| Deploy your own contracts from CryptoRail, on a test network or a real one, under your policies, your approvals and your signer; the confirmed transaction returns the contract's address. | FR-REG-11, J22, J24 |
| Once a contract is registered, every one of its functions can be called through the API by the contract's name, arguments checked against its ABI. | FR-REG-03, FR-REG-04, FR-API-08, J24 |
| Contract reads and ordered batches through the HTTP API. | FR-API-17, FR-API-18, J46, J47 |
| Several calls that succeed or fail together, in one UserOperation of the customer's smart account: the policy reads every call and their sum, and a call that cannot succeed leaves none of them done. | FR-TX-30, ADR-0008, J66 |
| Submitting the same intent twice with the same idempotency key returns the same transaction: a retry never becomes a second payment. | FR-TX-03, FR-API-03, J26 |
| Several node endpoints per network: calls go to the first healthy one, an operation stays on the endpoint it started on, and a dead or lagging node is left aside without losing anything. | FR-CHN-05, FR-CHN-15, J39 |
| Your own signer keeps the key: CryptoRail prepares the exact bytes, your system signs them, CryptoRail verifies and broadcasts. | FR-SIG-05, FR-SIG-09, J25, J42 |
| Operations above a threshold wait for a quorum of approvers, who sign an EIP-712 digest that names neither nonce nor fee. | FR-APR-01, FR-APR-05, J41 |
| A tenant sees only its own resources, proven on every route of the API on every change. | FR-API-05, J44 |
| Per-tenant limits set by the operator, with refusals that name the limit reached. | FR-API-16, J44 |
| A pilot environment stood up in minutes with nothing installed on your side. | NFR-SEC-10, ADR-0005, J43 |
| An operation CryptoRail has acknowledged is never lost: not across crashes and restarts, not through a node outage of up to ten minutes. | NFR-REL-01, NFR-REL-05, FR-TX-02, J15 |
| Nonces strictly increasing per sending address, gaps detected and filled, and never two transactions mined for one operation. | FR-TX-09, FR-TX-10, FR-TX-11, NFR-REL-02, J09 |
| A transaction the network does not pick up is replaced with a higher fee within the caps you set, or cancelled, never silently abandoned. | FR-TX-12, FR-TX-13, FR-TX-25, J04 |
| An operation is reported confirmed only when the network's finality rule is met; a reorganisation before that is followed, not hidden. | FR-FIN-01, FR-FIN-02, FR-FIN-04, FR-FIN-08, J11 |
| Every failure comes with a report: the stage, a stable cause, whether a retry can work and on what condition, and the suggested action. | FR-TX-29, FR-REG-07, J02, J03 |
| Your business operation travels with its transactions: its type, its id and its step appear in queries, events and traces. | FR-TX-28, NFR-OBS-06, J22 |
| Priority tiers per sending identity with fee caps you set; an urgent operation can go ahead of a queue already on the network. | FR-CHN-16, FR-TX-26, J21 |
| The actual cost of every operation is recorded, and a payer running low on funds raises an alert before operations fail. | FR-TX-23, FR-TX-24, J22 |
| Keys never enter CryptoRail: signing happens in your HSM, your cloud KMS or your own signer, and only the development signer ever touches a key. | NFR-SEC-01, FR-SIG-01, J12 |
| Every signature is checked against the expected address before anything is sent. | FR-SIG-09, NFR-SEC-02, J12 |
| When required, approvals are enforced on chain by a smart account: the signing key alone cannot move anything. | FR-APR-11, J33 |
| Every approval, signature and decision is recorded with who, when and what, and every change made through the API lands in an audit log. | FR-APR-10, FR-API-14, FR-TX-18, J19 |
| Declarative policies decide before anything happens: limits per operation, payer and period, held even when several workers decide at once. | FR-POL-01, FR-POL-02, FR-POL-06, J28, J29 |
| Subscribe to your contracts' events and receive them decoded into named fields, in chain order, once they are deep enough to trust. | FR-EVT-01, FR-EVT-04, FR-EVT-14, FR-REG-08, J35 |
| Chain reorganisations handled: no event lost or delivered from a discarded block, across restarts. | FR-EVT-06, NFR-REL-03, J36 |
