Security

Mainnet deploy gates

Mainnet deploys require an explicit operator-signed manifest naming the deploy pubkey, the cluster, and the balance. The CLI's `lien deploy` command never broadcasts on its own — it prints the plan so the human is always in the loop for the mainnet step.

Programs published to the marketplace must declare their flags bitmap on-chain. The executor refuses to run a hook whose declared flag does not match the event kind, preventing manifest spoofing.