This page zooms into one box on the Sovereign Stack map:
Layer = Individual, Module = Money & Finance.
It describes how a single person can structure their Bitcoin life
so that they actually own it under stress, not just in slogans.
The goal is not “learn Bitcoin from scratch” or “optimize yield”.
The goal is to have a clear, teachable, survivable money topology:
where your sats live, what they’re for, how they move, and what
happens when things break.
Orientation
Read this as a design template, not as financial advice.
It assumes you’ve already decided to hold value in Bitcoin and want a
sovereign, privacy-aware way to do it. You don’t have to implement
everything at once; the Pedagogical Tiers section shows how to
start simple and grow into the full topology.
Monetary base: Bitcoin-only (no altcoins, stablecoins, synthetic BTC as reserves).
These are the non-negotiable rules of this template. If you break them,
you are no longer running this stack; you are running a different one. You can
still choose to break them, but you should do it consciously.
Bitcoin-only base.
No altcoins/stables/yield/wrapped/synthetic BTC as reserves.
Sovereign balance = on-chain UTXOs under your keys + explicitly bounded Lightning exposure.
Self-custody default.
Custodial services are tactical, capped, and never used as “savings”.
Full validation.
At least one full node under your control; wallet backends and explorers
ultimately point to that, not to random servers.
UTXO-level accountability.
Coins are discrete histories, not just a number. Every UTXO belongs
to a clear pool and identity mask.
Complexity bound.
The topology must be operable by tired future-you and by heirs.
Core reserves fit on a one-page diagram with a runbook.
No blind governance trust.
Protocol changes and wallet updates are deliberate choices; you reject “blacklist”,
confiscation, or discretionary admin powers at the individual layer.
Forced-seller risk tracked.
Fiat obligations (taxes, rent, debt, legal risk) are modeled as external claims
that can force you to sell BTC at bad times. You watch them explicitly.
Mental model
The invariants are the constitution of this stack.
Everything else—masks, tiers, tools—is implementation detail.
The same human can appear to the world in different ways.
Here we formalize those faces as masks: distinct
identity surfaces with different privacy, narrative, and risk.
Every UTXO belongs to exactly one mask.
Why masks?
Without masks, all your activity collapses into one graph:
public, ghost, and deep reserves get tangled.
Masks keep those worlds separate so a leak in one doesn’t
automatically expose the others.
Mask APublic Sovereign
The “public you” that can survive headlines, audits, and normie conversation.
Sources: KYC (if used), public earnings, visible donations/tips.
Masks are about who a transaction belongs to.
Tiers are about where the sats physically live and how exposed they are.
Every combination is “Mask X in Tier Y”.
How to read this
Tier 0/1 are reserves, Tier 2 is daily life, Tier 3/4 are high-velocity rails.
You can start with fewer tiers (see Pedagogical Tiers) and grow into this.
Tier 0Deep Cold Vault(Mask C)
The “if everything else is compromised, this still survives” layer.
In Bitcoin, your “balance” is actually a pile of discrete chunks called
UTXOs (unspent transaction outputs). Each one has its own history.
Hygiene here means: you know which chunk is which, and you don’t casually
glue unrelated histories together.
Pools (by mask + source)
A-KYC: Mask A, KYC-origin.
A-nonKYC: Mask A, public but non-KYC origin.
B-P2P: Mask B, P2P/Bisq/RoboSats acquisition.
B-earned: Mask B, sovereign work payments.
C-sacred: Mask C, deep reserves.
Rules of hygiene
No cross-pool merges unless explicitly ritualized (e.g., promoting B → C).
Use wallets with full coin control and labels; treat labels as part of your accounting.
Quarantine dust; never co-spend unknown dust UTXOs with valuable ones.
Simple rule
If you don’t know exactly why two UTXOs belong together,
do not spend them together.
The aim here is plausible deniability and surface reduction,
not Hollywood invisibility. You keep the obvious leaks closed and only
reach for heavier tools where they actually buy you something.
Always-on baseline
No address reuse.
No unnecessary multi-input merges.
Per-transaction coin control; never combine Masks A/B/C in one spend.
Embedded upgrades
Payjoin (BIP78) when possible: the receiver collaborates on the transaction, breaking simple heuristics.