| Signed webhooks, retried for about three days, then held in a dead-letter queue an operator can redeliver from. | FR-EVT-09, J34, J45 |
| At-least-once delivery through a transactional outbox, with a deterministic id on every event so your systems can drop duplicates. | FR-EVT-07, FR-EVT-08, NFR-REL-04, J34 |
| Every change of state of your own operations arrives through the same channel as the contract events. | FR-EVT-11, FR-TX-05, J34 |
| The complete history of any operation, exported in a machine-readable file for audit. | FR-OPS-07, FR-TX-18, J45 |
| Traces, metrics and structured logs through OpenTelemetry, into the monitoring tools you already run. | NFR-OBS-01, NFR-OBS-02, NFR-OBS-04 |
| Health and readiness that tell the truth, and a configuration checked at startup with every problem listed at once. | FR-OPS-01, FR-OPS-02, J27 |
| One process, or separate API, worker, signing gate and indexer processes sharing only the database, each with a database role limited to what it needs. | FR-OPS-04, NFR-SEC-06, J27, J38, J49 |
| Several workers on the same database without sending anything twice. | FR-OPS-05, NFR-REL-02, J29 |
| Secrets passed by reference and never written to logs, traces, metrics or responses. | FR-OPS-03, NFR-SEC-04 |
| An operator command line for the daily work: pause an identity, redeliver a webhook, reconcile nonces, export a history, onboard a tenant. | FR-TX-27, FR-OPS-07, FR-API-16, J45 |
| Dependencies scanned on every change; a high or critical vulnerability blocks the release. | NFR-SEC-05 |
| Several networks at once, each declared in configuration, with every record carrying the network it belongs to. | FR-CHN-01, FR-CHN-02, J06 |
| Permissioned consortium networks with free gas (Hyperledger Besu with QBFT): no fee market, no gas balance to keep topped up. | FR-CHN-08, FR-CHN-11, J05 |
| Tested on every change to the code against Anvil and a Hyperledger Besu QBFT network, and run on public test networks by recorded manual procedures. | NFR-INT-05, J01, J05 |
| Works with your own nodes or a provider's, through standard Ethereum JSON-RPC over plain HTTP. | FR-CHN-03, FR-CHN-04, FR-CHN-14 |
| Embedded as a library in your Node.js application, or run as a service with an HTTP API described in OpenAPI and generated SDKs. | NFR-INT-01, NFR-INT-03, FR-API-01, FR-API-02, J23 |
| Runs in your infrastructure, as a container image over your PostgreSQL, with schema migrations applied by an explicit command. | NFR-INT-03, FR-OPS-06, J27 |
| Every external concern is a documented port: replace a signer, a store or a publisher with your own, and prove it with the contract tests. | NFR-INT-01, NFR-INT-02, FR-SIG-15 |
| The hosted profile refuses to start if it is given a key of its own, listing every reason. | NFR-SEC-07, ADR-0005, J42 |
| A sandbox says it is one: in its logs, on its health endpoint and on every screen built over it. It is never supported for value. | NFR-SEC-10, J43 |
| Bring the ABI of any deployed contract, yours or a third party's, as JSON or in readable form, even with only the functions and events you use, and check it against the deployed code. | FR-REG-01, FR-REG-12, FR-REG-13, FR-REG-14, J14 |
| Contracts behind upgradeable proxies, and new versions of their ABI, without losing history. | FR-REG-09, FR-REG-10, J37 |
| Call a function by the contract's name in your registry: arguments checked against the ABI before anything is signed, and the contract's own errors decoded when it refuses. | FR-REG-03, FR-REG-04, FR-REG-05, FR-REG-07, J01, J02, J03 |
| Read-only calls to any contract (a price, a balance, a position), decoded, from the library. | FR-REG-06 |
| Ordered batches from one identity, from the library: consecutive nonces, and the steps behind a failed one cancelled when you ask for it. | FR-TX-19, J22 |
| Payout rules that read the payment itself: only listed beneficiaries, a daily cap in the token's own units, and approval above an amount. | FR-POL-07, J51 |
| Tested against the real USDC and USDT contracts, on a fork of Ethereum mainnet where nothing of value moves: payouts under policy and approval, and incoming payments delivered to your ERP as signed webhooks, reversed if the chain reorganises. | FR-PLT-02, FR-PLT-03, FR-PLT-04, J52 |
