Configuration ownership

Checked-in environment examples are schemas, not deployable values. Railway sealed variables own runtime values; deployment identity JSON owns chain/address configuration; service profiles own commands, health checks, and replica policy.

Sensitivity classes

Class	Meaning	Documentation rule
Public	Safe endpoint, chain ID, cadence, or feature setting	Name and purpose may be documented
Internal	Topology, private origin, database role name, build/release setting	Document name/purpose, never resolved private hostname if unnecessary
Secret	API token, database/Redis credential, pepper, bearer token	Document variable name and owner only
Signing	Private key, journal keyring, intent keyring, receipt secret	Document mount boundary only; never format, length, sample, or value

Shared identity and telemetry

Variables	Owner	Required	Class	Purpose
`DEPLOYMENT_ENVIRONMENT`, `DEPLOYMENT_IDENTITY_JSON`	Release/deployment	Production	Internal	Bind environment, chain, start block, and contract identities
`CHAIN_ID`, contract-address variables	Local development	When identity JSON absent	Public	Development fallback only
`BUILD_VERSION`	CI release	Yes	Public	Immutable image/trace correlation
`METRICS_BEARER_TOKEN`	Observability	Production	Secret	Per-service Prometheus access
`OTEL_EXPORTER_*`	Observability	Optional/local, required by production policy	Secret/Internal	Private traces/logs endpoint and headers

The deployment identity artifact supersedes individually supplied chain/address values in qualified environments. Every service must receive the exact same artifact for a release.

API

Source schema: apps/api/.env.example and apps/api/src/config.ts.

Variables	Required	Class	Purpose
`API_ALLOWED_ORIGINS`, `API_TRUSTED_PROXY_HOPS`	Yes	Internal	Exact CORS and client-IP boundary
`ENGINE_URL`, `INDEXER_URL`, `ENGINE_INTERNAL_TOKEN`	Yes	Secret/Internal	Private upstream composition and engine authentication
`API_RPC_URLS`, `API_SIMULATION_ACCOUNT`	Yes	Internal/Public	Signerless live quote/risk/simulation reads
`REDIS_URL`, `REALTIME_STREAM_KEY`	Yes	Secret/Internal	Shared admission, ticketing, replay, and pump
`API_DATABASE_URL`, `API_DATABASE_POOL_SIZE`	Yes	Secret/Public	Restricted API-control storage
`API_KEY_PEPPER`, `API_KEY_POSITIVE_CACHE_SECONDS`	Yes	Secret/Public	Credential hashing and bounded positive cache
`API_REALTIME_`, `API_WS_`	Yes/defaulted	Public	Ticket, replay, subscription, capacity, heartbeat policy
`API_REQUESTS_PER_MINUTE`, `API_WS_*_PER_MINUTE`	Yes/defaulted	Public	IP safety ceilings; project quotas live in DB
`API_UPSTREAM_TIMEOUT_MS`, `API_READ_RETRY_COUNT`	Yes/defaulted	Public	Bounded upstream behavior
`API_ACTION_INTAKE_ENABLED`	Yes/defaulted	Internal	Emergency pause of new intake without losing status/drain

Indexer

Source schema: apps/indexer/.env.example and apps/indexer/src/config.ts.

Variables	Required	Class	Purpose
`DATABASE_URL` / `PONDER_PGLITE_DIRECTORY`	Production / local alternative	Secret/Internal	Isolated Ponder persistence
`PONDER_RPC_URLS`, optional `PONDER_WS_URL`	Yes / optional	Secret/Internal	Redundant ingestion; WebSocket is acceleration
`PONDER_START_BLOCK`	Yes	Public	Earliest deployment block; correctness-critical
`PONDER_ETH_GET_LOGS_BLOCK_RANGE`, `PONDER_RPC_REQUESTS_PER_MINUTE`, `PONDER_RPC_MAX_IN_FLIGHT`, `PONDER_RPC_TIMEOUT_MS`	Profile-specific	Public	Provider-qualified ingestion policy
`PONDER_DATABASE_POOL_MAX`, `PONDER_POLLING_INTERVAL_MS`	Defaulted	Public	Resource/cadence bounds
`RAILWAY_DEPLOYMENT_ID`	Railway	Railway start	Internal	Deployment-isolated schema identifier

Only indexer/Ponder may use the log-range configuration.

Keeper roles

Each role’s authoritative schema is the matching file in apps/keeper/env.

Variable family	Roles	Class	Purpose
`DATABASE_URL`, `REDIS_URL`, `QUEUE_PREFIX`	All coordinated roles	Secret/Internal	Durable state and rebuildable delivery
`RPC_URL`, `RPC_READ_URLS`, `RPC_ALLOW_SINGLE_ENDPOINT`	Signing roles/auditor	Secret/Internal/Public	Preferred write endpoint and safety reads; exception only for development chain 998
`SIGNER_KEYS`	Signing roles only	Signing	Exactly the matching two-key role pool
`TX_JOURNAL_KEYS`, `TX_JOURNAL_ACTIVE_KEY_ID`	Signing roles	Signing/Internal	Encrypt persisted signed bytes and manage rotation
`INTENT_KEYRING`, active key ID, receipt secret	Engine/relayer as explicitly required	Signing	Encrypt accepted terms and capability-scoped status
`ENGINE_INTERNAL_TOKEN`	Engine/API	Secret	Private API-to-engine authentication
Role contract addresses / deployment identity	Matching roles	Public/Internal	Readiness linkage and allowlist target
`HEALTH_HOST`, `HEALTH_PORT`, role-specific port	Each process	Public	Private liveness/readiness server
Cadence/batch variables	Matching automation role	Public	Bounded discovery and maintenance frequency
Source origins and bearer tokens	Oracle/attester	Secret/Internal	Independently authenticated facts
`AUDITOR_INDEXER_URL`	Auditor	Internal	Private ordered projection; no log scanning

Startup rejects SIGNER_KEYS for engine and auditor. Never reuse a keyring, signer pool, source token, or metrics token across roles or environments.

Market data and frontend

Market-data configuration is owned by apps/market-data/.env.example: source mode/origin and cache, circuit, notional, depth-band, freshness, four distinct route tokens, metrics token, and telemetry. Route and metrics tokens are secret; numeric normalization policy is public. Production uses independently governed sources rather than treating replicas as source diversity. Frontend runtime configuration is generated from the public testnet API origin https://api.testnet.tayho.io and WalletConnect metadata. It receives no private service origin, database/Redis value, internal engine token, receipt secret, or worker signer.

Change procedure

Change the parser/type and its tests.
Update the owning .env.example without a resolved value.
Update the Railway JSON profile or release wiring when shape changes.
Update this registry and the affected architecture/runbook.
Roll development, prove readiness and failure behavior, then qualify production.

Do not add aliases for renamed variables. The repository intentionally has no backward-compatibility configuration paths; migrate all callers atomically.

​Configuration ownership

​Sensitivity classes

​Shared identity and telemetry

​API

​Indexer

​Keeper roles

​Market data and frontend

​Change procedure