- `absorbs` lets one add-on derive under another's vault namespace. A
community install has the field stripped, but an update of one is placed
as shipped, so a second version could declare absorbs:["aegis"] and derive
the wallet's keys. It is now honoured only for ids that ship inside
Theseus, at the one place that matters: vault.derive.
- The legacy ids Aegis absorbs ("bchwallet", "siawallet") no longer have a
bundled folder, so nothing stopped a catalog extension from installing
under one and deriving `bchwallet/...`. They are reserved at install and
refused at derive.
- A page-to-add-on message is accepted only from the tab's top-level frame.
The origin shown to the user is the top-level URL, so a subframe that
reached the channel would have been credited with its parent's origin.
- The approval overlay ignores everything but Cancel for the first 800 ms.
A page can raise it without a gesture and knows where the primary button
lands, which made "double-click here" a way to approve a spend.
The browser — the consumer face of the stack. Native .bch support with the
resolver built in, so a user installs one app instead of modifying their
operating system. Named for the thread through the labyrinth: the chain is the
thread.
Scope
Electron shell (Chromium engine, no forking): tabs, address bar, history.
In-process .bch resolution — no system daemon, no NRPT, no OS
trust-store changes; reuses bns.js from the BNS repo as a library.
Record handling: h render, ip connect, p/s3 via in-app gateway,
u redirect.
TLS via cert-verify hook (Electron setCertificateVerifyProc) against the
BNS root / on-chain tls fingerprints — no OS store touched.
Provenance indicator: shows whether a page came from the chain / Sia / a
direct server, with NFT category and record type — the decentralized padlock.
Status: not started
Build it in its own session/repo. The ready-to-paste brief is
BROWSER-PROMPT.md (a reference copy in this folder; canonical source is
D:\Dev\NameCoin\BROWSER-PROMPT.md — if they diverge, NameCoin wins). It points
here and reuses the resolver core. theseus.bch is registered and should
eventually serve the browser's own homepage over the protocol it implements.
2dfa9e9c3e