Pause new execution while retaining original outcomes.
Incident controls fence new internal transfers, withdrawal/refund reservations, signing and broadcast authorizations. They do not cancel requests already started. Current operator sessions and passkey verification protect all private decisions.
01Pause and inspect
Owner, Operations or Security can create a pause with a title, severity and reason. Existing journals, reservations, signed bytes and request identities remain intact. Receipt lookup, original-result recovery, finality and reconciliation continue. A current authenticated account can read generic availability without private incident detail.
02Review closure independently
Request closure with a retained evidence reference. Another current incident operator approves the case. Closure does not resume execution, clear chain discrepancies, return reserves or establish non-broadcast.
03Require Owner and Security for resumption
One current Owner and a different Security operator decide a 15-minute resumption request. Current requester role/session/passkey authority and the exact control revision must still match. Open cases and original unsettled or uncertain signing/broadcast records block resumption. New pauses invalidate pending reviews.
04Preserve interrupted request identity
Every POST needs its original Idempotency-Key and body. The dashboard retains incident tracking across reload and authentication step-up. A replay returns the original decision without overriding a later pause. Inspect current records after recovery.
05Keep restored authority isolated
A verified isolated restore atomically revokes restored sessions, API keys, authentication challenges and operator login factors, cancels pending resumes, and fences the target as recovery_required. All dynamic /v1 routes, including sign-in, public checkout and incident controls, then return HTTP503 SERVICE_RECOVERY_REQUIRED with Retry-After; static assets/networks remain available. Keep the target physically isolated. Original-source factor recovery has a separate three-proof offline handoff to paused. Restored-primary promotion still requires fresh authority, catalog recovery and independent custody/chain/ledger reconciliation.
06Check access readiness before reconnecting
GET /ready returns HTTP503 while recovery or an unavailable control store holds access. GET /health is process/database liveness and can remain HTTP200 during recovery. An available /ready response does not enable mainnet or authorize financial execution. Preserve original request identities during maintenance; after service returns, inspect their original outcomes before retrying writes.
// Generic authenticated availability. App/admin audiences use separate sessions.
GET /v1/financial-status?audience=app
// Current authorized admin MFA; every POST requires Idempotency-Key.
GET /v1/admin/incidents
POST /v1/admin/incidents/pause
{ "title":"Investigate original request outcomes", "severity":"critical", "reason":"Pause new requests while original outcomes are independently inspected." }
POST /v1/admin/incidents/{id}/actions/request-closure
{ "reason":"Original evidence was reviewed independently.", "evidenceReference":"Protected incident report reference" }
POST /v1/admin/incidents/{id}/actions/approve-closure
{ "reason":"Another operator approves this operational closure." }
POST /v1/admin/incidents/resume-requests
{ "reason":"Current Owner requests independently reviewed resumption.", "evidenceReference":"Protected reconciliation report reference" }
POST /v1/admin/incidents/resume-requests/{id}/approve
{ "reason":"A different current Security operator approves resumption." }
// Resumption preserves every chain/custody/nonce/liquidity and user-approval gate.Open your workspace