[danielgorgonha]

What & why

Three text corrections, no code change.

• ADR-0007, amendment "I4 as built", point 3 (ADR-0007 "I4 as built" says a vault is saved only when every seat finished; the device saves it earlier, as not finished #941). It said the vault is "registered, shown and saved only when every seat has". A device saves its record earlier, as not finished and with no address. The point now says what waits for every seat (the device's registration and the deposit address), names the path of a device that did not receive every signature (it finishes only on a vault pinned to its own key package), and notes that waiting for every seat is the app's rule, while the coordinator pins on t seats (ADR-0012 D5). A correction note records the change.
• Known limit, ui/changelog.d/known-limits/ (The number of actions in a payment is not capped on the device #940). The device limits padding, but that limit grows with the transaction the coordinator builds, so a hostile or compromised coordinator can make the vault pay a higher fee than a payment needs. This corrects two firmer sentences in the 0.10.0 Known limits and the 0.19.0 entry for the lower network fee. Released sections are not rewritten.
• SECURITY.md: security@deegalabs.com as a second private channel beside GitHub Security Advisories, with a note that no PGP key is published yet, so the advisory form stays the better channel for exploit details. The same two channels are in https://www.deegalabs.com/.well-known/security.txt.

Closes #941, Refs #940 (#940 stays open until the device-side bound ships).

Verify-before-finishing checklist

• cargo fmt --check + cargo clippy -- -D warnings: not applicable (no Rust change)
• cargo test: not applicable (no Rust change)
• ui/: changelog tests (changelog-fragments, changelog-gate, changelog-sections, changelog-shape) pass; no UI source changed
• No secret, key share, seed, or passphrase in code, logs, URLs, or query strings
• Every fund-moving path keeps preview + explicit confirmation (no path touched)
• FROST signer, PCZT, loopback bridge: not touched
• User-facing strings: none added
• Docs/comments in English; commit is type(scope): description
• AI disclosure: written with Claude Code (drafting the three texts and running the changelog checks), reviewed by text and repo-rules audits; the commit carries Co-Authored-By: Claude <noreply@anthropic.com>, no session link

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
konclave-demo	Ready	Preview	Nov 13, 2026 2:30am UTC