Technical architecture
GateX system design
Control/data flows, trust boundaries, and component ownership for the AgentiX deployment. Card MCP–first; one-time XSGD cards; hash-chained audit.
01 · Context
System context
Humans fund and freeze. Equipped agents only talk to the gateway. GateX talks to StraitsX Card MCP and Avalanche; optional OpenAI for Q-LLM extract.
02 · Components
In-process map
UI routes call API routes; domain libs own policy, identity, CaMeL, cards, settlement, and audit. Policy + receipts persist in SQLite (data/gatex.sqlite).
| Module | Path | Role |
|---|---|---|
| Policy | src/lib/policy/store.ts | Caps, ledger, freeze |
| Mandate | src/lib/mandate/ | evaluateMandate codes |
| Identity | src/lib/identity/ | did:key registry |
| CaMeL | src/lib/camel/ | Quarantine + assert |
| Cards / MCP | src/lib/payments/ | Issue · RHA · revoke |
| x402 / XSGD | src/lib/payments/x402.ts | Settle + Snowtrace |
| Audit | src/lib/audit/ | Hash-linked chain |
| Run | src/lib/run/ | Demo SSE pipeline |
03 · Sequence
Equipped agent spend
Mandatory skill path: check → (deny or) pay → receipt. Pay always revokes the one-time card before returning.
Trust zones
- Trusted — controls, gateway, P-LLM/mandate, audit
- Untrusted — supplier HTML, injection strings
- External — Card MCP, Avalanche RPC
04 · Control
Freeze → deny
Also: CAP · DAY · WEEK · RATE · MERCHANT · SKU · APPROVAL · EXPIRED
05 · Isolation
CaMeL control vs data
Dual-LLM pattern (DeepMind CaMeL): untrusted page never reaches the privileged planner as free text that can become a tool.
Ref: arXiv:2503.18813
06 · Rails
Card MCP → Avalanche
| Env | Role |
|---|---|
| STRAITSX_CARD_MCP_URL | MCP SSE |
| AGENT_WALLET_ADDRESS | MCP wallet + balanceOf |
| AGENT_PRIVATE_KEY | EIP-3009 signer |
| MERCHANT_WALLET_ADDRESS | x402 payTo |
| X402_NETWORK | eip155:43113 / 43114 |
07 · Demo
Theater pipeline
POST /api/run streams runLane over SSE. Keys 1–4 map to identity, injection, execute, audit.
08 · Schema
Logical data model
Today these are in-process maps. Production maps 1:1 onto Postgres / DynamoDB rows so freeze + receipts survive restart.
09 · AuthN
Signed gateway requests
Shipped: optional shared x-gatex-key. Design next: per-agent Ed25519 over intent + timestamp + nonce so a leaked org key alone cannot spend.
10 · Target
AWS persistence shape
Hackathon: Amplify Hosting (memory on SSR) + local SQLite. Hire-signal target: RDS for policy/spend, DynamoDB or Postgres JSONB for audit links, Secrets Manager for keys, ECS/App Runner for the Next process.
| Concern | Now | AWS |
|---|---|---|
| Policy / freeze | SQLite (local file) | RDS Postgres |
| Spend ledger | SQLite | Postgres / DynamoDB |
| Audit chain | SQLite | DynamoDB or JSONB + S3 |
| Secrets | .env | Secrets Manager |
11 · Threats
Threat → mitigation
| Threat | Mitigation |
|---|---|
| Spoofed agent | DID registry + planned signed intents |
| Prompt injection → tool | CaMeL quarantine; P-LLM never sees HTML |
| Frozen agent still pays | evaluateMandate / RHA refuse FROZEN |
| Standing card theft | One-time card + mandatory revoke |
| Tampered receipt | verifyChain hash links |
Gateway API
GET /api/gateway— manifestPOST /api/gateway/check— check_spendPOST /api/gateway/pay— request_payGET /api/gateway/receipt/[id]— sealed chain
Machine-readable contract: /openapi/gateway.yaml
Source of truth: ARCHITECTURE.md. Hackathon MCP notes: see repo HACKATHON-LINKS.md.