| A ready-made stablecoin pilot pack for the sandbox: token addresses verified against the chain, an example payout policy and a one-command setup. | FR-PLT-01, J52 |
| Run on Base Sepolia, a public test network, with Circle's official test USDC: a payout confirmed, a payout to an unlisted address refused, a payout above the threshold held until the approver signed, the daily limit enforced, and an incoming payment delivered as a signed webhook. | FR-PLT-05 |
| A ready-made tokenisation pilot pack: an asset contract of our own on OpenZeppelin Contracts (issuance, a holder allowlist, redemption against a reference, pause, roles), compiled with pinned settings and checked on every change, an example issuance policy and a one-command setup that deploys it and registers it by name. | FR-PLT-10, FR-PLT-11, FR-PLT-14, J54 |
| Proven on every change on a Hyperledger Besu QBFT network without fees: the asset deployed through CryptoRail by an identity holding no ether, every function called by name, an issuance above a threshold held until the issuer's board approved, the contract's refusals reported with their reason, and every event delivered to the back office as a signed webhook. | FR-PLT-12, J54 |
| A ready-made customer programmes pilot pack: a loyalty points contract of our own on OpenZeppelin Contracts (points awarded with a reference, redeemed for a reward, never transferred between customers, pause, roles), compiled with pinned settings and checked on every change, an example sponsorship policy and a one-command setup that deploys it and registers it by name. | FR-PLT-15, FR-PLT-16, FR-PLT-19, J55 |
| Proven on every change: a customer whose key never held ether redeems points from a smart account created by that first redemption, signing in their own application while the programme's paymaster pays; anything but a redemption, and more redemptions than the day allows, refused with their reason; the cost of each redemption reported and every event delivered to the back office as a signed webhook. | FR-PLT-17, J55 |
| A ready-made attestations pilot pack: the Ethereum Attestation Service and its schema registry verified against the chain, a supplier accreditation schema that holds an identifier and the hash of the evidence and nothing personal, a policy that ties the attester's key to that schema with revocations under approval, and a one-command setup that registers the schema once. | FR-PLT-20, FR-PLT-21, J58 |
| Tested against the real Ethereum Attestation Service on a fork of Base Sepolia at a pinned block: the schema registered once, an accreditation attested by name and delivered to the back office as a signed webhook with its identifier, an attestation under another schema refused, a revocation held until a reviewer approved, and validity read as valid, revoked, expired or unknown. | FR-PLT-22, J58 |
| Run on Base Sepolia, a public test network, against the network's own Ethereum Attestation Service: the schema registered once, an accreditation attested and delivered as a signed webhook, an attestation under another schema refused, a revocation held until the reviewer approved, each visible on EAS's explorer. | FR-PLT-24 |
| A ready-made treasury pilot pack for Aave V3: the Pool, the treasury's asset (USDC; on Sepolia EURS, while Aave's test USDC there is over its supply cap) and its aToken, Aave's price oracle and four Chainlink price feeds verified against the chain at a pinned block, a policy that holds the treasury's key to the Pool and that asset with an exact approval, supplies only for the treasury, a daily cap and approval above a threshold, and a one-command setup. | FR-PLT-25, FR-PLT-26, J60, J62 |
| Tested against the real Aave V3 market and Chainlink feeds on a fork of Ethereum mainnet at a pinned block, with nothing of value: supplies as ordered batches of an exact approval and the supply, a large one held until the treasurer approved, the position, the supply rate and the prices with their age read, an approval to another spender, a supply for someone else and a supply past the daily cap refused, and withdrawals of part and of everything with a year of interest. | FR-PLT-27, J60 |
