System flows and trust boundaries
Environment boundary
Testnet and production are separate Railway environments with independent PostgreSQL, Redis, domains, deployment identity, API credentials, keyrings, and signer pools. No runtime service may reference data or secrets from the other environment. The browser signs typed data. The relayer—not the browser or API—signs and broadcasts the final EVM transaction. Contract checks remain the final authorization boundary.Public read
The API does not query keeper databases for on-chain history. Live reads never hold or use a signer.Relayed immediate action
The database commit precedes queue delivery. Queue loss is recoverable from the outbox. A repeated signed envelope and idempotency key converges on the same durable action.Automatic intent
Limit, stop-loss, and take-profit orders are signed intents. The engine validates and stores the encrypted terms, maintains trigger indexes and reservations, then emits only a reference job when conditions are satisfied. The relayer decrypts at execution time, rechecks the live state, simulates, and broadcasts. OCO and cancellation races resolve through durable lifecycle transitions and on-chain execution. The engine cannot broadcast. The relayer cannot accept or rewrite user intent terms. Database grants and row-level policies enforce this split.Funding and oracle maintenance
The funding-oracle role and depth/resolution-attester role use distinct sources, credentials, signers, and contract allowlists. Automation advances maintenance only after required observations exist; it does not manufacture attestations.Indexing and reorgs
Ponder is the single log-scanning owner: Ponder applies handlers in EVM order and rolls projection state back on a reorg. There is exactly one writer for a deployment schema. The auditor reads the indexer projection plus direct bounded quorum state; it never independently scans log ranges. A delayed indexer can delayindexed
terminal correlation without invalidating the engine’s receipt-authorized confirmed state.
Realtime
The indexer event pump writes canonical public lifecycle events into the shared bounded stream. Every API replica uses one stream reader and fans out locally. A new subscription captures a stream boundary, loads an authoritative snapshot, then releases buffered events. Reconnects replay after a per-channel cursor; a gap forcesresync_required and a new snapshot.
Redis Streams provides replay and cross-replica delivery, not authority. REST/indexer/engine
snapshots remain correct after stream loss.
Observability path
Services emit structured logs, traces, and Prometheus metrics to the private observability service.x-request-id and W3C trace context cross API, upstream, job, transaction, and receipt boundaries.
Health endpoints intentionally expose no resolved signer, credential, or upstream error detail.