Security-first wallet · Explicit by design
Gandalf keeps signing at the trusted boundary, makes network identity visible, and uses a capability-aware proxy to explain exactly what will happen before an irreversible action.
3.420000 UNIT
01 · Principles
Gandalf is designed for consequential actions. It favors calm surfaces, precise language, and visible security boundaries over market noise and decorative complexity.
Secret material stays behind an explicit boundary and appears only where the user must act.
Pending, confirmed, rejected, offline, and wrong-network outcomes are named in plain language.
Amounts, fees, destinations, network identity, and transaction evidence remain inspectable.
02 · How it works
Each step narrows uncertainty. The interface never collapses compose, review, signing, and result into one ambiguous action.
Choose the network, destination, and amount. Validation stays beside the field that needs attention.
Confirm the exact payment, fee, change, and network before secret material is requested.
Unseal only at the signing boundary. The cleartext secret does not leave the trusted runtime.
Retain submission evidence and distinguish pending, accepted, confirmed, and rejected outcomes.
03 · Gandalf Proxy
The proxy translates upstream infrastructure into one versioned contract. It exposes capabilities and failures without ever receiving private signing material.
chain-api/v1Versioned contract
Wallet surfaces consume a deliberate schema instead of depending on upstream quirks.
No secret transit
The proxy reads network state and submits signed payloads; it does not hold seed phrases or signing keys.
Honest failure
Offline, rejected, unsupported, and wrong-network outcomes remain distinct and recoverable.
04 · Security boundary
Gandalf treats security as an understandable sequence of boundaries. Users can see when the system is sealed, why access is required, and what will be signed.
No remote font, image, analytics, or interface dependency is required at the signing edge.
A mismatch blocks the action and names both the expected and selected network.
Rejected actions preserve the reason and provide a clear recovery path.
05 · One visual language
The public website and compact application use the same semantic tokens, controls, states, focus rules, and security language. Only density and composition change.
Generous space, narrative hierarchy, evidence-led sections, and clear calls to action.
Dense but calm rows, visible state, stable numbers, and deliberate signing boundaries.
Stay informed
Get occasional development notes about wallet milestones, network support, security work, and releases.
The path is clear
Use a wallet that makes the consequential parts visible.