docs: scope the migration-complete claim to the codebase - mainnet stays custodial until the cutover deploy

Critical truthfulness defect found by review: README.md's security notice claimed, in
unconditional present tense, that "the non-custodial migration is complete... No tool on this
hosted server accepts a mnemonic... this server never holds one" - sitting directly below the
README's own mainnet hosted-URL connect example. Per docs/architecture/non-custodial-split.md's
own rollout section, mainnet stays on its last custodial image until a separate, deliberate
cutover deploy ships - and nothing on this branch (or the two PRs it stacks on) has even merged
yet. A reader who followed the mainnet connect line and trusted the notice as written would be
told something the repo's own architecture doc directly contradicts. The rewrite had also
dropped the prior notice's hedge ("prefer self-hosting until the migration completes") and
replaced it with a strictly stronger, zero-caveat claim - the exact failure mode this migration
exists to prevent, reproduced at the documentation layer.

Fixed by rescoping every claim to the codebase and adding an explicit deployment-status caveat:

- README.md: added a deployment-status note directly beneath the hosted-servers URL table
  (before the connect command), stating plainly that testnet auto-deploys from main but mainnet
  stays on its last custodial image until a separate cutover deploy, and to treat the mainnet
  instance's signing tools as custodial until then. The security notice itself now says "as of
  this release, the non-custodial migration is complete in this codebase" and "no server running
  this release ever holds one," with an explicit closing line that this is a claim about the
  code, not about every deployment of it. The "Local signer" section got the same rescoping
  (it made the identical unscoped claim). The Self-Improvement Module features bullet was also
  adjusted: it had "all keyless" sitting directly next to a pre-existing "(live on Vector
  mainnet)" parenthetical, risking the same conflation between the on-chain module's blockchain
  deployment and this codebase's MCP-server code state - now stated as two separate facts.
- packages/signer/README.md: the "keyless across the board" pairing-status bullet and the
  "keeps your mnemonic off the hosted server" closing line both rescoped to "in this codebase" /
  "off any server running this release," each with an explicit note that the mainnet hosted
  instance is not yet running this release.
- .superpowers/sdd/pr9-body.md (gitignored, not part of this commit): opening paragraph and the
  stacked-PR timing note both updated with the same scoping - merging this PR does not deploy
  it anywhere, and the mainnet cutover is a separate future step.

Grepped the tree afterward for other unscoped "hosted server ... keyless"-class claims: found
none beyond what's fixed above. Pre-existing, unrelated mentions of "hosted server" in
docs/architecture/non-custodial-split.md (the historical problem statement) and README.md (a
self-hosting logistics note) were checked and left alone - correctly scoped by their own
surrounding context already.

README.md

@@ -15,22 +15,34 @@ Hosted instances run on both networks, exposing all 24 tools:
 | Mainnet | `https://mcp.vector.mainnet.apexfusion.org/sse` |
 | Testnet | `https://mcp.vector.testnet.apexfusion.org/sse` |
 
+> **Deployment status differs by network.** Testnet auto-deploys from `main` on every merge, so
+> it tracks this codebase closely. **Mainnet stays on its last custodial image until a
+> deliberate cutover deploy ships** - that deploy is a separate, future step, not automatic and
+> not implied by any merge (see [docs/architecture/non-custodial-split.md](docs/architecture/non-custodial-split.md),
+> section 11, "Rollout"). Until it ships, treat the mainnet instance's signing tools as
+> custodial: assume they may still accept a mnemonic as a tool-call parameter, and prefer
+> self-hosting this release or the testnet instance instead.
+
 Connect from Claude Code in one command:
 
 ```bash
 claude mcp add --transport sse vector-mcp https://mcp.vector.mainnet.apexfusion.org/sse
 ```
 
-> **Security notice: the non-custodial migration is complete.** No tool on this hosted server
+> **Security notice: as of this release, the non-custodial migration is complete in this
-> accepts a mnemonic, private key, or any other key material. Every `build_*` tool constructs an
+> codebase.** No tool in this repository accepts a mnemonic, private key, or any other key
-> unsigned transaction from a wallet *address* only, and every signing operation happens locally
+> material. Every `build_*` tool constructs an unsigned transaction from a wallet *address*
-> on your own machine, through the local signer companion. Broadcast the signed result with
+> only, and every signing operation happens locally on your own machine, through the local
-> `vector_submit_transaction` - your seed phrase never leaves your machine, and this server never
+> signer companion. Broadcast the signed result with `vector_submit_transaction` - your seed
-> holds one. This is enforced mechanically, not just by convention: the builder's custody
+> phrase never leaves your machine, and no server running this release ever holds one. This is
-> boundary test scans every source file for key-material vocabulary against an allowlist that is
+> enforced mechanically in the code, not just by convention: the builder's custody boundary test
-> now empty and pinned at size zero, so a future change cannot silently reintroduce a mnemonic
+> scans every source file for key-material vocabulary against an allowlist that is now empty and
-> parameter without failing that test by name.
+> pinned at size zero, so a future change cannot silently reintroduce a mnemonic parameter
-> See [docs/architecture/non-custodial-split.md](docs/architecture/non-custodial-split.md).
+> without failing that test by name.
+> **This is a claim about the code, not about every deployment of it** - see the deployment
+> status note above the connect command, and
+> [docs/architecture/non-custodial-split.md](docs/architecture/non-custodial-split.md) for the
+> full rollout plan.
 
 Self-hosting instructions are below.
 
