Secure HMI for field-session orchestration, supervised automation, operator takeover, audit control and external signing authority.
SECURE CORE ONLINEDFHS ISOLATED SIGNING BOUNDARY
CONTROL CENTER / SESSION
Live Operations
V2.0 / SECURE CUSTODY
AP
——
ACTIVE CONTROL SESSION
No session selected
———
CONTROL AUTHORITY
Session
—Live field channel
Amount
0 BTC0 sat/vB
Authority
—Current control owner
Signing
DFHS ACTIVENo private key in web plane
Broadcast
LOCKEDSeparate release boundary
TRANSACTION CONTROL
Execution Pipeline
—
FIELD COMMUNICATION
Secure Session Chat
LIVE
IMMUTABLE EVENT CHAIN
Audit Stream
—
FIELD REQUEST QUEUE
Operator Decisions
0 PENDING
SECURITY POSTURE
Runtime Boundary
Control planeONLINE
Private-key materialNOT PRESENT
DFHS Secure CoreINTERNAL ISOLATED SERVICE
Bitcoin GatewayNOT CONFIGURED
Autopilot authorityPOLICY-GATED
PREPARE≠SIGN≠BROADCAST
FIELD OPERATIONS
Sessions
DFHS Secure Core
CHECKINGisolated signer service
Self Tests
—fail-closed startup
Audit Chain
—HMAC chained JSONL
Keys
—non-export API
Validation
INTERNALnot FIPS validated
APEXF PROPRIETARY CRYPTOGRAPHIC BOUNDARY
DFHS Secure Core / Signing Gateway
The web control plane never receives private-key material. A separate DFHS process performs policy-gated secp256k1 cryptographic operations, startup self-tests, encrypted key storage and tamper-evident audit logging.
FIELD / WALLET
→
CONTROL / POLICY
→
APEXF DFHS v2
→
BITCOIN ADAPTER
DFHS control-intent attestations are real secp256k1 signatures. Bitcoin transaction signing remains a separate adapter boundary until independent PSBT/sighash verification is connected.
KEY INVENTORY
Secure Keys
KEY CEREMONY
Generate Internal Key
OPERATOR ONLY
Customer Liabilities
0.00000000 BTCInternal custodial claims
Available
0.00000000 BTCSpendable internal balance
Locked
0.00000000 BTCWithdrawal holds
Double Entry
BALANCEDEvery journal sums to zero
On-chain Reserve
NOT CONNECTEDLedger ≠ dedicated UTXO
SUPERVISOR WALLET CONSOLE
Customer Wallets
NEW INTERNAL WALLET
A
Select a customer wallet
Choose Pouria or another account from the left to view balances, activity and supervisor controls.
SELECTED CUSTODIAL ACCOUNT
—
—
SUPERVISOR CONTROL
TOTAL0.00000000 BTC
AVAILABLE0.00000000 BTC
LOCKED0.00000000 BTC
BALANCE LOCK CONTROL
Manual Lock / Unlock
MANUAL LOCK0.00000000 BTC
WITHDRAWAL HOLDS0.00000000 BTC
Manual locks are separate from Withdrawal Holds. Releasing a manual lock will never release funds reserved by an active withdrawal.
BALANCE ADJUSTMENT
Credit / Debit
This posts a balanced internal ledger journal. It does not move Bitcoin on-chain. Debits cannot exceed Available balance.
ACCOUNT ACTIVITY
Ledger History
0 ENTRIES
WITHDRAWALS
Withdrawal Holds
FORENSIC TRACE
Full Session Audit
API
ONLINEFastAPI control plane
Realtime
ACTIVEWebSocket session bus
Audit
HASH CHAINPer-session SHA-256
Autopilot
ACTIVEUnattended policy engine
Custody
ISOLATEDDFHS encrypted key boundary
OPERATING PRINCIPLE
Observe → Assist → Intervene → Take Control → Return to Autopilot
Every sensitive transition is represented as explicit workflow state. Manual authority can take over a live session without handing private-key custody to the web application.
