Files

ci / gate (push) Successful in 4m24s

Details

feat: scaffold the workspace, the tauri shell and the webview

The house shape (architecture/generic.md §1): wallet-entities for the
vocabulary and the IPC wire types, wallet-core for the four ports that are the
architecture (KeyScheme, ChainAdapter, SwapProvider, FiatRamp), wallet-data
for the adapters that will implement them, and wallet-app as a Tauri 2 shell
whose commands are one-line shims. The webview is Vite + React + TypeScript
and reaches Rust only through ui/src/api/wallet.ts, typed by what ts-rs
exports from the entities crate on every `cargo test`.

Amounts are integer base units plus decimals, serialised as strings, because
the webview has no integer wide enough and a wallet that rounds is a wallet
that lies. The webview never receives a secret; readme.md and CLAUDE.md say
why and what will bite.

Two things the scaffold learned: Tauri's `version` field takes a JSON file or
a literal, never Cargo.toml, so the release workflow stamps it; and Prettier
must skip the generated types, which carry ts-rs's own style.

Placeholder icon; the mark comes later. CI targets the rust-gtk3 runner.

Refs #1

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW

2026-09-15 15:42:28 +03:00

3.2 KiB

Raw Permalink Blame History

blackbeard wallet

A desktop wallet for post-quantum chains, Quantus first. Linux, Windows and macOS; installable on Fedora with dnf.

Shape

The wallet is a Rust cargo workspace with a Tauri shell and a React webview. That split is the security model, not a convenience: every key, signature, decoded transaction and amount lives on the Rust side, and the webview only renders what a Tauri command hands it. Nothing that could serialise a secret is reachable from JavaScript.

crates/
  wallet-entities/   domain types and the IPC wire protocol; exported to TypeScript
  wallet-core/       wallet logic and the ports it is written against
  wallet-data/       adapters behind those ports: keystore, cache, RPC, provider APIs
  wallet-app/        the Tauri binary; commands are one-line shims into core
ui/                  Vite + React + TypeScript webview

The ports in wallet-core are what make "any post-quantum chain" a profile rather than a rewrite:

KeyScheme turns a seed and a path into a signer. ML-DSA-65 and ML-DSA-87 now; whatever the next chain uses later.
ChainAdapter knows one chain: balances, building and submitting a transaction, watching it. The Substrate adapter is driven by runtime metadata plus a small per-chain profile (ss58 prefix, decimals, signature enum, transaction extensions, signing-context rule, coin type).
SwapProvider is a swap venue. NEAR Intents first.
FiatRamp builds a provider session through a relay on our infrastructure, which holds the provider secrets, and opens it in the system browser.

The wallet is post-quantum only. Classical chains appear only as transit legs of a swap or ramp; the wallet never derives a secp256k1 or ed25519 key.

Why these choices

Quantus signs extrinsics with ML-DSA, hashes public keys with Poseidon2 for the account id, and shields mining rewards behind a Plonky2 wormhole whose prover is minutes of native CPU. All of that exists as Rust crates and nothing else, so the core is Rust. Tauri is the house desktop convention (~/git/architecture/generic.md §4) and the only shell that packages rpm, deb, msi and dmg with a Rust-owned IPC boundary out of the box.

NEAR's post-quantum work (their MPC fork with threshold ML-DSA-87) is not yet able to sign a Quantus extrinsic, so the swap module is built and tested against chains NEAR Intents already lists, with Quantus as a registry entry that lights up when the bridge does.

Building

pnpm --dir ui install
cargo tauri dev --config crates/wallet-app/tauri.conf.json   # from crates/wallet-app: cargo tauri dev
cargo test --workspace                                        # also regenerates ui/src/api/generated

The CI gate is cargo fmt --check, cargo clippy -D warnings, cargo test, and the webview's typecheck, lint and build. Run them before claiming done.

Work

Work is filed before it is done. Epics carry the epic label and an external definition of done; their steps carry child, in dependency order, at https://git.lair.cafe/blackbeard/wallet/issues. A commit that finishes a child closes it (Closes #N); when an investigation contradicts an issue, the correction is a comment on the issue, dated, not a surprise in a diff.