> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/normative-design/local-production.md).

# Local production operations

NIGHTSHIFT's local runtime is a production Next.js process behind a loopback-only Node supervisor. It does not expose a public hostname and does not use Docker, Cloudflare Workers/Pages or OpenAI Sites.

The official public release is a separate, explicitly approved path: an exact immutable standalone artifact runs on the operator-owned VPS, bound to loopback behind the existing systemd, Nginx and TLS configuration for `nytshift.xyz`. A source checkout, successful local start or ambient hosting manifest never authorizes promotion. `pnpm preflight` and `pnpm handoff:check` reject `.openai/hosting.json` and root/web Wrangler configuration; any new host or hosting provider requires another explicit review and approval. The Linux-only `pnpm release:public:build` workflow now owns exact-commit compilation, deterministic packaging, a complete content manifest and receipt; `pnpm release:public:verify` must pass before and after transfer. See [`runbooks/public-release.md`](/nytshift-docs/release-and-readiness/public-release.md). Privy's `https://challenges.cloudflare.com` browser origin is retained only for its authentication challenge and is not NIGHTSHIFT hosting authority.

Rendered pages receive a new base64 CSP nonce on every request from `apps/web/proxy.ts`. Production `script-src` uses the nonce plus `strict-dynamic` and excludes `unsafe-inline`; inline event handlers and objects are disabled, while frame/child/connect access is limited to the exact Privy, WalletConnect, Robinhood Chain and venue origins documented by their current integrations. Dynamic chart/depth geometry requires the intentionally narrower `style-src-attr 'unsafe-inline'` policy, while the two identical `lightweight-charts@5.2.0` style elements are allowed only by their pinned SHA-256. DM Mono and Manrope are emitted as same-origin font assets by `next/font`, so runtime startup does not depend on Google Fonts. Do not add a connect origin or weaken CSP during an incident; reproduce and review the exact violation first.

## Start

```powershell
pnpm local:start
pnpm local:health
```

The first start creates `%USERPROFILE%\.nightshift\config.json` on Windows or `~/.nightshift/config.json` on macOS/Linux. Set `NIGHTSHIFT_HOME` to choose another location. Existing configuration is never overwritten.

The config controls host, port, health cadence, restart limits, build policy, and server-side read providers. Validation rejects public binds, production mock mode, URL userinfo, non-HTTPS/WSS transports, unknown environment keys, and execution settings. Managed-provider API keys may be embedded in an endpoint path as documented by that provider; NIGHTSHIFT never returns or logs the endpoint. The web supervisor always sets:

```
NODE_ENV=production
EXECUTION_MODE=disabled
ALLOW_MAINNET=false
ARCUS_EXECUTION_MODE=disabled
ARCUS_ALLOW_MAINNET=false
```

### Customer identity

Privy customer login is optional and fail-closed. Create separate Privy development and production apps. For production, enable Google and wallet login, add only `https://nytshift.xyz` and `https://www.nytshift.xyz` as web origins, configure your own Google OAuth branding before launch, and enable Privy's production HttpOnly-cookie domain after the required DNS record is verified. Keep the default `SameSite=Strict` unless a reviewed cross-site requirement exists.

Launch or build the web process with `NEXT_PUBLIC_PRIVY_APP_ID`, optional `NEXT_PUBLIC_PRIVY_CLIENT_ID`, optional 32-hex `NEXT_PUBLIC_PRIVY_WALLETCONNECT_PROJECT_ID`, and server-only `PRIVY_APP_SECRET`. `PRIVY_JWT_VERIFICATION_KEY` may hold the dashboard public verification key to avoid the first verification-key lookup. The three `NEXT_PUBLIC_` values are identifiers, not secrets. The app secret and verification key must stay in the private service environment and must not enter `.nightshift/config.json`, source, browser storage, logs or analytics. A later completed production rehearsal may be supplied through the server-only absolute `NIGHTSHIFT_PRIVY_PRODUCTION_EVIDENCE_PATH`; its file contains no credential or customer identity and must remain a private regular file outside the repository.

The terminal exposes `GET /api/auth/session` as a private/no-store verification boundary. It accepts Privy's production `privy-token` HttpOnly cookie or one exact bearer token obtained through the SDK, rejects conflicting evidence, and returns only the authenticated DID/session/expiry. This customer session is not the 15-minute local operator session and cannot grant execution, funding, transfers, withdrawals or Agent Pro.

Authenticated account settings use the separate private/no-store `GET /api/profile` and same-origin `PATCH /api/profile` boundary. Both Privy's access token and identity token are required: the access token establishes the exact app/DID/session/expiry, the identity token supplies the bounded authenticated-user claim, and the server refuses the response unless both identify the same DID. This follows Privy's authenticated-user query path instead of the heavily rate-limited arbitrary-DID lookup. Provider-linked wallets remain distinct from currently connected browser wallets; identity-token coverage can be smaller than the full provider account graph and is labeled `identity-token-bounded` rather than overclaimed.

Only strict display preferences are written: display name, experience, portfolio start view, market density, chart workspace and three notification toggles. Without `DATABASE_URL`, the unsigned local terminal retains the legacy private `~/.nightshift/data/customer-profiles-v1.json` checkpoint. When PostgreSQL is configured, the same opaque customer digest, strict preference shape and optimistic revision move to `customer_profiles`; production identity health is unsafe unless that database is queryable. No raw DID, email, wallet address or token is retained. PATCH requests require same-origin evidence, a bounded exact JSON shape and the current revision, and are limited to 20 writes per session per minute. `/api/health` publishes only aggregate store state, counts and update time. Profile preferences do not grant portfolio, trading, funding, withdrawal, operator or Agent Pro authority.

### Customer database and PAPER history

Authenticated PAPER uses the private customer PostgreSQL ledger from [`NS-443`](/nytshift-docs/implementation-ledger/ns-443-durable-customer-trading-ledger.md). Configure a private PostgreSQL URL only in the service environment, then apply and verify ordered checksummed migrations before starting the authenticated release:

```powershell
pnpm db:status
pnpm db:migrate
pnpm db:verify
```

`db:migrate` takes a PostgreSQL advisory lock and refuses changed history. The database stores an opaque customer identity, profile preferences, active/archived PAPER sessions, normalized orders/fills and append-only position/PnL/risk projections. Guest PAPER remains browser-local. A reset archives the authenticated session; it does not erase history. High-frequency mark-only snapshots are compacted, while order/fill/GTC/protection changes persist immediately through serialized optimistic revisions. Local Compose creates an empty database and does not preload migration SQL; the checksummed migration registry is the sole schema authority.

