Multisig treasuries, and the seed phrase we removed

Shared fund control is live: a .vault holds assets for several .human members, with an M-of-N signature threshold. No transfer leaves it without enough of them agreeing.

A treasury, not a wallet

The design choice that matters: a vault has no private key of its own. It is closer to a safe than to an account you log into — a treasury controlled entirely by its members.

That also closed a real gap. Vaults used to inherit a seed phrase from the registration flow shared with .node and .app addresses. Holding that seed let you move funds directly, bypassing the multisig entirely — the threshold was advisory for anyone who kept it. Removing the seed removes that path, and removes the confusion of a "wallet" nobody was supposed to log into.

What works today

Registration with no seed, a Vault tab on every member's address, adding and managing members, an adjustable threshold, proposals split into pending and history, and the vault's own balance and transaction history.

Tested end to end over the real RPC and WebSocket paths: registration, threshold changes, member addition, and creating, signing and executing proposals.