# Operator Key Custody

## Enforced state

The canonical PLAIS operator address is preserved, but its private key is not available to the web process.

- Custody: Windows DPAPI `CurrentUser`, stored under the ignored `data/operator-custody/` directory.
- Web signer: offline and fail-closed.
- PLAIS external transfers: disabled.
- BNB, BABYDOGE, and TRX transfers: disabled.
- Operator pages: address, balance, and history are read-only.
- Readiness: the configured address, canonical network metadata, genesis allocation, vault metadata, signing lock, and multichain lock must agree.

The vault file and directory have inheritance disabled. Access is limited to the migration account, `SYSTEM`, and the local Administrators group. The migration performs a decrypt-and-address self-test before removing the plaintext key from `.env`.

## One-time migration

Run this only on the custody host, while `.env` still contains the existing canonical operator key:

```powershell
npm run operator:custody:migrate
```

The command verifies that the key derives the existing operator address and that the address owns the canonical genesis allocation. It then creates and audits the DPAPI vault, blanks `PLAIS_EVM_OPERATOR_PRIVATE_KEY`, and writes the fail-closed runtime settings.

After migration, use the non-signing audit:

```powershell
npm run operator:custody:audit
```

The audit decrypts only inside the CLI process and prints booleans, never the private key or ciphertext.

## Recovery boundary

DPAPI `CurrentUser` is bound to this Windows account and its host profile. The vault is an offline recovery control, not a portable backup and not an online signer. Do not restore signing by putting the private key back into `.env`.

If the service runtime account changes, use the two-account rewrap ceremony. Run `operator:custody:rewrap:stage` under the current vault owner, then run `operator:custody:rewrap:finalize`, `operator:custody:audit`, and `operator:custody:rewrap:cleanup` under the target runtime account. The short-lived handoff is DPAPI `LocalMachine` ciphertext protected by filesystem ACLs; plaintext is never written to disk or emitted to logs. Do not proceed if either identity or ACL audit fails.

Before any public issuance or value transfer is enabled, replace this interim custody with an approved hardware wallet, HSM/KMS, or remote signer workflow that includes multi-person approval, transaction simulation, amount and destination policy, immutable audit logging, and a tested disaster-recovery ceremony.
