Railyard
The AI settlement + model rail.
Thesis
The durable asset is the settlement rail underneath every app: Mint (a fiat-backed, gasless, success-only microdollar ledger with hash-linked receipts, AITP-402). Every other app is either the model rail (Relay) or a wedge that installs Mint under a new class of payer.
The rail
| App | Role | Status |
|---|---|---|
Mint (apps/mint) | Settlement ledger: double-entry, Ed25519 hash-linked receipts, reserve conservation, payouts and provider reconciliation. The core asset. | implemented; operator console at /admin |
Relay (apps/relay) | Model gateway (TensorZero fork) with success-only Mint billing and a per-model price catalog. The model rail. | implemented; operator UI in apps/relay/ui |
Rago (apps/rago) | Usage-based billing (Rust rewrite of Lago, API-compatible): metering, subscriptions, invoicing, payments, integrations. | implemented; admin at /admin, customer portal at /portal/:token |
Vend (apps/vend) | Resellable metered AI SDK on the rail (Stripe-meets-OpenRouter). Interrupted holds and payouts are replayed by vend-reconcile. | implemented; tenant console at /console, operator admin at /admin |
Turnstile (apps/turnstile) | Drop-in paywall for paid agent tools (AITP-402 and x402). | runnable SDK + reference server; admin at /admin |
Rithub (apps/rithub) | Self-hostable git forge on rit: repos, orgs, issues, pull requests, reviews, releases, CI checks, audit. | implemented; server-rendered web UI at / |
rit (apps/rit) | Library-first Rust implementation of Git's object/authoring model, interop-tested against git. | library |
| agent-runtime | Shared Rig/AITP-402 runtime: policy signing, paid SSE/multipart, cancellation reconciliation, pinned Mint-proof verification. | payment SDK ready |
| abacus | Inline proxy enforcing hard, receipted per-agent spend budgets (kill-switch). | implemented; Postgres-backed |
| identity-lock | Provider-agnostic locked character/brand/persona identity, resolved through Relay for consistent generation. Source path: apps/context-passport. | runnable slice |
| ledgerline | Gross-margin lens: revenue + provider COGS on one Mint-backed ledger, settled through a durable outbox. | runnable slice |
| game-economy | Storefront for card packs, cosmetics and battle passes on Mint hold/capture. | runnable slice |
Switchyard (apps/toolgate, working name) | The tool rail next to Relay: one sk-t0- key reaches a schema-typed catalog (our products first, free/public APIs second, BYO keys third) with Mint hold/capture, Rago events, SSRF-safe egress, an MCP server and the sy CLI. | MVP implemented; see below |
Consumed by, not owned by
Products such as Menivor call Railyard over HTTP and shared contract packages — they do not own it. That separation is the point: the rail outlives any single app.
How a request moves through the rail
A product sends a model request through Relay, the shared model gateway. Agent Runtime carries the signed policy, streaming response, cancellation handling, and Mint receipt verification. Mint records the successful usage as a microdollar ledger entry instead of asking every product to invent its own balance system. Turnstile can expose the same settlement path as paywall middleware, while Abacus applies receipted per-agent spending limits.
This split keeps model routing, payment evidence, and product interfaces separate. A client can change its user experience without replacing the ledger, and the gateway can add providers without moving settlement logic into each application. Hash-linked receipts and reserve-conservation checks make charges inspectable; success-only billing means the rail is designed to capture completed work rather than failed attempts.
Current scope and constraints
Railyard is infrastructure in active development, not a promise that every listed service is production-complete. Mint has a ship-ready core, Agent Runtime has a payment SDK, and Turnstile has its durable paywall core and Axum adapter. Relay still needs a per-model price catalog, Vend needs crash recovery, Abacus is currently single-process, and Ledgerline still needs atomic settlement compensation. The status table above is the source of truth for those boundaries.
Contact
Infra enquiries: [email protected].