<pclass="lede">A verified-custody Ed25519 wallet whose trust boundary is a quorum of four <em>independently proven</em> curve25519-dalek forks.</p>
<pclass="sub">Inbound acceptance requires all four to agree. Every outbound signature must pass the same quorum — a firewall — before it is released. Because each fork is proven to decide the same equation, a disagreement isn't an opinion. It's a caught fault.</p>
<pclass="kicker">The trust posture — read before trusting it</p>
<h2>Strongest exactly where custody needs it. Honest everywhere else.</h2>
<pclass="intro">The whole design is an asymmetry: the decision of whether an inbound authorization is <em>real</em> stands on machine-checked proofs; the weaker outbound edge is fenced by the same quorum acting as a firewall, and named as trusted base rather than dressed up.</p>
<divclass="posture">
<divclass="prow">
<divclass="surface">Inbound verification<small>quorum of certificate-covered verify paths</small></div>
<svgviewBox="0 0 900 300"role="img"aria-label="Signing request flows through intent binding, signer, then a four-member quorum firewall; unanimity releases, dissent quarantines and latches.">
<pclass="caption">intent → sign → firewall → release · a signature the wallet's own signer produced, rejected by the wallet's own quorum, never reaches the chain</p>
</div>
</section>
<divclass="rule"></div>
<section>
<pclass="kicker">The lineup</p>
<h2>One core. Four deployment profiles.</h2>
<pclass="intro">Same tested core — quorum boundary, signing firewall, hash-chained ledger, MCP surface — wired into four situations. The trust posture above holds for all four without exception. What changes is where the boundary sits and what it's plugged into.</p>
<pclass="role">For a single autonomous agent that owns a wallet and must not sign anything it would regret. Local signer, quorum firewall on every outbound, MCP next to the agent.</p>
<divclass="scifi"><b>The agent gets a conscience it cannot bribe.</b> Refusal receipts make it portable — when warden says no, the agent can prove to its principal exactly what was refused, and why.</div>
<ul>
<li>local dogfood signer</li>
<li>intent-bound outbound + firewall</li>
<li>signed, machine-actionable refusals</li>
</ul>
<pclass="status live"><spanclass="dot"></span>LIVE — the tested default path</p>
</article>
<articleclass="card"style="--accent:#6ea8ff">
<spanclass="no">02 · warden-airgap</span>
<h3>The <spanclass="em">signing firewall</span> for hardware</h3>
<pclass="role">For custody where the key never touches the networked host — a Precursor/Betrusted device, an HSM, a phone in a drawer. Seed stays across the gap; the returned signature still faces the quorum.</p>
<divclass="scifi"><b>Verify-after-sign, but the verifier is proven.</b> A glitched or substituted device signature is quarantined and latches custody — it never reaches the chain.</div>
<pclass="role">For an agent that must believe on-chain state without trusting an RPC provider's word. Re-verify the signatures on treasury transactions with Solana's own proven verify path.</p>
<divclass="scifi"><b>The treasury trusts mathematics, not middlemen.</b> A lying RPC can withhold data but cannot manufacture a signature the quorum will accept.</div>
<ul>
<li>anza member re-verifies locally</li>
<li>RPC demoted from oracle to bandwidth</li>
<li>observation-not-verdict, applied to chain data</li>
<pclass="role">For operators who want no single warden able to rewrite its own history unobserved. N wardens gossip and countersign each other's ledger heads — the transparency-log witness pattern, turned inward.</p>
<divclass="scifi"><b>A wallet that keeps the others honest.</b> Equivocation would have to survive every peer's memory of a countersigned head.</div>
<ul>
<li>hash-chained ledgers already exportable</li>
<li>heads carried in the posture attestation</li>
<li>custody becomes its own little transparency log</li>
</ul>
<pclass="status scaffold"><spanclass="dot"></span>PRODUCT-READY — one net-new component: gossip transport</p>
</article>
</div>
</section>
<divclass="rule"></div>
<sectionclass="honesty">
<pclass="kicker"style="color:var(--trust)">The part most products hide</p>
<h2>What a warden signature does <em>not</em> prove.</h2>
<ul>
<li><b>Signing is trusted base.</b> The proofs cover verification; the signing step is the attested artifact, fenced by the firewall — not a theorem.</li>
<li><b>SHA-512 is an oracle.</b> The apex theorems hold for whatever bytes the hash produces; the hash itself is unverified.</li>
<li><b>Wire parsers are hypotheses.</b> Byte-level parser specifications are not yet certified.</li>
<li><b>No reproducible builds, no side channels.</b> Those are the R5 frontier, and warden does not claim them.</li>
<li><b>ML-DSA fails closed.</b> There is no proven post-quantum implementation to put in the slot, so it reports unavailable rather than pretending.</li>
<li><b>Profiles 3 & 4 name their one wire.</b> Product-ready on the tested core, each with exactly one documented integration point — stated, not blurred.</li>