The database is an application/history boundary, not signer authority. Do not place Privy tokens, identity tokens, wallet signatures, private keys, signer paths or raw signer payloads in it. Before account binding, configure the private `CUSTOMER_ACCOUNT_DIGEST_KEY` (minimum 32 bytes) and protect it with infrastructure secrets/backups. Same-origin `PUT /api/profile/venues` accepts only an exact wallet present in the matching Privy identity-token projection; the database stores an HMAC digest and one-customer ownership constraint, not the address. Testnet/live order/fill/fee/closed-PnL rows may be projected only from the strict signer lifecycle returned by reconciliation. The matching reconciled portfolio generation adds account equity/margin/exposure, positions, unrealized PnL, liquidation/leverage/margin context and funding rows with explicit completeness/boundedness. Exact replay is idempotent, conflicts/regressions fail closed, bounded evidence stays partial and unavailable domains remain null/empty. Follow [`runbooks/customer-database.md`](/nytshift-docs/agents-identity-and-data/customer-database.md) for migration, binding, backup, restore and incident handling.

Privy's current setup, network, CSP, domain and cookie requirements are recorded in [`tickets/NS-387-privy-customer-identity.md`](/nytshift-docs/implementation-ledger/ns-387-privy-customer-identity.md). After credentials are configured, rebuild/restart, verify `/api/health` reports both identity states `configured`, and exercise Google, wallet, embedded-wallet, link-wallet, logout, expiry and Robinhood Chain switch flows in the real production origin. Those configuration states alone are not customer-launch proof. Follow [`runbooks/privy-production-activation.md`](/nytshift-docs/release-and-readiness/privy-production-activation.md) to create a maximum-30-day exact-app rehearsal document; health and `activation:audit` require its `verified` state before either login method is reported ready.

### User-owned Arcus withdrawals

Arcus withdraw-to-self submission is independent from customer login and from the Arcus API-wallet order signer. It defaults to `NIGHTSHIFT_ARCUS_WITHDRAWAL_MODE=disabled` and `NIGHTSHIFT_ARCUS_WITHDRAWAL_ALLOW_MAINNET=false`. The local supervisor and public release builder force those values and remove any confirmation secret. Production activation requires an explicitly reviewed private service environment plus fresh Privy production evidence, production RHC providers, a healthy private lifecycle store and a 32–4096 byte confirmation secret. The store defaults to `~/.nightshift/data/arcus-customer-withdrawals-v1.json`; an absolute `NIGHTSHIFT_ARCUS_WITHDRAWAL_STORE_PATH` is allowed only in the private service environment, never local `config.json`.

Preparation remains no-send. If every independent gate is ready, the exact provider-linked connected wallet on chain 4663 signs one EIP-712 request after the user types the exact phrase. The server recovers that wallet, repeats all live preflight evidence, claims the durable ticket before one fixed-origin submission, records HTTP 202 only as pending and reconciles finality only from the exact withdrawal ID in Arcus account-transfer updates. No private key, DID, wallet address, signature or provider token is persisted. Follow [`runbooks/arcus-customer-withdrawals.md`](/nytshift-docs/arcus/arcus-customer-withdrawals.md); do not enable this scope through the local supervisor.

Licensed Advanced Charts setup and production activation are also separate. `NIGHTSHIFT_ADVANCED_CHARTS_MODE=licensed` plus a verified private v32 tree proves only package integrity. Follow [`runbooks/tradingview-advanced-charts.md`](/nytshift-docs/release-and-readiness/tradingview-advanced-charts.md) to perform the real production drawing/datafeed/study/history/zoom/persistence/reconnect desktop/mobile rehearsal and create a maximum-30-day document bound to the exact release and asset tree. Health and `activation:audit` require `advancedChartsProductionEvidenceState=verified`; a missing, expired or rotated proof leaves the custom chart active and native launch readiness false.

The durable profile/account workspace and its recovery and privacy boundaries are recorded in [`tickets/NS-388-customer-profile-account-hub.md`](/nytshift-docs/implementation-ledger/ns-388-customer-profile-account-hub.md).

Those values keep browser and web processes unable to sign. An optional signer is a separate loopback process described below.

Arcus and Hyperliquid public REST traffic is pinned to the official endpoints in `config.json`. `VENUE_PUBLIC_READ_MAX_INFLIGHT`, `VENUE_PUBLIC_READ_CIRCUIT_FAILURES`, `VENUE_PUBLIC_READ_CIRCUIT_COOLDOWN_MS` and `VENUE_PUBLIC_READ_MAX_RESPONSE_BYTES` bound the server-side fan-out. Account reads use `VENUE_PUBLIC_ACCOUNT_WINDOW_MS` and `VENUE_PUBLIC_ACCOUNT_MAX_REQUESTS`; only an opaque hash is retained in memory. `/api/market/health` exposes aggregate success/failure, latency, circuit and reason-code state without URLs, response bodies, credentials or wallet addresses. A degraded venue does not make process health unsafe or trigger a restart; follow [`public-venue-degraded.md`](/nytshift-docs/market-data-and-providers/public-venue-degraded.md).

Validated Arcus and Hyperliquid REST candles write through to `%USERPROFILE%\.nightshift\data\market-history-v1.json` on Windows or `~/.nightshift/data/market-history-v1.json` elsewhere. The filename remains stable while schema v1 migrates to v2, adding explicit update/provider-observation times without inventing a newer observation. `MARKET_HISTORY_RETENTION_DAYS`, `MARKET_HISTORY_MAX_SERIES`, `MARKET_HISTORY_MAX_CANDLES_PER_SERIES` and `MARKET_HISTORY_MAX_TOTAL_CANDLES` bound retention and LRU eviction. Writes are private and atomic; mutable open-bar rewrites are throttled while new/closed/corrected bars persist immediately. `/api/market/history/health` reports only schema, counts and configured bounds. Follow [`market-history-degraded.md`](/nytshift-docs/market-data-and-providers/market-history-degraded.md) when it is unavailable.

