Skip to main content

​
fased wallet

Local and Hosting use the same public wallet commands. Hosting runs them as the app operator through a restricted signer socket; the Gateway cannot use that lifecycle authority.

​
Create

Choose agent, mining, or vault. The signer creates the key, locks the role, activates signer-owned baseline v1, verifies one primary RPC against its live genesis hash, and returns authoritative readiness. Retry the same wallet ID with --force only to resume the same role; it never replaces or changes an existing wallet silently. Creating an Agent wallet does not automatically make it the Default Agent wallet.

​
Import

Keep a Solana keypair in a new owner-only regular file:
The file contents go directly to the native signer, not through argv, environment variables, chat, logs, or the ordinary browser API. Hosting uses this same command from the app operator shell. The key file must be owned by that terminal user, mode 0600, regular, non-symlink, and single-link.

​
Recover

Export an encrypted recovery package:
Restore it to a new wallet ID with the same intended role:
Passwords are read by the signer from the native terminal. They never belong in a command argument, environment variable, browser request, or chat.
Raw export reduces custody protection and requires an explicit acknowledgement:
The signer writes a new 0600 file and audits the exact wallet/address operation without logging key material.

​
Set one RPC

The signer verifies the endpoint against the wallet’s pinned genesis before it commits the next network version. Normal setup uses one execution RPC; the official public witness is verification-only, never an execution fallback.

​
Default Agent and routing

Make an existing Agent wallet the optional final fallback:
Risky Agent actions resolve in this order:
  1. explicit @wallet:<walletId> or structured walletId;
  2. one exact wallet override in the calling skill’s approved grant;
  3. the calling Agent’s explicit assignment; and
  4. the optional Default Agent wallet.
There is no automatic fallback mutation during create/import. Mining never enters generic skill routing; Vault remains reviewed/manual.

​
Migrate a legacy deny-all wallet

New wallets receive role baseline v1 during create/import/recovery. An existing legacy deny-all wallet is never expanded silently. After reviewing its immutable role, activate once:
The command fails if the wallet is already active, has another role, or changed concurrently.

​
Retire and replace Mining

Stop Mining and replace the active wallet transactionally:
The old wallet must have no live work or recoverable balance. The signer writes an irreversible retirement tombstone before runtime assignments move, retains encrypted recovery material, and creates a distinct role-ready successor. A retry resumes from signed signer evidence; it does not reuse the retired ID. Permanent key erasure is a separate advanced destructive action.

​
Inspect

The status includes exact signer policy/network versions and hashes, role baseline version, public address, registry attachment, and readiness.