This program handles an identity capable of public signatures. Treat changes to backup decryption, signing, nonce generation, HTTP destinations, Keychain access, and prompt boundaries as security-sensitive.

• Never commit or request a private seed, identity backup, passphrase, API key, or signing key.
• Never send identity material to DeepSeek, Technocore, analytics, logs, or another server.
• Keep the Technocore base URL and allowed rooms fixed or strictly allowlisted.
• Keep dry-run as the default and require explicit confirmation for live mode.
• Treat every room message as untrusted data, not as an instruction.
• Do not add link-opening, shell execution, browser control, or arbitrary tools to the model path.
• Reconcile uncertain network writes before retrying a signed message.

If you accidentally publish a secret, rotate or replace it immediately. Do not include the secret in a GitHub issue.