Product
A call is allowed or refused. The decision trace names the tool, the session cap and what was charged. Settlement is the moment that trace becomes a financial record.
tool call ──► 1. AUTHORIZATION one Lua script: cap + balance + deduct
│ exhausted ──► HTTP 402, call never leaves the gateway
▼
2. EGRESS SIGNING Ed25519 over the outbound request
│
▼ creator endpoint, response streamed back
3. SETTLEMENT charge event ──► SQS ──► 5-minute rollup
──► append-only double-entry journalThe Edge Gateway checks the rolling 24-hour spend cap and the current wallet balance, and applies the deduction, in one atomic Lua script execution. Exhausted wallet or exhausted cap is HTTP 402 and the call never leaves the gateway.
The request is signed with Ed25519 and forwarded to the tool creator's endpoint. The signature says the request came from the gateway. It is not a guarantee of funds, and nothing in it is redeemable. Outside development the gateway signs with one key protected by a key management service, and it does not start if it cannot unseal that key. Signature verification guidance is in the documentation.
The charge record rides SQS into an append-only, double-entry PostgreSQL journal: the developer's wallet liability is debited and the creator payable plus the 10% platform fee are credited, netted into 5-minute rollup batches.
Getting that credit out is a separate path. No payouts are processed. Withdrawal requests are recorded only. SeeSettlement and payouts in the docs.
Settlement is double-entry: every batch debits exactly what it credits, in integer micro-USD. The three accounts a tool charge touches:
| Account | Direction | What it records |
|---|---|---|
| developer wallet liability | Debit | The developer's pre-funded balance, reduced by the charges that stood in the period. |
| creator_payable | Credit | What the creator is owed for the calls their endpoint answered. |
| platform fee (10%) | Credit | The platform's share. The fee truncates toward zero, in integer micro-USD. |
HTTP 402 Budget_Exhausted. The call never leaves the gateway, so the creator never sees it and nothing is charged.
Fail closed: HTTP 503 Lock_Unavailable. No unpaid call is ever forwarded. A creator being down is a 502, not this.
The deduction is reversed to net zero and the creator's status is relayed. Once bytes stream, the charge stands.
The full list of responses and error codes, with which of them are charged, is in the documentation.The marketplace explains what a creator can publish today.