For a production-ready Robinhood Chain data plane, set distinct `RHC_PUBLIC_RPC_URL` and `RHC_FALLBACK_RPC_URL` managed endpoints, their corresponding WSS URLs, and explicitly claim archive access with both `RHC_*_RPC_ARCHIVE=true` flags. Then produce a fresh endpoint-bound `RHC_PROVIDER_ATTESTATION_PATH` using `pnpm rhc:attestation:probe`; booleans without measured HTTPS historical-state and WSS `newHeads` evidence remain degraded. After manual bootstrap, use the reviewed `rhc:attestation:refresh` one-shot/timer rather than rerunning `probe`: refresh cannot create first trust or attest rotated endpoints, retains the old evidence on failure and exposes its expiry through health. `RHC_MAX_BLOCK_DIVERGENCE` controls the fail-closed block-gap threshold. `RHC_WEBSOCKET_STALE_MS`, the bounded reconnect base/max, the rolling metrics window and `RHC_PROVIDER_STABILIZATION_MS` are validated operational controls. Health starts the WSS supervisors and the unattended HTTP topology monitor, but upstream failure does not restart the web process; `/api/rhc/providers` exposes the degraded reason, alert state and recovery state. The default public endpoint remains useful for local diagnostics but correctly reports `PUBLIC DIAGNOSTIC`. See [`rhc-provider-attestation.md`](/nytshift-docs/release-and-readiness/rhc-provider-attestation.md).

Provider incident checkpoints live at `%USERPROFILE%\.nightshift\data\rhc-provider-observability-v1.json` on Windows or `~/.nightshift/data/rhc-provider-observability-v1.json` elsewhere. The filename remains stable while the content schema migrates from version 1 to version 2, adding a durable delivery outbox without inventing historical attempts. Writes use atomic replacement and private permissions. Monitor cadence, HTTP error-rate basis points/minimum requests, rolling reconnect threshold, retention days and hard event cap are set with the bounded `RHC_PROVIDER_MONITOR_INTERVAL_MS`, `RHC_PROVIDER_ALERT_*` and `RHC_PROVIDER_INCIDENT_*` controls. Inspect `/api/rhc/providers/health` for aggregate state and `/api/rhc/providers/incidents?limit=50` for newest-first alert lifecycle history. Provider URLs and credentials are deliberately absent.

Optional operator delivery is disabled unless `RHC_PROVIDER_ALERT_WEBHOOK_URL` and `RHC_PROVIDER_ALERT_WEBHOOK_SECRET` are both present in the server process. The URL must be HTTPS without userinfo or a fragment; the secret must be 32–4096 characters and must not be placed in `config.json`, source, browser storage or logs. Non-secret cadence, timeout, retry, batch, retention and pressure settings may live in `config.json`. Every alert-open and alert-resolved envelope carries a stable delivery/idempotency ID, millisecond timestamp and `x-nightshift-signature: v1=<hex HMAC-SHA256>` over `<timestamp>.<exact body>`. Receivers must verify the signature and timestamp before parsing, deduplicate the delivery ID, and return 2xx only after durable acceptance. Delivery is at least once: a crash after receiver acceptance but before local acknowledgement can resend the same ID. Redirects are rejected and response bodies are never retained.

Verified wallet-activity checkpoints live at `%USERPROFILE%\.nightshift\data\rhc-activity-v1.json` on Windows or `~/.nightshift/data/rhc-activity-v1.json` elsewhere. The filename remains stable while schema v1 migrates to v2, adding separate native-ETH ranges and typed event provenance without inventing native coverage for an old token-only checkpoint. Writes use private permissions and atomic replacement. `RHC_ACTIVITY_WINDOW_BLOCKS`, `RHC_ACTIVITY_CHUNK_BLOCKS`, `RHC_ACTIVITY_REORG_BLOCKS`, `RHC_ACTIVITY_CONFIRMATION_BUFFER`, `RHC_ACTIVITY_MAX_EVENTS`, `RHC_ACTIVITY_RETENTION_DAYS` and `RHC_ACTIVITY_NATIVE_MAX_PAGES_PER_CHUNK` are bounded by preflight. An Alchemy primary endpoint enables its indexed external native-ETH value-transfer method; every other provider remains explicitly unsupported for that rail. Internal contract ETH transfers are not claimed. Older pagination remains disabled until both RPC providers are archive-attested.

## Operations

```powershell
pnpm local:status
pnpm local:health
pnpm local:restart
pnpm local:stop
```

`local:start` builds when sources are newer, starts a detached supervisor, and waits for a healthy response. `local:restart` is also build-aware: it stops the current web child before preflight/build, applies the validated `autoBuild` policy, starts only after build success and waits up to ten minutes for the replacement's disabled-execution health contract. `if-needed` rebuilds only when a web/package/service input is newer than `.next/BUILD_ID`; `always` rebuilds every time; `never` requires an existing build and never creates a missing one. A failed build leaves the supervisor in fixed `build-failed` state with no child; inspect `nightshift.log`, fix the build and run `local:restart` again. Automatic crash/health recovery restarts the already accepted bundle and does not compile moving source. Runtime state, `nightshift.log`, and atomic control requests live in the persistent NIGHTSHIFT directory.

The app is at `http://127.0.0.1:3000`, the terminal at `/terminal`, process health at `/api/health`, and public venue health at `/api/market/health`.

In an immutable seven-character production release directory, `/api/health` also verifies `RELEASE_COMMIT` and `RELEASE_SHA256` from the release root. It publishes the exact lowercase values only when both stable regular files validate and the directory matches the commit prefix. A partial, malformed or mismatched deployed pair returns unsafe health without exposing a path or file content. Source checkouts without markers remain explicitly `unversioned`; `NIGHTSHIFT_RELEASE_MARKER_DIR` is an optional absolute override for nonstandard layouts.

The public artifact embeds the exact commit marker and a complete hashed tree manifest. Its create-once receipt carries the finished archive digest. Because an archive cannot contain its own SHA-256, the operator writes `RELEASE_SHA256` from that verified receipt only after extraction and before atomic promotion. Building and verifying never contact or mutate the VPS.

The same verified release boundary publishes coarse filesystem capacity without exposing a mount or release path. `NIGHTSHIFT_RELEASE_FREE_RESERVE_BYTES` defaults to 2 GiB and `NIGHTSHIFT_RELEASE_DEPLOY_HEADROOM_BYTES` defaults to 512 MiB. Free space below reserve plus allowance is `constrained` but leaves a disabled read-only service healthy; free space below the operating reserve is `critical` and makes health unsafe. The command deck and terminal build-trust drawer show the same strict evidence. This observation never deletes a release; use the content-addressed [`release-capacity.md`](/nytshift-docs/release-and-readiness/release-capacity.md) workflow for any separately authorized pruning.

