Railyard
The AI settlement + model rail.
Thesis
The durable asset is the settlement rail underneath every app: Mint — a fiat-backed, gasless, success-only microdollar ledger with Ed25519 hash-linked receipts and reserve conservation, speaking AITP-402. Everything else in this repo is either: - the model rail (Relay — a TensorZero fork with success-only Mint billing), or - the tool rail (Switchyard — one key, a priced tool catalog, the same hold/capture discipline), or - a wedge that installs Mint under a new class of payer (billing, paywalls, a game economy, a resellable AI SDK, a forge, analytics, error tracking). If an app in this repo doesn't touch Mint and isn't infrastructure those apps run on, it probably doesn't belong here — see [docs/RAILYARD_ENTERPRISE_ARCHITECTURE.md](docs/RAILYARD_ENTERPRISE_ARCHITECTURE.md) §0 for the design invariants every app is held to.
The rail
| App | Role | Status |
|---|---|---|
Mint (apps/mint) | Settlement ledger: double-entry, Ed25519 hash-linked receipts, reserve conservation, payouts and provider reconciliation. The core asset. | implemented; operator console at /admin |
Relay (apps/relay) | Model gateway (TensorZero fork) with success-only Mint billing and a per-model price catalog. The model rail. | implemented; operator UI in apps/relay/ui |
Rago (apps/rago) | Usage-based billing (Rust rewrite of Lago, API-compatible): metering, subscriptions, invoicing, payments, integrations. | implemented; admin at /admin, customer portal at /portal/:token |
Insights (apps/insights-edge) | Cookieless, GDPR-friendly web analytics: email+domain signup, private per-site dashboard, session replay (paid tier), UTM/referrer/page-speed reporting. | live at insights.ereboslab.com, free up to 10,000 events/month/site |
| Faultline (GlitchTip, box 2) | Sentry-compatible browser/server error tracking for the portfolio. | live at errors.ereboslab.com, wired into Scribase, Menivor, Bidstage |
Vend (apps/vend) | Resellable metered AI SDK on the rail (Stripe-meets-OpenRouter). Interrupted holds and payouts are replayed by vend-reconcile. | live at vend.ereboslab.com; tenant console at /console, operator admin at /admin |
Turnstile (apps/turnstile) | Drop-in paywall for paid agent tools (AITP-402 and x402). | live at turnstile.ereboslab.com; admin at /admin |
Rithub (apps/gitea, decided 2026-10-15) | Self-hostable git forge + CI: Gitea (MIT) branded as "Rithub", with the Rago/Mint billing bridge and a registered Actions runner (act_runner) so pushed .gitea/workflows/*.yml jobs actually execute. apps/rithub (from-scratch Rust forge on rit) is the earlier effort — kept, not deleted, documented as superseded for this slot in apps/rithub/README.md and apps/gitea/README.md. | live at git.ereboslab.com; CI runner deployed 2026-10-20 |
rit (apps/rit) | Library-first Rust implementation of Git's object/authoring model, interop-tested against git. | library |
| agent-runtime | Shared Rig/AITP-402 runtime: policy signing, paid SSE/multipart, cancellation reconciliation, pinned Mint-proof verification. | payment SDK ready |
| abacus | Inline proxy enforcing hard, receipted per-agent spend budgets (kill-switch). | live at abacus.ereboslab.com; Postgres-backed |
| identity-lock (Context Passport) | Provider-agnostic locked character/brand/persona identity, resolved through Relay for consistent generation. Source path: apps/context-passport. | live at context-passport.ereboslab.com |
| ledgerline | Gross-margin lens: revenue + provider COGS on one Mint-backed ledger, settled through a durable outbox. | live at ledgerline.ereboslab.com |
| game-economy | Storefront for card packs, cosmetics and battle passes on Mint hold/capture. | runnable slice |
Toolgate (apps/toolgate, aka Switchyard) | The tool rail next to Relay: one sk-t0- key reaches a schema-typed catalog (our products first, free/public APIs second, BYO keys third) with Mint hold/capture, Rago events, SSRF-safe egress, an MCP server and the sy CLI. | live at toolgate.ereboslab.com |
Consumed by, not owned by
Products such as Menivor call Railyard over HTTP and shared contract packages — they do not own it. That separation is the point: the rail outlives any single app.
How a request moves through the rail
A product sends a model request through Relay, the shared model gateway. Agent Runtime carries the signed policy, streaming response, cancellation handling, and Mint receipt verification. Mint records the successful usage as a microdollar ledger entry instead of asking every product to invent its own balance system. Turnstile can expose the same settlement path as paywall middleware, while Abacus applies receipted per-agent spending limits.
This split keeps model routing, payment evidence, and product interfaces separate. A client can change its user experience without replacing the ledger, and the gateway can add providers without moving settlement logic into each application. Hash-linked receipts and reserve-conservation checks make charges inspectable; success-only billing means the rail is designed to capture completed work rather than failed attempts.
Current scope and constraints
Railyard is infrastructure in active development, not a promise that every listed service is production-complete. Mint has a ship-ready core, Agent Runtime has a payment SDK, and Turnstile has its durable paywall core and Axum adapter. Relay still needs a per-model price catalog, Vend needs crash recovery, Abacus is currently single-process, and Ledgerline still needs atomic settlement compensation. The status table above is the source of truth for those boundaries.
Contact
Infra enquiries: caelum0x42@gmail.com.