Document ID: GOS-80-CHAIN-ALG-ROADMAP Version: 0.1.0 Status: DRAFT Owner Role: CHAIN_OFFICER Last Review Date: 2026-03-04 Next Review Date: 2026-04-04

Goal

Start multichain execution with Algorand as first production-grade anchor target while preserving existing HASH_ONLY and Shadow-Only boundaries.

Scope (Phase-0 / Now)

• Introduce ALGORAND as a first-class chain type in chain binding.
• Keep canonical ledger truth unchanged.
• Keep anchoring as boundary operation (no business truth migration on-chain).

Architecture Intent

• packages/financial-layer/chain remains the chain-routing control plane.
• Chain resolution selects targets by settlement domain + namespace.
• Algorand integration is initially an adapter behind existing AnchorTarget semantics.

Phased Plan

Phase 1 — Shadow Anchoring MVP (2–3 sprints)

• Add Algorand binding records per target domain (anchoringMode=HASH_ONLY).
• Implement AlgorandAnchorAdapter (submit note/box/app-call hash anchor).
• Persist tx references in audit trail (txId, round, timestamp, namespace).
• Add idempotent retry policy using existing idempotency key.

Deliverables:

• packages/financial-layer/chain/adapters/algorand-adapter.ts
• services/* integration points for shadow anchor dispatch
• Governance runbook for key rotation and endpoint failover

Phase 2 — Reliability + Observability

• Add health probes: algod, indexer availability, network lag.
• Add confirmation policy (minConfirmedRound, timeout, retry budget).
• Add telemetry: submit latency, confirmation latency, failure reason taxonomy.
• Add dead-letter flow for unresolved anchor submissions.

Deliverables:

• Metrics dashboard spec
• Alert thresholds and on-call SOP

Phase 3 — Policy Activation

• Enable domain-level activation policy from SHADOW_ONLY to ACTIVE by jurisdiction.
• Add change-control gate for switching activation states.
• Keep fallback path reversible without altering core write-path truth.

Deliverables:

• Activation checklist
• Rollback and incident response playbook

Data/Contract Conventions

• Anchor payload remains canonical hash envelope only.
• Required persisted metadata:
  • chainType=ALGORAND
  • chainId (network/genesis reference)
  • anchorNamespace
  • anchorTxId
  • anchorRound
  • submittedAt, confirmedAt

Security Baseline

• Sign submission requests at application layer (existing signature controls).
• No private keys in source; use HSM/KMS signer boundary.
• Rotate Algorand signing keys per governance schedule.
• Record hash-chain audit entries for submit/confirm/fail transitions.

Risks

• Network/indexer drift causing delayed confirmations.
• Inconsistent namespace policy across jurisdictions.
• Operational key custody maturity lag.

Immediate Next Steps

1. Add adapter interface contract for non-EVM anchors.
2. Create Algorand testnet sandbox profile and dry-run submission command.
3. Register first shadow binding for one low-risk settlement domain.
4. Add integration test for idempotent duplicate submission handling.

Testnet Submit Command (Scaffold)

• Command: npm run algorand:testnet-submit
• Required env:
  • ALGORAND_SIGNER_URL (signer boundary endpoint)
• Optional env:
  • ALGOD_TESTNET_URL (default https://testnet-api.algonode.cloud)
  • ALGOD_TESTNET_TOKEN, ALGOD_TESTNET_TOKEN_HEADER
  • ALGORAND_SIGNER_API_KEY, ALGORAND_SIGNER_API_KEY_HEADER
  • ALGORAND_SENDER_ADDRESS
  • ALGORAND_REQUEST_TIMEOUT_MS
  • ALGORAND_CONFIRMATION_TIMEOUT_MS
  • ALGORAND_CONFIRMATION_POLL_MS

Signer boundary contract (request):

• chainId
• anchorNamespace
• envelopeHash
• idempotencyKey
• note (optional)
• senderAddress (optional)

Signer boundary contract (response):

• signedTransactionBase64 (required)
• transactionId (optional, but recommended)

Related Architecture Artifacts

• C4 and sequence design: MULTICHAIN_ORCHESTRATION_C4.md
• Kafka event schemas: schemas/README.md
• Single-operator runbook: SINGLE_OPERATOR_MODE.md

Kafka Adoption Mode

• Adopt Kafka incrementally by adding producer/consumer per saga step, not all services at once.
• Use shared DTO contracts and partition-key enforcement helper from financial-layer orchestration module.
• Keep core-ledger transactional outbox as the only source for initial event publication.