davide
b292590cdc
docs/docs-as-code.md defines the workflow; docs/adr holds 31 ADRs (retroactive, reconstructed from code and changelog) with a template and index. docs/check-docs.sh validates ADR structure, index, cited code paths, relative links and CLAUDE.md/AGENTS.md sync.
25 lines
1.1 KiB
Markdown
25 lines
1.1 KiB
Markdown
# 0031. Explicitly defer multisig, Lightning, Tor and hardware wallets
|
|
|
|
- **Status:** Accepted
|
|
- **Area:** Scope
|
|
- **Recorded:** 2026-11-03 (retroactive: reconstructed from code, comments and changelog)
|
|
|
|
## Context
|
|
|
|
Each of these adds large attack surface or UX complexity. Shipping a half-working version in a wallet is worse than not shipping it.
|
|
|
|
## Decision
|
|
|
|
The first release excludes Lightning, M-of-N multisig, hardware-wallet integration, Tor/proxy support, multi-server pooling and RBF/CPFP fee-bumping UI. Where the profile already defines the constants (multisig SLIP-132 headers, BIP48/BIP86 purposes), the unimplemented paths throw rather than silently producing an incorrect wallet. Coin control exists in `TransactionFactory` (manual UTXO selection) and freezing in the cache; `SECURITY.md` lists the limitations users must know.
|
|
|
|
## Consequences
|
|
|
|
- A smaller, auditable v1.
|
|
- Network traffic reveals which addresses are queried (no Tor); this is stated in the threat model.
|
|
- Each deferred feature needs its own ADR when taken up.
|
|
|
|
## References
|
|
|
|
- `SECURITY.md`
|
|
- `src/Core/Crypto/DerivationPaths.cs`
|