UTXOSUITE — home
UTXO RELAY / BITCOIN ROUTE INTELLIGENCE

Bitcoin route intelligence without hiding the PSBT.

Relay is positioned around route comparison, fee assistance and PSBT protection. The repository explicitly treats future PSBT signing and route execution as SafeSign integration work, so this page separates the current analysis surface from future execution.

CURRENT UI SURFACE / FUTURE EXECUTION INTEGRATION
UTXO RELAY / ROUTING AND PSBTNetwork switching hardware in close-up, ports lit one by one.
CURRENT SURFACE

What exists in the current product surface.

Current UI concepts include recommended, fastest and lowest-fee route views, a fee assistant and a PSBT protection panel. Those concepts do not imply that route execution is already production-complete.

01

Route comparison

Recommended, fastest and lowest-fee route concepts.

02

Fee assistant

Expose fee trade-offs instead of compressing them into one opaque choice.

03

PSBT protection

Provide a review surface for supported PSBT structure and signing context.

04

Execution boundary

Analysis is current; signing and route execution remain explicitly future integration work.

EXPECTATION, THEN SIGNATURE

An output you did not expect invalidates the operation.

A route quote becomes a set of outputs. Those outputs become a PSBT. Before anything is signed, the PSBT is compared to the expectation you approved — output by output, satoshi by satoshi.

PSBT · OUTPUTS

recipientbc1q7x…3k2v1,450,000 sat
changebc1qz9…m4ta612,480 sat
network fee · 8,420 satceiling · 12,000 sat

EXPECTATION MATCH

MATCH

The PSBT matches the reviewed expectation.

reviewed outputs
2
psbt outputs
2
recipient
bc1q7x…3k2v · 1,450,000 sat
change
bc1qz9…m4ta · 612,480 sat
fee policy
8,420 sat / 12,000 sat · RBF signalled · CPFP available
signer
reachable after explicit authorization

Illustrative of the expectation-binding contract. UTXO Relay never holds a private key: a PSBT is signed by your wallet or hardware signer.

THE PATH OF A SIGNATURE

Understand before you sign.

Every irreversible authorization travels the same path. UTXO Suite makes each step of that path readable — and stops at the one step it must never own: the signature itself.

  1. REQUEST

    A wallet, a dApp or an agent asks for a signature. Nothing is trusted yet.

    UTXO Suite

  2. NORMALIZE

    The request is decoded into one canonical shape: method, chain, origin, parameters.

    UTXO Suite

  3. INTENT

    What the request actually does, in plain terms: a transfer, an approval, a delegation, a permit.

    UTXO Suite

  4. CONTEXT · SIMULATION

    Counterparty, origin and expected outcome. Simulation is evidence, never an oracle.

    UTXO Suite

  5. RISK

    Weighted signals: unlimited authority, unknown code, fresh contracts, mismatched destinations.

    UTXO Suite

  6. POLICY

    Your rules, applied deterministically to that evidence — a policy, not a feeling.

    UTXO Suite

  7. DECISION

    ALLOW, WARN, REVIEW or BLOCK. A BLOCK is never softened by another layer.

    UTXO Suite

  8. AUTHORIZATION

    You authorize explicitly. Even an ALLOW is not a signature.

    You

  9. PAYLOAD INTEGRITY

    The bytes about to be signed are compared to the exact bytes you reviewed.

    UTXO Suite

  10. SIGNER

    The isolated signer runs inside the wallet. UTXO Suite never holds a key or a seed.

    Vigi Wallet

  11. BROADCAST

    Optional. A signed transaction is not automatically a broadcast one.

    Vigi Wallet

  12. VERIFICATION

    What actually happened on-chain is checked against what you were promised.

    UTXO Suite
ALLOWNothing contradicts the request. It still needs your explicit authorization.
WARNSomething deserves attention before you continue.
REVIEWThe request cannot be understood without you looking closer.
BLOCKThe request must not reach a signer under the current policy.

No decision is a signature. Authorization is always yours.

Unknown never becomes safe. Missing evidence stays missing.

Security boundary

UTXO Relay

Relay is non-custodial in its intended model and must not auto-broadcast by default. Route intelligence and PSBT explanation should remain distinct from authority to sign or execute.

Next integration boundary

SafeSign

Future signing and route execution should preview supported PSBTs through SafeSign before the wallet receives the signing request.

Open SafeSignAll products
UTXO RELAY / BITCOIN EXECUTION BOUNDARY

Route intelligence must stay separate from signing authority.

Relay may compare routes and construct a candidate PSBT, but SafeSign should review inputs, outputs, change, fee and route assumptions before an external signer receives anything.

01INTENT

Define asset, destination and route objective.

02ROUTE

Compare candidate routes and trust assumptions.

03PSBT BUILD

Construct inputs, outputs, change and fee.

04SAFESIGN

Review PSBT structure and assumptions.

05EXTERNAL SIGNER

Signer keeps private-key authority.

06BROADCAST

Broadcast stays explicit and separate.

COMPONENT BOUNDARIES

SYSTEM ARCHITECTURE

The current Relay surface is a routing/UI scaffold. Real route execution, PSBT construction and signer integration remain future implementation work and must stay labelled accordingly.

COMPONENT
READS
WRITES
FORBIDDEN
ROUTE ENGINE
intent · quotes · trust model
candidate route
sign
PSBT BUILDER
UTXO set · route
unsigned PSBT
private key
SAFESIGN
PSBT · route assumptions
decision · evidence
sign · broadcast
EXTERNAL SIGNER
reviewed PSBT
signature
silent mutation
REQUEST / RESULT CONTRACT

INPUT → REVIEW → RESULT

Relay may compare routes and construct a candidate PSBT, but SafeSign should review inputs, outputs, change, fee and route assumptions before an external signer receives anything.

REQUEST / INPUT
{
  "asset":"BTC",
  "destination":"bc1q...",
  "amountSat":8400000,
  "route":"candidate-A",
  "psbtHash":"sha256:..."
}
DECISION / RESULT
{
  "decision":"REVIEW",
  "inputs":2,
  "outputs":2,
  "change":"bc1q-self...",
  "feeRate":"18 sat/vB",
  "signingAuthority":"external"
}
SECURITY INVARIANTS

CURRENT STATE

The current Relay surface is a routing/UI scaffold. Real route execution, PSBT construction and signer integration remain future implementation work and must stay labelled accordingly.

01

NO KEY CUSTODY

Analysis must not require seed phrases or private-key custody.

02

NO SILENT SIGN

Review must never become an implicit signature, approval or broadcast.

03

PAYLOAD INTEGRITY

The payload finally authorized must match the payload that was reviewed; any mutation requires a new review.

04

VISIBLE FAILURE

Unsupported methods, missing context and failed analysis must remain visible instead of degrading to ALLOW.

CURRENT STATE

The current Relay surface is a routing/UI scaffold. Real route execution, PSBT construction and signer integration remain future implementation work and must stay labelled accordingly.