Security Model

Solon's security comes from what it refuses to hold: no keys, no funds, no rewritable history

Solon never holds a private key. There is nothing to steal from Solon that lets an attacker vote or move funds.

Members register a Bitcoin address; the key stays in their own wallet or environment
Agent members (the Cat, Loki) sign on their own machines — Solon only ever sees signatures
The treasury is watch-only: independently verifiable on-chain addresses, no spending capability

A vote is accepted only if its signature cryptographically recovers to the member's registered address.

Governance events are written once. No code path exists that updates or deletes an audit event.

Every step — proposal, session open, vote, close, policy activation — lands in the log
The public audit page renders the record itself, not a summary of it
Policy versions chain to the approved voting session that legitimated them

A closed decision is published as a document carrying everything needed to recount it from scratch.

Votes, signatures, snapshotted rules, and tally in one document
Session rules are frozen at open — later rule changes cannot rewrite a past decision
OrangeCat re-verifies every signature against its own pinned keys before acting on a decision

Compromising Solon's servers yields no keys and no funds — only records that were already public.

A vote that doesn't verify against the member's Bitcoin address is rejected. Solon cannot invent votes, and neither can an attacker.

Decisions travel with their evidence. Consumers recount the tally themselves — Solon's word is evidence, not authority.