Not usable, and not safe to use. Nothing before the Phase 9 release tag should ever touch real funds. This repository is public so the work can be checked as it happens, not because there is anything to run.
An offline-only desktop signer (Tauri + Rust) that holds key material for the duration of one session and keeps nothing afterwards: no wallet file, no seed, no descriptors, no PSBTs, no history. Every launch starts with no wallet loaded, and there is nothing to delete.
Phase 0 — foundation and enforcement. An empty but fully governed repository: nothing about the signer works yet, everything about the quality gates does.
docs/project-overview.md |
What is being built, and why |
docs/implementation-plan.md |
Phases, exit criteria, risks |
docs/coverage-policy.md |
The coverage denominator, and why it is a file |
docs/adr/ |
Decisions that would otherwise be surprising later |
CONTEXT.md |
Glossary |
Enforced in CI from the first commit, because a guarantee nothing checks is a habit:
- Coverage — ≥95% workspace, ≥98% for crates handling key material or hostile input
- No network —
deny.tomlis deny-by-default; every crate in the graph is named and justified - Supply chain — advisories, licences, sources, and build scripts, all opt-in by name
- Pinned integrity — the wordlist and every test vector are checked structurally, not just hashed
- Reproducibility — exact toolchain, committed lockfile,
--lockedeverywhere - Threat-model integrity — every threat names a mitigation and something that checks it; every
out-of-scope threat is answered in
docs/limitations.md
Run them locally with cargo fmt --check, cargo clippy --all-targets -- -D warnings,
cargo test, ci/coverage.sh, cargo deny check --deny unmatched-skip, ci/vectors.sh,
ci/threat-model.sh, and ci/api-surface.sh.
MIT, except crates/backup/assets/eff_large_wordlist.txt — see
LICENSES/eff-wordlist-CC-BY-3.0.md.