## Live-feed soak evidence

Run `pnpm soak:live -- --replace` for the 24-hour release window. It samples only normalized loopback APIs, writes a bounded private SHA-256 chain outside the repository and requests one controlled web-child restart. `pnpm soak:status` validates and summarizes an active/final checkpoint; `pnpm soak:verify` succeeds only when the full duration, observation coverage, at-least-99% valid probe rate, changed child generation, post-restart convergence and managed Robinhood fallback/WSS/archive topology all pass. A short `--allow-short` rehearsal may prove mechanics but is never release evidence. See [`live-feed-soak.md`](/nytshift-docs/release-and-readiness/live-feed-soak.md).

## Optional development API

`apps/api` is deliberately excluded from `pnpm local:start`. It provides only deterministic AEGIS evaluation, schema validation, and process-local paper state; it has no signer, no live order route, and every stateful response declares `executionCapability: "none"`. It is disabled by default and refuses to start unless an operator explicitly enables it, supplies a distinct 32–4096 byte bearer token, and keeps the exact `127.0.0.1` bind.

Use [`development-api.md`](/nytshift-docs/agents-identity-and-data/development-api.md) only for an intentional local development session. Never reuse the browser operator secret, signer token, provider credential, or wallet key. This process is not required for the landing page, terminal, Robinhood Chain reads, venue reads, or execution boundary.

## Isolated Hyperliquid signer

The web application never imports signing code and never receives an API-wallet key. `services/execution-py` is the only signing boundary and binds to loopback. Its safe default is disabled.

Before any testnet execution rehearsal, configure a distinct local operator secret in the shell that launches the supervisor. It must be 32–4096 bytes, must not use the placeholder prefix, and deliberately cannot be stored in `config.json`:

```powershell
$env:NIGHTSHIFT_OPERATOR_SECRET = [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(48))
pnpm local:start
```

If the supervisor is already running, use `pnpm local:stop`, set the environment value in the new launching shell, and start again. The terminal Safety settings exchange the value once for a 15-minute HMAC-authenticated cookie scoped to `/api`, marked HttpOnly and SameSite=Strict. The browser keeps only the paired CSRF value in React memory; refresh recovers it from authenticated `/api/session` state, while logout revokes the session for the remaining process lifetime and clears the cookie. Mutations require exact Origin, JSON content type, the CSRF header, a bounded body, and a session-scoped rate budget. Because approved local production uses loopback HTTP, the cookie cannot carry `Secure`; any future public TLS review must require `Secure` and a host-prefixed cookie before external access.

For an authorized testnet configuration, use the dedicated Hyperliquid supervisor. The shell must supply an absolute `HL_AGENT_PRIVATE_KEY_PATH` outside the repository for a dedicated API wallet, not the owner/master-wallet key, plus the exact lowercase `NIGHTSHIFT_HL_OWNER_ADDRESS`. Set owner equal to `HL_ACCOUNT_ADDRESS` for a master account or to the owning master for a subaccount. Inline `HL_AGENT_PRIVATE_KEY`, symlinks, repository paths, a key derived to either owner or selected account, a mismatched mainnet flag and active Arcus execution are refused. The doctor derives the API-wallet address locally and makes zero network requests. The child binds only `127.0.0.1` (default port `4300`), initializes the official SDK only on a later venue operation, verifies exact authenticated schema-v8/WAL/eligibility/dead-man health, holds the shared signer-store lock and persists fingerprints only.

```powershell
pnpm hl-signer:doctor
pnpm hl-signer:start
pnpm hl-signer:status
pnpm hl-signer:health
pnpm hl-signer:restart
pnpm hl-signer:stop
```

Follow [`hyperliquid-testnet-signer.md`](/nytshift-docs/hyperliquid/hyperliquid-testnet-signer.md). These commands prove process isolation and recovery only; they do not register an API wallet, create eligibility, approve the builder, fund the account, arm the dead-man switch or authorize an order.

After the signer and separately configured web control plane are ready, `pnpm hyperliquid:readiness -- --origin http://127.0.0.1:3000 --expected-network testnet --expected-symbols BTC --max-canary-notional-usd 12 --max-leverage 1 --require-zero-open-orders --require-ready` performs one authenticated no-send audit of the database, signer, eligibility, account/builder scope, kill switch, exact campaign scope, authoritative portfolio generation and dead-man state, then revokes its temporary operator session. Mainnet changes the expected network and adds `--require-dead-man-rehearsal`. It never calls an order, cancel, leverage, funding or dead-man mutation route. Follow [`hyperliquid-go-live-validation.md`](/nytshift-docs/hyperliquid/hyperliquid-go-live-validation.md) for the separately authorized testnet matrix and mainnet canary boundary.

To run a later explicitly authorized testnet rehearsal, configure the same lowercase `NIGHTSHIFT_HL_BUILDER_ADDRESS` and `NIGHTSHIFT_HL_BUILDER_FEE_TENTHS_BPS` in both BFF and signer environments. The builder address must have at least 100 USDC perps account value and must explicitly report Standard account mode as `userAbstraction="disabled"`. The user's main wallet must separately approve at least that maximum through Hyperliquid; an API/agent wallet cannot approve it. Then supply the web process with the signer URL, a separate internal token, a separate confirmation secret, an exact symbol allowlist, `EXECUTION_ACCOUNT_SCOPE`, and the same short-lived signed eligibility token/public key used by the signer. Environment booleans cannot create eligibility. Follow [`execution-eligibility.md`](/nytshift-docs/policy-control-and-incident-response/execution-eligibility.md) and keep `EXECUTION_KILL_SWITCH=true` until the testnet checklist is ready.

Required gates are documented in `.env.example`. When locked, `/api/execution/status` returns only disabled/redacted state and `OPERATOR_SESSION_REQUIRED` or `OPERATOR_AUTH_NOT_CONFIGURED`; authenticated status reports booleans and reason codes but never a secret. A review uses live book, account, daily P\&L, drawdown, `userFees`, `maxBuilderFee`, builder `clearinghouseState` and builder `userAbstraction` data. The exact 2 bps native builder fee and venue fee range are shown before confirmation, apply only to fills and are bound into the one-use 30-second ticket. Submission is exactly once by intent ID and CLOID; ambiguous outcomes are reconcile-only.

