Problem
loadOracleKeypair() (src/shared/stellar.ts) reads ORACLE_SECRET_KEY directly from process env. Code comments and the README both flag this as dev/testnet-only, but there's no interface boundary prepared for swapping in a KMS/HSM-backed signer — submitContractCall() (src/safetynet/oracle.ts) works directly with a Keypair. Without a tracked follow-up, this risks shipping to mainnet unchanged under time pressure.
Location
src/shared/stellar.ts#loadOracleKeypairsrc/safetynet/oracle.ts#submitContractCall
Suggested fix
Extract a Signer interface (sign(tx): Promise<Tx> / publicKey(): string) that submitContractCall depends on instead of a raw Keypair, with the current env-based loader as one implementation and room for a KMS-backed one. Track mainnet cutover as a hard release gate, not an incidental refactor.
Problem
loadOracleKeypair()(src/shared/stellar.ts) readsORACLE_SECRET_KEYdirectly from process env. Code comments and the README both flag this as dev/testnet-only, but there's no interface boundary prepared for swapping in a KMS/HSM-backed signer —submitContractCall()(src/safetynet/oracle.ts) works directly with aKeypair. Without a tracked follow-up, this risks shipping to mainnet unchanged under time pressure.Location
src/shared/stellar.ts#loadOracleKeypairsrc/safetynet/oracle.ts#submitContractCallSuggested fix
Extract a
Signerinterface (sign(tx): Promise<Tx>/publicKey(): string) thatsubmitContractCalldepends on instead of a rawKeypair, with the current env-based loader as one implementation and room for a KMS-backed one. Track mainnet cutover as a hard release gate, not an incidental refactor.