docs(quoter-bot): propose delegated KMS signer architecture

[haydenshively]

Summary

• add the proposed operator-maker and delegated-KMS-signer TIB
• separate the out-of-band funded maker, KMS offer/cancellation signer, and gas-only publisher
• adopt whole-root cancellation and document the broad native-authorization threat boundary
• supersede the previous funded-KMS-maker middleware TIB and update the docs index

Verification

• pnpm format:check
• pnpm --filter @morpho-org/quoter-bot run typecheck
• pnpm --filter @morpho-org/quoter-signer run typecheck
• pnpm lint
• pnpm knip
• non-fork Vitest suite: 219 files, 3249 tests passed
• playground suite: 24 passed, 91 platform-specific skips
• full pnpm test reached 222 passing files but could not start four fork suites because RPC_URL_8453 is not configured

Risk

This TIB governs a funds-at-risk signing boundary. The accepted residual risk is explicit: native Midnight delegation is broad, and the dedicated maker capital remains the hard loss boundary while delegation is active.

---

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T07:59:57.159698Z	e8bd487	PR opened
🔒 Security Review	✅ Completed 2026-09-10T07:53:55.319619Z	e8bd487	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

Devin Review found 2 potential issues.

2 flags not posted on this PR by your GitHub settings — view them in Devin Review. (Configure)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e8bd48771f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[julien-devatom]

Keep things much more simple: delegate offer signing to a key but keep everything in the bot instance: no lambda function, no dynamodb etc

moreover the tib is really verbose and seems not to follow the principles expressed here : a lot of context is ai written and does not provide so much value (i know my tibs in this repo are also not a good example at all)

[haydenshively]

Keep things much more simple: delegate offer signing to a key but keep everything in the bot instance: no lambda function, no dynamodb etc

Ack, we can do this. On the call it sounded like you'd prefer if the KMS key could only sign (not withdraw, etc.), and this was a way of achieving that without additional smart contracts. If you're ok with standard Midnight-authorization for it, we can simplify a lot.