feat: machine-checkable custody policy enforcement

[cryptofixyup]

Summary

• adds fail-closed custody-policy.yaml and JSON Schema
• adds deterministic custody and transaction risk scoring
• adds read-only Safe on-chain collector for owners, threshold, modules, guard, module guard, fallback handler and code hashes
• adds chain/address/code-hash extension allowlists
• adds recovery/threshold/signing-domain invariant tests
• adds custody policy validation and test gates to CI

Security properties

• no signing/private-key material is accepted by the collector
• unknown Safe execution extensions block material custody
• threshold must be >= 2 and below signer count
• signer independence is fail-closed when operational metadata is unavailable
• code-hash changes invalidate extension allowlists

Validation

GitHub Actions will run the full test suite plus the dedicated custody-policy gate.

[ecc-tools]

ECC bundle files are already tracked in this repository. Skipping generation of another bundle PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api	Ready	Preview	Sep 5, 2026 10:20pm UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ecc-tools]

ECC bundle files are already tracked in this repository. Skipping generation of another bundle PR.

[ecc-tools]

ECC bundle files are already tracked in this repository. Skipping generation of another bundle PR.