> For the complete documentation index, see [llms.txt](https://argon-4.gitbook.io/argon-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://argon-4.gitbook.io/argon-docs/suresign/trust-model.md).

# Trust model

What SureSign trusts, what it does not, the four zones of the design, and the twenty-five invariants every release must keep.

A wallet's security is decided by what it trusts. SureSign trusts almost nothing: the reference Kaspa consensus code it is pinned to, its own construction and decoding, and the user's explicit approval of a plan it produced. Everything else is input.

## Four zones

Enclave is built in four zones, from most hostile to most trusted. Data flows inward, and at every boundary it loses authority.

| Zone                | What lives there                                                                                                       | Standing                                                                                                                                                                                            |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **0 · External**    | Web pages, dApps, Kaspa nodes, Igra endpoints, indexers, provider APIs, price feeds, token metadata, remote registries | Hostile. Assume forged provenance, lying balances, lying token data, hostile images. Nothing here is semantically trusted.                                                                          |
| **1 · Transport**   | The content scripts that carry requests from a page to the extension                                                   | A courier. Carries bytes, binds their origin, holds no secret and interprets nothing.                                                                                                               |
| **2 · Application** | The Compact and Studio interfaces, the background worker, the dApp dispatcher, snapshot collection                     | Privileged relative to the page, **not authoritative** for what a transaction means. May ask the kernel to plan, review, authorize, and sign. May not construct or alter anything the kernel signs. |
| **3 · SureSign**    | The Rust kernel: vault, derivation, construction, protocol packs, ReviewPlan, policy, signing, sealed messaging        | The trusted computing base. The only zone that may hold a secret or make a signature.                                                                                                               |

Zone 2 is where almost all of Enclave's code is, and it is deliberately untrusted for meaning. A bug in a button cannot change what is signed, because the button never decides what is signed. A lying node can make a balance look wrong; it cannot make SureSign spend a Note that does not resolve, sign a change output it did not derive, or omit a payee from the review.

## What each input is allowed to do

| Input                                    | May                                                                        | May not                                                                                                            |
| ---------------------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **User intent** (a form)                 | Say who, how much, which asset, which Notes to prefer                      | Supply transaction bytes, a fee, a change address, or a meaning                                                    |
| **Node**                                 | Supply candidate Notes, the DAA score, mempool acceptance, confirmations   | Be believed about a Note's script or ownership; SureSign re-derives and checks                                     |
| **Indexer**                              | Assert that an address holds a token, a collectible, or a name             | Be presented as consensus; every such fact is labelled *indexed* on the plan                                       |
| **dApp**                                 | Ask to connect, ask for a message signature, submit a PSKT or an Igra call | Declare which output is change, choose a sighash the kernel does not honor, or obtain a signature without a review |
| **Provider API** (bridge, swap, lending) | Supply a quote, a route, a price                                           | Change a pinned contract, a pinned fee address, or a function the kernel has not decoded                           |
| **Remote registry or metadata**          | Supply names, logos, addresses, template hashes, flags                     | Supply executable policy, WASM, or JavaScript that participates in signing                                         |

## The twenty-five invariants

These are the rules the project holds non-negotiable. Contributors may propose changes to them; nobody may silently change them. Invariant 25 is the release-blocking P0.

**Trusted computing base**

1. No private-key operation in TypeScript or interface code.
2. No transaction signing logic duplicated in TypeScript.
3. No seed or private key is ever passed to a content script.
4. No dApp-provided transaction is considered semantically trusted.
5. No node-provided Note metadata is accepted from the request itself without independent resolution by the wallet.

**Review binding**

6. Every transaction presented for signature produces a canonical semantic `ReviewPlan`.
7. User authorization is bound to the exact `ReviewPlan` hash.
8. If transaction semantics change after approval, the authorization is invalid.
9. A post-sign decode must semantically equal the approved `ReviewPlan`.

**PSKT and signing modes**

10. PSKT signing signs only explicitly requested, wallet-controlled inputs.
11. All other inputs remain byte-for-byte unaffected.
12. Requested sighash types are honored exactly or rejected.
13. Unknown sighash types are never silently substituted.

**Change**

14. Change outputs are independently recognized as wallet-derived.
15. A dApp may never declare an attacker-controlled output to be change.

**Protocols**

16. Known protocol operations satisfy protocol-specific conservation and state-transition rules.
17. Unknown covenant templates are not generically trusted.
18. Unknown protocol semantics fail closed by default.
19. Remote configuration may contain data, never executable wallet logic.

**Authorization**

20. Network, account, origin, and transaction authorization are explicitly bound.
21. Connection permission is never transaction approval.
22. No background automatic value-moving signatures. Completing the remaining steps of a package the user already authorized, within its bounds and before it expires, is not this.
23. There is one semantic transaction engine.
24. Consensus truth and indexer-derived protocol truth remain distinct.
25. **Any violation of "what the user approved equals what was signed" is a P0 release blocker.**

In code, the invariants that apply to a given plan are checked by name (`NetworkMatchesWallet`, `ChangeIndependentlyDerived`, `FeeIndependentlyCalculated`, `PostSignEqualsReviewPlan`, `UnknownSighashNeverSubstituted`, and their siblings) and a failed check is a refusal with that name attached.

## Threats the design answers

The engineering record keeps a threat table in which every design decision traces to a named attacker. The short form:

| Attacker                               | What stops them                                                                                                                                                                                                                              |
| -------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| A malicious page or iframe             | Requests bind origin, top origin, frame, tab, nonce, and expiry. The courier carries no secret. Every signature is a review.                                                                                                                 |
| A malicious dApp transaction           | Independent Note resolution, a typed intent, protocol validation, a full ReviewPlan, and a post-sign equality check. Change is the kernel's to derive.                                                                                       |
| A lying node                           | Notes are re-resolved and re-derived; fees and masses are computed by the kernel; stale state invalidates an approval; the local transaction id must agree with the broadcast one.                                                           |
| A lying indexer                        | Its claims are labelled indexed and never collapse into consensus facts. Where a pack exists, the kernel reconstructs the payload itself.                                                                                                    |
| Hostile token metadata                 | Fetched with byte limits, sniffed, sanitized, and rendered as safe images. Never HTML, never SVG with script, never trusted MIME.                                                                                                            |
| A compromised dependency               | Pinned toolchain and lockfiles, audit and deny checks in CI, no CDN runtime code, no JavaScript cryptography for wallet secrets.                                                                                                             |
| A compromised publisher                | Signed tags with a published allowed-signers file, reproducible builds, a software bill of materials, public checksums. Remote configuration cannot carry code.                                                                              |
| Theft of the encrypted vault from disk | Random 256-bit data key, wrapped under Argon2id (password) or a WebAuthn PRF output (passkey), XChaCha20-Poly1305 everywhere. Disk yields ciphertext.                                                                                        |
| Clipboard substitution                 | Addresses are validated against the network on paste; the review names every recipient (first and last eight characters, full address on hover, and in the canonical plan JSON), and the address you approve is the address the kernel pays. |
| Time-of-check to time-of-use           | Inputs are revalidated after approval and before signing; a changed byte changes the hash and the approval no longer applies.                                                                                                                |

## What the model does not claim

An unlocked hot wallet on a fully compromised computer is lost. SureSign reduces how much has to be true for funds to move, how long secrets live in memory, and how much a lying page, node, or indexer can hide from you. It does not create a hardware enclave in a browser and does not pretend to. Lock when you are not using it; the vault is ciphertext while locked.