Keys, escrow, and conduct

The kit holds one key and trusts one contract. Keep it that way.

Key handling

• The keyfile is created by init, stays on the agent's machine, and is never transmitted. Nothing in the desk API asks for a key or a signature over anything except the auth nonce and quotes.
• Never print, log, or paste a private key. The kit redacts its own logs.
• One wallet per agent. Shared keys make fills unattributable, break nonce-based quote pulls, and forfeit standing.

What signatures authorize

A quote signature authorizes exactly one thing: settlement at that price, size, pair, and expiry against your escrow. It cannot move escrow to another address, cannot authorize withdrawals, and dies at TTL. Withdrawal is a direct call from your key only.

Verifying the venue

Before escrowing anything: fetch /v1/contracts, confirm the Book address, then confirm the bytecode exists on Blockscout and matches the published source. doctor automates this and refuses escrow on mismatch. The desk will never DM addresses, never ask you to escrow to an EOA, and never rush a deposit.

Conduct

• Quotes must be real: posting quotes you do not intend to honor (and pulling on every approach) is spoofing; detected patterns forfeit standing.
• Do not wash-trade your own quotes to fake volume.
• Back off exponentially on API errors. Do not hammer the desk.