> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/arcus/arcus-testnet-signer.md). # Testnet signer supervisor Use this runbook only after the operator has created and registered a dedicated Arcus testnet Ed25519 API wallet. It prepares and proves the isolated local process. It does not authorize an order, disable the web kill switch or attest a completed testnet rehearsal. ## Safety boundary * The ordinary `pnpm local:start` web supervisor always forces both venue execution modes disabled. * The signer supervisor accepts only `ARCUS_EXECUTION_MODE=testnet`, binds `127.0.0.1`, forces Hyperliquid disabled and refuses every mainnet flag. * The PEM must be an absolute regular non-symlink file outside the repository. Never paste its content into a shell command, prompt, browser, config file or log. * The internal token is shared only by the local web and signer processes. The operator secret and Arcus confirmation secret must be different values. * The detached signer receives an explicit environment allowlist; web operator/confirmation secrets, provider URLs/keys and `NODE_OPTIONS` are not inherited from the launching shell. * Optional Arcus alert URL/secret values are the only non-venue egress configuration forwarded to the signer child; they are validated together and never persisted in supervisor state/logs. * Doctor and runtime health do not call Arcus and do not prove that the API key is registered, eligible or funded. ## Prepare an operator shell Set these values in the private shell that will launch the signer. Use the registered testnet master address and the key's actual secure path. Generate each secret independently with the operating system cryptographic RNG. ```powershell $env:EXECUTION_MODE = "disabled" $env:ALLOW_MAINNET = "false" $env:ARCUS_EXECUTION_MODE = "testnet" $env:ARCUS_ALLOW_MAINNET = "false" $env:ARCUS_ACCOUNT_ADDRESS = "0x...lowercase-master-address..." $env:ARCUS_ACCOUNT_INDEX = "0" $env:ARCUS_API_PRIVATE_KEY_PATH = "C:\secure-location\arcus-testnet-ed25519.pem" $env:INTERNAL_EXECUTION_TOKEN = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(48)) ``` Do not persist these commands with real values in PowerShell history or a repository file. The optional `NIGHTSHIFT_SIGNER_*` variables in `.env.example` tune only bounded runtime timing and the loopback port. ## Offline proof ```powershell pnpm signer:doctor ``` Expected evidence is `status=ready`, `venue=arcus`, `mode=testnet`, `networkRequests=0`, an account fingerprint, an API-key fingerprint, the account index and `keyType=Ed25519`. The report deliberately omits the address, PEM path, public API key and internal token. Stop if the doctor fails. ## Supervise and rehearse process recovery ```powershell pnpm signer:start pnpm signer:health pnpm signer:status pnpm signer:restart pnpm signer:health pnpm signer:stop ``` Health must stay `testnet`, `signingEnabled=true`, `ackIsFinalState=false`, `automaticCancelPolicy=required`, `reconciliationSafe=true` with zero active incidents, and match the configured account fingerprint/index. It must also report `databaseSchemaVersion=8`, `databaseSchemaCurrent=true`, `databaseIntegrity=ok`, and `databaseJournalMode=wal`; the supervisor rejects and restarts an unsafe store. Before an execution rehearsal it must additionally report `alertDeliveryEnabled=true`, `alertDeliverySafe=true`, and `executionAlertOutboxOverflowed=false`. `signer:restart` must return a new child to healthy state without losing pending delivery or execution rows. `signer:stop` must leave the persisted state `stopped` and the health endpoint unreachable. Inspect `%USERPROFILE%\.nightshift\signer-runtime.json` and `signer.log`; neither may contain the address, PEM path, internal token, alert URL, or alert secret. Use [`arcus-execution-store-recovery.md`](/nytshift-docs/arcus/arcus-execution-store-recovery.md) for cold backup and fail-closed recovery. The supervisor holds `signer-store-operation.json` for its whole lifetime, including child recovery. A cold `signer:backup:create` or `signer:backup:restore` therefore cannot race signer startup and will refuse until `signer:stop` releases the lock. Never delete a live-owner lock manually. The repository integration gate performs this lifecycle with an ephemeral generated key and no venue request: ```powershell pnpm test:signer ``` ## Verify a testnet funding plan Before any user-owned wallet action, verify that the current Arcus guide still matches the reviewed chain, RPC, test USDG, deposit proxy and decimals: ```powershell pnpm audit:arcus-funding ``` In the Arcus terminal rail, open **Plan Robinhood Chain testnet funding**, enter the public source-wallet address, account index and exact test USDG amount, then build the live plan. Confirm that documentation parameters match, chain `46630` is live, both contracts have deployed code, USDG metadata matches, and each required call shows its exact consequence and simulation/prerequisite state. This workflow cannot request a wallet signature or send a transaction. The user must independently execute any chosen testnet calls in their own wallet. Do not treat a wallet transaction as credited collateral: keep execution locked until `GET /v1/account` and `GET /v1/accountTransferUpdates` show the expected `APPLIED DEPOSIT`. Test USDG is valueless, and the published testnet addresses may drift. Production deposit onboarding uses a separate Fun flow and is not constructed by this direct testnet planner. ## Connect the locked web control plane Before launching `pnpm local:start`, the web shell needs the same `INTERNAL_EXECUTION_TOKEN`, `ARCUS_EXECUTION_SERVICE_URL=http://127.0.0.1:4200`, a distinct `NIGHTSHIFT_OPERATOR_SECRET`, a distinct `ARCUS_EXECUTION_CONFIRMATION_SECRET`, and the exact eligibility account and per-market size attestations. The signer shell additionally needs the reviewed alert URL and its distinct secret as described in [`arcus-execution-alert-delivery.md`](/nytshift-docs/arcus/arcus-execution-alert-delivery.md). Keep `ARCUS_EXECUTION_KILL_SWITCH=true`. With that state the authenticated terminal may inspect redacted gates, but it cannot issue a confirmation token or submit. Do not change the kill switch to false or confirm an Arcus testnet order until the user has explicitly authorized the separately reviewed testnet rehearsal and the account is eligible and intentionally funded. There are no rehearsal environment flags: the signer derives account-bound order-lifecycle and emergency-stop proof from its durable audit, and both proofs expire after 30 days. Preserve and verify the same signer store when preparing a later mainnet process; a different account, an acknowledgement without terminal `FILLED`/`CANCELED` evidence, an emergency acknowledgement without a later zero-open-order read, or stale evidence remains unproven. Mainnet remains outside this supervisor and requires a separate canary authorization. ## Incident rule If a place or cancel attempt ever reaches an ambiguous result, preserve its `clientId`, keep the kill switch active, and reconcile public `orders`/`userFills` plus the signer reconciliation endpoint. An unknown signer reconciliation uses the original reviewed scope for at most one automatic cancel, then latches entry until a terminal venue state. Never retry merely because the local signer stopped or restarted. Follow [`arcus-reconciliation-incident.md`](/nytshift-docs/arcus/arcus-reconciliation-incident.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://nytshift.gitbook.io/nytshift-docs/arcus/arcus-testnet-signer.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.