- Authentication
- OAuth 2.1 access tokens (PKCE, device code, or SIWE/SIWS). Guest capability lane for attended signing, claimable into an account later.
- Fail closed
- A present-but-invalid credential is always 401; it never downgrades to guest. Missing scope is 403.
- Idempotency
- Idempotency-Key on every mutating call. Same key + same body returns the recorded response; a different body is 409.
- Concurrency
- One turn per session. A second request during an active turn returns 409 busy with the live cursor.
- Custody models
- Browser and embedded wallets sign in-band. Safe, Turnkey, and policy custody return deferred; the action waits for quorum.
- Verification
- A reported hash enters submitted_unverified. A watcher checks signer, chain, calldata, ordering, and fee legs before confirmed.
- Recovery
- Unresolved actions appear in every delta regardless of cursor. Refresh, crash, or second device—nothing is lost.
- Errors
- Typed JSON errors with a retryable flag: invalid_auth, insufficient_scope, quota_exhausted, action_superseded, transaction_mismatch…