Understand
Trust Boundaries
Separate user custody, signer custody, admin authority, solver execution, and public app state.
Most integration bugs come from blurring trust boundaries. The system has several actors that can all appear in one user flow but must not share custody.
Boundaries
| Boundary | Holds | Must not hold |
|---|---|---|
| Browser app | public manifests, user intent, wallet connection | signer keys, deployer keys, solver secrets |
| Quote server | signer custody, policy checks, route inventory | admin keys unless deliberately separated and audited |
| Solver | order execution credentials and replay state | user wallet custody |
| Admin wallet | privileged contract authority | routine quote-serving responsibility |
| Operator | logs, health checks, restart access | unilateral protocol authority |
Practical Rule
If a value can mutate privileged state, sign settlement material, or drain inventory, keep it out of browser-safe configuration and out of generic operator dashboards.
Source Files
script/testing/check-interface-secret-boundary.mjsquote-server/src/config.tsinterface/src/src/