Governance
Kill switches and their blast radius
Section titled “Kill switches and their blast radius”Three independent levers can stop your device, and each names what it stops:
| Lever | Held by | Stops |
|---|---|---|
| Platform freeze | Sitora | Provider-driven collection everywhere; display planes freeze with it |
| Provider standing | Sitora | One provider’s routes; its in-flight intents are released |
| Device pause / station retire | The restaurant owner | That device or that till |
Cash and attested-terminal collection survive all three. A restaurant is never unable to take money because a device, a provider, or Sitora itself had a bad day — which is also why your integration must degrade quietly rather than blocking the till.
Throttling
Section titled “Throttling”Rates are keyed per credential, not per IP, so one noisy device cannot starve another. Enrollment claims are anonymous by nature and keyed by IP. Design for the documented cadences rather than probing for the limits.
Everything is auditable
Section titled “Everything is auditable”- Every device registration, pause, retirement, and enrollment reset lands in the owner’s audit stream with a required reason.
- Every intent carries the acting cashier, the station, and the attestation mode — permanently. Attested money stays identifiable as the weaker evidence class forever, because that is what reconciliation targets first.
- Every handoff report is immutable. A corrected outcome is a new report, never an edit to an old one.
Enrollment codes and credentials never appear in audit payloads.
Permanent limits of this contract
Section titled “Permanent limits of this contract”These are not roadmap items. They are the shape of the product:
- No cardholder data, ever. Sitora accepts, stores, logs and forwards none of it, and no field exists to carry it.
- No device-declared settlement. See the handoff rules.
- No amount, currency, or order chosen by the device. The backend authors every amount from order truth.
- No partial or split payment. An intent collects one order’s total.
- No merchant-initiated refund. Refunds are provider-initiated; nothing on this surface executes one.
- No offline store-and-forward. Without connectivity there is no intent — the till falls back to cash and attested collection, honestly.
Certification
Section titled “Certification”A capability is certified per provider × capability, on the evidence of a recorded conformance run. Passing for one hardware verb never certifies another, and a re-run is a new record — certification artifacts are never edited.
Run the suite as described in the quickstart.