ACCESS CONTROL
Field Users
CREATE FIELD LOGIN
New Field User
OPERATOR ONLY
A secure password is generated automatically and shown once. The server stores only a salted password hash. Field Personal Wallets are isolated from Client Wallets even when names match.
A
APEXFFIELD / CLIENT ASSURANCE TERMINAL
PF
—Restricted Field Access
ASSIGNED SECURE SESSION
—
Awaiting session data…
—
PERSONAL WALLET
0.00000000 BTC—
AVAILABLE 0.00000000 BTCLOCKED 0.00000000 BTC
SECURE CONTROL LINK
Secure Control Chat
LIVE
CONTROLLED REQUESTS
Request Action
NO DIRECT EXECUTION
Requests are sent to Secure Control. This terminal cannot sign, broadcast, alter transaction parameters or take operator authority.
READ-ONLY STATUS
Session Status
Session—
Workflow State—
Signing BoundaryAPEXF SECURE CORE
Private-key accessNONE
Broadcast accessNONE
REQUEST HISTORY
Secure Requests
INTERNAL CUSTODIAL ACCOUNT
0.00000000BTC
Wallet ID —
AVAILABLE0.00000000 BTC
LOCKED0.00000000 BTC
PENDING WITHDRAWALS0
Personal Wallet ≠ Historical Reserve Reference
The balance above is the authenticated user's internal custodial ledger balance. It is not the historical 187,492.86208716 BTC reserve reference, and it is not presented as proof of a dedicated on-chain UTXO.
INTERNAL TRANSFER
Send to APEXF Wallet
OFF-CHAIN LEDGER
Internal transfers update the APEXF ledger instantly and do not create a Bitcoin network transaction.
WITHDRAWAL REQUEST
Withdraw BTC
CONTROLLED FLOW
The amount is moved to Locked and a Control Center session is created. Withdrawal requires a fully signed PSBT verified by the Bitcoin Gateway. Broadcast remains separately locked.
ACTIVITY
Ledger History
CLIENT DIRECTORY
Client Wallets
Read-only Client Wallet directory. Wallets bound to this Field Account are pinned first; unbound Client Wallets remain visible for operational lookup. Balance administration remains Operator / Supervisor only.
DEPOSIT
Funding Status
TREASURY ROUTING NOT CONNECTED
No on-chain deposit address is exposed by this module.
Confirmed funding is credited to this internal wallet only after treasury/reconciliation records it. The balance shown here is a custodial account balance, not a claim that a dedicated UTXO exists for this user.
WITHDRAWALS
Withdrawal History
RESTRICTED CRYPTOGRAPHIC OBSERVABILITY
HSM Test & Live System Status
Read-only HSM verification and sanitized live diagnostics. No private-key export, shell access, signing authority or broadcast authority is exposed here.
CONTROL SERVERCHECKING
DFHSCHECKING
SELF TESTS—
AUDIT CHAIN—
HSM KEYS—
BTC GATEWAY—
BITCOIN NODE—
BROADCAST GATE—
DFHS VERIFICATION SERVICE
Verify Signature
READ-ONLY
Awaiting verification input.
Verification uses the selected DFHS public key. The private key never enters the web/control plane and this function cannot create signatures.
LIVE DIAGNOSTIC STREAM
Server / HSM Monitor
2 SEC LIVE
[--:--:--]INITIALIZE CLIENT_DIAGNOSTICS → READY
This is a sanitized diagnostic feed of predefined health checks—not a shell. Arbitrary server commands cannot be submitted from the Client terminal.
INSTITUTIONAL ASSURANCE PORTAL
Evidence, Governance & Claim Boundaries
This page separates public references, internal documentation, runtime cryptographic observations and independent verification. No status shown here should be read more broadly than its stated source and scope.
