Optional Lit and PKP backend

Lit is an optional backend and does not replace Luvion's policy, role separation, high-threshold authorization, or evidence layers. Luvion supplies the authorization decision and certificate. Lit can provide a PKP-backed validation or execution backend after that decision.

Division of responsibility

Luvion owns	Lit provides
Canonical operation intent	Immutable Action execution environment
Policy version and separated approvals	Dedicated PKP-backed attestation
Luvion authorization certificate	Group-scoped permission boundary
Request state, idempotency, and evidence	Cryptographic proof that the pinned Action accepted the exact request

Validated flow

Luvion policy and approvals
  -> Luvion authorization certificate
  -> exact Lit validation request
  -> immutable Lit Action verifies all bound fields
  -> dedicated PKP signs an attestation
  -> Luvion independently verifies and stores the receipt

The current sandbox profile pins one Lit Group, a dedicated PKP, one immutable Action CID, the exact Action source digest, and the active Luvion authorization key identifier. The sidecar rejects changes to those bindings and rejects conflicting retries.

What has been verified

• a live Chipotle sandbox Action accepted an exact Luvion authorization;
• the dedicated PKP produced an attestation and Luvion independently recovered the expected signer;
• an identical retry reused the durable result without another provider call;
• a deployed sidecar survived forced process termination and reconciled the original result after restart;
• Action, authorization-key, and least-privilege usage credentials were rotated with old access removed.

Current boundary

The generic treasury-validation profile provides validation-only operation. It stores a PKP-signed validation receipt, leaves the Luvion request in the authorized state, and records execution as false.

This is distinct from the protocol-upgrade Gate profile. The old immutable-PKP Gate has BSC testnet execution/cancellation evidence using an internal 1-of-1 sandbox authorization certificate. New Gate PKP-rotation tests remain local in the reviewed records. Generic Action or credential rotation must not be used as evidence of that new Gate's testnet PKP rotation. See Protocol upgrade.

The production Lit profile adds an independently reviewed transaction construction path, permission and PKP rotation drills, monitoring, external security review, and partner acceptance. Lit contributes a compatible backend and an additional execution-resilience path to the Luvion architecture.