8c0855b16e
Split out of feat-shamir so the wire contract can be reviewed on its own. Rebased onto main: main's UNSEAL_RESULT_LOCKED_OUT keeps tag 4, so UNSEAL_RESULT_AWAITING_CONTRIBUTIONS moved to 5. BREAKING CHANGE: `shared.VaultState` renumbers SEALED/UNSEALED/ERROR to make room for VAULT_STATE_BOOSTRAPPING = 2. Old and new peers disagree on every vault state value. - operator: new `governance` branch in OperatorRequest/Response (field 5) - vault: new `rekey` branch in vault Request/Response (field 4) - bootstrap/unseal: passphrase and recovery-passphrase contribution payloads
Arbiter
Policy-first multi-client wallet daemon, allowing permissioned transactions across blockchains
Security warning
Arbiter can't meaningfully protect against host compromise. Potential attack flow:
- Attacker steals TLS keys from database
- Pretends to be server; just accepts operator challenge solutions
- Pretend to be in sealed state and performing DH with client
- Steals user password and derives seal key
While this attack is highly targetive, it's still possible.
This software is experimental. Do not use with funds you cannot afford to lose.