> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Operating Lerian SCR

> Operating Lerian SCR: readiness checks, runtime configuration namespaces, credential rotation, cache and retention, metrics, and the strict posture.

Lerian SCR runs on a tariffed regulatory channel, and its operational surface protects it.

## Health and readiness

***

`GET /health` answers liveness. `GET /readyz` answers one entry per dependency.

| Check            | What it probes                                             | When it fails                                            |
| ---------------- | ---------------------------------------------------------- | -------------------------------------------------------- |
| `postgres`       | A ping on the primary pool.                                | Unreachable: down.                                       |
| `redis`          | A ping on the cache client.                                | Unreachable: down. Absent: skipped.                      |
| `scr_endpoint`   | A limited TLS handshake to BACEN. No query, no credential. | Broken chain: down. Dial timeout: degraded.              |
| `vault`          | A reachability call on the credential store.               | Unreachable: degraded, a cached credential still serves. |
| `tenant_manager` | The tenant directory, multi-tenant only.                   | Unreachable: down.                                       |
| `event_emission` | The declared emission posture.                             | Never. It reports only.                                  |

The handshake result serves for 20 seconds, so readiness never dials BACEN per request. The pod-level breaker opens only when every per-institution breaker is open. One failing institution keeps the pod ready and answers `SCR-1002`.

On shutdown `/readyz` turns 503 first, and the listener stays open three seconds. `READYZ_DRAIN_DELAY` overrides it.

## Runtime configuration

***

Nine namespaces reach an operator at `/v1/system`, under the `scr:system:write` scope. The table lists the seven the service reads. `scr.cors` and `scr.postgres` also exist in the catalog. The service takes its cross-origin and connection-pool settings from the [environment variables](/en/rails/native/scr/scr-environment-variables).

A log-level change takes effect at once. A retention change takes effect at the next purge sweep. The service reads every other namespace when it starts, so a change there takes effect at the next restart. See [System plane](/en/reference/systemplane/overview).

| Namespace             | What it controls                               | Defaults                                  |
| --------------------- | ---------------------------------------------- | ----------------------------------------- |
| `scr.app`             | Log level.                                     | Boot configuration.                       |
| `scr.rate_limit`      | Inbound limit per IP.                          | 100 per 60 seconds.                       |
| `scr.outbox`          | Interval, batch size, publish attempts.        | `2s`, 50, 3.                              |
| `scr.wsscr2n`         | Request deadline, connections per institution. | `25s`, 2.                                 |
| `scr.cache`           | Entry lifetimes.                               | `4h`, `720h`.                             |
| `scr.circuit_breaker` | Trip thresholds, cool-down.                    | 5 failures, ratio 0.5, minimum 10, `30s`. |
| `scr.retention`       | Purge window, sweep cadence.                   | Empty. Purge off.                         |

Every knob carries finite bounds. The request deadline stops below 28 seconds, so a request never outlives the gateway. The connection cap accepts 1 or 2.

## Credentials and rotation

***

The secret-store kind picks the credential source. The environment kind reads the user and password from the deployment environment. The managed-vault kind resolves them per institution, and the database holds only a reference.

The managed-vault kind also mounts `PUT /v1/scr/credential`. It writes the vault first and the metadata second, so a retry reuses the reference.

The password never reaches a log, a span, or an error. The status operation returns a masked user name. A vault outage answers `SCR-1002` and never trips the channel breaker.

## Cache and retention

***

The result cache holds one entry per institution, borrower blind index, and reference month. Each value carries the audit row's at-rest envelope. A current-month entry lives four hours, a closed-month entry 720 hours. An unreadable entry counts as a miss, and a deployment without Redis always misses.

The audit purge stays off until an operator sets a window. An empty window deletes nothing. With a window, a daily sweep deletes older rows in bounded batches, and never archives them.

## Metrics and tracing

***

The default export is OTLP push. A Prometheus scrape listener is opt-in on a loopback address, `127.0.0.1:9075` by default. The application port has no `/metrics` route.

Two histograms measure a consultation: end to end, and the overhead without the BACEN call. Their labels carry the institution, the cache-hit flag, and the outcome, never the borrower. Counters cover unknown decode codes and purged rows.

## Deployment posture

***

A production environment name or the SaaS deployment mode selects the strict posture. Strict boot demands an explicit deployment mode, the Postgres host, database and user, and authorization over an https address. It demands the channel base URL over https, and TLS on Postgres and any configured Redis or broker. It demands two distinct at-rest keys and a region for the managed vault, and it forbids a wildcard proxy range.

A blank broker list or Redis host refuses the boot, unless an operator states the opt-out. The boot log and `/readyz` then name the degraded protections.

Multi-tenancy needs the tenant directory URL and a service key. Otherwise one deployment serves one institution.

An operator applies the schema outside the runtime process. The service reads it and never creates it.