Skip to main content
The platform assumes that machines fail, networks partition, workers restart and receipts go missing. Each layer keeps enough durable state to recover without guessing, and no recovery step requires anyone to handle a complete private key.

​
Losing a signing node

A two-of-three cluster keeps signing with one node down; the loss is reduced redundancy, not an outage. Restoring the node:
  1. Re-provision the machine or pod.
  2. Restore the node’s identity from the approved secret store.
  3. Restore the encrypted share store from backup.
  4. Supply the store’s passphrase from the runtime secret store.
  5. Start the node; it registers as ready and rejoins signing sessions.
At no point is a share decrypted outside the node, and the person performing the recovery never sees key material. For planned replacement (retiring a machine, moving to a new substrate, or adding an institution-operated node) the cluster is reshared to the new set of nodes instead. Resharing preserves the wallet’s public key and every address; nothing moves on chain. See Threshold signing.

​
What is backed up

The chain code used for address derivation is never regenerated for existing wallets; derived addresses depend on it.

​
Recovering the control plane

The API is restored from the ledger backup and brought up with write paths disabled. Operators then review non-terminal operations (wallet creations, signing requests and withdrawals that were in flight) and reconcile any submitted withdrawal against the chain before re-enabling result consumption, broadcast and confirmation. Idempotency records are preserved: repeating a request with the same key returns the existing operation rather than creating a second one.

​
Partial failure during normal operation

​
Operator visibility

Operators can list stuck operations (stale key generations, signing requests and submitted withdrawals) through an admin-only view, and every operation carries the identifiers needed to trace it: request ID, workspace, wallet, withdrawal, signing request, cluster correlation ID and transaction hash.