Removed SHKeeper

2026-10-22 10:45:32 -04:00
parent e835238d05
commit 5d607c1521
18 changed files with 41 additions and 662 deletions
@@ -15,7 +15,7 @@ Use Node.js 24 and a clean reviewed checkout. For mainnet assessment on a host,
 The preflight:

 - Selects the pinned profile and reports network, chain/genesis, fixed fee policy and local gate status.
- Does **not** open/create a ledger or wallet, start a RandomX engine/listener, contact peers or SHKeeper, or write approval settings.
+- Does **not** open/create a ledger or wallet, start a RandomX engine/listener, contact peers or external payment services, or write approval settings.
 - Does not print environment values or payment credentials. Reports are still operational information; review them before publishing.
 - Lists code blockers and missing external evidence. `productionReady` remains false even if startup approval variables are supplied. Fixes and independently reviewed evidence must be reflected in a future reviewed release; do not turn the report green by deleting findings.

@@ -27,7 +27,7 @@ The runtime image can execute the entry point with `--launch-preflight` as well;

 For the proposed **non-monetary testnet beta only**, use a separate scoped decision: the chain/network is explicitly testnet, no valuable cards are offered, real payment/custody settings remain off, mock market delivery is disabled or the deployment is demonstrably valueless, and experimental wallet/data-loss limitations are disclosed. This does not close any mainnet/live-payment hold point below. Apartment-hosting evidence must include ISP/CGNAT/reachability, TLS/proxy/backend isolation, firewall/admin/patch controls, off-host encrypted backup and restore, and external alert delivery. If these cannot be verified, do not expose the apartment host publicly; choose a managed host.

-[Stage-5 SHKeeper prototype](shkeeper-settlement.md) is fixture-only and disconnected from the public market. Production payment activation, real processor verification, custody/refund policy, journal/backup/monitor integration and operator reconciliation remain missing. It cannot justify closing the real-money hold point.
+The real-money custody path is not implemented end-to-end. Production deposit/credit/withdrawal services, custody and refund policy, journal/backup/monitor integration, operator reconciliation and independent review remain missing.

 [Stage-4 deployment and recovery tooling](operations-recovery.md) adds explicit proxy trust, private loopback diagnostics/checks and stopped-node pair backup/verification/non-overwriting restore. A local native proof-replay restore drill is automated, but actual-host TLS/proxy verification, off-host recovery, alert delivery and operational ownership still require external evidence.

@@ -41,7 +41,7 @@ For each item record **owner, artifact/release ID, date, evidence location, revi
 | Consensus launch design | Final genesis and manifest; measured starting target/hashpower; reviewed timestamp/retarget/partition/reorg attack analysis | Missing |
 | Node availability | Bounded public APIs/client; global resource/admission controls; realistic long-chain and hostile traffic capacity report | Missing |
 | Production wallet | At-rest/unlock/signing policy, same-origin compromise analysis, user confirmation and offline recovery drill | Missing |
-| Real-money market, if offered | Reviewed SHKeeper invoice/payment checks, invoice quote authorization, seller destination registration, fee-recipient allocation, custody policy, durable payout intents, timeout/partial-success reconciliation, refund/reorg dispute controls | Not implemented; real payment must stay blocked |
+| Real-money market, if offered | Direct wallet deposit observation and exact liability crediting, customer-authorized withdrawals, isolated treasury signing, durable reconciliation, custody policy, refund/reorg dispute controls | Not implemented; real payment must stay blocked |
 | Mock-market policy | Ensure public users cannot mistake buyer-triggered mock payment for money; disable sandbox selling/delivery for valuable mainnet cards unless explicitly confined to a valueless trial | Unresolved |
 | Peer/miner topology | Multiple independently administered hosts/operators/failure domains; actual online matching manifests and sufficient independent hashpower, not just two URL strings | Unverified |
 | Edge and host security | TLS/certificate renewal, firewall, loopback backend, reviewed proxy IP trust, connection/global limits, restricted administration, patched hosts, time synchronization | Unverified |