Vaults
Register m-of-n Taproot vaults with a
covenant:v1:<hrp>:<m>-of-<n>:<keys…> descriptor.
The address is fully determined by the cosigner set — no keypath bypass exists
(NUMS internal key). Registering is watch-only: no keys required.
Demo vault — testing only
These mnemonics are shown once. They control a demo vault — fund it only with amounts you can lose. Copy them to the cosigners' password managers, then dismiss this panel.
Registered vaults
| Vault | Address | Quorum | Confirmed | Unconfirmed | UTXOs | Refreshed |
|---|
Spend proposals
Draft a spend intent. The proposal id is the SHA-256 of its canonical JSON — tamper with any field and the id stops matching. Amounts use integer grain math only; the payee must be a valid Taproot address on the vault's network.
Proposals
| Fingerprint | Vault | Payee | Amount | Status | Due |
|---|
Proposal detail
Cosigner signing
Turn a proposal into a real Taproot signing round, sign it locally with a cosigner key, and pass the round JSON to the other cosigners. Every signature is Schnorr-verified against the round digest before it is stored; a key that is not a cosigner is loudly refused.
Funding outpoint
Cosigner key (in memory only — never stored)
Confirm the spend
Collected signatures
Import a cosigner's signature
Load a cosigner's round
Disburse
When a proposal's round reaches quorum, finalize the real Taproot spend, inspect the raw hex, and broadcast it through Blockbook. The round is checked against the proposal intent first — a round that drifts from the approved payee or amount is refused.
Signed transaction
txid
vBytes · fee
Broadcasting spends real PRL. The hex above is final — confirm the payee and amount one last time.
Scheduled payouts
Recurring proposals land here as a calendar table. Nothing on-chain enforces the timing — when a payout is due, build its spend above and mark it paid.
| Proposal | Every | Next due | Last paid | Status |
|---|
Audit log
Every vault registration, proposal, signature, disbursement, and schedule event is appended to a hash-chained log. Each entry commits to the previous entry's hash — edit any line and the chain check fails.
| # | Time | Event | Actor | Detail | Hash |
|---|