Compatibility matrix
This matrix separates tested pilot behavior from interfaces, reference designs, and research paths. It is the source of truth for external capability claims.
Status vocabulary
| Status | Meaning |
|---|---|
| Controlled validation | Implemented and covered by automated or recorded non-production tests |
| Interface defined | Contract and validation rules exist; a named partner implementation is still required |
| Reference design | Integration and security requirements are documented; partner enforcement acceptance is the next gate |
| Experimental | Research-only; prohibited for real keys or production assets |
None of these labels means production readiness, third-party audit completion, or acceptance by a named design partner.
Capability matrix
| Component or path | Current status | Evidence available now | Missing before production |
|---|---|---|---|
| Policy, roles, approvals, request state, and evidence export | Controlled validation | Deterministic tests and reproducible release evidence | Multi-tenant admission, production operations, external audit, partner acceptance |
| FROST Ed25519, 3-of-5 on one controlled host | Controlled validation | Process, restart, and aggregate-verification tests; controlled lifecycle replacement is not automatic committee failover | Independent machines, administrators, failure domains, and protected key hardware |
| FROST Ed25519, 5-of-7 and 22-of-33 certificate profiles | Controlled validation | RFC 9591 authorization-certificate tests for both profiles | Independent operator deployment, production DKG, protected key custody, load and fault evidence |
| Algorithm-neutral signer backend | Controlled validation | FROST backend and stable backend boundary | Reviewed threshold ECDSA, hardware signer, or external custody implementations |
| Dynamic committee selection and rotation | Experimental | Research implementations and state-machine tests | Governed candidate registry, bias-resistant randomness, Sybil controls, multi-operator rotation drills |
| Proactive resharing and incremental DKG | Experimental | Research implementations and lifecycle tests | Reviewed production protocol, participant-isolated ceremony, complaint handling, HSM/KMS custody |
| Remote FROST signer transport over pinned mTLS | Controlled validation | TLS 1.3, leaf pinning, signed envelopes, bounded requests | Multi-host deployment, capacity controls, metrics, certificate automation, external review |
| Registry, key-epoch, and certificate lifecycle | Controlled validation | Staging, overlap, activation, revocation, expiry, rollback rejection | Multi-operator approval, automated issuance, trusted time, HSM/KMS-backed identities |
| Independent evidence witness transport | Controlled validation | Signed receipts, exact retry, restart recovery, rollback detection | Separately administered retention-locked or WORM service |
| Restricted BSC ERC-20 wallet handoff | Controlled validation | Self-operated testnet and restricted wallet workflow with receipt reconciliation | Named partner environment, production key custody, operational acceptance |
| Vendor-neutral custody adapter | Interface defined | Stable request binding, idempotency, outcome and completion semantics | Provider mapping, authenticated transport, sandbox implementation, partner sign-off |
| Optional Lit PKP validation backend | Controlled validation | Live Chipotle sandbox validation, immutable Action binding, durable reconciliation, rotation drill | Reviewed transaction construction and broadcast path, monitoring, external review |
| Safe module, guard, or timelock verifier | Reference design | Exact certificate-binding and bypass requirements | Reviewed onchain verifier, testnet enforcement, bypass closure, partner acceptance |
| Old immutable-PKP UUPS upgrade Gate | Controlled validation | BSC testnet execution, independent cancellation, RPC fallback, and process recovery with a 1-of-1 sandbox authorization certificate | Distributed authorization integrated end to end, partner bypass closure, audit, independent infrastructure |
| New signer-epoch / PKP-rotation Gate | Controlled validation (local only) | Local EVM tests for delayed rotation, cancellation, and epoch isolation | Deployment and rotation drill for this version on testnet, followed by partner and production acceptance |
| Operational alert webhook | Controlled validation | Durable deduplication, degraded/reminder/recovered transitions, restart recovery | Real alert destination, on-call ownership, escalation and response drills |
| Threshold ML-DSA path | Experimental | Research tests only | Standardized construction, external cryptographic review, production implementation |
Configuration and parameter workflows
| Workflow | Current implementation | Execution verification |
|---|---|---|
| Cross-chain receive configuration | Fixed-policy OApp example: dual business approvals, controlled local 3-of-5 FROST, delay, cancellation and evidence. | Isolated chain 31337. FROST is verified off-chain; the Gate checks business signatures and a local attestor. See the walkthrough. |
| LTV parameter authorization | Exact request and policy, baseline checking, separated approvals, authorization and controlled wallet handoff. | Local transaction/result-observation tests; no parameter Gate or verified closure of administrator bypasses. Actual wallet plugins, Safe/AA and custody integrations require acceptance. |
The public source sample, hosted configuration workflow and local parameter tests are separate profiles. Their respective records are linked from Release evidence.
Integration decision rule
Start a design-partner pilot only when one row maps to a specific operation, owner, environment, and acceptance test. Do not combine several unaccepted paths into one pilot and describe the result as an end-to-end production system.
For any execution integration, complete the non-bypassable checklist. Check whether an owner, emergency key, legacy module or provider credential can execute the same operation around Luvion. Remove these alternate paths or subject them to the same authorization checks.