WalletKit
Business intent and wallet workflow
Does not hold keys or decide PKCS#11 token routing.
Security architecture
Trust boundaries for bank-grade Mesh execution
Alloy separates business authorization from cryptographic execution. VaultCore authorizes the signer. Mesh resolves and executes against governed backends. Provider-held key material stays with the HSM, MPC, or custody boundary.
VaultCore
Signer authorization, approval evidence, signer binding identity, and expiry
Does not pass provider secrets, PINs, slots, sessions, or caller-selected key labels through the public Mesh contract.
Mesh
Cryptographic execution, contract gate, HSM/MPC adapter selection, receipt emission, and diagnostic traceability
Does not make business policy decisions or accept caller-supplied provider routing hints.
HSM / MPC provider
Key custody, key operation enforcement, PKCS#11 mechanism execution, or threshold signing primitive
Does not receive Alloy business policy context unless routed through governed integration boundaries.
Fail-closed controls
The current Mesh posture treats ambiguity as a denial condition. That is deliberate: contract drift, missing authorization, and provider lookup failures should be visible and auditable.
- No plaintext transport helper in SDKs or service defaults.
- Exact-match contract gate for mesh-v1.0.0-m2.
- Request ID, correlation ID, client name, client version, and contract version are carried into receipts.
- HSM callers use typed VaultCore signer authorization.
- Mesh resolves backend profile and PKCS#11 key selectors from governed bindings.
- Missing authorization, unsupported contract, missing key, or provider unavailability returns denial receipts instead of local fallback signing.
- Provider PINs and runtime credentials stay outside the public contract.
HSM signing path
| Step | Boundary | Invariant |
|---|---|---|
| 1 | WalletKit | Creates business signing intent and policy context. |
| 2 | VaultCore | Issues typed signer authorization with signer binding ID, evidence hash, mechanism, key reference, and expiry. |
| 3 | Mesh | Checks contract/version metadata, validates authorization envelope, resolves governed backend profile and key selector. |
| 4 | Provider | Performs the key operation only when the configured provider, token, key object, and mechanism are available. |
| 5 | Mesh receipt | Returns completion, pause, or denial receipt with request/correlation/client/contract metadata. |