Architecture
Three pieces, one rule each, and nothing restated in two places at once.
Where each rule lives
The on-chain program holds custody, chamber policy and the redemption queue. The indexing service compiles the seam catalogue and publishes the aggregates. This site reads that catalogue and does arithmetic on top of it. No business rule exists in two of those layers.
- Program: position accounting, chamber ceilings, queue order, keeper bond and slashing.
- Service: seam discovery, rate windows, source cross-checks, the survival gate, catalogue publication.
- Web: local arithmetic over a published catalogue, and nothing that recomputes an admission decision.
Why the board computes locally
The catalogue is fetched once and every subsequent keystroke is arithmetic in the browser. A round trip per keystroke turns a decomposition into a loading state, and a decomposition that arrives late does not get read. The same arithmetic is mirrored from the service so the two cannot produce different answers for the same input.
The survival gate
Before a venue enters the catalogue it has to clear five checks. Each one exists because of a specific failure observed while the catalogue was being built, not as a general principle.
- The data source answers, and the expected fields are actually present in the body. One endpoint under review returned a valid response code on every path while serving a domain parking page.
- The venue account shows recent transactions that succeeded. One perpetual market held 250 BTC of open interest through a week in which every write to it failed.
- A lending reserve has non-zero borrow. A reserve with 5.48 million dollars supplied and nothing borrowed pays zero by construction.
- Two independent sources agree within twenty percent, or the seam is withheld and flagged.
- The venue clears the size floor. A rate of 104 percent against eleven thousand dollars of capacity is not capacity.
Keys and secrets
Anything with a key in it is read server side only. The browser talks to this origin and to public infrastructure; keyed provider endpoints sit behind route handlers on this domain. A build that inlines a keyed URL has published it permanently, so the separation is enforced at the point the environment is read rather than at each call site.