After the earlier signer/configuration/eligibility gates pass, status performs a server-owned reconciliation for the exact configured account. `NIGHTSHIFT_PORTFOLIO_RECONCILIATION_INTERVAL_MS` and `NIGHTSHIFT_PORTFOLIO_MAX_REMOTE_AGE_MS` both default to 30,000 ms; both accept 5,000–300,000 ms and the maximum age must be at least the interval. The 30-second refresh keeps the full current 10-DEX Info fan-out below Hyperliquid's documented 1,200-weight-per-minute IP ceiling before other market traffic. The adapter requires every discovered perp DEX, exact missing-order resolution, current timestamped capital state and an explicit account mode. `allPerpMetas` must bind every DEX to a collateral token; `spotMeta` plus reserve-oracle rows then convert Standard, Unified and Portfolio Margin balances, positions and HIP-3 lifecycle evidence into USD. Debt reduces Portfolio Margin equity, while unrelated Unified spot holdings are ignored and counted rather than promoted. Failed attempts persist a degraded generation and retry as reconnects without replacing accepted capital or accepted remote time. Follow [`portfolio-reconciliation.md`](/nytshift-docs/policy-control-and-incident-response/portfolio-reconciliation.md).

Mainnet uses the same supervised process boundary, never an ad hoc Uvicorn command. It requires exact `EXECUTION_MODE=mainnet`, `ALLOW_MAINNET=true`, an explicitly configured `MAINNET_CANARY_MAX_NOTIONAL_USD` no greater than the compiled $12 first-canary ceiling, `NIGHTSHIFT_HL_SYMBOL_ALLOWLIST=BTC` and `NIGHTSHIFT_HL_MAINNET_MAX_LEVERAGE=1`. The offline doctor, loopback bind, key isolation, strict health, store lock, bounded recovery and redacted state/log rules remain mandatory. Preserve the same account-bound signer store after the testnet dead-man rehearsal, but use the separately registered mainnet API wallet selected by the owner. Follow [`hyperliquid-mainnet-signer.md`](/nytshift-docs/hyperliquid/hyperliquid-mainnet-signer.md). Never place the API-wallet key in the repository `.env`, browser storage, prompts, logs, analytics or the web process.

### Arcus protected-request boundary

Arcus execution is an independent venue scope in the same loopback service. It uses the current official `ordersign` Ed25519 scheme: a monotonically increasing Unix-nanosecond timestamp, compact alphabetically sorted engine payload, lowercase address/client ID, exact integer price ticks and quantity quantums, and `X-API-Key` / `X-Timestamp` / `X-Signature` headers. The HTTP body retains human-readable decimal strings. The browser and Next.js process never load the Ed25519 key.

Keep `ARCUS_EXECUTION_MODE=disabled` until a user-owned Arcus API wallet is registered. The signer accepts only `ARCUS_API_PRIVATE_KEY_PATH`, which must resolve to a regular non-symlink Ed25519 PEM outside the repository. Testnet or mainnet startup also requires the exact account address/index and a strong internal token. The adapter pins egress to `https://api.testnet.arcus.xyz` or `https://api.arcus.xyz`; redirects and automatic order retries are disabled.

For an authorized testnet configuration, use the dedicated signer supervisor instead of running Uvicorn by hand. `pnpm signer:doctor` first validates the exact testnet scope and Ed25519 key locally with `networkRequests: 0`. The supervisor then binds only `127.0.0.1`, forces Hyperliquid disabled and every mainnet flag false, disables access logs, verifies authenticated health against the exact configured account/index, automatically recovers an unhealthy child under a bounded restart budget, and stores only an account fingerprint plus process metadata under `~/.nightshift`. It never stores the address, key path or internal token. The supervisor refuses `ARCUS_EXECUTION_MODE=mainnet` even when another flag attempts to allow it.

```powershell
pnpm signer:doctor
pnpm signer:start
pnpm signer:status
pnpm signer:health
pnpm signer:restart
pnpm signer:stop
```

The calling shell must supply the required values from `.env.example`; do not put them in `config.json`, the repository, a prompt or browser storage. The doctor/supervisor are operational infrastructure, not order authorization. Follow [`arcus-testnet-signer.md`](/nytshift-docs/arcus/arcus-testnet-signer.md) and stop before releasing the kill switch or confirming a testnet order without a separately authorized rehearsal.

The web control plane additionally requires a distinct `ARCUS_EXECUTION_CONFIRMATION_SECRET`, inactive kill switch, exact `ARCUS_EXECUTION_ACCOUNT_SCOPE`, the shared signed eligibility authority, and exact per-market size caps in `ARCUS_ATTESTED_MAX_ORDER_SIZE`. Status and each place/cancel review read the current official `/v1/rateLimit` pool, validate the echoed account scope, and refuse a ticket while the relevant `nextAvailableMs` is non-zero. Mainnet also requires daily-risk-control attestation and explicit canary approval, plus two non-configurable proofs from the same signer store within 30 days: an acknowledged testnet order followed by terminal `FILLED`/`CANCELED` reconciliation, and acknowledged account-wide cancel-all followed by a zero-open-order read. A review re-reads live market rules, book, compliance, margin and positions, then produces a one-use ten-second ticket. Submission repeats the live review and rate check before signing. Place/cancel claims are durable in SQLite; a crash, timeout or 5xx becomes reconcile-only and is never retried automatically.

The signer owns an application-identified schema-v8 execution database. Startup migration is exclusive and transactional, preserves existing intent/reconciliation/audit/alert/scope/revenue/lifecycle/leverage/bracket rows, adds durable Hyperliquid dead-man state/action/CLOID evidence, binds new rehearsal evidence to the exact account while clearing older unbound timestamps, labels existing protective scopes as stop-loss and permits exact take-profit leg identity, and refuses foreign, future, unknown, malformed, or inconsistent schemas. `pnpm signer:health` must report schema 8, current true, integrity `ok`, and journal `wal`; the BFF blocks ordinary and emergency authority otherwise. The authenticated terminal shows only these aggregate fields. Its Arcus `Signer audit` tab additionally requires the inspected account to match the signer/eligibility scope, requests Arcus-only rows, and displays only event type, status, opaque client ID, and time. Review approval fails if this signer audit cannot first persist the verdict. Follow [`arcus-execution-audit.md`](/nytshift-docs/arcus/arcus-execution-audit.md). `signer:backup:*` provides stopped-runtime SQLite snapshots with independent schema/fingerprint/integrity and SHA-256 verification, bounded retention, operation locking, and rollback-preserving restore. Follow [`arcus-execution-store-recovery.md`](/nytshift-docs/arcus/arcus-execution-store-recovery.md); the public-store `backup:*` commands intentionally exclude signer state.

