Custody.

Self-custody and server-custodial signing coexist, selected per node by detected hardware. A TEE-equipped or key-holding runner signs locally and the node never sees the secret. A runner without a local key uses the server-custodial MPC path. Both are supported tiers.

On the self-custody path the signer holds the Ed25519 + ML-DSA-65 keypair locally. The client builds the canonical transaction hash (including the PQ verifying key), signs both legs, and submits the pre-signed transaction. The node verifies the signing key derives the sender, then verifies both the Ed25519 and ML-DSA-65 signatures — a missing leg is rejected.

const txHash = await client.wallet.sendSelfCustody({
  signer,          // holds Ed25519 + ML-DSA-65, never exposes the secret
  to: recipient,
  value: 1_000_000_000_000_000_000n,
});

Default 2-of-3 MPC shares. Auto-provisioned on identity registration. No seed phrase.

SOCIAL_RECOVERY_VALIDATOR  0x101d  N-of-M guardians
SESSION_KEY_VALIDATOR      0x101e  bounded session keys
SPENDING_LIMIT_VALIDATOR   0x101f  per-tx + daily ceiling

Guardian quorum signatures combine Ed25519 + ML-DSA-65 (the PQ-hybrid composite). Every installed module must approve a UserOperation.

On-chain validators are the primary control surface. The off-chain SpendingPolicyResolver is defence-in-depth, not the gating layer.