Watch-only Bitcoin Architecture
AENET Wallet is a local-first, watch-only Bitcoin wallet. Watch-only means the
wallet observes addresses, receive requests and transfer intents, but it never
signs online and never holds private keys in the online domain.
ONLINE WALLET DOMAIN (watch-only)
↓ observe / prepare intents
UNSIGNED PSBT
↓ signing boundary
EXTERNAL HARDWARE SIGNER
↓ physical confirmation
SIGNED PSBT → validate → broadcast
Why watch-only
Placing a private key on any online surface creates a theft surface that no
amount of hardening fully removes. The AENET answer is architectural: the key
simply is not there. The online domain holds no key material at all.
The signing boundary
The signing boundary is the strict separation between the online wallet domain
and the external signer. Only unsigned PSBT intents cross it; key material
never does. Signing requires physical confirmation on the hardware signer.
Public observation
The public side observes only sanitized snapshots from public-data/wallet/.
There is no live query path from AENET Cloud into the wallet domain. Mainnet
settlement is blocked during development; testing runs on a private regtest
network.