| Run on Sepolia, a public test network, against Aave's own test market and Chainlink's live feeds, in test EURS while Aave's test USDC is over its supply cap: two supplies as ordered batches, the larger one held until the treasurer approved, an approval to another spender and a supply past the daily cap refused, and withdrawals of part and of everything, each visible on the explorer. | FR-PLT-29 |
| Policies per protocol: which contracts and functions may be called, with what value, and how much per period. | FR-POL-02, FR-POL-06, J28 |
| One image and one configuration file: each process is started in a role (API, worker, indexer, or all of them at once) and runs only the work of that role. | FR-OPS-04, J27, J38 |
| A submission is answered at once with the operation's id; progress is read through queries and events, and the API never waits for the chain. | FR-TX-02, FR-API-07, J23 |
| A stopping process finishes its broadcasts and deliveries in flight within a grace period, and whatever it could not finish is picked up again on restart. | FR-OPS-08, J15 |
| Every operation follows one state machine written as a transition table: each change of state is persisted with its cause and time before anything depends on it, and a transition the table does not allow is refused. | FR-TX-04, FR-TX-05, J07, J13 |
| The full history of every operation, every transition and every attempt with its time and cause, can be queried. | FR-TX-17, FR-TX-18, J14 |
| Each operation is simulated before it is signed: a call that would revert, a fee above the cap or a payer without enough funds fails with the reason before any signature, and the nonce is taken last. | FR-TX-06, FR-TX-16, FR-TX-09, J03, J08 |
| Fees follow the network's gas policy (EIP-1559 market, legacy market, fixed price or free) and the sending identity's tier, never the caller's guess; an override is allowed only under the cap. | FR-CHN-12, FR-TX-07, FR-TX-08, J08 |
| A node's refusal is classified: a recoverable one (underpriced, stale nonce) is rebuilt and retried, an unrecoverable one (insufficient funds, intrinsic gas too low) fails with the reason and gives the nonce back. | FR-TX-15, J10 |
| A transaction the node forgets is rebroadcast with the same signed bytes, then rebuilt at the same nonce: never a second payment. | FR-FIN-06, J11 |
| Cancelling before broadcast means nothing reaches the network; after broadcast it sends a zero-value replacement at the same nonce, and the final state says which of the two landed. | FR-TX-14, J24, J17 |
| An identity can be paused: new operations are accepted and wait without taking a nonce until it is resumed. | FR-TX-27, J24, J45 |
| Each network declares its finality rule: a number of blocks on top, the node's finalized block, or instant on networks with deterministic finality, with coherent defaults for public and permissioned networks. | FR-FIN-01, FR-CHN-13, J05, J06 |
| A deeper confirmation can be asked per operation or chosen by a policy rule (large amounts wait longer); the strictest applies, never one looser than the network's. | FR-FIN-07, FR-FIN-09, J22, J28 |
| Three ways to sign behind one port: a digest signer that returns only r and s, a transaction signer that returns the signed bytes, and an external signer that answers later through an inbox. | FR-SIG-03, FR-SIG-04, FR-SIG-05, J08, J16, J20 |
| An identity holds an address and a reference to its signer, never a key; for an HSM or KMS key the address is derived from the device's public key and the curve is checked before the identity is accepted. | FR-SIG-01, FR-SIG-02, FR-SIG-12, J16, J18, J40 |
| A request to an external signer carries the exact bytes, their hash, the decoded call and a deadline; a request nobody signs expires and gives the nonce back. | FR-SIG-06, FR-SIG-07, FR-SIG-08, J20, J25 |
| A transaction signed outside CryptoRail is never re-signed on the signer's behalf: if it gets stuck, the new fee goes back as a request flagged fee-refresh, and an approval already given is reused. | FR-SIG-22, FR-APR-08, J20 |
| EIP-712 typed data signed through the same identities and signers, with the same verification, from the library. | FR-SIG-13, J16, J18 |