APEXF PUBLIC REPRESENTATIVE / ATTESTATION ADDRESS
Loading…
BITCOIN MAINNETREGISTRY / ATTESTATION IDENTITYNOT AN AGGREGATE WALLET
Claim boundary: the historical reserve reference is not a Personal Wallet balance, is not represented as an immediately spendable balance, and is not proven by the representative address alone. Underlying wallet evidence is a separate controlled due-diligence layer.
CLAIM / SOURCE / VERIFICATION / SCOPE
Evidence Matrix
EVIDENCE LANGUAGE
Verification Levels
INTERNAL CLASSIFICATION
E0 — DECLAREDClaim stated; no supporting material represented here.
E1 — DOCUMENTEDInternal or historical supporting documentation exists.
E2 — CRYPTOGRAPHICA specified signature, hash or chain observation can be cryptographically checked.
E3 — THIRD-PARTYExternal documentary evidence exists from a named counterparty, custodian or adviser.
E4 — INDEPENDENTQualified independent assurance completed for the specifically stated scope.
E0–E4 is an APEXF internal evidence taxonomy, not a regulator, accounting-standard or credit rating.
LEGAL / REGULATORY / SECURITY REFERENCES
Independent Reference Links
Reference links are provided for independent checking. Their inclusion does not imply certification, endorsement, authorisation or regulatory approval.
CRYPTOGRAPHIC ASSURANCE BOUNDARY
What the HSM Status Means
ArchitecturePROPRIETARY SOFTWARE-DEFINED
Private-key exportDISABLED
Runtime self-testsOBSERVABLE
Audit-chain integrityOBSERVABLE
FIPS 140-3 validationNOT CLAIMED
ISO certificationNOT CLAIMED BY PORTAL
FIPS, ISO and NIST references are design/assurance references unless a specific third-party certificate is explicitly identified. Runtime PASS states are not regulatory certifications.
POINT-IN-TIME EVIDENCE RECORD
Evidence Snapshot
SnapshotNOT GENERATED
Generate a snapshot to capture the current claim boundaries, evidence states, runtime status and a SHA-256 digest.
The snapshot SHA-256 identifies the generated JSON record. It is not a Bitcoin proof-of-control signature. Representative-address signing remains NOT CONFIGURED unless separately performed through a controlled process.
CLIENT SECURITY NOTICE
Non-Negotiable Portal Rules
No seed phrase / private key collection
This portal has no legitimate workflow requiring a client to submit a seed phrase or private key.
No “unlock” or HSM-release fee
This portal has no function to collect an activation, unlock, tax or HSM-release payment to make a displayed balance available.
Internal ledger is not proof of reserves
A displayed internal balance or lock state is accounting/control information and does not, by itself, prove on-chain reserves.
Independent verification remains independent
Public addresses, ENS records, portal status and internal documentation do not replace a qualified independent review of the underlying evidence.
ACCOUNT WALLET BINDING
Bind Wallet to Field Account
CURRENT BINDINGS
Wallet Access
This binding grants an account association to a Client Wallet without replacing the Field user's Personal Wallet. Existing wallet/ledger data is not moved or merged.
FIELD USER PROFILE
Field User
STATUS—
PERSONAL WALLET—
SESSIONS0
BOUND CLIENT WALLETS
Account Wallet Bindings
ASSIGNED HISTORY
Sessions
Deleting a Field User removes the login and wallet binding, but preserves the wallet ledger and historical sessions. Historical sessions are detached from the reusable username.
FIELD USER CREDENTIALS
Save these credentials now
The password is shown only now. If it is lost, use Reset Password; it cannot be retrieved from the server.
BITCOIN VERIFICATION GATEWAY
Import finalized signed PSBT
NEW FIELD OPERATION
Create session
NEW FIELD LOGIN
A secure password will be generated and shown once. The new Field User will be selected automatically for this session. Its Personal Wallet is isolated from any Client Wallet with the same name.