The seed-phrase-as-loot reward is the most dangerous feature in this project. It is also one of the most powerful teaching tools we have: the treasure is real, so the lesson is real. We ship it with both hands on the wheel.

We are scattering shares of a real Bitcoin wallet across a game world generated by a local LLM and unlocked by user-solved puzzles. A bug anywhere in that chain — bad randomness, a share stored in one place, a puzzle that leaks a word, a hallucinated "fact" that reveals a fragment — can burn real money or hand it to the wrong person.

1. Regtest is the default network. PA_NETWORK=regtest. Play money, zero real risk. This is where every operator learns and every feature is proven.
2. Testnet is opt-in. For realistic rehearsal without real value.
3. Mainnet is doubly gated. It requires BOTH:
   • PA_MAINNET_ACK=true (the operator's explicit, informed acknowledgement), and
   • a passing security-auditor review of the value paths. services/bitcoin-bridge/vault.py refuses real-value operations otherwise, and that guard is the first code executed in the file. Treat any bypass as a release-blocking bug.
4. Seed-loot is off by default. PA_SEED_LOOT_ENABLED=false. The operator turns it on deliberately, after reading this doc.

• Never store the full 24-word phrase in one place. Ever. Shamir's Secret Sharing splits it into shares with a threshold (e.g. 15 of 24). No single file, table, agent, or backup holds the whole secret. A single point of storage is a defect.
• Fail closed on money paths. Flavor prose may stream before it's verified; anything that reveals a fragment must pass the hallucination guardrail (and the human operator, if quarantined) before it reveals. Speed everywhere the stakes are low; rigor everywhere they aren't.
• Proof of understanding gates the final word. The 24th word / checksum only reveals when the player teaches the concept — this both verifies mastery and blocks brute-forcing.
• Good randomness or nothing. Key material and SSS shares use vetted crypto libraries and the OS CSPRNG. No home-rolled crypto.
• The private key never leaves the box and never enters git (.gitignore enforces the second).

We do not wag fingers; we teach the stakes plainly and give tools:

• The reward word is written on an in-game scroll. Lose the scroll, lose the sats. This is the Zelda-chest lesson — the seed phrase is the treasure; guard it like one. 💜
• "Bank Vault" NPCs offer secure storage with multi-factor access for players who want it.
• Every player who can earn real sats first passes a short self-custody lesson (the pacbot skill).

Distributing Bitcoin as a reward for educational achievement, from a non-profit, may carry tax, money-transmission, and jurisdictional implications. This is flagged for Pac + counsel before any mainnet flip — it is a legal question, not only a technical one. Regtest/testnet development proceeds freely in the meantime.

• security-auditor review passed on all value paths.
• Mainnet guard proven un-bypassable (grep every path that can move funds).
• No full-seed storage anywhere (grep for reconstruction points).
• Guardrail proven to gate every reveal path.
• Randomness sources verified.
• Legal sign-off from Pac + counsel on the reward model.