Setup first: BOOTSTRAP.md. Agent workflows: AGENT_GUIDANCE.md. Token traps: TOKEN_IDENTITY.md.

This page is the short essentials front door only. Residual detail (launcher tables, multiproc matrices, encryption internals, crash windows, reviewSummary fields) lives in SECURITY_DEEP.md — optional, not required for first-run.

Runtime and agent first-install both default to research-only (AGENT_WALLET_ENABLED unset or false). Signing is opt-in: AGENT_WALLET_ENABLED=true plus a master key (prefer BOOTSTRAP.md wallets-on path).

When wallets are enabled in the process, a master key is required to start. Prefer write-only generation — never print or paste the key into chat or host config.

Write-only key path (never print the key; never commit):

node scripts/generate-wallet-env.mjs
# or: node scripts/install-for-host.mjs --host <host> --mode wallets

Do not use console.log / print-then-paste key generation with agents. Lose the master key → encrypted wallets are unrecoverable.

• Funding the agent is authorization. If you fund an agent wallet, the agent can spend it. You accept that risk.
• Private keys stay AES-256-GCM encrypted at rest; tools never return them.
• No spend caps, allowlists, confirm gates, or token-notional send blocks. Real controls: how much you fund, master key, unique dir, kill_switch.
• Prefer: create wallet → verify address → fund (value + PulseChain gas) → inspect → propose → review → execute.

If something looks wrong: call kill_switch / revoke. Signing stops until you recover with set_agent_policy (killed=false and enabled=true together).

One MCP process → one unique AGENT_WALLET_DIR. Do not share the dir across hosts. Wallets-on default is AGENT_WALLET_MULTIPROC_STRICT=true (unset/empty). Explicit false or 0 is warn-only opt-out. Strict is not a distributed lock; shared dir is still not multi-writer-safe.

No private keys, master keys, mnemonics, or ciphertext in tool args, logs, or operator paste. Do not read_file .env.wallet to “verify.”

Dedicated launcher: scripts/start-wallet-mcp.mjs + gitignored .env.wallet (see SECURITY_DEEP.md). Host config must not embed AGENT_WALLET_MASTER_KEY. Stdio clients: absolute path to launcher or dist/index.js; do not set HTTP_TRANSPORT_PORT.

Windows: POSIX modes are best-effort; use NTFS ACLs or keep secrets off shared folders.

PulseChain gas often costs tens–hundreds of PLS even for small value transfers. Fund value + gas headroom, not Ethereum-dust amounts.

1. Bootstrap smoke passes (BOOTSTRAP.md) — research-only first unless signing was requested.
2. Master key only in .env.wallet or research-only disable.
3. Unique wallet dir; multiproc strict recommended for dedicated wallet process.
4. Fund only what you accept the agent may spend (never during bootstrap).
5. On incident: kill_switch.

Heuristic analytics tools are directional, not formal audits.

Optional deep residual: SECURITY_DEEP.md (not required for first-run).