Signed inv/rcp codecs keyed by identity, payments table with unverified incoming receipts, optional JSON-RPC sidecar (loopback/.onion HTTP only), and TUI /pay /tip. OnionWire still holds no spend keys.
