Who holds each key
Each key is listed with its holder, its use, and its status. Nothing here is a secret: an attacker learns nothing from it that a diligence team should not know first.
| Key | Who holds it today | How it is used | Roadmap | Status |
|---|---|---|---|---|
| Validator signing keys | JIL Sovereign Technologies Incorporated, as operator of all ten validators on jil-mainnet-2. | Ed25519 software keys, held in a file on each validator node, sign consensus votes. | A hardware security module and post-quantum validator signing. | Live. Roadmap items Designed. |
| Default service key | JIL Sovereign Technologies Incorporated. A 2-of-3 threshold key; all three shares are generated and held server-side. | Signing reconstructs the key in memory. There is no user-held shard on the default key. A user can authorize a signature, which is not possession of a key. | Threshold signing in which the key is never reconstructed. | Live. Roadmap item Designed. |
| Issuer mint and burn authority | The licensed issuer of each currency. Authority is bound to the issuer's key in the Currency Object. | Mint and burn require the issuer's key. JIL operates every validator and still cannot mint a domain's currency. Issuance is disabled on every sovereign cell until that cell's licensing event. | Live | |
| Corridor credential | The root of each domain, after go-live. | Only the root sends on a corridor. A hub or an annex cannot. | Live | |
| Attester and reviewer keys | JIL Sovereign Technologies Incorporated. Each key is pinned on chain. | The attester signs identity records. The reviewer signs agentic review results. The ruling checks both signatures against the pinned keys. | Live | |
| System-account keys | Decided by JIL's founder today. | System accounts are protocol accounts, not customer accounts. | A published custody arrangement for system accounts. | Designed |
Who can halt, patch, or upgrade
| Action | Who can do it today | How it is controlled | Status |
|---|---|---|---|
| Halt the chain | JIL Sovereign Technologies Incorporated, as operator of every validator. | Below seven voting validators, consensus stops. JIL operates all ten validators, so JIL can stop the chain and every cell on it. | Live |
| Halt one domain | The domain's own operator under its constitution, and JIL as operator of the validators. | A domain cannot halt another domain. A corridor party may suspend new transfers on that corridor under the model Digital Treaty, section 9. | Live |
| Freeze an account | The domain, under its own published rule. | A freeze state is part of the attested identity record. The ruling denies an act from a frozen account. | Live |
| Patch the core | JIL Sovereign Holdings, LLC (Wyoming) maintains the code. JIL Sovereign Technologies Incorporated rolls each release onto the validators it operates. | Bug fixes, protocol hardening, and security patches. Core technology changes are made through Holdings. | Live |
| Upgrade by vote | No one today. On-chain governance (jil1gov) lets parameter changes pass by proposal and vote inside consensus. | Until it is deployed, JIL rolls upgrades as operator. | Built |
The path to sovereign-hosted validators
Today JIL Sovereign Technologies Incorporated operates every validator, at one hosting provider, in data centers in Germany, Finland, Singapore, and the United States. A node named for a compliance zone is labeled for that zone, not located in it.
The roadmap moves validators to the sovereign. A runbook for a sovereign cell on the customer's own hardware exists. Validators a sovereign hosts inside its own jurisdiction, and growth of the validator set, are on the roadmap. JIL approves every validator in the federation and produces, cycles, and attests its keys. No date is published for the hand-over.
What a domain keeps if it leaves
| Item | What the published documents say | Source |
|---|---|---|
| Attestation records | Participants have access to their own transaction and attestation records, and attestation evidence is portable. | Model Sovereign Domain Charter, article 6.3 |
| Corridor attestations | Termination of a corridor treaty does not extinguish attestations already produced. | Model Digital Treaty, section 9.4 |
| Ruling records | The chain references each ruling by its hash. A reader verifies a ruling from the record and the hash, without trusting JIL's statement. | White paper, section 9.4 |
| Ledger, keys, and license exit | Exit and portability terms for the ledger and the keys are set in each license. A public summary is not yet published. | License agreement |
The control statement
JIL Sovereign Technologies Incorporated operates the validators and holds the validator and service keys. The domain holds its issuance, its rulebook, and its corridor credential. JIL Sovereign Holdings, LLC (Wyoming) owns and maintains the core software. That is a defined split of control between named parties. It is not a claim that no one is in control.
Walk through the control split
A briefing covers the key layout, the hand-over path, and the license terms for exit.