Problem
Mainnet issuer and distribution operations need custody that does not depend on one hot secret and remains recoverable during signer loss or compromise.
Scope
- Define signer roles and thresholds for issuance, payouts, emergency actions, and recovery.
- Add an HSM/KMS/external-signer adapter; app processes never receive master secrets.
- Build network-, source-, sequence-, time-, memo-, and intent-bound envelopes.
- Enforce allowlists, limits, separation of duties, and environment binding.
- Implement overlap-safe rotation, recovery quorum, and rollback.
- Persist tamper-evident approval, submission, and final-ledger records.
- Document compromise, lost signer, stuck sequence, partial signature, and outage scenarios.
Acceptance criteria
- No single app credential executes high-risk operations.
- Raw secrets never enter env vars, logs, database, or repository.
- Cross-network and cross-intent replay fails.
- Rotation preserves threshold and continuity.
- Every envelope traces to policy, approvals, and ledger result.
Required tests
Threshold matrices, stale sequences, replay, rotation with pending approvals, signer outage, recovery, and secret scanning.
Non-goals
Do not mandate a specific custody vendor.
Problem
Mainnet issuer and distribution operations need custody that does not depend on one hot secret and remains recoverable during signer loss or compromise.
Scope
Acceptance criteria
Required tests
Threshold matrices, stale sequences, replay, rotation with pending approvals, signer outage, recovery, and secret scanning.
Non-goals
Do not mandate a specific custody vendor.