Readiness is computed, never declared.

Principle

A feature flag alone never makes an integration appear available. Readiness is computed on the server from validated configuration plus live checks: an adapter id must map to a registered factory whose own configuration validates, and a network must answer a chain-id probe. Anything else reports "Not configured" or "Unavailable".

Networks

• Robinhood Chain (chain id 4663) — official public RPC https://rpc.mainnet.chain.robinhood.com; server default https://robinhood-rpc.publicnode.com; override with ROBINHOOD_RPC_URL; explorer https://robinhoodchain.blockscout.com. Verified 2026-11-09 against https://docs.robinhood.com/chain/connecting/.
• Ethereum (chain id 1) — official public RPC https://ethereum-rpc.publicnode.com; server default https://ethereum-rpc.publicnode.com; override with ETHEREUM_RPC_URL; explorer https://etherscan.io. Verified 2026-11-09 against https://ethereum.org/en/developers/docs/networks/.
• Robinhood Chain Testnet (46630) is known but not configured: no feeds and no issuer assets exist there.

Browser reads go through the same-origin relay /api/rpc/[chainId], which forwards only read-only JSON-RPC methods to the server-configured endpoint. Provider URLs with keys stay on the server.

Price providers

• Chainlink — AggregatorV3 reads through Multicall3. Each feed is checked for decimals and description against the registry, positive answer, round completeness (answeredInRound ≥ roundId), non-future timestamp, and age within heartbeat plus a 15-minute grace. Equity feeds are 24/5 and go stale over weekends; the record says so. No L2 sequencer-uptime feed is listed for Robinhood Chain.
• Robinhood issuer quotes — GET /rhj/prices/{SYMBOL}; mid of the per-token bid/ask, marked indicative, stale after 15 minutes, fetched one symbol at a time because the endpoint rate-limits bursts.
• xStocks issuer quotes — GET /api/v2/public/assets/{SYMBOL}/price-data; null outside US market hours, reported as unavailable.
• DefiLlama — aggregate market prices by chain:address; stale after 24 hours; low confidence is noted.

Valuation prefers a token oracle, then an issuer quote, then an aggregate; an underlying reference (such as XAU / USD) is never used to value a token. No execution venue is configured, so no executable quote, fee, expected output or expiry is ever shown.

Privacy adapter

Interface in src/lib/privacy/adapter.ts: getSupportedAssets, getPrivacyScope, getDepositQuote, prepareDeposit, getPrivateBalance, prepareWithdrawal, getTransactionStatus. To enable a protocol: implement the interface on top of its reviewed SDK, register a factory in PRIVACY_ADAPTER_FACTORIES under an id, make the factory return null whenever its required settings are missing, and set PRIVACY_ADAPTER to that id. The not-configured adapter refuses every transactional call.

Sealed batch execution adapter

Interface in src/lib/trading/adapter.ts: describeMechanism (sealing, who can reveal, batch timing, cancellation, expiry, partial fills, pricing rule, fee calculation, settlement contracts, refund behaviour, confidentiality limits), previewOrder, submitOrder, cancelOrder, getOrderStatus. Register in TRADING_ADAPTER_FACTORIES and set TRADING_ADAPTER. Order states must come from adapter responses and transaction receipts; the UI never reports settlement from a timer.

Eligibility provider

Interface in src/lib/eligibility/adapter.ts: listRequirements, startVerification, getVerificationRecord. The pure evaluator evaluateVerificationRecord applies audience, session, requirement, nonce, replay, issuer, revocation, freshness and expiry checks and is unit-tested. Register in ELIGIBILITY_PROVIDER_FACTORIES and set ELIGIBILITY_PROVIDER. Identity documents are never uploaded to this application.

Security notes

• Server-side fetches are limited to an allowlist of upstream hosts; configurable URLs cannot point elsewhere.
• Addresses are validated (format and EIP-55 checksum) before any request.
• Every upstream request has a timeout; API routes apply per-client rate limits; error messages are redacted of anything that looks like a key.
• The Content-Security-Policy restricts scripts, styles, images and connections to this origin. Next.js hydration requires inline scripts, so 'unsafe-inline' is allowed for scripts; the development server additionally needs 'unsafe-eval'.
• No analytics; no wallet address is ever sent to a third-party analytics payload.

Registry maintenance

Records live in src/data/registry/registry.json and are validated by the schema in schema.ts at build time. To add a verified asset, add the record with its sources and a verification method, then run pnpm verify:registry, which reads every contract and feed on-chain and fails on any mismatch.