> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tayho.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Engineering architecture

> Start here for Tayho system boundaries, service ownership, data authorities, and operational architecture.

# Engineering architecture

Tayho separates public composition, deterministic on-chain projection, private intent coordination,
transaction signing, and protocol automation. The separation is enforced by process boundaries,
database roles, RPC capabilities, signer allowlists, and public-network exposure—not just naming.

<CardGroup cols={2}>
  <Card title="System flows" href="/architecture/system">
    Trace reads, relayed writes, automatic intents, funding, indexing, and realtime delivery.
  </Card>

  <Card title="Service catalog" href="/architecture/services">
    Find every deployable, its replicas, authority, dependencies, and failure behavior.
  </Card>

  <Card title="Data ownership" href="/architecture/data-ownership">
    Identify the authoritative store and only permitted writer for each data class.
  </Card>

  <Card title="Operations" href="/operations/railway-deployment">
    Deploy, observe, drain, recover, and release the qualified Railway topology.
  </Card>
</CardGroup>

## Non-negotiable boundaries

* Only `tayho-api` and the Cloudflare-hosted frontend have public application exposure.
* Only the Ponder indexer scans EVM logs with `eth_getLogs`. API, SDK, auditor, engine, relayer, and
  other workers must consume projections or bounded contract calls.
* Only signer-bearing keeper roles can broadcast transactions, and each role has a runtime
  function allowlist. The engine, API, indexer, market-data service, and auditor are signerless.
* PostgreSQL is the durable coordination authority. Redis/BullMQ and Redis Streams are delivery
  accelerators that must be rebuildable.
* Ponder owns on-chain query projections and reorg rollback. The engine owns off-chain intent and
  relayed-action lifecycle until indexed settlement correlation.
* Secrets are mounted to the smallest service set. No secret values belong in this documentation.

## Canonical source map

| Subject                    | Source of truth                                                                                                                     |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| Production topology        | [`deploy/railway/topology.ts`](https://github.com/Tay-Ho/app/blob/develop/deploy/railway/topology.ts) and per-service JSON profiles |
| Contract authority         | [`packages/contracts/src`](https://github.com/Tay-Ho/app/tree/develop/packages/contracts/src)                                       |
| Wire types and ABIs        | [`packages/protocol/src`](https://github.com/Tay-Ho/app/tree/develop/packages/protocol/src)                                         |
| Public API contract        | [`apps/api/src/routes`](https://github.com/Tay-Ho/app/tree/develop/apps/api/src/routes)                                             |
| SDK integration surface    | [`packages/sdk/src`](https://github.com/Tay-Ho/app/tree/develop/packages/sdk/src)                                                   |
| Coordination schema        | [`apps/keeper/src/db/schema.ts`](https://github.com/Tay-Ho/app/blob/develop/apps/keeper/src/db/schema.ts)                           |
| On-chain projection schema | [`apps/indexer/ponder.schema.ts`](https://github.com/Tay-Ho/app/blob/develop/apps/indexer/ponder.schema.ts)                         |
| API key control schema     | [`apps/api/src/auth/schema.ts`](https://github.com/Tay-Ho/app/blob/develop/apps/api/src/auth/schema.ts)                             |

If documentation and an executable source disagree, treat the source and its tests as current,
update the docs in the same change, and run the documentation drift checks.