Hyperliquid mainnet entry also requires the venue-native dead-man switch. An explicit operator arm schedules a 30-second cancel-all deadline, and the authenticated mounted terminal extends it every ten seconds only after the BFF and signer revalidate readiness and the signer completes all-DEX open-order discovery. Do not run the real testnet trigger rehearsal without separate authorization: a deadline trigger cancels live testnet orders and consumes one of Hyperliquid's ten daily trigger events. Test fixtures do not create production proof. Unknown schedule actions are never retried, disarm requires zero open orders, and mainnet remains locked without fresh same-account `scheduledCancel` rehearsal evidence plus a recent acknowledged deadline. Follow [`hyperliquid-dead-man-switch.md`](/nytshift-docs/hyperliquid/hyperliquid-dead-man-switch.md).

After a fee-bound Hyperliquid order is submitted, authenticated CLOID reconciliation invokes only `POST /v2/orders/{cloid}/reconcile` on the loopback signer. That operation resolves the venue order ID, queries unaggregated user fills from five minutes before the retained review time through the observation time, validates the official status set and atomically stores normalized lifecycle, all matching fills and native builder revenue. Exact venue `tid` dedupe makes repeated reads safe; OID/status/fill conflicts preserve prior truth and return unavailable. A `bounded-partial` result means the documented 10,000-fill venue history or the five-page cap prevents complete traversal and must not be invoiced as complete revenue. Raw account-wide fills remain inside the signer. Follow [`hyperliquid-order-lifecycle.md`](/nytshift-docs/hyperliquid/hyperliquid-order-lifecycle.md).

Authenticated Time Machine reads are local-only projections of those committed lifecycles. `GET /v1/time-machine` and `GET /v1/time-machine/{cloid}` require the configured signer account internally, return no account identifier and perform no venue operation. The terminal's `Time Machine` tab is available independently from arbitrary public-account inspection and reconstructs exact lifecycle, fills, fees, realized PnL, builder revenue and bounded flow/span lineage. Follow [`hyperliquid-time-machine.md`](/nytshift-docs/hyperliquid/hyperliquid-time-machine.md).

Hyperliquid market discovery, portfolio reconciliation and execution review share strict `perpDexs`/`allPerpMetas`/`metaAndAssetCtxs` identity. `/api/health` exposes aggregate state, fixed reason, drift flag and DEX/asset counts. Every fresh review also requires strict `activeAssetData`: quantity must remain within the minimum side capacity and AEGIS available margin comes from the venue-computed minimum `availableToTrade` converted by the reviewed collateral oracle. A leverage mismatch yields a separate leverage-only review, not an order ticket. It preserves active cross/isolated mode, uses a separate one-use confirmation, calls the signer at most once and claims success only after a new `activeAssetData` read matches; automation cannot use it and the order must be reviewed from scratch afterward. Keep execution disabled when state is degraded or unavailable; never filter out a failed named DEX or clear an additive drift alarm without reviewing the official field and its capital-moving semantics. Follow [`hyperliquid-metadata.md`](/nytshift-docs/market-data-and-providers/hyperliquid-metadata.md) and [`hyperliquid-leverage-update.md`](/nytshift-docs/hyperliquid/hyperliquid-leverage-update.md).

An opening Hyperliquid review may include an optional take-profit trigger. The BFF normalizes it against the reviewed entry, derives a profitable-side limit, binds a distinct child CLOID and chooses signer `/v4/orders`; the signer sends parent, reduce-only TP and reduce-only SL together with official SDK grouping `normalTpsl`. Without TP it continues to use immutable `/v2/orders`. V3 automation has no bracket authority. Both children are fixed-size limit-trigger orders: a price gap can leave an exit resting, and this release does not claim dynamic resizing or sibling cancellation. Follow [`hyperliquid-bracket-orders.md`](/nytshift-docs/hyperliquid/hyperliquid-bracket-orders.md).

AEGIS independently binds reduce-only approval to the fresh position direction and normalized open size, then projects reviewed correlated exposure for new entries. A reduce-only venue error after local approval can still result from intervening fills or position changes and must be reconciled by CLOID, never retried automatically. Follow [`aegis-risk-policy.md`](/nytshift-docs/policy-control-and-incident-response/aegis-risk-policy.md).

The signer also exposes authenticated loopback `GET /v1/revenue/summary`, which scans every retained positive builder-fee row with exact decimal arithmetic and returns aggregate token/month/count/time evidence only. Operator-only `GET /api/commercial` joins that projection with local proposal/automation usage and a content digest. It never returns account, CLOID, trade, builder, license or customer identity; coverage remains bounded to reconciled local orders, builder claims are not reconciled, the official daily builder archive is not ingested, and premium attempts remain unpriced while payment collection is unconfigured. Follow [`commercial-revenue.md`](/nytshift-docs/agents-identity-and-data/commercial-revenue.md).

Protected Arcus and Hyperliquid review, submit, cancel, emergency-cancel, reconciliation and audit routes assign a fresh server span in `x-nightshift-trace-id`. Review also creates `x-nightshift-root-trace-id`; the root is HMAC-bound into the confirmation ticket, crosses the loopback signer, and can be recovered from the exact CLOID/client-ID signer audit for later cancel/reconciliation. Browser headers never establish lineage. A separate private atomic store at `%USERPROFILE%\.nightshift\data\control-plane-observability-v1.json` on Windows or `~/.nightshift/data/control-plane-observability-v1.json` elsewhere retains only span/root UUIDs, fixed operation/outcome/timing, and fixed-code SLO incident/delivery fields. The stable filename carries schema v3 and migrates exact schema-v1/v2 spans by making each legacy span its own root while preserving SLO state. `NIGHTSHIFT_OBSERVABILITY_RETENTION_DAYS` accepts 1-365 (default 30); `NIGHTSHIFT_OBSERVABILITY_MAX_EVENTS` accepts 100-10,000 (default 5,000); an optional store override must be absolute. `/api/health` reports only aggregate store/delivery health. The session-protected `/api/observability` feeds the terminal's `24H CONTROL PLANE` panel and never returns account/order/body/URL/credential data. Follow [`execution-flow-tracing.md`](/nytshift-docs/policy-control-and-incident-response/execution-flow-tracing.md) and [`control-plane-observability.md`](/nytshift-docs/policy-control-and-incident-response/control-plane-observability.md).

