spb/sp-wallet

1# Deviations from the master specification, and why23The owner asked on 2026-11-10 for mainnet from day one, single user, small balances, in one pass. Consequently:45| Specification | What was built | Reason |6|---|---|---|7| testnets first, mainnet after gates | mainnet only | owner instruction |8| independent audit / pentest before live value | not done | owner accepted for ≤ tens of USD; limits enforce it |9| Next.js App Router | Vite + React SPA served by the API | no inline scripts → strict `script-src 'self'` CSP; smaller dependency surface |10| Rust signer | TypeScript signer on audited noble/scure primitives | one pass; same libraries verify test vectors |11| many micro-services (indexer, broadcaster, approvals, gateway) | two processes: API (with worker) and signer | the trust boundary that matters is API ↔ signer |12| Bitcoin Core descriptors + PSBT | Esplora indexers (two, must agree) + @scure/btc-signer | no full node on the cluster; signer still verifies every input/output |13| OCI images, mTLS, VLAN | PM2 processes; HMAC + source-IP allowlist on LAN | existing MacLustr deployment model |14| Redis, OpenAPI document, roles (viewer/operator/…) | none | single owner |15| second approver for large amounts | none; per-transfer cap instead | single owner |16| service worker / offline mode | none (installable PWA manifest only) | avoids caching anything sensitive |17| un-halt from the app | signer CLI only | a compromised app must not be able to resume signing |18| incoming native ETH/POL deposits in Activity | balance only (USDC, BTC, SOL deposits are listed) | needs a tracing indexer |19