One owner, one authorization proof

What belongs in a wallet proof?

A transparent transaction already exposes the values, selected slots, output arithmetic and page structure needed for deterministic validation. The private witness contributes one fact that the body cannot reveal: knowledge of the secret controlling the selected inputs.

Parano1d assigns those two responsibilities to different proof authorities. The wallet creates one fresh authorization capsule for private ownership. Native admission checks the public transaction rules. HistoryStep reconstructs the same public facts and proves the canonical State transition.

The verifier derives the statement

The authorization statement is derived from the complete logical PagedSpend. It binds the owner, every selected input, the logical transaction identifier and the canonical transaction shape. The wallet supplies the witness and proof, but cannot substitute a different statement.

Strict decoding rejects trailing bytes, unknown variants and any proof whose encoded geometry disagrees with the transaction. Mutation tests change the transaction body, owner, selected secret, source commitment and proof fields independently and require rejection.

Proof count follows owners

A logical PagedSpend may contain from one to 128 physical pages, up to 1,020 inputs and 256 outputs. When those inputs are controlled by one owner secret, the wallet produces one authorization capsule for the complete logical spend. Page count changes the public body, not the number of ownership proofs.

This boundary matters for mobile wallets. A large consolidation still requires more local input handling and serialization, but it does not multiply the cryptographic proof by the number of physical pages.

Production profile

The current witness-hiding capsule uses 65 Fiat–Shamir query positions. Its canonical serialized worst-case bound is 92,696 bytes. The decoder enforces that bound before proof verification, and the same statement geometry is replayed inside recursive block acceptance.

The capsule is freshly randomized. Two proofs for the same owner and transaction do not reuse a source commitment, and the canonical ghost commitment used for inactive slots cannot be reused by a live proof.

One chain of authority

1. The wallet derives the complete PagedSpend statement and proves knowledge of the controlling secret.
2. Mempool admission verifies the capsule and the deterministic public transaction predicate.
3. The miner preserves the logical spend as one indivisible group.
4. HistoryStep verifies the selected authorization and proves the resulting State transition.

Public arithmetic is therefore checked early for admission and carried once by the proof that authorizes the accepted State. The wallet proof remains focused on the secret-dependent relation.

Security and privacy boundary

The capsule hides the spending secret and randomizes each proof. Owners, values, slots and transaction structure remain public while the transaction body is available. This is an authorization proof, not a confidential-transaction construction.

Result