> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/engineering-guide/08-identity-portfolio-and-funding.md). # Identity, portfolio and funding [← Execution](/nytshift-docs/engineering-guide/07-execution-and-reconciliation.md) · [Documentation home](/nytshift-docs/start-here/readme.md) · Next: [Contracts and APIs →](/nytshift-docs/engineering-guide/09-contracts-and-apis.md) NYTSHIFT separates user identity, wallet identity, venue account identity and capital authority. They may refer to the same human, but they are not interchangeable capabilities. ## Identity layers ```mermaid flowchart TB P[Privy customer identity] --> PR[Opaque profile/preferences] P --> W[Verified linked EVM wallet] W --> RHC[Robinhood Chain holdings/activity] W --> VA[Arcus/Hyperliquid/Lighter public account reads] O[Separate operator session] --> CP[Protected control plane] E[Signed entitlement] --> AG[Agent credential issuance] AG --> MCP[Scoped MCP/API calls] CP --> S[Execution review] ``` Customer login never grants operator, signer, execution, funding, transfer, withdrawal or Agent Pro authority. ## Customer session Privy access tokens are verified server-side and periodically revalidated. Durable profile binding uses separate ID-token evidence. The profile store retains opaque identity/preference records and must reject raw provider identity, email, wallet and credential material. Production readiness is stricter than SDK configuration. A private, maximum-30-day evidence document binds the exact app ID to production origins, cookies, identity-token behavior and observed Google/wallet/embedded/link/logout/expiry/chain-switch flows on desktop and mobile. ## Wallet boundary The browser can discover injected EIP-6963 providers, request an account with user consent and explicitly request chain 4663. It never requests a signature or transaction as part of discovery/inspection. Manual public-address inspection remains available without login. The server accepts portfolio/funding requests only for an exact provider-verified linked EVM wallet. Late/superseded reads are cancelled or rejected to prevent cross-selection data bleed. ## Capital domains | Domain | Evidence | Aggregation rule | | --------------- | ----------------------------------------------------------------------------- | -------------------------------------------------------------- | | Robinhood Chain | Canonical chain-4663 token holdings and bounded activity | Exact canonical identity; ERC-8056 display semantics preserved | | Arcus | Venue equity, collateral, margin, positions, order/fill and transfer evidence | Venue-local only | | Hyperliquid | Exact DEX clearinghouse, positions, fills, funding and margin mode | Exact master/subaccount and DEX scope | | Lighter | Public account collateral/balance/positions | Missing authenticated history stays locked | | PAPER | Exact simulated ledger and reviewed marks | Never presented as venue capital | NYTSHIFT does not sum these into a fictional cross-domain total. A chain holding, perp collateral balance and PAPER position may have different settlement, liquidity, freshness and authority. ## Portfolio reducer The portfolio service reduces idempotent order, fill, funding and position events into materialized account state. Reconciliation bootstraps and periodically converges from authoritative venue reads. A partial/malformed/stale generation preserves the last accepted capital but cannot advance its remote clock or authorize execution. Hyperliquid Standard, Unified and Portfolio Margin require strict `spotMeta` identity and reserve/oracle conversion. Debt reduces Portfolio Margin equity. The platform does not invent LTV borrowing capacity or unrelated balance value. ## Activity and performance Customer activity is newest-first and venue-separated. Provider IDs are removed from browser responses. Performance is explicitly bounded to returned windows: * no window is labelled lifetime; * missing P\&L, fee or funding fields remain unavailable; * incomplete values never create partial sums presented as complete; * venues are not combined; * Hyperliquid's bounded fill history is named as bounded coverage. ## Funding rails The public Funding Rails panel exposes reviewed bridge evidence rather than a transaction builder: * parent chain 1 and Robinhood Chain 4663; * one canonical route and provider-owned partner route families; * reviewed L1/L2 contract identities; * canonical deposit/withdrawal timing; * the required separate L1 withdrawal claim; * live-provider quote requirement for fees; * `quoteCapability: none` and `executionCapability: none`. An external bridge handoff leaves network, asset support, fee quote, allowance, calldata, signature and final confirmation with the provider/user. NYTSHIFT requires destination-chain receipt evidence and never treats a handoff acknowledgement as finality. ## Arcus customer withdrawals Withdrawal-to-self is independently disabled by default. Preparation binds: * exact provider-verified wallet; * chain 4663; * reviewed proxy/implementation and collateral identity; * compliance/account/funding evidence; * one private confirmation scope; * explicit mainnet authorization. The connected wallet signs the EIP-712 message. NYTSHIFT never holds its private key. The BFF attempts provider submission at most once. HTTP 202 remains pending; exact transfer-ID evidence supplies terminal finality. Missing Privy, production RHC data, secret/store health or approval leaves submission blocked. ## Read-path privacy Public RHC health/price/portfolio/activity contracts exclude endpoint URLs, credentials and server paths. Customer DTOs exclude provider-native private fields and raw identity tokens. Observability uses UUIDs, digests and fixed codes instead of addresses/order payloads. Deep references: [Robinhood Chain](/nytshift-docs/normative-design/robinhood-chain.md), [Arcus](/nytshift-docs/normative-design/arcus.md), [portfolio reconciliation](/nytshift-docs/policy-control-and-incident-response/portfolio-reconciliation.md), [Privy activation](/nytshift-docs/release-and-readiness/privy-production-activation.md), [customer withdrawals](/nytshift-docs/arcus/arcus-customer-withdrawals.md) and [funding handoff ticket](/nytshift-docs/implementation-ledger/ns-428-verified-customer-rhc-funding-handoff.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://nytshift.gitbook.io/nytshift-docs/engineering-guide/08-identity-portfolio-and-funding.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.