Apps

Public apps talk to the chain and a small read layer:

Role	Job
Indexer	Follow suite events (Ghosts, rewards, router, optional pool logs)
API	Serve UI reads, live updates, and private submit (/private/*)
Wallet (ghost-wallet)	Derive note keys, prove shield/send/reappear locally
Relayer	Background worker: claim relayer_jobs, sign gas txs; never holds note secrets

Note scan for V1 is client-side (pool events). Wallet proves; UI posts proofs to the API; the relayer only sees the job payload. Do not send note secrets to any server.