Operational dependencies

Static disclosure of what Raven depends on and how it fails — not a live uptime page. Machine-readable: /status-policy.json.

The Launch Console is static (Vercel) — no backend, no keys in browser code. The hosted verifier runs on Render; primary POST /receipt/v1 depends on its availability, /healthz reports it, and /pubkey is public discovery/cross-check material only. POST /verify is legacy v2 compatibility. Solana RPC is server-side only: user-supplied rpcUrl and issuerIdentity are rejected.

Fail behavior: receipt-v1 returns an unsigned 422 refusal when required evidence cannot be established and issues no receipt; 500/502/503/504 are also no-receipt failures. Rate limits return 429. Retry later or request access. Local MCP (npx -y raven-verify-mcp) is unsigned developer output, not a fallback signed receipt. No secret logging; no private keys or API keys in logs.