safes: 2026-07-28 on-chain re-verification + honest MPC/KMS state (zoo-treasury-v1 is degree-0)

Co-authored-by: Hanzo Dev <[email protected]>

manifests/safes.yaml

@@ -36,12 +36,23 @@ safes:
     role: "Zoo DAO — Zoo NGO/Foundation DAO (treasury / governance)"
     saltString: zoo.dao.safe.v1
     address: "0x229599f227231d8C90fcF1a78589F5DC4b7A6962"
-    status: deployed                   # 1/1 owner 0x9011 verified on-chain
+    status: deployed                   # re-verified on-chain 2026-07-28: Safe 1.5.0,
+                                       # threshold 1, owners [0x9011], 0 modules, nonce 0, balance 0
   team:
     role: "Zoo Z/Team Safe (Z Vault)"
     saltString: zoo.team.safe.v1
     address: "0xb8BbCdde5E8713f9849D1520D71Bc08Af94E6F00"
-    status: deployed                   # 1/1 owner 0x9011 verified on-chain
+    status: deployed                   # re-verified on-chain 2026-07-28: Safe 1.5.0,
+                                       # threshold 1, owners [0x9011], 0 modules, nonce 0, balance 0
+
+# MPC / KMS (zoo-k8s, verified 2026-07-28):
+#   zoo-mpc: 5-node mpcd ring, ghcr.io/zooai/mpc:1.17.12, genuine 3-of-5
+#     (startup log keygenDegree=2 signersRequired=3). Named wallets on the ring:
+#     zoo-treasury-v1 (threshold 0 — DEGREE-0, keyed pre-fix: any single node can
+#     sign; re-key before custody of real value), zoo-threshold-proof-v1 (threshold 2 = 3-of-5).
+#   zoo-kms: kms-0 ghcr.io/zooai/kms:1.11.8 (behind luxfi/kms v1.12.10; MPC_VAULT_ID
+#     empty = secrets-only, MPC signing not wired). Public surface kms.zoo.cloud is the
+#     shared white-label KMS on hanzo-k8s (healthz 200), not this pod.
 
 foundationTimelock:                    # OZ TimelockController — transparent EVM-native unlock
   address: "0x31C89A0509F7783b742B01Be9103c05BbF4B9510"   # CREATE(0x9011,97)