# Nilla Wallet identity and origin contract

- Wallet/provider ID: `nilla-wallet`
- Default name: **Nilla Wallet**
- RDNS namespace: `app.nilla.wallet`
- Provider UUID: `6b9d2389-6321-4c1d-934e-961eb4148d38`
- Fork SDK pin: `sdk.js?v=nilla-180.1`
- `sdkVersion`: `nilla-180.1`; `upstreamSdkVersion`: `180`
- Compatibility APIs: `window.kcc20`, `window.kcc20wallet`; new alias `window.nilla`.
- VEYRA phase 6, methods, `ns: kcc20` wire compatibility and expectedPayer remain.

## Origin resolution

Load the SDK from the verified Nilla wallet origin, not an unrelated dApp host.
An explicitly configured `window.NILLA_WALLET_ORIGIN` may select the controlled
wallet origin. Otherwise the classic SDK derives it from `document.currentScript.src`.
Only the no-script-source case uses this document's HTTP(S) origin.
There is no hardcoded upstream wallet fallback. Legacy
`KCC20_WALLET_ORIGIN` and `KCC20_RDNS` globals are not identity configuration.
An RDNS identifier is a provider namespace, not proof of domain ownership.
No production hostname is guessed or configured and nothing is published.

Explicit `useWallet` / Dot.K HOST selection remains available for compatible
wallets, preserving named-wallet behavior. Origin changes clear cached accounts,
state, the activity bridge and popup handles. No previously selected origin is
implicitly trusted as a parent. Replies/ready messages require the selected
origin and the expected popup/parent/bridge window. Wallet request targets never
use `*`.

## Session isolation

DApp session/origin keys use Nilla namespaces suffixed by the SDK's base origin.
Records must match wallet ID, RDNS, fork version, base origin and selected origin.
Old KCC20/Scorpion SDK session keys are not read. Retired upstream wallet
origins are never restored implicitly, even if placed inside new records.
Wallet-side connect grants and treasury metadata use Nilla-specific keys;
old grants require new explicit user approval. Explicit third-party Dot.K
selection does not make that host the default Nilla wallet.

## Phase 1 preservation

Encrypted native-key storage names, cipher formats, PIN derivation and
origin-bound recovery database remain unchanged. They are compatibility storage
identifiers, not provider identity. Legacy Scorpion native-key data remains
inactive quarantine requiring explicit recovery; it is not a session fallback.
The disabled persistence bridge and browser/proxy quarantine remain disabled.
Scorpion agent/token names and upstream copyright/provenance may remain where
they identify existing features or legally required attribution.

## Licensing and release limits

The exact original MIT notice is included at `LICENSE` in the wallet output and
API output. `THIRD_PARTY_NOTICES.md` inventories external/vendored dependencies;
the API build also emits actual bundled-package versions and full available
license/notice texts. Unresolved binary/vendor provenance is explicitly marked,
not assumed MIT. This is not legal clearance or funded-wallet certification.