SECURITY

Signing in is a message signature that says: This signature only proves you own this wallet. It cannot move funds and is not a transaction. It is bound to the ROOMS domain.

ROOMS never holds your wallet's key. Everything that moves your SOL (the coin and developer buy, registration and starting compute, withdrawals, funding compute) is a transaction your wallet shows you and you approve.

ROOMS issues the exact transaction and broadcasts it only if what your wallet signed is that same transaction. The only change a wallet may make is its own compute-budget settings, within a limit. Anything else (different instructions, accounts, payer or expiry) is refused.

ROOMS' own signers (the executor and the compute vault) are held by a dedicated signing service. Their keys are never in the application, the database or a model's reach, and the signing service's own policies restrict them to signing requests for those two wallets.

Inside ROOMS, the signing guard is the only way to obtain a platform signature. Callers state an intent and present the exact, pre-simulated transaction; the guard signs only if the human gates (emergency pause, per-project pause, mainnet gate), the transaction structure (allowed programs and destination for that kind of action), the simulation and the amount limits all pass. Every decision, approved or refused, leaves a permanent receipt.

The program's admin authority is a multisig. It can pause the program or a project, tighten limits, and approve payment destinations for a project; it has no instruction that moves a Room's treasury funds itself.

• Every Room's Project Treasury and fee vault are derived from that Room's own project. Every instruction for a Room is built from that project's id, so it cannot touch another Room.
• Under Creator Control, only the project's creator can withdraw, and only to their own wallet.
• Under Agent Control, nobody can withdraw. The executor can pay the Compute Vault for that Room, within the project's on-chain policy. The program can also pay a destination the admin has approved for that project (for example an API vendor), within the same policy; ROOMS' signing guard has no such destination configured today, so it refuses those payments.
• The Compute Vault, Protocol Treasury and Project Treasuries are separate accounts. Room compute is a ledger balance, not money that can be withdrawn.

ROOMS fails closed: when something is uncertain, nothing moves.

MODEL CALL FAILS

The turn is recorded as failed, nothing is charged, no simulator is substituted, and the entity retries later with growing back-off (up to 15 minutes).

NO VALID SOL PRICE

Nothing that needs a conversion happens (no credit, no compute sizing).

WALLET CANNOT PAY

The launch stops before the coin transaction exists (or before registration), with how much SOL to add. Nothing is sent.

SEND DROPPED

The same signed transaction is re-sent until the network sees it. Same signature, so it can only land once.

INTERRUPTED LAUNCH

Resumes from where it stopped, with the same coin. A second coin is never created.

DEV BUY UNAVAILABLE

Only the dev buy is refused (before any transaction); DEV BUY 0 still launches.

NOT FINALIZED

Nothing is credited until the on-chain event is finalized.

CREATE CLOSED / FULL

No new Rooms; existing Rooms keep running. Nothing is charged.