Signer (web3)

In-process transaction signing with policy + approval.

The signer authorizes and signs Web3 transactions in-process via the OWS crates — the wallet key never leaves the vault.

warden sign --warrant warden2_… --wallet trade-wallet \
  --value 500 --chain sui:testnet --tx 0x…

It verifies the warrant, runs the policy's sign-rules, and — if within threshold — signs. Over the threshold, the transaction is held for owner sign-off (action-bound, fail-closed).

--value (USD) drives the budget and approval threshold; --to, --function, and --packages feed the sign-rules.

On Sui, the value is computed from the decoded transaction's real outflows — --value is only the declared fallback for non-Sui chains or undecodable txs (so you can't pass a small --value to dodge a threshold on a priced Sui tx). Omit it on a non-priced chain and the action is marked unpriceable — your policy must then explicitly allow unpriceable actions (or carry a raw-unit floor).