Run `pnpm contracts:check` before starting or releasing either loopback service. It verifies all nine committed JSON Schema/OpenAPI artifacts against the runtime Zod registry. The signer document is additionally compared with live Pydantic request schemas during Python tests. The anonymous public-market, public-account, public-RHC-readiness and public-RHC-data documents are loopback-oriented, contain no security scheme, and their 18 route surfaces validate every emitted body before serialization. The v1 agent API document remains proposal-only with an opaque bearer scheme. The separately versioned v2 automation document uses DPoP, accepts only policy-bound Hyperliquid-testnet limit orders and exposes no cancel, policy mutation or signer URL. Existing v1 definitions and operation request/parameter/security/response boundaries cannot be regenerated after mutation or removal; use the versioned migration procedure in [`contract-evolution.md`](/nytshift-docs/agents-identity-and-data/contract-evolution.md). Both venue signer boundaries accept exact decimal strings only. Hyperliquid converts those strings to SDK numbers only inside the isolated final adapter after exact notional and stop validation.

Operator-imported advisory proposals use a separate private atomic store at `%USERPROFILE%\.nightshift\data\proposal-lifecycle-v1.json` on Windows or `~/.nightshift/data/proposal-lifecycle-v1.json` elsewhere. It stores only normalized UUID/hash/times/symbol/stance/actionability and fixed lifecycle/intent fields; proposal evidence, thesis, assumptions, risks, prompt text, prices and sizes are excluded. `NIGHTSHIFT_PROPOSAL_RETENTION_DAYS` accepts 1-365 (default 30), record/event caps accept 100-10,000 (defaults 1,000/5,000), and maximum validity accepts 30,000-3,600,000 milliseconds (default 900,000). `/api/health` returns aggregate counts only; authenticated `/api/proposals` and Terminal settings expose strict projections. Follow [`proposal-lifecycle.md`](/nytshift-docs/agents-identity-and-data/proposal-lifecycle.md).

Pro agent credentials use `%USERPROFILE%\.nightshift\data\agent-access-v1.json` on Windows or `~/.nightshift/data/agent-access-v1.json` elsewhere. The operator issues them from Terminal Safety settings with exact symbols, stances, maximum proposal notional, maximum proposal validity, hourly attempt budget and a 15-minute-to-24-hour lifetime. The plaintext bearer appears once and only a server-keyed HMAC digest is persisted. `/api/agent/v1/proposals` is the only bearer surface: it reports the calling agent's own mandate/quota/audit and registers bounded advisory proposals. It cannot review, confirm, sign, submit, retry, cancel, fund or reach a signer. Individual and revoke-all operations require the normal operator session, same-origin CSRF and bounded JSON. Retention accepts 1-365 days (default 30), credential caps 1-1,000 (default 100) and event caps 100-10,000 (default 5,000). Follow [`agent-proposal-api.md`](/nytshift-docs/agents-identity-and-data/agent-proposal-api.md).

New Agent Pro credentials additionally require `NIGHTSHIFT_AGENT_PRO_LICENSE` and `NIGHTSHIFT_AGENT_PRO_PUBLIC_KEY` in the launch environment. The compact Ed25519 license controls activation/expiry, per-license active credentials and shared UTC-month proposal attempts; additive `nsl_v2` licenses also carry the automation-attempt allowance required for policy creation and submission. It cannot outlive 366 days and no issued credential can outlive it. Missing values leave ordinary terminal health safe but lock issuance; a partial, malformed or bad-signature pair makes health unsafe. `NIGHTSHIFT_AGENT_USAGE_RETENTION_DAYS` (32-3,660, default 400), `NIGHTSHIFT_AGENT_MAX_USAGE_PERIODS` (12-10,000, default 1,200) and `NIGHTSHIFT_AUTOMATION_MAX_USAGE_PERIODS` (12-10,000, default 1,200) bound local aggregate usage. These meters are exact for one NIGHTSHIFT installation, not a centralized billing ledger or proof of payment. Follow [`agent-pro-entitlements.md`](/nytshift-docs/agents-identity-and-data/agent-pro-entitlements.md); issuer private-key paths must never enter the production web environment or persistent config.

Policy-bound Agent Pro automation uses `%USERPROFILE%\.nightshift\data\agent-automation-v1.json` on Windows or `~/.nightshift/data/agent-automation-v1.json` elsewhere. It is Hyperliquid-testnet-only and requires an active `nsl_v2` automation entitlement, an active credential, operator-created maximum-24-hour limits including an explicit current-leg total-fee ceiling, a registered client-held P-256 public key and a fresh DPoP proof for every submit/status request. Store schema v3 atomically retains aggregate commercial usage with public-key/policy digests, consumed proof hashes, fixed-code events and deterministic action/CLOID state; it never retains a license token, client private key, order body or plaintext agent token. Strict schema-v1/v2 checkpoints migrate, but every migrated policy is revoked until the operator creates a new policy with an explicit total-fee ceiling. `NIGHTSHIFT_AUTOMATION_RETENTION_DAYS` accepts 1-365 (default 30), policy caps 1-2,000 (default 500), and action/proof/event caps 100-50,000 (defaults 10,000). Invalid settings make `/api/health` unsafe. Follow [`agent-automation.md`](/nytshift-docs/agents-identity-and-data/agent-automation.md).

The bundled `@terminal/agent-client` and `agent-automation:*` commands are for a separate local automation process. They require an absolute regular private-key file outside the repository, read the credential only from `NIGHTSHIFT_AGENT_TOKEN`, target exact IPv4 loopback HTTP, create fresh sender-constrained DPoP proofs and bound every response. They intentionally expose only submit/status. Do not add the client token or private-key path to `.env.example`, `config.json` or the supervised web environment; follow the key generation and incident steps in the runbook.

Optional control-plane alert delivery requires both `NIGHTSHIFT_OBSERVABILITY_ALERT_WEBHOOK_URL` and `NIGHTSHIFT_OBSERVABILITY_ALERT_WEBHOOK_SECRET` in the private runtime environment. Never put the secret in `config.json`; the URL may be configured there only if it is credential-free HTTPS without userinfo, query or fragment. The schema-v3 checkpoint preserves the existing outbox while persisting alert-open/recovery transitions atomically; leases work across restart and send stable-ID exact-body HMAC envelopes with redirect rejection, bounded timeout/retry and discarded response bodies. Disabled or degraded delivery keeps localhost and Hyperliquid testnet available but blocks Hyperliquid mainnet readiness. Follow [`control-plane-alert-delivery.md`](/nytshift-docs/policy-control-and-incident-response/control-plane-alert-delivery.md).

