This section defines the non-negotiable laws of the business money stack.
If any of these are broken, the system may still run, but it is no longer
this reccomended stack.
BTC-only monetary base. Reserves are on-chain BTC under keys; rails (LN/etc.) are capped working capital.
Self-custody default. Custody is tactical, capped, and time-bounded.
Descriptor-native wallet policy + recovery. Descriptor wallets are default in Core 23.0+.
PSBT-native spend coordination. PSBT is the multi-party interchange format (BIP174).
Private descriptor material is seed-class. Anything that can emit private descriptors is treated as a crown-jewel leak surface.
Avoid-reuse is governed (where feasible). Dirty/clean tracking is an explicit wallet posture (Core has an avoid_reuse mechanism).
Processor/workflow systems are hostile-by-default. Compromise of workflow does not imply treasury compromise.
Accounting is an external-claim interface. Accounting determines what is owed/recognized; it must not become a custody driver. (Accounting standards references included in your spec.)
Business posture
The business layer assumes constant adversarial pressure from counterparties,
platforms, processors, staff churn, and deadline-driven mistakes. Treasury
survives compromise by design.
This defines the things the business stack acknowledges: where BTC can sit,
what is owed, and how revenue is encumbered. Everything else (apps, UIs,
spreadsheets) must map cleanly onto these objects.
2.1 Custody buckets (where BTC lives)
Buckets are treasury topology, not accounting categories. Each one has its own
risk, dwell time, and access profile.
B0 Sales Intake Float
short dwell · sweep bucket
B1 Refund Buffer
refunds/returns · prevents reserve-touch
B2 Accounts Payable
vendors
B3 Payroll / Contractors
deadline-sensitive
B4 External Claims Set-Aside
tax + known fiat claims timing buffer
B5 Capital Reserve (runway)
rare moves
B6 Deep Reserve / Strategic
ultra-rare moves
B7 Transmission / Deployment Fund
propagation spend · capped · proof-based
B8 Sacrificial / Duress Buffer
credible loss layer · bounded · formula replenishment
2.2 Liability ledgers (what is owed)
Liability ledgers describe promises the business has made that may
or may not touch custody today, but will constrain future moves.
L0 Refundable customer liabilities
L1 Unfulfilled deliverables
deposits/prepayments/subscriptions owed
L2 Third-party funds
marketplace custody adjacency; target = minimize to zero
2.3 Revenue pools (source encumbrance)
Same sats, different risk signatures. Revenue pools classify how
“contaminated” an incoming flow is by surveillance, custody, or clawback power.
It must pass an explicit encumbrance / quarantine pathway before any deep-reserve interaction.
Design aim
No bucket, liability, or revenue pool is an accident. Every BTC UTXO
must be placeable into exactly one custody bucket and (where relevant) one
revenue provenance class.
Registries are the address books the business relies on for getting
money in and out. If they are compromised, invoice substitution and payroll
hijack follow. This layer turns them into signed, fail-closed artifacts.
RRReceive Registry
All inbound destinations.
On-chain: descriptors/xpubs; LN: offer endpoints; any reusable receive identifiers.
BRBeneficiary Registry
All outbound destinations (vendors, contractors, payroll endpoints).
Signed Registry State (fail-closed root of truth)
Registry state is published as a signed artifact by a signer threshold.
Any registry change is invalid until a new signed state exists and is verified out-of-band by signers.
Registry truth is not “whatever the server UI shows.”
Purpose: defeat invoice destination substitution + beneficiary swaps under server compromise.
Root-of-truth rule
If an address or offer cannot be traced back to signed RR/BR state,
it is treated as hostile—even if it appears in the “official” dashboard.
Roles split who can see, build, and sign. This prevents one compromised
human or machine from moving serious BTC without others noticing.
R-OPSWorkflow/Server Operator
Runs BTCPay/workflow tooling.
Cannot move meaningful buckets.
R-CONConstructor
Builds manifests + unsigned PSBTs from approved proposals.
R-SIGSigners
Threshold policy holders.
Sign PSBTs and registry state artifacts.
R-AUDAuditors
Watch-only verification + reconciliation.
Ledger integrity + drift detection.
R-FEEFee Authority
Scoped right to rebuild replacement PSBTs within ceilings and deadline classes.
Constraint
No person may be R-CON + R-SIG for the same spend.
Human firewall
This separation-of-duties layout is the human analogue of multisig:
no single role can both create and approve value-moving transactions.
This section draws the front door for money entering the business:
invoices, rails, and the guarantees that invoice destinations haven’t been swapped.
5.1 Workflow layer (routing, not treasury)
BTCPay Server is the invoice/payout workflow surface.
Refunds are built on Pull Payments; payouts are tied into Pull Payments (refunds/salary/withdrawals).
Boundary rule: BTCPay may request payouts/refunds; treasury spending requires PSBT signing under bucket policy.
5.2 Rails — on-chain
Default for larger settlement.
5.2 Rails — Lightning
Throughput rail; capped working capital.
5.2 Rails — BOLT12 Offers
Upgrade slot for reusable LN payment requests.
Endpoints treated as public infrastructure.
5.3 Invoice destination integrity (inbound)
Every invoice destination must be derivable from the signed Receive Registry state.
Any deviation → invoice invalid (fail-closed).
Key idea
The workflow server can be fully compromised without granting attackers
the ability to redirect invoice funds, as long as RR and derivation rules are enforced.
Artifacts are the files and metadata around money:
descriptors, PSBTs, manifests, labels. This section defines what must
never leave the enclave, and what can.
10.1 Crown jewels
Private descriptors are seed-class: never exported, never shared.
Perimeter rule
Auditors, regulators, and partners can see the sanitized bundle,
never the crown jewels. Custody key material stays entirely inside the business.
Modes are global behavioral switches for the finance stack.
They are triggered by events and change what is allowed without needing
ad-hoc decisions.
Mode NNormal
Routine sweeps; standard approvals.
Mode AAttention
Triggered by missed sweep, registry change, anomaly.
Shrink caps; freeze high-risk changes.
Mode EEmergency
Compromise suspected.
Rotate descriptors/signers; invalidate old registries; operate minimal buckets only.
Mode CContinuity
Key-person loss.
Execute pre-written re-key + registry re-sign.
Descriptor-era benefit
Descriptor-default policy in Core 23.0+ makes migrations and runbooks
explicit objects with clean exports/imports instead of folklore.
Telos buckets are the intentional spend zones that encode mission:
propagation (B7) and duress / sacrifice (B8). They remain numeric and
mechanical here; story lives elsewhere.
B7 Transmission
Capped and proof-based.
Dual-proof + repeat-recipient escalators.
B8 Duress
Credible-but-bounded.
Formula replenishment.
Depletion triggers Mode A/E.
Signal ledger (numeric-only)
Dependency deltas
Optionality/runway deltas
Disclosure-surface deltas
No narrative fields.
Separation
Telos is acknowledged as a driver, but here it is constrained to
numbers and thresholds, not stories. That keeps the business stack auditable.
Merchant: BTCPay Server (+ Payjoin where compatible); Pull Payments/Payouts for refunds + payroll; BTCPay→Sparrow PSBT for separation-of-duties.
Lightning: CLN + LNbits (+ optional NIP-47/NWC where scoped remote perms are required).
Accounting: hledger.
Swap safety
Any candidate replacement tool must be evaluated on how well it preserves:
descriptors, PSBT workflows, labels, and the registry/manifest discipline—
not just UX.