| EIP-712 typed-data signing over the HTTP API. | FR-API-19, FR-SIG-13, J48, J50 |
| The development signer warns on every start and refuses to load in production unless an explicit override is set. | FR-SIG-14, J12 |
| Only the development signer's package may touch key material, enforced by a dependency check on every change. | NFR-SEC-01, FR-SIG-01 |
| An operation waiting for approval holds no nonce and no fee, so it can wait days without blocking anything, and a later fee or nonce change never needs a new approval. | FR-APR-01, FR-APR-02, FR-APR-08, J13, J19 |
| At the last moment before signing, a signing gate checks the exact payload against what was approved: same digest, gas within the cap, not expired, not used by another transaction, quorum still valid, policy still allowing it. | FR-APR-07, FR-APR-09, J19 |
| Three kinds of approval proof: EIP-712 signatures of registered approvers, an authenticated attestation from an approval system that cannot sign, or verification on chain by the account itself. | FR-APR-03, J19, J33 |
| Approvers are registered per tenant, their keys rotated and revoked; approvals expire and can be rejected with a reason, and the events of each step reach your workflow system. | FR-APR-04, FR-APR-05, FR-APR-06, J19, J41 |
| API keys are stored only as a keyed hash under a pepper kept in your secret manager, so whoever reads the database cannot call the API with what they find. | FR-API-04, NFR-SEC-04, ADR-0002, J26 |
| Who may do what is checked per call: read-only, submitter, signer, sponsor, operator and admin roles. | FR-API-06, J26, J41 |
| Each webhook endpoint gets a secret shown once, sealed at rest under a key from your secret manager, and rotated without a gap; endpoints must be HTTPS unless the deployment explicitly allows otherwise. | FR-EVT-09, FR-API-12, NFR-SEC-03, ADR-0004, J34 |
| Signatures and approvals posted back are authenticated and bound to the one request they answer. | NFR-SEC-03, FR-APR-05, J20, J25, J41 |
| Each process has its own database role: the API cannot allocate a nonce, the worker cannot read API keys, the indexer cannot touch transactions, identities or signing requests, and no process can change the schema. | NFR-SEC-06, J38 |
| The API process builds no signer, and a split deployment that configures one for it is refused at startup. | NFR-SEC-06, FR-OPS-04, J27 |
| In a split deployment the signing gate is a process of its own, the only one with signer credentials: it reaches the database and your signer and nothing else, and re-checks every request before it signs. | FR-APR-07, NFR-SEC-06, FR-OPS-04, J49 |
| A production deployment refuses to start with authentication on but no pepper, or without a webhook encryption key, rather than pretend to a protection it lacks. | FR-OPS-02, FR-API-04, ADR-0002, ADR-0004 |
| A secret written into the configuration instead of a reference to your secret manager is refused at startup. | FR-OPS-03, J18 |
| A subscription names a registered contract, an event and optional filters on its indexed parameters, and delivers to one of your webhook endpoints or a configured publisher. | FR-EVT-01, J35, J38 |
| A subscription starts from the latest block, a given block or the contract's deployment block; earlier history is backfilled at a limited pace before the subscription goes live. | FR-EVT-02, J35 |
| Events your ABI does not declare can be received raw by topic, and are decoded from the block a later version of the ABI declares them. | FR-REG-13, J35 |
| A subscription at depth zero receives events at once, as tentative, and a revert message carrying the original id when a reorganisation removes them. | FR-EVT-05, J36 |
| A reorganisation deeper than a subscription's depth raises an alert naming the block it rewound to, so you reconcile on the event ids instead of finding out later. | FR-EVT-06, J36 |
| Each subscription shows its cursor and how many blocks it is behind the head, as a field and as a metric, with an alert above your threshold. | FR-EVT-12, J35, J36 |
| A subscription pauses and resumes without losing its place: what was missed while paused arrives, in order, on resume. | FR-EVT-13, J35 |