Silent Payments (BIP352) where supported: static-looking receive identifiers that don’t reuse addresses on-chain.
Collaborative / market privacy
Optional CoinJoin, preferably via decentralized/no-central-coordinator designs.
Central coordinators treated as ephemeral and pressure-prone, not as ultimate trust anchors.
If used: primarily on Mask B flows; don’t mix every mask into the same CoinJoin soup.
Strategy
First, stop obvious leaks (address reuse, dumb merges).
Then, add collaborative tools where they actually help your graph,
not as a ritual checkbox.
This is the “who tells you what Bitcoin is” layer.
If you don’t validate yourself, someone else decides the rules for you.
Run at least one full node under your control.
It validates rules and serves as the backend for your wallets.
Network posture: prefer Tor/I2P for node and wallet connections;
minimize direct exposure of your home IP.
Eclipse-awareness: don’t rely on a single fixed peer set;
occasionally restart/reshuffle peers.
Simple baseline
One node at home or on a small server, wallets pointed at it via Tor,
and you already beat “trust a random API” by orders of magnitude.
Here you decide what the chain will enforce for you:
who can unlock funds, when, and under what conditions.
Complexity buys you nothing if future-you or heirs can’t operate it.
Scripts
Use multisig + timelock scripts for inheritance/governance (“me now OR heirs after T”).
Prefer well-supported, well-understood constructions over exotic combinatorics.
Seed & passphrase policy
Core long-term funds: at most one real passphrase and, if you use it, one duress passphrase.
Real passphrase documented for heirs in a way they can actually use.
Avoid labyrinths of hidden wallets that nobody can reconstruct under stress.
Duress / sacrificial layer
Maintain a believable sacrificial wallet (some hot + some warm + maybe minor Mask A).
Under forced-unlock: surrender sacrificial tier first; Mask B/C stay hidden by topology and non-association.
Principle
Anything you can’t explain simply to your future self or to your heirs
is not security, it’s a booby trap for you.
Even in a Bitcoin-only worldview, the world still throws fiat at you:
rent, tax, debt, jurisdictional fines, and random “one-time fees”.
These are claims on future BTC.
If you ignore them, they choose the liquidation timing for you.
Track fiat-denominated obligations and their timelines explicitly.
Model forced-seller conditions (tax, debt, rent, legal claims, etc.).
Objective: reduce and control those claims so you aren’t forced to sell BTC at the worst possible moments.
View
Fiat is treated as an external constraint, not as “savings”.
The question is: how much of it do you need to carry to keep BTC sovereignty intact?
The topology doesn’t change every day, but your operating mode does.
Modes are pre-decided patterns for how you behave under different levels of threat.
Prioritize mobility + ability to reconstitute later over squeezing every sat.
Offer sacrificial tiers to protect core reserves.
Mode 4 — Posthumous / Incapacitation
You can’t act, but your topology still has to resolve.
Timelocks/multisig enable heir access after T or other conditions.
Non-secret runbook explains what exists, which masks, and safe consolidation paths.
Why predefine modes?
When something breaks, you won’t invent a plan from scratch.
You will do whatever is easiest and most obvious. Modes make
the easiest option the least destructive one.
At the Individual layer, “Money & Finance” in the Sovereign Stack
is not just “have a wallet”. It is a full topology:
Bitcoin-only, self-custodied, fully validated by your own node.
Segmentation by mask (Public / Ghost / Sacred) and
tier (cold / warm / hot / LN / eCash).
Governed by UTXO hygiene, privacy methods, network posture,
scripts-as-law, and fiat/credit risk modeling.
Mode switching under surveillance, coercion, and collapse conditions.
Ritualized audits that keep the topology accurate and adaptable over time.
A teachable template for activating other nodes, not just surviving alone.
Relation to the civOS map
On the Sovereign Stack map, this page is:
Layer = Individual, Module = Money & Finance.
The same module will look different at Household, Business,
Community, and Citadel—but it will rhyme with this.
Everything above is conceptual topology.
This appendix maps those concepts to concrete open-source tools and hardware
as of a specific snapshot in time. You don’t need every item on this list;
treat it as a menu of known-good building blocks.
Snapshot
Versions and projects evolve. This appendix is a pinned baseline
for one moment in time, not a live update feed.