@@ -42,15 +54,17 @@ stdio transport, no Provider, no egress — so a key given to it never reaches a
 or your model provider. Four tools: `vector_signer_get_address`, `vector_signer_decode_transaction`,
 `vector_signer_sign`, `vector_signer_get_spend_limits`.
 
-**This signer is the single signing point for every family this server exposes.** The full
+**In this codebase, this signer is the single signing point for every family the builder
-non-custodial flow is live for all of them: `vector_signer_get_address` → `build_*` →
+exposes.** The full non-custodial flow is live in this release for all of them:
-`vector_signer_sign` → `vector_submit_transaction` → `vector_await_transaction`. No step in that
+`vector_signer_get_address` → `build_*` → `vector_signer_sign` → `vector_submit_transaction` →
-chain puts a mnemonic in front of this server or your model provider, for any tool. The
+`vector_await_transaction`. No step in that chain puts a mnemonic in front of a server running
-build → submit → await half is E2E-proven on Vector testnet across the wallet/tx, smart-contract,
+this code, or your model provider, for any tool. The build → submit → await half is E2E-proven
-agent-registry, and self-improvement families, including the first keyless-built proposal
+on Vector testnet across the wallet/tx, smart-contract, agent-registry, and self-improvement
-submission the deployed self-improvement module validator has ever accepted; see
+families, including the first keyless-built proposal submission the deployed self-improvement
+module validator has ever accepted; see
 [`packages/signer/README.md`](packages/signer/README.md#known-limitations) for exactly what that
-testing does and does not exercise on the signer's side.
+testing does and does not exercise on the signer's side. **This describes the code, not every
+deployment of it** - see the deployment status note above.
 
 See [`packages/signer/README.md`](packages/signer/README.md) for configuration, tools, and known
 limitations.
@@ -62,7 +76,7 @@ limitations.
 - **Smart contracts** - deploy Plutus/Aiken validators, lock and spend UTxOs at script addresses (keyless)
 - **Agent registry** - register, discover, update, transfer, and deregister on-chain AI agent identities via soulbound NFTs (keyless - build, sign locally, broadcast)
 - **Agent messaging** - send on-chain messages between agents via TX metadata (keyless)
-- **Self-Improvement Module** - browse, submit, critique, and endorse improvement proposals, all keyless (live on Vector mainnet)
+- **Self-Improvement Module** - browse, submit, critique, and endorse improvement proposals; the on-chain module is live on Vector mainnet, and every write tool is keyless in this codebase
 - **Safety controls** - per-identity rate limiting; spend limits for every family are enforced by the local signer, per user - the server holds no spend-limit state of its own
 - **SSE transport** - HTTP server with Server-Sent Events for MCP client connectivity
 

packages/signer/README.md

@@ -144,10 +144,10 @@ over-counts, which refuses too much rather than too little.
 - **Prompt injection is bounded, not eliminated.** Policy refuses out-of-limit
   transactions, but an injected agent can still cause any transaction *within* policy.
   Recipient allowlisting is the next lever.
-- **Pairing this signer with the hosted builder now removes the custody exposure it was
+- **Pairing this signer with the builder in this codebase now removes the custody exposure it
-  designed to fix, for every family this server exposes.** The signer's own four tools are
+  was designed to fix, for every family the builder exposes.** The signer's own four tools are
   complete and independently verified end to end against live chain data
-  (`test/integration/roundtrip.test.ts`), and the hosted *builder's* tools are keyless across
+  (`test/integration/roundtrip.test.ts`), and this codebase's *builder* tools are keyless across
   the board: every `build_*` tool, across the wallet/transaction, smart-contract, agent-registry,
   and self-improvement families, takes a wallet *address* and never a mnemonic, and
   `vector_submit_transaction` / `vector_await_transaction` complete the round trip. The
@@ -162,10 +162,13 @@ over-counts, which refuses too much rather than too little.
   `vector_signer_sign` directly, not a call to this package's own code), then submit and confirm
   on real Vector testnet blocks. This signer's own tool surface, policy engine, and audit log
   are exercised separately, by this package's own suite (`test/integration/roundtrip.test.ts`
-  and the smoke tests above). **Nothing is left open: this was the last custodial family.** The
+  and the smoke tests above). **Nothing is left open in the code: this was the last custodial
-  non-custodial migration described in
+  family.** The non-custodial migration described in
   [`docs/architecture/non-custodial-split.md`](../../docs/architecture/non-custodial-split.md)
-  is complete.
+  is complete in this codebase. It is not yet complete on every deployment: the mainnet hosted
+  instance stays on its last custodial image until a deliberate cutover deploy ships (see that
+  document's rollout section). Until then, pair this signer with a self-hosted or testnet
+  builder if you want the guarantee above to actually hold - not the mainnet one.
 
 ## Running it
 
@@ -191,9 +194,11 @@ example):
 }
 ```
 
-Register it alongside the hosted builder so an agent has both sets of tools available. This
+Register it alongside the builder so an agent has both sets of tools available. This pairing
-pairing keeps your mnemonic off the hosted server for every family it exposes: wallet,
+keeps your mnemonic off any server running this release, for every family it exposes: wallet,
-transaction, smart-contract, agent-registry, and self-improvement alike. See the last bullet
+transaction, smart-contract, agent-registry, and self-improvement alike - as long as that
+server is actually running this release. The mainnet hosted instance is not, yet: see the
+deployment status note in the root README before assuming this covers it. See the last bullet
 under Known limitations above for the full evidence.
 
 ## Testing