SystemNetworkExplorer DevelopersResearchSecuritySpecification
SECURITY

Security is a system property.

Audit status
Not published

Trust boundary

Kervon resolves, compiles, and simulates execution plans. It produces an unsigned execution plan. Everything beyond the authorization boundary — signing, submission, settlement — happens outside Kervon's execution layer.

Signing model

Private keys and signing operations remain in the principal's wallet or signer environment. Kervon never requests, stores, or transmits private key material.

Authorization assumptions

Payment authority belongs to the principal. Kervon's policy layer determines whether an action is autonomous-approvable or requires principal approval, but does not itself hold spending authority.

External dependencies

Execution correctness depends on the availability and honesty of external facilitators, RPC providers, and resource servers. Kervon's constraint engine and simulator reduce, but do not eliminate, exposure to these dependencies.

Settlement assumptions

Settlement finality follows the guarantees of the underlying network and asset. Kervon's settlement observer tracks reported state but does not alter finality guarantees.

Failure domains

Failures are classified by domain (core, x402, rail-specific) with explicit terminality and retryability. See Section 12 of the specification.

Contract surface

Where rail execution involves onchain contracts, the contract surface is defined by the rail adapter, not by Kervon's core compiler. Adapter-level contract review is out of scope for this document.

Upgrade model

The specification is versioned as a draft (KES-001, 0.1.0). Adapter packages carry independent preview/experimental version tags.

Known limitations

This site presents a protocol concept and demonstration interface. No production deployment, audit, or live transaction execution exists at this time.