# M10-L05 — Lab contract

**Build:** Expose GET balance and POST unsigned-intent endpoint with validation.

**Pass:** Bad address returns 400; RPC outage returns controlled error.

**Failure injection:** Unvalidated address/amount and unbounded retries cause loss.

**Review question:** Where should signing keys live in production?

Status: specification; only count as executable when source and tests are present and verified.