Cross-platform, cross-chain cryptographic wallet for AI Agent workloads. Fully implemented in Rust. Designed in accordance with the WalletConnect v2 protocol and the Open Wallet Standard.
- Quick Start — install, create a wallet, sign your first transaction
- CLI Reference — full command reference
- Architecture — system design, crate structure, hard gates
- Storage Format — vault structure, wallet/API key file formats, encryption
- Signing Interface — sign, signMessage, signTypedData, error codes
- Policy Engine — declarative rules, executable policies, API key cryptography
- Wallet Lifecycle — create, import, export, backup, recovery, deletion
- Supported Chains — CAIP identifiers, derivation paths, chain families
- Security Model — key isolation, memory hardening, threat model, conformance requirements
OneCipher is a local-first wallet specification for encrypted wallet storage, signing operations, policy enforcement, and multi-chain account derivation.
The key words MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY in the specification documents are to be interpreted as described in RFC 2119.
| Document | Scope |
|---|---|
| Storage Format | Vault directory, wallet/API key file formats, encryption |
| Signing Interface | Core signing operations, error handling |
| Policy Engine | Access model, policy rules, evaluation semantics |
| Wallet Lifecycle | Creation, import, export, backup, recovery |
| Supported Chains | Chain families, identifiers, derivation paths |
| Document | Scope |
|---|---|
| Security Model | Key isolation, memory hardening, conformance |
| Document | Scope |
|---|---|
| Architecture | Rust crate structure, design decisions |
| CLI Reference | Command-line interface |
| Quick Start | Getting started guide |
- Wallet file schema:
oc_version = 2 - Policy schema:
version = 1
- New chain families MAY be added with a stable CAIP-2 namespace, deterministic derivation path, and address encoding rule.
- Policy engines MAY add namespaced declarative rule types but MUST reject unknown unnamespaced rule types.
- Files MAY include additional metadata fields; unknown fields MUST be preserved during non-destructive updates.