Isolated signing
Venue credentials belong only to loopback signer runtimes. Browser code receives no private key, unrestricted token or signer endpoint.
Keys stay outside the browser.
NYTSHIFT separates public data, customer identity, deterministic risk review and isolated venue signing. A login, wallet connection or configured service never creates execution authority.
Reconcile unknowns
An ambiguous submit or cancel result becomes reconcile-only. It is never converted into an automatic retry.
Disabled by default
Mainnet authority remains off until exact-account, eligibility, rehearsal, observability and release evidence all pass independently.
Report a vulnerability
The public disclosure mailbox and response SLA are pending operator verification. Until that contact is published, do not send secrets, wallet keys, credentials, live exploit payloads or customer data through product forms or public issue trackers.