From 2895e7daf3df51291ea980bb5035594376f84296 Mon Sep 17 00:00:00 2001 From: gravermistakes Date: Fri, 17 Jul 2026 18:40:02 -0700 Subject: [PATCH] Update M4-wallets.md --- core/docs/plans/M4-wallets.md | 50 +++++++++++++++-------------------- 1 file changed, 21 insertions(+), 29 deletions(-) diff --git a/core/docs/plans/M4-wallets.md b/core/docs/plans/M4-wallets.md index e20a235..6e1a7c8 100644 --- a/core/docs/plans/M4-wallets.md +++ b/core/docs/plans/M4-wallets.md @@ -4,8 +4,7 @@ The economy organ's vault: **sovereign, local-hosted, our-custody-only cryptocurrency wallets**. Each wallet binds to exactly one Trader (M5) — strictly 1:1 both directions. A single wallet handles multiple chains internally (EVM, Solana, etc.). A trader without a wallet cannot access -the Marketplace (M1). Wallets hold keys, sign transactions, and enforce wallet-level spending -limits. +the Marketplace (M1). Wallets hold keys, sign transactions, and enforce wallet-level trade limits. Tax is collected on trader income and routed to the Verschwörern Veregeister wallets (stub — M0). ## 2. Status / certainty @@ -13,8 +12,7 @@ DESIGN-FIRST · ABSENT. Role C4 (sovereign custody is a hard requirement); imple ## 3. Language & location TBD · `src/economy/wallets/`. Needs cryptographic key management (secp256k1 for EVM, ed25519 for -Solana, etc.), HD derivation, and transaction signing. Rust or Go for crypto primitives; Python -with web3 libs for prototyping. +Solana, etc.) ## 4. Does / does-not - **Does:** generate and store private keys locally (never transmitted); sign transactions on @@ -26,16 +24,11 @@ with web3 libs for prototyping. custody to any third party — ever. ## 5. Interface contract -- `create_wallet(chains: [Chain], trader_id) -> wallet_id` — generates keys for each chain, - binds to trader. One multi-chain wallet per trader. - `sign(wallet_id, tx: UnsignedTransaction) -> SignedTransaction` — signs with the wallet's key. - Only the bound trader (via Marketplace) can request signing. + Only the bound trader can request signing. - `balance(wallet_id) -> { chain, assets: [{ token, amount }] }`. -- `spending_check(wallet_id, amount) -> { allowed:bool, remaining_daily:num }`. -- `tax_collect(wallet_id, income_amount) -> { tax_amount, receipt }` — computes and stages tax. -- `transfer_tax_stub(source_wallet, dest_wallet, amount) -> receipt` — **STUB** for future - Verschwörern Veregeister internal transfer. Logs only; does not execute. -- `Chain` ∈ { `evm`, `solana`, `bitcoin`, … } — extensible. +- `spending_check(wallet_id)`. +- taxes are out of scope ## 6. Dependencies & stubs - M5 Traders — 1:1 binding; *stub:* canned trader ID. @@ -45,33 +38,32 @@ with web3 libs for prototyping. ## 7. Invariants / laws - **L1 (C5):** **sovereign custody only** — private keys are generated locally, stored locally, - and **never leave the wallet**. No custodial service, no exchange deposit, no MPC with external + and **never leave the wallet**. No custodial service, no exchange deposit, no trust with external parties. Our keys, our coins. - **L2 (C5):** **1:1 trader binding** — each wallet is bound to exactly one trader. A trader cannot use another trader's wallet. The Marketplace enforces this. -- **L3 (C4):** **signing requires Marketplace routing** — a wallet will not sign a transaction - that didn't come through the Marketplace harness (M1-L1). No direct signing API for traders. +- **L3 (C4):** **signing requires Marketplace confirmation** — a wallet will not sign a transaction + that didn't receive direct authorization from Marketpakce (M1-L1). No direct signing API for traders. - **L4 (C4):** **spending limits are wallet-level** — independent of Conductor or Marketplace - limits. Defense in depth: even if other controls fail, the wallet itself caps exposure. + limits. Defense in depth: even if other rules fail, the wallet itself caps exposure. - **L5 (C4):** **tax collection is automatic** — realized income triggers tax staging. The trader - cannot opt out. + cannot opt out. OUT OF SCOPE ## 8. Build steps -1. Implement key generation and secure local storage (encrypted keystore). -2. Implement transaction signing for one chain (start with EVM/secp256k1). +1. Implement key generation and secure storage. +2. Implement transaction signing for one chain. 3. Implement trader binding and Marketplace-only signing enforcement. -4. Implement spending limits (daily cap, per-tx cap). -5. Implement tax calculation and staging stub. +4. Implement algorithmic limits. ## 9. Tests -Custody: private key never appears in any API response or log. Binding: wrong trader cannot -sign. Marketplace-only: direct sign request (not via Marketplace) rejected. Spending limit: -over-limit transaction rejected. Tax: income event triggers correct tax amount. Multi-chain: -EVM and one other chain produce valid signatures. +Custody: private key never appears in any response, messages, or log. +Binding: wrong trader cannot sign. +Trade limits: over-limit transaction rejects; risk :: reward ratio below-limit rejects. +Tax: out of scope. +Multi-chain: every chain produces valid signatures. ## 10. Open items -- Key storage format (encrypted JSON keystore? OS keyring? HSM for production?). -- Which chains to support initially. -- Spending limit configuration (hardcoded? per-trader? adjustable by Conductor?). -- Tax rate and calculation method. +- Key storage format. +- Which chains to support initially. (all of them) +- Spending limit configuration (correction: This is algorithmic and hardcoded.) - Key rotation / backup strategy.