IMPLEMENTED MILESTONE 1

A fuse that survives the dashboard.

The gateway makes admission decisions without a synchronous D1 dependency. A Durable Object owns each hot wallet, while signed envelopes carry trusted causal context between services.

Control plane

Policy authoring, compact metadata, incident review, and signed bundle distribution.

Data plane

Envelope verification, local policy decisions, wallet reservations, and provider routing.

Action plane

Scoped containment, verification, evidence capture, rollback, and gradual restoration.

Runtime guarantee

In strict mode, a protected operation must reserve its configured worst-case cost before execution. It is denied when settled spend plus outstanding reservations plus the request would exceed the wallet.

Integer microdollar accounting

Idempotent operation IDs

Single-use settlement tokens

Expiring reservations

Signed short-lived envelopes

Run-scoped freeze state

Repository boundaries

apps/console        Next.js product and simulator
packages/core       policy, wallet, envelopes, detectors
workers/gateway     OpenAI-compatible admission Worker
migrations          D1 control-plane schema
security            threat model and credential boundaries