Wallet boundary
TWIX SDK never asks for seed phrases or wallet private keys. The final validator transaction is reviewed and signed in Keplr.
Automation gets authority only where it needs it.
Validator Builder intentionally separates the public application from the privileged control service and from each operator's validator machine.
SSH boundary
The root password is accepted only for a live project-bound connection request. It is not written to the SDK database or telemetry.
Consensus boundary
The consensus private key is generated and retained on the validator VPS. Only the public consensus key is returned for transaction construction.
CONTROL SERVICE
No arbitrary remote-shell API.
The web application requests specific actions such as connect, qualify, build and cancel. The broker enforces public-IP targeting, port 22, project binding, short session lifetimes and an action allowlist.
Public IPv4 onlyPrivate/reserved targets rejectedFixed SSH portProject-bound sessionHost fingerprint recordedShort idle timeoutNo credential persistenceNo browser-to-SSH socket