TelaroDocs
Reference · Operations

Keep environment, authority, and data boundaries visible.

A successful demo and a safe production transaction require different controls. Use this checklist before enabling real spend.

Environment matrix

Configure every dependent value as one set

ValueMust match
ClusterProgram ID, RPC, stablecoin mint, explorer links, and signer configuration.
ApplicationDocs URL, public API, Indexer, procurement API, and exact allowed origins.
OrganizationWorkspace, cost center, settlement asset, policy, and bounded budgets.
EvidenceTrusted AgentCard signer, maximum age, and upstream timeout.

Fail startup when a mainnet service is missing an explicit program ID, mint, or signer. Do not silently inherit devnet defaults.

Authority

Each actor signs only its own transition

BoundaryAuthority
Human walletAuthentication and user-approved wallet actions.
Buyer service signerAuthorized sACP create, fund, settle, dispute, and reclaim commands.
Provider signerSubmission for the provider wallet named in the frozen job.
Evaluator signerVerdict for a dispute bound to that evaluator.
Indexer signerSigned AgentCard evidence and approved score updates.

Published packages and browser bundles must not contain raw service signer material.

Browser session

Keep the API bearer outside JavaScript

  • Configure PROCUREMENT_API_URL only on the product server.
  • Store the upstream bearer in an HTTP-only, Secure, SameSite Strict cookie.
  • Require an exact same Origin and a session-bound CSRF value for every command.
  • Rotate the bearer before its bounded expiry and invalidate the previous token atomically.
  • Revoke the server session on sign-out, then clear every browser session cookie.

Browser storage may keep tenant selections such as organization, workspace, and cost center. It must not contain an access token, wallet session proof, or service signer.

Data

A chain reference is public by default

  • Put public-safe, encrypted, or content-addressed references in on-chain URI fields.
  • Keep customer inputs, raw outputs, reviewer notes, and dispute evidence in controlled storage.
  • Store hashes that prove integrity without exposing the underlying content.
  • Apply retention and access policies to receipts and audit exports.
Spend gate

Deployment does not automatically enable new spend

Keep NEW_SPEND_ENABLED=0 for a new environment. Validate migrations, tenant isolation, policy, evidence signer, RPC, remote signer authentication, reconciliation, alerting, and rollback before a separate reviewed change enables financial commands.

Environment
NEW_SPEND_ENABLED=0
Local development

Run the complete local stack

Terminal
nvm use
pnpm dev:local
ServiceLocal URL
Product apphttp://localhost:5001
Docshttp://localhost:5011
Indexerhttp://localhost:5050
Procurement APIhttp://127.0.0.1:8080