# Centralized Dependencies — Vaultfire V3

Every runtime dependency below is a single point of failure. This list is
required reading before the pilot enable vote.

## Infrastructure
| Dependency | Role | Fallback? | Notes |
|---|---|---|---|
| Vercel | UI + `/api/*` hosting | None | If Vercel is down, users cannot reach V3 write flows. V2 read paths keep working via cached SDK + direct RPC. |
| Alchemy | Primary Base RPC + webhooks | `base-rpc.publicnode.com` read fallback wired in `pr7/api/v3` | No webhook fallback yet. |
| Upstash KV | Idempotency keys, rate-limit counters, session tokens | None | If Upstash down, idempotency degrades to per-node in-memory and rate limiting relaxes; pilot caps must not be raised while degraded. |
| GitLawb node (node.gitlawb.com) | Public repo mirror | Local git; primary git host TBD | Push is disabled by default per operator policy. |

## Keys & signers
| Key | Role | Storage | Rotation cadence |
|---|---|---|---|
| MultisigGovernanceV3 signers | Approve every admin call after timelock | Hardware wallets, physically separated | On any suspected exposure or annually. |
| Guardian key | Pause-only fast lane | Separate hardware wallet | On any exposure; also after every pilot phase. |
| StreetCredV3 attester keys | Post attestation signals | Hot but per-attester | On any exposure. |
| x402 payee (`0xfA15…813C` = ghostkey.base.eth) | Receives priced-endpoint payments | Deployer's wallet | Move to multisig before public pilot enable. Recorded as pilot blocker. |

## Off-chain services
| Service | Role | Fallback? |
|---|---|---|
| Facilitator (x402) | Verifies payment, mediates 402 challenge | Sandbox tests exist; production must be dual-region. |
| Indexer | Reconstructs solvency view | None yet — pilot blocker until dual-writer. |

## Governance
| Element | Status |
|---|---|
| Multisig signer set | Not yet appointed. Blocker. |
| Timelock duration | Default 24h in code. Must be ratified. |
| Guardian identity | Not yet appointed. Blocker. |
| Bug bounty program | Draft only. See `SECURITY.md`. |

## Explicit non-goals of V3
- V3 does not replace V2. V2 addresses stay live and read/writeable.
- V3 does not migrate user funds automatically. See `baseline/MIGRATION_PLAN.md`.
- V3 does not remove ghostkey-controlled deployer authority from V2 contracts (they are immutable; scope is out of reach).
