From 41bfad594bdbfd7879c627408913c1bbee366e63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Vargas?=
 <111903096+adrianvrj@users.noreply.github.com>
Date: Thu, 12 Nov 2026 09:42:23 -0600
Subject: [PATCH 1/2] Add Cavos under Smart Account & Authentication

---
 skills/standards/ecosystem.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/skills/standards/ecosystem.md b/skills/standards/ecosystem.md
index 56be3f9..00605eb 100644
--- a/skills/standards/ecosystem.md
+++ b/skills/standards/ecosystem.md
@@ -219,6 +219,20 @@ TypeScript SDK for passkey-based smart wallets. Sibling to Smart Account Kit, wi
 - **Demo**: [passkey-kit-demo.pages.dev](https://passkey-kit-demo.pages.dev)
 - **Example**: [Super Peach](https://github.com/kalepail/superpeach)
 
+#### Cavos
+Embedded wallet SDK that gives each user a classic `G…` account behind Google, Apple, GitHub, Telegram, or email sign-in, with reserves and fees sponsored.
+- **Website**: https://cavos.xyz
+- **Docs**: https://docs.cavos.xyz/docs/stellar ([llms.txt](https://docs.cavos.xyz/llms.txt))
+- **GitHub**: https://github.com/cavos-labs/kit
+- **Authorization model**: One Ed25519 spend key, derived by HKDF from a per-user MasterDEK and held on the device: a non-extractable WebCrypto key in the browser (inside the Cavos vault iframe by default), the OS keystore on React Native, caller-supplied on Node
+- **Use Case**: In-app wallets for users who have no Stellar wallet
+- **Features**:
+  - Classic `G…` account that also signs its own Soroban `require_auth` entries
+  - Sponsored account creation (`create()`), trustlines, and fee-bumps; the relayer cannot authorize the account's operations
+  - Optional restore by signing in again: an AWS Nitro enclave holds a sealed copy of the MasterDEK and re-encrypts it to a new device; the enclave does not sign and is part of the trust model
+  - Optional passkey that stores an encrypted copy of the MasterDEK
+  - Live on mainnet: [example account](https://stellar.expert/explorer/public/account/GCTAQXKRGWROJ5UZBLUQ472PNNFOPQQOJBPCVSVCM5SKPKDOAVP5LG4Q)
+
 #### OpenZeppelin Relayer
 Service for fee-sponsored transaction submission.
 - **Docs**: https://docs.openzeppelin.com/relayer

From 1b3a7de02cc4ec487500111620853c2ae4d498f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Vargas?=
 <111903096+adrianvrj@users.noreply.github.com>
Date: Thu, 12 Nov 2026 10:08:05 -0600
Subject: [PATCH 2/2] Scope the Cavos key-storage line to the browser

---
 site/src/data/skills.ts       | 2 +-
 skills/standards/ecosystem.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/site/src/data/skills.ts b/site/src/data/skills.ts
index 323c6d9..21f7f47 100644
--- a/site/src/data/skills.ts
+++ b/site/src/data/skills.ts
@@ -541,7 +541,7 @@ const ECOSYSTEM_CARD_SOURCES: readonly EcosystemCardSource[] = [
   {
     title: "Cavos",
     description:
-      "Add embedded Stellar wallets to a web or React Native app with @cavos/kit. Users sign in with Google, Apple, GitHub, Telegram, or an email code and get a classic G account with no seed phrase. Covers the React provider, sponsored reserves and fees, XLM payments, trustlines, Soroban calls, signing backend-built XDR, and device restore.",
+      "Add embedded Stellar wallets to a web app with @cavos/kit. Users sign in with Google, Apple, GitHub, Telegram, or an email code and get a classic G account with no seed phrase. Covers the React provider, sponsored reserves and fees, XLM payments, trustlines, Soroban calls, signing backend-built XDR, and device restore.",
     pathLabel: "cavos-labs/kit",
     copyValue:
       "https://raw.githubusercontent.com/cavos-labs/kit/main/skills/cavos-stellar/SKILL.md",
diff --git a/skills/standards/ecosystem.md b/skills/standards/ecosystem.md
index 00605eb..933fe9b 100644
--- a/skills/standards/ecosystem.md
+++ b/skills/standards/ecosystem.md
@@ -224,7 +224,7 @@ Embedded wallet SDK that gives each user a classic `G…` account behind Google,
 - **Website**: https://cavos.xyz
 - **Docs**: https://docs.cavos.xyz/docs/stellar ([llms.txt](https://docs.cavos.xyz/llms.txt))
 - **GitHub**: https://github.com/cavos-labs/kit
-- **Authorization model**: One Ed25519 spend key, derived by HKDF from a per-user MasterDEK and held on the device: a non-extractable WebCrypto key in the browser (inside the Cavos vault iframe by default), the OS keystore on React Native, caller-supplied on Node
+- **Authorization model**: One Ed25519 spend key, derived by HKDF from a per-user MasterDEK and held in the browser as a non-extractable WebCrypto key (inside the Cavos vault iframe by default in the React provider with an `appId`). Stellar on React Native and Node is not on this path yet
 - **Use Case**: In-app wallets for users who have no Stellar wallet
 - **Features**:
   - Classic `G…` account that also signs its own Soroban `require_auth` entries