SolGuard applies one basic request-integrity boundary before policy, behavioural detection, authorization creation, or settlement. It has no external dependency and uses no custom cryptography.
For each canonical payment request, the gateway:
- Rejects a missing or malformed nonce during contract validation.
- Rejects the request when the gateway clock is at or beyond
expires_at. - Atomically consumes the
(agent_id, nonce)pair in the nonce store. - Returns
REQUEST_REPLAYEDif that pair was already consumed. - Continues to mandate and behavioural evaluation only for a fresh pair.
Expired and malformed requests never reach the nonce store. A fresh, structurally valid request consumes its nonce at the integrity boundary even if a later policy, detection, or settlement control blocks it. Retrying a corrected request therefore requires a new nonce.
The store exposes one atomic consume_if_unused operation so the security decision never depends on a separate read followed by a write. An exception or invalid response from the store becomes SYSTEM_FAILURE; no authorization or settlement is produced.
InMemoryNonceStore is thread-safe but process-local and non-durable. Restarting the process clears replay state, and separate instances do not coordinate. Production deployment requires an atomic durable store, authenticated tenant isolation, retention controls, and operational monitoring.
Request-nonce replay protection is distinct from single-use authorization enforcement at the wallet boundary. The implemented wallet guard maintains a separate process-local store because request observation and signing authority are different security boundaries.