Operator guide

Operators maintain service truth, user safety, policy integrity, verifier independence, settlement reconciliation, and recoverability. They do not manufacture demand, silently alter outcomes, or treat a successful tool call as proof of external state.

Routine responsibilities

• Reconcile application, API, database, bot, edge, and chain state.
• Keep public pre-launch and fixture labels accurate.
• Version campaign rules, score models, proof schemas, and external configuration pins.
• Review exceptions and ambiguous evidence with an attributable record.
• Separate creator obligations, project-refundable funds, protocol fees, and treasury assets.
• Monitor credentials, signer roles, verifier quorum, contract pauses, and deployment drift.
• Maintain rollback images, database backups, and recovery procedures.

Before enabling a campaign

Confirm project ownership, policy version, campaign terms, participant eligibility, reward currency, exact contract addresses, gross budget, fee, creator pool, creator limit, reward allocation, deadline, retention period, verifier set, emergency authority, signer destination, and expected post-state.

Simulate where supported. A timeout after a public mutation creates unknown state: query the receipt/state before any retry.

Verifier operations

Use three operationally independent verifiers for a 2-of-3 system. Keep signing keys outside source and logs. Each verifier must construct or validate the same domain-separated payload from independently observed evidence. Sort signatures by recovered address before submitting them to the prototype escrow.

Rotate a verifier only after confirming quorum remains possible. The prototype registry prevents removing a verifier when the count would fall below or equal the two-signer threshold.

Manual review

Manual review is appropriate for source outages, ambiguous evidence, appeals, suspected fraud, jurisdiction uncertainty, and conflicts between channels. Record evidence, policy/model versions, reviewer, decision, reason, time, affected amount, and whether a new attestation is required.

Manual review must not:

• change the campaign terms after creator acceptance;
• expose unnecessary personal data;
• convert ambiguity into automatic payment;
• reuse or edit a consumed attestation;
• bypass an onchain obligation or refund guard.

Communication

Publish only verified facts through an unaffected official channel. State what is affected, what is not known, whether funds or personal data may be at risk, what action users should avoid, and when the next update is expected. Never publish raw secrets, private evidence, or exploit details that expand harm.

For commands and recovery, use Deployment and runtime, Observability, and Incident response.