Envelope
Confidential payroll on Arc: computed in a Chainlink enclave, approved via Privy
Demo
About
Envelope pays employees in USDC on Arc without ever putting the payroll table onchain. Employer HR data, including employees, salaries, hours, leave, performance multipliers, and compensation policy, is fetched over confidential HTTP inside a Chainlink CRE Confidential Workflow. Payroll is computed inside the enclave and committed to a Merkle tree. Only four values leave it: the period, Merkle root, batch total, and recipient count. The backend proposes the root and total to PayrollDisburser. Funds require two independent controls: EIP-712 approvals from registered approvers, followed by a Privy server wallet secured by a 2-of-2 authorization-key quorum. Below the approval threshold, no transaction is built. Each employee gets a private claim link with only their payroll line and Merkle proof. Their payment becomes public when claimed, but the rest of the payroll table never does. Envelope is deployed on Arc testnet with the full lifecycle tested. The mainnet address is fixed via CREATE2, and a single command runs 16 local verification checks with no accounts or funding.
How it's made
The enclave is a TypeScript CRE workflow registered with handlerInTee. Secrets come from the Vault DON at use, HR data is fetched through confidential HTTP, payroll is computed in integer micro-USDC math, and the result is returned to the backend through a third HTTP call. Capabilities are restricted to exactly those three calls, preventing a tampered workflow from adding another. The backend rebuilds the Merkle proofs from its own payroll table and accepts the result only when the enclave root matches. The employer already knows its payroll; the enclave protects that data from node operators and the chain. Since Arc does not yet have a CRE Forwarder, the enclave computes and the backend submits the transaction. The stack is a Next.js app with viem, an ops CLI, and a Solidity contract using OpenZeppelin MerkleProof and ECDSA, claim bitmaps, relayable claims, and CREATE2 deployment through the canonical deployer. Privy handles both signing paths: secp256k1 embedded wallets for approvers and P-256 authorization keys for the server wallet quorum. createViemAccount from @privy-io/node plugs the quorum wallet into the existing viem flow. The rough edges are documented too. The CRE simulator drops config during preHook, preventing restricted workflows from completing simulation, so we reproduced and reported it and maintain a control run without that restriction. The simulator also requires a real PTY and window size, so a small Python driver runs it unattended. The only mocked component is the employer HR system, since real salary data is obviously unavailable.