is a feature — it is the source of PRISM's transparency and auditability.

It is also a problem for institutional LPs. Credit fund managers do not publish their yield. They do not disclose how much capital they have deployed in which risk layer. They do not want their competitors to know their payout schedule, their tranche allocation, or their return profile.

• Every yield payment is permanently indexed and readable by anyone.
• Competitors can infer a fund's position size from payout amounts.
• Counterparties can deduce LP exposure in specific tranches.
• Institutional credit desks face regulatory constraints on public financial disclosures.
• No institutional LP will reveal their payout structure to the entire internet.

Without a solution to this, PRISM's LP market is limited to participants who have no privacy requirements. That is a small and uninteresting subset of the institutional credit world.

After accrue_yield distributes yield across Prime, Core, and Alpha tranches, every LP's claim is on-chain. Anyone can read it.

• Prime LPs receive 2.1% annualized — publicly readable.
• Core LPs receive 5.4% — amount and identity permanently on-chain.
• Alpha LPs receive 11.2% — risk appetite exposed to all observers.
• Yield epoch timestamps reveal when each investor is active.

In traditional finance, yield distributions happen inside prime brokerage systems — invisible to outside observers. In on-chain credit without Cloak, the equivalent data is permanently public on an indexed ledger. The disclosure risk alone is enough for institutional credit desks to decline participation.

This is the gap that Cloak closes.

Cloak is a privacy protocol on Solana that provides shielded batch disbursement — a primitive that fans one transaction out to many recipients with hidden individual amounts. Each recipient gets a viewing key that lets them verify and decrypt their own payout. No one else can.

Cloak's batch disbursement primitive is structurally identical to a tranche waterfall payout. One vault, many recipients, individual amounts that should stay private. The fit is not approximate — it is exact.

• Shielded batch disbursements fan one transaction out to many recipients.
• Individual payout amounts are hidden from all outside observers.
• Each LP receives a viewing key — the only path to their own amount.
• The batch receipt is committed on-chain: public confirmation, private amounts.
• Live on Solana mainnet — not a prototype, not a promise.

The batch receipt is committed on-chain. The world knows that a disbursement happened, when it happened, and that the Cloak oracle attested to its validity. What the world cannot read is how much each LP received. That detail lives only in each LP's viewing key.

PRISM's Cloak integration mirrors the Encrypt FHE pattern exactly — the shielding happens via the Cloak SDK, and the on-chain program records a signed attestation of the batch disbursement result.

The result: Solana has a verifiable record that yield was shielded and confirmed by the Cloak oracle. The LP has a viewing key that decrypts their exact payout amount. Everyone else sees a commitment hash and a confirmation bit.

Cloak's oracle produces a 73-byte signed attestation after a batch disbursement completes — the same length as PRISM's Encrypt attestation, by design. The message encodes the vault key, a sha256 commitment of the Cloak batch receipt, and a single confirmation byte.

The transaction structure mirrors Encrypt exactly: ix[0] is Solana's native Ed25519 precompile, which validates the Cloak oracle signature at the runtime level. ix[1] is record_cloak_payout, which reads the precompile result through the instructions sysvar, checks the batch ID commitment, and creates a CloakPayoutRecord PDA with status Shielded.

Both Cloak and Encrypt use the same Ed25519-via-sysvar pattern. Both produce 73-byte attestations. Both verify signatures through the native precompile. But they answer completely different questions.

Together they close the two disclosure problems in on-chain institutional credit: Encrypt protects borrower data at the default event, Cloak protects LP data at the yield event. Neither is optional for an institutional credit market.

The waterfall logic is unchanged. Prime still gets paid first. Alpha still absorbs losses first. What changes is who can see the amounts flowing through that waterfall — and the answer, with Cloak, is: only the LP whose funds they are.

PRISM's credit market is designed for institutions — capital allocators who measure positions in tens of millions, who have compliance teams, who operate in markets where revealing your book is a competitive and regulatory liability.

A public tranche payout is not just inconvenient for these participants. It is disqualifying. No credit fund manager will accept a structure where their yield schedule, their tranche allocation, and their return profile are permanently indexed on a public ledger for their LPs, competitors, and regulators to read without consent.

Cloak does not add privacy as a feature on top of PRISM. It removes the single largest barrier to institutional LP participation. The waterfall already worked. The math was already correct. The tranches were already liquid. What was missing was the ability to move money through that waterfall without every amount becoming permanently public.

That is what Cloak provides. And that is why it was never optional.