| Events arrive in order per stream (a subscription, a transaction, an identity, a paymaster), and a target that refuses its deliveries delays only what is addressed to it. | FR-EVT-14, J34 |
| Webhooks follow the Standard Webhooks convention, so a receiver verifies them with an existing library; the delivery id stays the same on every retry. | FR-EVT-09, NFR-SEC-03, ADR-0004, J34 |
| Every delivery can be read with its status and each attempt, with what your receiver answered, per webhook endpoint or per subscription. | FR-EVT-15, J34, J38 |
| The history of a subscription, every delivery with its attempts, exported as NDJSON whose last line states that the file is complete. | FR-OPS-07, FR-EVT-15 |
| Metrics for transactions by state and network, time spent per state, attempts, nonce gaps, payer balances, paymaster deposits, outbox depth, deliveries, indexer lag, and each node endpoint's health, lag and queue. | NFR-OBS-03, FR-CHN-15, FR-EVT-12, J39 |
| One trace per operation, from submission to confirmation, across processes and restarts; spans carry the operation type, contract and function, so a search by operation type returns the whole business flow, and the reference dashboard drills down from a failed operation to its trace. | NFR-OBS-02, NFR-OBS-06, NFR-OBS-07, NFR-QA-08 |
| Alerts for a payer low on funds, a paymaster deposit running down, a nonce gap, a signature from the wrong key, a reorganisation deeper than the finality rule and an indexer falling behind, each raised once per crossing and delivered as an event, a metric and a log line. | FR-TX-24, FR-SPN-07, FR-TX-10, FR-SIG-09, FR-FIN-08, FR-EVT-12, J22 |
| Rate limits per API key, off by default, announced with standard rate-limit headers and refused with 429 and a retry time; health and readiness are never limited. | FR-API-13 |
| Runbooks for the situations that recur (a dead-lettered delivery, an unhealthy endpoint, a lagging indexer, a paused identity, a signing gate down, onboarding, offboarding and key rotation of a tenant), each naming the requirement behind the behaviour and the journey that shows it. | FR-EVT-09, FR-CHN-15, FR-EVT-12, FR-TX-27, FR-APR-07, FR-API-16, FR-OPS-07, J45 |
| Runs on Node.js 22 and 24, both tested on every change; the service ships as an OCI container image over PostgreSQL, tested on PostgreSQL 17. | NFR-INT-03, FR-OPS-04, J27 |
| Only the admins of the deployment's operator tenant can give a new tenant its first key or change another tenant's quotas; a request that names a tenant in its body or query is refused rather than ignored. | FR-API-04, FR-API-05, FR-API-16, J44 |
| Offboarding a tenant deletes nothing: its identities are paused, its history exported for audit and its keys revoked. | FR-TX-27, FR-OPS-07, FR-API-04, J45 |
| Two network profiles, public and permissioned, fill coherent defaults for fees, finality, stuck thresholds and priority tiers; every default can be overridden on its own. | FR-CHN-02, FR-CHN-13, J06 |
| Every endpoint is asked which network it serves when the process starts; one that answers with another chain id is refused before anything is sent to it. | FR-CHN-09 |
| An endpoint counts as healthy only when it answers in time and its head is within a set number of blocks of the most advanced endpoint; rate and concurrency limits per endpoint, and provider limits such as the eth_getLogs block range, are respected on CryptoRail's side. | FR-CHN-15, FR-CHN-06, FR-CHN-07, J39 |
| On every change to the code, the integration suites run against Anvil on the Prague hardfork, against a four-validator Hyperledger Besu QBFT network with zero gas price, and, for sponsored execution, against the Alto bundler pinned by digest; no test in CI spends funds or sends anything to a public network. | NFR-INT-05, NFR-INT-06, NFR-QA-02, NFR-QA-05, J05, J32 |
| Run on public test networks by manual procedures recorded with their dates: a real wallet asking for sponsorship on Base Sepolia, the stablecoin and attestation packs on Base Sepolia, the Aave treasury pack on Sepolia. | NFR-INT-06, FR-PLT-05, FR-PLT-24, FR-PLT-29 |
