> For the complete documentation index, see [llms.txt](https://argon-4.gitbook.io/argon-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://argon-4.gitbook.io/argon-docs/suresign/roadmap.md).

# Roadmap

Where SureSign is going: a kernel project of its own, with Enclave as its first host.

SureSign began as the security kernel inside Enclave. It was designed from the first day as a separable component: a Rust crate with no user interface, no network access, a typed intent vocabulary, a canonical review, and a narrow host interface. The intention is to let it stand on its own.

{% hint style="info" %}
This page describes direction, not commitments. Anything here that touches signing semantics ships only when it meets the same bar as everything else in the kernel: pinned upstream, tests, review, and a release.
{% endhint %}

## SureSign as a project

The plan is to publish SureSign as a dedicated kernel project, with Enclave as its first and reference host.

**What that means in practice**

* The kernel crate, its protocol packs, its pinned artifacts, its fixtures, and its tests move to their own repository under their own release cadence, with Enclave consuming a pinned version.
* The host interface documented under [Kernel API](/argon-docs/suresign/kernel-api.md) becomes the project's public contract, versioned by the ABI marker, with reference documentation generated from the crate.
* The design record that today lives in Enclave's engineering docs (the trust model, the twenty-five invariants, the threat table, the architecture decisions) moves with it and becomes the kernel's own.
* Other hosts, a desktop wallet, a mobile wallet, a hardware-backed signer, a server-side treasury tool that never holds keys but needs the review, can use the same kernel and inherit the same guarantees.

**What does not change**

The laws. Minimize the trusted wallet. One transaction engine. Every signature bound to a canonical plan the user read. Unknown semantics refused. Consensus and indexed facts kept apart. Packs in the repository, never fetched. Those are what SureSign is; a project boundary does not move them.

## Near term

* **Independent review.** A third-party review of the kernel (vault, derivation, construction, signing, policy, protocol boundary), then of the extension boundary, then of the high-risk packs, followed by a public bug bounty. None of these gates the current beta; all are intended before the kernel is offered to other hosts as a dependency.
* **Two-person release.** From `1.0.0`, every release requires two approvals and two signers; the allowed-signers file will list both.
* **Package hash coverage.** Extend the package hash to cover the kernel-authored headline and detail text, so the copy a user reads for a multi-step action is bound by the same hash as the action itself.
* **Hardware key source.** The `KeySource` trait already separates derivation and signing from the seed in memory; a hardware-backed implementation is the natural next source.
* **Qualification follow-ups.** Recorded interface passes on testnet-10 for the flows currently qualified from kernel vectors and mainnet traces.

## Protocols under evaluation

Each of these is tracked against its upstream and stays inspect-only or absent until proven.

| Area                                           | Status                                                                                                                                                             |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **KCC-0020 covenant tokens**                   | Qualified `enclave-kcc20-v1` transfers, consolidation, receive settings and delegated receive. Other templates and custom issuance require separate qualification. |
| **Multisig (2-of-3) and P2MR**                 | Catalog template for inspection. Deal Desk was built so that co-signing has a room when it arrives.                                                                |
| **Mecenas, Hodl vault, transfer with timeout** | Inspect. Create refused (compiler pin issues or unproven).                                                                                                         |
| **Igra dApps beyond the pinned set**           | Reads answered; writes refused per contract until pinned.                                                                                                          |
| **Igra USDC mailbox (Base)**                   | Accepted design, not in the kernel. Predicts a user-bound contract that forwards USDC to this Igra address. No Base signer.                                        |
| **PSKT signing modes beyond `SIG_HASH_ALL`**   | Refused. Would need a reviewed pack proving each mode's semantics.                                                                                                 |
| **Other Kaspa networks**                       | testnet-11, devnet, simnet recognized by name; no consensus parameters pinned.                                                                                     |

## How to follow

Consensus-sensitive pull requests cite the upstream commit they were read from; security-critical ones are never auto-merged. Release notes call out ABI marker changes, new or lifted feature gates, and upstream re-pins.