Operations and incident response

Routine checks

• Envio cursor advances and remains behind head only by configured finality.
• Every raw page exists and decompresses from R2.
• Held account positions reconcile directly from Vault reads and wallet NFT UTXOs; escrowed and historical D1 rows reconcile to exact contract state.
• Oracle source is fresh and quotes verify against the configured signer.
• Liquid plus deployed collateral covers principal liabilities under the approved policy.
• USDC reserves cover promised returns under the approved policy.
• Upcoming maturity and unbonding claims have sufficient liquid assets.

Pause triggers

Pause new activity for signer compromise, stale/divergent pricing, reconciliation failure, unexplained asset movement, strategy loss, reserve breach, or contract exploit indicators. Pausing is not a recovery mechanism and cannot confiscate NFTs.

Response

1. Pause affected contracts with the manager multisig.
2. Stop oracle issuance when quote integrity is uncertain.
3. Preserve Worker logs and R2 evidence.
4. Reconcile contract balances and liabilities at an exact block.
5. Publish scope, affected positions, and claim implications.
6. Rotate signer or manager through documented on-chain controls if required.
7. Resume only after independent review and a recorded multisig decision.

Never rewrite indexed evidence or silently replace an exact-block check with latest state.