> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/hyperliquid/hyperliquid-mainnet-signer.md). # Mainnet signer supervisor Use this procedure only after the complete Hyperliquid testnet matrix and account-bound dead-man rehearsal have passed review. It prepares a supervised signer for the separately authorized mainnet canary. Starting the process does not register a wallet, approve a builder, fund an account, change leverage, arm a dead-man deadline or submit/cancel an order. ## Promotion invariants * Keep the web entry kill switch active throughout signer preparation. * Stop the testnet signer first. The shared signer-store lock prevents two execution processes. * Create and verify a cold backup of the schema-8 WAL signer store before changing network or key scope. * Preserve the same `NIGHTSHIFT_HOME` and account-bound store so the signer can verify retained testnet dead-man rehearsal evidence. * Use a dedicated mainnet API wallet registered by the owner. Never use the owner/master private key and never reuse a deregistered API-wallet address. * Keep Arcus disabled and absent from this process. * The supervised first canary has a compiled $12 maximum. A larger environment value is rejected before child launch. * The first canary is compiled to BTC only and 1x maximum leverage. Both signer policy values must be explicit and exact before child launch. * The process binds only IPv4 loopback, emits redacted state/logs and initializes the venue SDK only if a later authorized venue operation reaches the adapter. * A healthy signer is not order authority. The production database, identity, eligibility, builder, alerting, portfolio, dead-man, allowlist, leverage, confirmation and per-action authorization gates remain independent. ## Pre-promotion proof With the testnet signer stopped: ```powershell pnpm signer:backup:create pnpm signer:backup:verify pnpm hl-signer:status ``` Verify the final testnet evidence record proves the expected account fingerprint, a current `scheduledCancel` rehearsal, zero all-DEX open orders, flat intended position state, schema 8, SQLite integrity `ok` and WAL. ## Private environment Configure these only in the operator-owned service environment or current private PowerShell session: ```powershell $env:EXECUTION_MODE = "mainnet" $env:ALLOW_MAINNET = "true" $env:MAINNET_CANARY_MAX_NOTIONAL_USD = "12" $env:NIGHTSHIFT_HL_SYMBOL_ALLOWLIST = "BTC" $env:NIGHTSHIFT_HL_MAINNET_MAX_LEVERAGE = "1" $env:ARCUS_EXECUTION_MODE = "disabled" $env:ARCUS_ALLOW_MAINNET = "false" $env:HL_ACCOUNT_ADDRESS = "0x" $env:NIGHTSHIFT_HL_OWNER_ADDRESS = "0x" $env:HL_AGENT_PRIVATE_KEY_PATH = "C:\secure\nightshift\hl-mainnet-api-wallet.key" $env:NIGHTSHIFT_HL_BUILDER_ADDRESS = "0x" $env:NIGHTSHIFT_HL_BUILDER_FEE_TENTHS_BPS = "20" $env:INTERNAL_EXECUTION_TOKEN = "" $env:NIGHTSHIFT_HOME = "C:\secure\nightshift\runtime" $env:NIGHTSHIFT_HL_SIGNER_PORT = "4300" ``` Configure the current signed mainnet eligibility attestation and public verification key through their private file paths. The issuer private key must never enter this environment. The mainnet API-wallet file must be an absolute regular non-symlink file outside the repository, restricted to the signer service identity. Do not place any value above in repository files, command arguments, chat, browser storage, evidence exports or logs. ## Offline doctor ```powershell pnpm hl-signer:doctor ``` Required redacted evidence: * `status: "ready"`; * `venue: "hyperliquid"` and `mode: "mainnet"`; * `networkRequests: 0`; * matching account, owner and builder fingerprints; * a matching redacted BTC-only symbol-scope digest/count and `mainnetMaxLeverage: 1`; * a separately reviewed API-wallet fingerprint; * `keyType: "secp256k1"`. The doctor must reject absent `ALLOW_MAINNET=true`, an absent explicit canary cap, any cap above $12, absent or widened signer symbol scope, leverage other than 1x, active Arcus scope, inline/repository/symlink key material, and a key derived to the owner or selected trading account. ## Supervised start Do not run Uvicorn directly. ```powershell pnpm hl-signer:start pnpm hl-signer:status pnpm hl-signer:health ``` Required infrastructure evidence: * state and health both report `mode: "mainnet"`; * the child is bound only to `127.0.0.1:4300`; * `mainnetCanaryMaxNotionalUsd` is `12` or lower; * `symbolCount` is `1`, its digest matches the separately configured web `BTC` allowlist, and `mainnetMaxLeverage` is `1`; * signer database schema is 8, current, integrity `ok` and journal mode `wal`; * dead-man network is `mainnet`; it may remain unconfigured until a separately authorized arm; * mainnet eligibility state and exact scope are visible without token material; * persisted supervisor state and logs contain no full address, key path, private key, internal token or eligibility token. Keep the web kill switch active. Configure the separately isolated web control plane and run the strict read-only mainnet readiness audit from the go-live runbook. A failed readiness gate means stop; it is not a reason to bypass the supervisor. ## Canary window and shutdown Every dead-man action, leverage change, order, cancellation and funding action requires its own action-time authorization. After the authorized entry and reduce-only exit reconcile: 1. prove the intended account is flat and all-DEX open orders are exactly zero; 2. restore the web kill switch; 3. separately authorize and safely disarm the dead-man switch only after the zero-order proof; 4. stop the supervisor; 5. verify a final cold signer-store backup; 6. remove mainnet secrets and flags from the session. ```powershell pnpm hl-signer:stop pnpm hl-signer:status Remove-Item Env:ALLOW_MAINNET -ErrorAction SilentlyContinue Remove-Item Env:EXECUTION_MODE -ErrorAction SilentlyContinue Remove-Item Env:HL_AGENT_PRIVATE_KEY_PATH -ErrorAction SilentlyContinue Remove-Item Env:INTERNAL_EXECUTION_TOKEN -ErrorAction SilentlyContinue ``` Do not widen capital, symbols, leverage or automation after one successful canary. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://nytshift.gitbook.io/nytshift-docs/hyperliquid/hyperliquid-mainnet-signer.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.