Auditors
Every pool names one auditor. Each note carries an envelope sealed to the auditor's X-Wing key, so the auditor reads every amount in its pool, and in a pool that requires attestation, no payee can accept a note until the auditor has opened it, checked it and attested it on chain.
What the auditor service does
The auditor runs its own service with its own database and keys, separate from the public API.
- Discover. It watches the pool for new notes.
- Open and check. For each note it reads the note, the pool and its own key record from the chain, checks the envelope pair against the hash the note carries, opens the auditor envelope and checks that the opening reproduces the commitment: .
- Attest. Notes that pass are attested in batches with one
attesttransaction each batch. The amount and memo go into the auditor's encrypted ledger. - Reconcile. It follows each attestation transaction until it is final.
A note whose auditor envelope doesn't open is never attested; in a pool that requires attestation, its payee can't accept it, and it goes back to its sender.
The console
Operators use the auditor console, on its own address, separate from the app. Sign in with an operator wallet: the console sends a one-use challenge, the wallet signs it, and the session is bound to the console's address and the pool the operator is scoped to.
Above the pages, the console counts the notes waiting, attested and not opening, and the time from a note landing to its attestation (p95).
| Page | What it shows |
|---|---|
| Queue | Notes waiting to be checked or attested, with their state |
| Attested notes | Every attested note with its amount and memo, the sender and payee, and when it was attested |
| Exports | CSV and JSON exports of the ledger for a date range or one account, each stating its coverage (how many notes it holds and how many it left out, and why) |
| Disclosures | A selective-disclosure report for one account, to hand to a party who is entitled to it |
| Key epochs | The auditor's X-Wing keys by epoch, which one is current, and how many open notes each still has |
The auditor service enables operator wallets per pool, each with a role; managers also create exports and disclosure reports. A disclosure report covers one wallet's notes in the pool, sent and received.
Key epochs
The auditor's X-Wing key has an epoch, recorded in the pool. Every note is sealed to the auditor epoch that is current when it is sent and keeps it, and the auditor service holds every epoch's key, so every note it was ever sent still opens.