> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/implementation-ledger/ns-444-supervised-hyperliquid-mainnet-canary.md).

# NS-444 · Supervised Hyperliquid mainnet canary

Status: implemented locally on 2026-07-23; no venue mutation or mainnet activation performed.

## Problem

The Python execution boundary already enforced mainnet canary notional, fresh dead-man and retained testnet rehearsal gates, but the managed `hl-signer:*` process supervisor accepted testnet only. The documented mainnet canary therefore lacked the same key isolation, strict health, store lock, bounded restart and clean-shutdown controls used for testnet.

## Delivered

* The Hyperliquid supervisor accepts only `testnet` or explicitly enabled `mainnet`.
* Mainnet requires both `EXECUTION_MODE=mainnet` and `ALLOW_MAINNET=true`.
* Mainnet requires an explicit `MAINNET_CANARY_MAX_NOTIONAL_USD`; the first-canary supervisor rejects values above $12.
* Arcus remains disabled and cannot share the process.
* Offline doctor proof now binds either exact network while retaining zero network requests and rejecting owner/account keys.
* Strict authenticated health binds the child mode and dead-man network to the supervisor configuration.
* Child environment projection carries only the exact selected network and mainnet flag.
* Redacted runtime state records the network without addresses, keys, paths, tokens or attestations.
* A real-process integration test starts and stops an isolated mainnet child with an ephemeral key, validates schema-8/WAL health and proves no venue request.
* A dedicated operator runbook preserves the testnet rehearsal store, backup, kill-switch and per-mutation authorization boundaries.

## Non-authority

This milestone does not register or revoke an API wallet, approve a builder, claim testnet funds, move funds, change leverage, arm/disarm/heartbeat a dead-man deadline, place/cancel an order, configure production identity/database services or authorize a mainnet canary. Those remain external operator actions with separate action-time authorization.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://nytshift.gitbook.io/nytshift-docs/implementation-ledger/ns-444-supervised-hyperliquid-mainnet-canary.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.