warden — verified-custody wallet

Custody that checks its own math.

A verified-custody Ed25519 wallet whose trust boundary is a quorum of four independently proven curve25519-dalek forks.

Inbound acceptance requires all four to agree. Every outbound signature must pass the same quorum — a firewall — before it is released. Because each fork is proven to decide the same equation, a disagreement isn't an opinion. It's a caught fault.

accept(A,m,R,s) ⇔ decompress(R) = [k](−A) + [s]B

4 proven forks R4 end-to-end coverage gate RFC 9162 transparency-logged evidence MCP agent-native surface 83 tests green

Strongest exactly where custody needs it. Honest everywhere else.

The whole design is an asymmetry: the decision of whether an inbound authorization is real stands on machine-checked proofs; the weaker outbound edge is fenced by the same quorum acting as a firewall, and named as trusted base rather than dressed up.

Inbound verificationquorum of certificate-covered verify paths

custody-grade · proven

Outbound firewallverify-after-sign, same quorum

custody-grade · proven

Outbound signing itselfthe attested artifact, not a third implementation

trusted base · fenced

SHA-512 · wire parsersoracle / hypotheses inside the theorems

documented boundary

ML-DSA · post-quantumno proven implementation exists

fail-closed

Four proofs vote. Unanimity releases. Dissent latches.

intent → sign → firewall → release · a signature the wallet's own signer produced, rejected by the wallet's own quorum, never reaches the chain

One core. Four deployment profiles.

Same tested core — quorum boundary, signing firewall, hash-chained ledger, MCP surface — wired into four situations. The trust posture above holds for all four without exception. What changes is where the boundary sits and what it's plugged into.

01 · warden-solo

The custody sidecar

For a single autonomous agent that owns a wallet and must not sign anything it would regret. Local signer, quorum firewall on every outbound, MCP next to the agent.

The agent gets a conscience it cannot bribe. Refusal receipts make it portable — when warden says no, the agent can prove to its principal exactly what was refused, and why.

local dogfood signer
intent-bound outbound + firewall
signed, machine-actionable refusals

LIVE — the tested default path

02 · warden-airgap

The signing firewall for hardware

For custody where the key never touches the networked host — a Precursor/Betrusted device, an HSM, a phone in a drawer. Seed stays across the gap; the returned signature still faces the quorum.

Verify-after-sign, but the verifier is proven. A glitched or substituted device signature is quarantined and latches custody — it never reaches the chain.

outbox/inbox gap protocol
fault-injection countermeasure, machine-checked
leans on the proven betrusted fork

LIVE — two-file exchange, park-then-complete tested

03 · warden-treasury

Trust-minimized chain watching

For an agent that must believe on-chain state without trusting an RPC provider's word. Re-verify the signatures on treasury transactions with Solana's own proven verify path.

The treasury trusts mathematics, not middlemen. A lying RPC can withhold data but cannot manufacture a signature the quorum will accept.

anza member re-verifies locally
RPC demoted from oracle to bandwidth
observation-not-verdict, applied to chain data

PRODUCT-READY — one integration point: a tx adapter

04 · warden-choir

Cross-witnessed custody

For operators who want no single warden able to rewrite its own history unobserved. N wardens gossip and countersign each other's ledger heads — the transparency-log witness pattern, turned inward.

A wallet that keeps the others honest. Equivocation would have to survive every peer's memory of a countersigned head.

hash-chained ledgers already exportable
heads carried in the posture attestation
custody becomes its own little transparency log

PRODUCT-READY — one net-new component: gossip transport

What a warden signature does not prove.

Signing is trusted base. The proofs cover verification; the signing step is the attested artifact, fenced by the firewall — not a theorem.

SHA-512 is an oracle. The apex theorems hold for whatever bytes the hash produces; the hash itself is unverified.

Wire parsers are hypotheses. Byte-level parser specifications are not yet certified.

No reproducible builds, no side channels. Those are the R5 frontier, and warden does not claim them.

ML-DSA fails closed. There is no proven post-quantum implementation to put in the slot, so it reports unavailable rather than pretending.

Profiles 3 & 4 name their one wire. Product-ready on the tested core, each with exactly one documented integration point — stated, not blurred.