Operating windows
BACEN announces the STR operating-window grades through GEN0021. The rail persists them, and you query the current grades with STR0001. A live schedule view lists the opening and closing times per reference date. The last announcement for a reference date wins. The rail does not impose a generic rejection of every submit outside an operating window. Its explicit schedule-related admission rule is RLPI0007: during the additional-aporte window, it rejects an aporte to a foreign Conta PI. Aportes to the institution’s own Conta PI and resgates remain allowed.
Certificate rotation
The rail hot-reloads the ICP-Brasil signing certificate pair with no restart. A rotation swaps the in-memory signing pointer and writes audit evidence. An activation announces the new certificate to BACEN through GEN0006. Responses never expose the private key path or any key material. Certificate warnings surface in the readiness and summary views before the certificate expires.
Contingency and durability
- Persist-before-send guarantees the rail dispatches no unrecorded message.
- A dispatch sweep retries stuck outbound work.
- The rail retries a failed event delivery. A delivery that uses all its attempts moves to
EXHAUSTED, and an operator can retry it manually.
Reconciliation
The rail opens a reconciliation case for an operation that needs review, such as one that is stuck or has an uncertain outcome. An operator resolves a case by recording an action against it. A terminal case accepts no more actions.
Settlement invariants
Two invariants hold throughout:
- A submit is dispatch, not confirmation.
SUBMITTED(a TED) orPENDING(a Conta PI or SME movement) means the rail accepted the dispatch. The inbound R-leg moves the TED’s STR message toCONFIRMEDorREJECTED. That R-leg carries BACEN’s settlement fields, for examplenumCtrlSTRandsitLancSTR, projected verbatim. - The rail is money-neutral. It forwards declared amounts exactly and computes no position or balance. Your ledger consumer records any accounting position.