| The EntryPoint, account and validator contracts are pinned per network by address and code hash; a process whose node shows other code, or none, at a pinned address refuses to start, naming the network, the contract and both hashes. | NFR-SEC-09, FR-SPN-06, ADR-0003 |
| Throughput from one sending identity is measured on every change, against PostgreSQL, a real node and authentication on: on a development machine one worker carries about 25 submissions a second through to broadcast, against a target of 50 that one worker does not meet. | NFR-PERF-01 |
| A second worker on the same identity adds throughput (about 34 submissions a second against about 25 with one, on a development machine) and the nonce sequence stays dense: no gap, no repeat. | NFR-PERF-01, FR-TX-09, FR-OPS-04, FR-OPS-05 |
| The nonce lock is held for two database round trips and nothing else, measured on every run: a median of about 5 ms, an eighth of the time a transaction spends in the pipeline. | FR-TX-09, NFR-PERF-01 |
| A submission is answered 202 in single-digit milliseconds at the 95th percentile over 200 authenticated submissions with gas supplied, against a budget of 200 ms; the API accepts about 390 submissions a second from one identity. | NFR-PERF-03, FR-API-07 |
| One indexer kept up with 500 subscribed logs per block at a 2-second block time: 6,000 logs delivered once each under 6,000 distinct ids, never a block of lag against a bound of depth plus two. | NFR-PERF-02, NFR-PERF-04 |
| Per node endpoint, a rate and a concurrency limit enforced before a request leaves the process: a burst above the limit waits in a queue and is served, and fails as retryable only after a timeout. | FR-CHN-06, J39 |
| Per API key rate limiting with standard rate-limit headers and a 429 with Retry-After, counted in each API process; a count shared across several copies of the API is not built. | FR-API-13 |
| An atomic multi-call carries two to sixteen calls, executed all or none by the actor's smart account in one UserOperation; it is refused in plain transaction mode. | FR-TX-30, ADR-0008, J66 |
| An API key's secret is shown once when it is created; a rotation keeps the old key working through a configurable overlap, a revocation ends it at once on every API process, and a tenant's last admin key cannot be revoked. | FR-API-04, J26, J27 |
| Rate limiting per API key, configurable, reported with standard rate-limit headers and a refusal that says when to come back. | FR-API-13, J26 |
| A change to a tenant's policy is a new version that can be made to wait for a quorum of named approvers, required by default when CryptoRail is run for you; every proposal, approval and activation is recorded. | FR-POL-09, J65 |
| Every dependency version is fixed in a committed lockfile, and every build installs exactly that set. | NFR-SEC-05 |
| Every Must requirement has at least one automated test that names it, and a change is merged only with its tests, every check green and no loss of requirement coverage. | NFR-QA-01, NFR-QA-06 |
| A space of your own on our sandbox, never for value: a tenant with its admin key, a key on Sepolia that the sandbox generated and holds, funded with test ether and test USDC, and rules that are your tenant's own policy version and bind nobody else. | NFR-SEC-10, FR-API-05, FR-POL-08, J43, J63 |
| Every request of the getting-started tutorial is a file that a journey sends against a fork of Sepolia on every change, so a step that stops working cannot be merged. | FR-POL-07, FR-EVT-05, NFR-QA-07, J63 |
| Each pilot pack has a console in the browser, behind a login, that operates the pack on a sandbox: the API key never reaches the browser and every screen says it is a sandbox with nothing of value. | FR-PLT-07, FR-PLT-09, J53, J56, J57, J59, J61 |
| Every behaviour a consumer sees has a journey: a scenario run on every change whose HTML report shows, step by step, the request, the response, the resulting state, the events and, for a negative case, the failure report. | NFR-QA-07, NFR-QA-09 |
| Sponsored gas comes from your own paymaster's deposit: its data signed by your own signing identity, the deposit watched against a threshold you set, the operations sent through a bundler you run or a provider's. | FR-SPN-05, FR-SPN-07, FR-SIG-19, FR-SPN-15 |