{"ok":true,"resolver":"cronus-governance","generatedAt":"2026-08-26T07:32:48.699Z","network":{"name":"arc-testnet","chainId":5042002,"rpc":"https://rpc.testnet.arc.network"},"guard":{"address":"0xea4788164c63b0ef2788d9c74859b43f42bc391e","explorer":"https://testnet.arcscan.app/address/0xea4788164c63b0ef2788d9c74859b43f42bc391e","token":"0x3600000000000000000000000000000000000000","owner":"0xde8874c53d82a38c1c2864ea575f9e62dc29da5f","ownerIsMultisig":true,"operator":"0xb8d0054dd4fe76115e75bf196d89e760bbcd3bc6","guardian":"0x3d31ec5079e78ab2e18a1b49fd78927523d5a7f7","recovery":"0x99d0da7e02c605e9efe6b06226433770dbafeeac","perTxCapUsdc":25,"dailyCapUsdc":100,"hardPerTxCapUsdc":50,"hardDailyCapUsdc":500,"spentInWindowUsdc":0.01,"availableUsdc":25,"windowStart":1786695147,"paused":false,"timelockDelaySeconds":172800,"note":"Every privileged setter is onlyThis: the owner can only queue an operation, wait out timelockDelay, then execute it. Hard caps and the recovery sink are immutable and outlive any owner."},"multisig":{"address":"0xde8874c53d82a38c1c2864ea575f9e62dc29da5f","explorer":"https://testnet.arcscan.app/address/0xde8874c53d82a38c1c2864ea575f9e62dc29da5f","threshold":2,"ownersCount":3,"owners":["0xff31daf4d7088e51ea8d5c5d37407d97b56c7d23","0xb317954f17c9e6adafacc40777fec7931d7b956e","0x7f3ae0110a131c02000f95869dafda52702aaef0"],"txCount":8,"pendingCount":0,"pending":[],"scanned":8,"note":"Owners and threshold change only through a confirmed transaction to the multisig itself; there is no admin backdoor."},"invariants":[{"name":"the guard is owned by the multisig, not by a single key","holds":true,"detail":"owner=0xde8874c53d82a38c1c2864ea575f9e62dc29da5f"},{"name":"moving the guard needs more than one key","holds":true,"detail":"2 of 3"},{"name":"live caps sit at or below the immutable hard ceilings","holds":true,"detail":"25/50 per tx, 100/500 daily USDC"},{"name":"no owner action can take effect immediately","holds":true,"detail":"172800s timelock"},{"name":"the cold recovery sink is neither the owner nor the operator","holds":true,"detail":"recovery=0x99d0da7e02c605e9efe6b06226433770dbafeeac"},{"name":"the agent hot key cannot change the rules on its own","holds":true,"detail":"operator holds no signature"},{"name":"the spend role and the pause role are held by different keys","holds":true,"detail":"separate keys"},{"name":"a rules change in flight is disclosed with the exact time it can execute","holds":true,"detail":"no rules change in flight"}],"timelock":{"delaySeconds":172800,"queuedCount":0,"queued":[],"scanned":"the last 24 multisig transactions","note":"Queued operations are read from guard.opEta, keyed by keccak256(abi.encode(data, salt)) recovered from the executed multisig call. An operation older than the scanned window would be missed, so the window is stated rather than implied."},"knownGaps":[],"unread":[],"complete":true,"honesty":"Every field is read live from Arc with eth_call and no keys. A value the node refused is listed under unread and its invariant reads unknown, never satisfied. A control that is weaker than the documentation claims is listed under knownGaps rather than left for a reader to discover.","cache":{"hit":false,"stale":false,"ageSeconds":0,"ttlSeconds":120}}