# Railyard

> The AI settlement + model rail.

Platform infrastructure that serves many products — not coupled to any one app.

## Thesis

The durable asset is the **settlement rail underneath every app**: **Mint** — a fiat-backed, gasless, success-only microdollar ledger with Ed25519 hash-linked receipts and reserve conservation, speaking AITP-402. Everything else in this repo is either: - the **model rail** (**Relay** — a TensorZero fork with success-only Mint   billing), or - the **tool rail** (**Switchyard** — one key, a priced tool catalog, the   same hold/capture discipline), or - a **wedge** that installs Mint under a new class of payer (billing,   paywalls, a game economy, a resellable AI SDK, a forge, analytics, error   tracking). If an app in this repo doesn't touch Mint and isn't infrastructure those apps run on, it probably doesn't belong here — see [`docs/RAILYARD_ENTERPRISE_ARCHITECTURE.md`](docs/RAILYARD_ENTERPRISE_ARCHITECTURE.md) §0 for the design invariants every app is held to.

## The rail

| App | Role | Status |
| --- | --- | --- |
| **Mint** (`apps/mint`) | Settlement ledger: double-entry, Ed25519 hash-linked receipts, reserve conservation, payouts and provider reconciliation. The core asset. | implemented; operator console at `/admin` |
| **Relay** (`apps/relay`) | Model gateway (TensorZero fork) with success-only Mint billing and a per-model price catalog. The model rail. | implemented; operator UI in `apps/relay/ui` |
| **Rago** (`apps/rago`) | Usage-based billing (Rust rewrite of Lago, API-compatible): metering, subscriptions, invoicing, payments, integrations. | implemented; admin at `/admin`, customer portal at `/portal/:token` |
| **Insights** (`apps/insights-edge`) | Cookieless, GDPR-friendly web analytics: email+domain signup, private per-site dashboard, session replay (paid tier), UTM/referrer/page-speed reporting. | **live** at `insights.ereboslab.com`, free up to 10,000 events/month/site |
| **Faultline** (GlitchTip, box 2) | Sentry-compatible browser/server error tracking for the portfolio. | **live** at `errors.ereboslab.com`, wired into Scribase, Menivor, Bidstage |
| **Vend** (`apps/vend`) | Resellable metered AI SDK on the rail (Stripe-meets-OpenRouter). Interrupted holds and payouts are replayed by `vend-reconcile`. | **live** at `vend.ereboslab.com`; tenant console at `/console`, operator admin at `/admin` |
| **Turnstile** (`apps/turnstile`) | Drop-in paywall for paid agent tools (AITP-402 and x402). | **live** at `turnstile.ereboslab.com`; admin at `/admin` |
| **Rithub** (`apps/gitea`, decided 2026-10-15) | Self-hostable git forge + CI: Gitea (MIT) branded as "Rithub", with the Rago/Mint billing bridge and a registered Actions runner (`act_runner`) so pushed `.gitea/workflows/*.yml` jobs actually execute. `apps/rithub` (from-scratch Rust forge on `rit`) is the earlier effort — kept, not deleted, documented as superseded for this slot in `apps/rithub/README.md` and `apps/gitea/README.md`. | **live** at `git.ereboslab.com`; CI runner deployed 2026-10-20 |
| **rit** (`apps/rit`) | Library-first Rust implementation of Git's object/authoring model, interop-tested against `git`. | library |
| **agent-runtime** | Shared Rig/AITP-402 runtime: policy signing, paid SSE/multipart, cancellation reconciliation, pinned Mint-proof verification. | payment SDK ready |
| **abacus** | Inline proxy enforcing hard, receipted per-agent spend budgets (kill-switch). | **live** at `abacus.ereboslab.com`; Postgres-backed |
| **identity-lock** (Context Passport) | Provider-agnostic locked character/brand/persona identity, resolved through Relay for consistent generation. Source path: `apps/context-passport`. | **live** at `context-passport.ereboslab.com` |
| **ledgerline** | Gross-margin lens: revenue + provider COGS on one Mint-backed ledger, settled through a durable outbox. | **live** at `ledgerline.ereboslab.com` |
| **game-economy** | Storefront for card packs, cosmetics and battle passes on Mint hold/capture. | runnable slice |
| **Toolgate** (`apps/toolgate`, aka Switchyard) | The tool rail next to Relay: one `sk-t0-` key reaches a schema-typed catalog (our products first, free/public APIs second, BYO keys third) with Mint hold/capture, Rago events, SSRF-safe egress, an MCP server and the `sy` CLI. | **live** at `toolgate.ereboslab.com` |

## Consumed by, not owned by

Products such as Menivor call Railyard over HTTP and shared contract packages — they do not own it. That separation is the point: the rail outlives any single app.

## How a request moves through the rail

A product sends a model request through **Relay**, the shared model gateway. **Agent Runtime** carries the signed policy, streaming response, cancellation handling, and Mint receipt verification. **Mint** records the successful usage as a microdollar ledger entry instead of asking every product to invent its own balance system. Turnstile can expose the same settlement path as paywall middleware, while Abacus applies receipted per-agent spending limits.

This split keeps model routing, payment evidence, and product interfaces separate. A client can change its user experience without replacing the ledger, and the gateway can add providers without moving settlement logic into each application. Hash-linked receipts and reserve-conservation checks make charges inspectable; success-only billing means the rail is designed to capture completed work rather than failed attempts.

## Current scope and constraints

Railyard is infrastructure in active development, not a promise that every listed service is production-complete. Mint has a ship-ready core, Agent Runtime has a payment SDK, and Turnstile has its durable paywall core and Axum adapter. Relay still needs a per-model price catalog, Vend needs crash recovery, Abacus is currently single-process, and Ledgerline still needs atomic settlement compensation. The status table above is the source of truth for those boundaries.

## Contact

Infra enquiries: caelum0x42@gmail.com.