Signing and key custody in production POA

POA chain 77 is a production network. Producer and Agent Gateway signing use 2d-hsm on AMD SEV-SNP infrastructure. Explorer publishes deployed component versions.

Separate key roles

Role	Authority
Producer	Signs block hashes with ML-DSA-65. The signature does not replace independent transaction and state-root validation.
Agent wallet	Signs permitted operations for one assigned wallet. Gateway checks the API token, capability, and applicable policy.
Bridge operator	Signs bridge_lock on POA. Ethereum event verification and bridge limits remain required.
Ethereum vault operator	Separate operational key for OperatorVault.bridgeOut(destination, amount), limited to allowlisted destinations, per-transaction and rolling daily caps. Reserved for governance-authorized treasury/rebalance operations, not public withdrawals; distinct from the POA operator and claim gas EOA.
Vault governance	Separate principal controlling signer rotation, allowlists, caps and upgrades. Its compromise can remove the operational restrictions; deployment must verify custody and governance controls independently of TEE claims.
Ethereum claim	Uses a separate gas EOA for permissionless claims. The HTLC determines the recipient.

Production bridge-lock signer

The POA-side bridge operator uses 2d-hsm through the agent_gateway protocol profile with the separate singleton key purpose agent_bridge_operator_k1. BRIDGE_OPERATOR_ENCLAVE_KEY_REF selects this path; endpoint, chain ID and sealed environment identity are pinned by the matching BRIDGE_OPERATOR_ENCLAVE_* configuration. This key is neither the ML-DSA producer key nor an assigned agent-wallet key. Internal environment identifiers are cryptographic bindings; they do not classify chain 77 as a test network and must not be renamed as a branding change.

Chain.Bridge.Executor applies host SignerPolicy and OPA checks before SIGN_BRIDGE_LOCK. The enclave constructs bridge-lock calldata and pins the precompile destination, zero transaction value and sealed chain ID; the host verifies the returned signer and signing hash against the requested envelope. Ethereum-event/finality validation remains a separate verifier obligation. These checks do not by themselves prove the trustworthiness of the launched image or host-provided Ethereum evidence: verify the deployed release/image, SEV-SNP attestation provenance, pinned public-key identity and policy as distinct release gates.

On chain 77, BRIDGE_NETHSM_SIGNING_ENABLED=false disables the NetHSM signing path, not enclave bridge-lock signing. The enclave uses AGENT_SIGNER_LIVE_SIGNING_ENABLED; automatic locks also depend on BRIDGE_INTENT_WATCHER_MODE=live. Keep the watcher disabled or in dry_run when arming agent signing unless bridge locks are explicitly intended. Changing the signer backend or money switch requires a process restart and identity/canary verification. The existing deployment’s identity-check settings are not evidence that a new custody release passed attestation or recovery checks.

The separate Ethereum OperatorVault.bridgeOut role is governed by its own signer configuration and vault controls; it does not inherit authority from the POA enclave key. Permissionless Ethereum claims use the gas EOA and cannot choose a different HTLC recipient. Public POA-to-Ethereum withdrawals remain disabled.

Wallet provisioning

Public registration assigns a key from the backed-up, identity_verified pool. It does not generate or export keys over HTTP. Pool exhaustion stops issuance. Registration quotas bound assignments; payments remain subject to Gateway and signer policy.

Trust boundary

The TEE separates the key from the calling host. This does not remove the need to verify the launched image, attestation, policy, and backup recovery. A producer signature identifies the signed hash; the verifier separately validates block execution. The API token remains a secret with authority over its assigned wallet.

Checks before a configuration change

1. Check node and 2d-hsm versions, expected key identity, and connection settings.
2. Run the identity canary and establish backup recovery evidence for the applicable policy.
3. Check limits, recipients, and feature switches before enabling write paths.
4. After the change, verify block signatures and a bounded agent operation; stop the affected operation on mismatch.

These checks govern production configuration changes. They do not assert that any particular recovery ceremony has already been completed.

Signing in the TEE · Agent Gateway · Bridge · Bridge monitoring