[keeganthomp]

What

Finishes ADR 0008 step 3 and closes HOO-2086: ramp adapters run on the contract alone, with their own keys and no process env.

• RampRuntimeContext is { mode, cluster, credentials }; services/ramps/runtime.ts resolves keys for calls, availability, the sweep and discovery
• Each provider refuses keys from the other mode (checkCredentials) before any request
• The registry is typed as the contract; a provider omits a direction it doesn't run (rampClientFor)
• A boundary test fails any import of a provider's internals outside its webhook processor's status mapping

Reviewer notes

• Tier: Critical, no behavior change. Adapters got the whole process env, now only their own two keys; refusal messages are byte-identical. Security reviewer: unassigned.
• MOONPAY_ONRAMP_URL / MOONPAY_OFFRAMP_URL are gone: widget hosts follow the mode. Dev infra still lists both names.
• AI use: Claude Code wrote the change and tests. No new dependencies.

Verification

• sdp-payments 186/186, API 7525 passed / 1 skipped, workspace typecheck 28/28, Biome, module boundaries, value movement
• Live sandbox: Stripe estimate, session and status pull; MoonPay estimates, widget and lookup
• Not run: deployed dev, which has no STRIPE_SANDBOX_* keys yet

🤖 Generated with Claude Code

[linear]

HOO-2086

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sdp-docs	Ready	Preview	Oct 21, 2026 4:46pm UTC
sdp-web	Ready	Preview	Oct 21, 2026 4:46pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable defects or rule violations were found.

Summary

The PR gives ramp adapters provider-specific credentials instead of the process environment.

• Ramp adapters get only the keys and mode for their provider calls.
• Each ramp provider declares only the directions it can run.
• MoonPay widgets use the host for their mode, and status events share asset mapping.
• Provider internals stay behind the shared ramp contract.

No actionable issues were found. Tests were not run during this review.

Acknowledgment: keeganthomp explicitly identified removal of MOONPAY_ONRAMP_URL and MOONPAY_OFFRAMP_URL as intentional. Widget hosts now follow the mode. The author also acknowledged that dev infrastructure still lists those names; this was not reported.

_{Reviews (1) · Last reviewed commit: "refactor(payments): finish the ramp prov..." · Reviewed by Greptile}

[Windscar]

Looks good. The ramp adapters now receive provider-specific credentials through the runtime contract.

Reviewed: credential and mode checks, provider calls, route and sweep handoffs, availability, and webhook boundaries.