TRUST / ELPIS

Recovery

Account access and fund recovery are different problems. One is email and 2FA; the other is an on-chain property fixed when the vault was deployed.

Two different problems

A password reset gets you back into the console. It does not get you back into the vault.

What was lost	What recovers it
Your password	Email reset
Your 2FA device	Recovery codes
Your session	Sign in again; revoke the old one
The wallet key that operates the vault	Only an on-chain recovery path fixed at deployment

Elpis holds no key for a self-custodied treasury, so no application feature can reconstruct a lost wallet key. The honest recovery is a guardian that was given that power in advance.

Account recovery

Password reset by email — single-use, hashed, expiring.
2FA recovery codes — shown once, each usable once.
Session revocation — one session or all the others.
Wallet re-linking — for sign-in, not for funds.

Fund recovery

The vault has one immutable property, fixed at deployment:

LazarusVault

bool public immutable guardianMayRecoverOperator;

Mode	What the guardian can do
`false — brake only`	Pause, freeze and cancel. Never install an operator. A lost owner key means stuck funds.
`true — recovery`	While paused, install a new operator. It still cannot move funds, only change who operates.

The flag cannot change after deployment. An existing brake-only vault becomes recoverable only by deploying a new vault in recovery mode and migrating the funds.

A guardian that can rotate the operator can, in the limit, take control. Choose a guardian you trust: a second hardware wallet, a Safe you control, or a trusted holder. The contract refuses a guardian equal to the operator.

The procedure

Signed by the guardian

1. pause()                       // the guardian's brake
2. setOperator(newOwner)         // only while paused, only in recovery mode
3. the new owner signs in and attaches the vault

The app prepares these calls at /app/recovery. The guardian signs them with their own wallet; Elpis holds no key. If the guardian is a Safe or is not logged in, the page exposes the raw to, data and value so the calls can be executed from a Safe or a block explorer.

GET /api/v1/state reports the posture under recovery: whether the guardian may recover the operator, whether the vault is paused, and a plain-language note.

What recovery is not

Not key reconstruction. A lost key is lost.
Not a reversal of a settled transaction.
Not a defence against a compromised operator key — the allowlist and ceiling bound that loss.
Not available on a brake-only vault. The UI says so in red.