Arcus commonly returns `202 Accepted`. NIGHTSHIFT records this only as `acknowledged`, never as a fill or final order state. The address-scoped `orders` and `userFills` WebSocket streams plus REST resynchronization remain authoritative. Every place review binds literal one-cancel authority for reconciliation failure. The signer persists its exact account/index/market/client-ID scope before place; an unknown lifecycle read atomically claims at most one cancellation, latches ordinary entry across restart, and only `FILLED`, `CANCELED`, or `REJECTED` resolves the incident. A cancel ACK remains non-final. Manual cancellation targets the exact live `clientId`, receives a separate one-use confirmation, and follows the same unknown-outcome rule.

Arcus testnet entry also requires signer-owned execution alert delivery. Configure both `ARCUS_ALERT_WEBHOOK_URL` and a distinct random `ARCUS_ALERT_WEBHOOK_SECRET` only in the private signer-launch shell. Partial, non-HTTPS, userinfo-bearing, fragment-bearing, placeholder or out-of-bounds configuration fails closed. The signer writes order-failure/reconciliation transitions to its bounded SQLite outbox before a leased worker sends stable-ID, HMAC-authenticated, secret-free envelopes. `/health` exposes only aggregate delivery state; the terminal Safety settings never receive the URL or secret. Disabled, failed or overflowed delivery locks ordinary execution without blocking kill-switch-only emergency cancel-all. Follow [`arcus-execution-alert-delivery.md`](/nytshift-docs/arcus/arcus-execution-alert-delivery.md).

## Recovery

If the terminal is unreachable:

```powershell
pnpm local:status
pnpm local:health
Get-Content "$env:USERPROFILE\.nightshift\nightshift.log" -Tail 100
pnpm local:restart
```

If an order result is `unknown`, do not resubmit. Preserve the displayed CLOID and reconcile it through the signer or public Hyperliquid order-status API before any further action.

For an Arcus signer incident, keep the web kill switch active and run `pnpm signer:status` plus `pnpm signer:health`. `pnpm signer:restart` changes only the testnet signer child; `pnpm signer:stop` cleanly removes signing availability. Preserve the Arcus `clientId` and signer database for reconciliation and never infer that a missing local process means a prior request failed. Follow [`arcus-reconciliation-incident.md`](/nytshift-docs/arcus/arcus-reconciliation-incident.md); never clear the durable latch or alert outbox by editing local state.

### Verified checkpoint backups

Create a point-in-time snapshot while NIGHTSHIFT remains live:

```powershell
pnpm backup:create
pnpm backup:list
pnpm backup:verify -- <backup-id>
```

`backup:create` reads only regular, allowlisted `rhc-activity-v1.json`, `rhc-provider-observability-v1.json`, `control-plane-observability-v1.json`, `proposal-lifecycle-v1.json`, `agent-access-v1.json`, `agent-paper-v1.json`, `agent-automation-v1.json`, `market-history-v1.json`, `portfolio-reconciliation-v1.json`, `arcus-customer-withdrawals-v1.json` and `customer-profiles-v1.json` checkpoints. Atomic store replacement means each captured file is complete. The stores are independent; the backup does not claim a cross-store transaction boundary. The versioned manifest fixes chain ID 4663, logical path, data class, byte length and SHA-256 digest. Verification rejects unknown paths, undeclared files, symlinks, malformed schemas, wrong sizes and changed hashes. Control-plane schema v3 additionally requires canonical span/root UUIDs; v1/v2 remain restore-compatible. Proposal verification rejects undeclared/secret-bearing fields, invalid lifecycle consistency, duplicate IDs and out-of-order state. Agent-access verification accepts strict v1/v2 checkpoints plus schema v3 MCP policies/activity and rejects token-shaped plaintext, invalid digests/mandates/scopes, broken event references and inconsistent order. Agent-paper verification rejects non-canonical exact decimals, malformed policy/ledger/risk linkage, duplicate IDs, undeclared fields and credential material. Agent-automation verification accepts strict schema-v1/v2 checkpoints plus current schema v3 and rejects undeclared/sensitive fields, private-key material, malformed public JWKs/digests, invalid total-fee ceilings, replay/state inconsistencies, broken references and arithmetically inconsistent aggregate usage. Portfolio verification accepts only opaque account digests plus strict order/fill/position/funding/account and fixed-code divergence state; account-address, key, token and unknown fields are rejected. Arcus customer-withdrawal verification accepts only opaque customer/session/wallet bindings plus strict one-use acknowledgement/terminal lifecycle state; raw address, DID, key, signature, token and unknown fields are rejected. Customer-profile verification accepts only opaque customer digests and the exact bounded preference schema; raw Privy DIDs, email, wallet, token, key and unknown fields are rejected. `NIGHTSHIFT_BACKUP_RETENTION` retains 14 verified snapshots by default and accepts 1 through 365. Invalid backups are never silently deleted by retention pruning.

Local snapshots live under `~/.nightshift/backups`. They are private-permission files but are not encrypted by NIGHTSHIFT. The provider, control-plane, proposal-lifecycle and market-history checkpoints are secret-free telemetry. Agent-access contains names, mandates, MCP scopes and fixed audit metadata but no plaintext bearer; agent-paper contains connection-owned policies and simulated positions/executions but no model or venue credential; agent-automation contains policy public keys, account scope, action metadata and opaque aggregate commercial identifiers/counters but no license token, order body, private key or plaintext agent token; the portfolio checkpoint contains capital state under an opaque digest but no account address; the Arcus customer-withdrawal checkpoint contains opaque customer/session/wallet fingerprints plus lifecycle evidence but no raw address or signature; the customer-profile checkpoint contains user-chosen display preferences under an opaque customer digest but no raw DID, email or wallet address; and the activity checkpoint contains public wallet addresses and public token history. Move backups to operator-controlled encrypted storage and apply the organization's retention/access policy.

Restore is intentionally offline and explicit:

```powershell
pnpm local:stop
pnpm backup:verify -- <backup-id>
pnpm backup:restore -- <backup-id>
pnpm local:start
pnpm local:health
```

The restore command refuses to run while the supervisor PID is live. It verifies the complete backup first, stages and rechecks every replacement, preserves current checkpoint bytes under `~/.nightshift/recovery/pre-restore-*`, then atomically installs the verified files. If installation fails, moved files are rolled back. After startup, keep execution stopped, verify `/api/rhc/activity/health`, `/api/rhc/providers/health`, `/api/market/history/health`, proposal lifecycle, agent-access, MCP connection, paper, automation and portfolio-reconciliation aggregates in `/api/health`, then revoke restored external-agent credentials and all restored automation policies before deliberately reopening execution. A corrupt or unsupported store returns `503` and is never silently discarded.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://nytshift.gitbook.io/nytshift-docs/normative-design/local-production.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.