REA You hold
Model keys. Model invoices. The repo. The agent config.
Architecture
Three controls in front of the model.
Every call crosses three controls in one hop: PreFlight checks your declared policy before the vendor sees the call (a refused call costs $0). LoopGuard stops runaway and repeated code loops. TraceGuard writes a receipt for calls that use tools, without message content. All three are included in every tier, including the free Trial.
REA sits in front of your vendor’s API. It does not live inside the model and it does not rewrite the answer.
Request path
1 HTTPS ends at the edge
2 Gateway checks the REA key
3 Rate window and monthly loop budget
4 PreFlight checks your declared deny rules
deny -> refuse with a reason · no vendor call · $0
allow -> continue
5 TraceGuard classifies tool calls (observe mode)
6 LoopGuard extracts code, if any, and hashes the structure
7 Look in the cache
hit -> replay the stored stop
miss -> probe the snippet (fixed time box)
8 On timeout or crash, remember the hash
9 GPT path may attach logit bias
10 Call OpenAI, Anthropic, xAI, or Gemini with your key
11 Record a class-only receipt (status, timings, model, token counts,
structural hash; no message text) · return vendor JSON + rea_meta
How the fingerprint works
Incoming code is parsed into an abstract syntax tree and reduced to a 64-bit structural hash. Comments and whitespace do not create a new key. Two infinite loops that differ only in wording still match. A cache hit replays the stored stop and sets cache_hit to true.
Layers
| Layer | Job | State |
|---|---|---|
| FastAPI gateway | OpenAI-compatible listener, including stream | Live |
| PreFlight | Declared deny rules, checked before the vendor call; a refused call costs $0 | Live |
| TraceGuard | Class-only receipt for calls that use tools (tool names, class, response label); no message content | Rolling out (observe) |
| TraceGuard Direct, Contain | Responses beyond observe: refuse one tool call, contain a session | Rolling out |
| TraceGuard Kill | End a session | Planned |
| Tenant ledger | Key, tier, loop pool, active flag | Live |
| LoopGuard (AST + time-boxed subprocess) | Structural fingerprint and a fixed probe time box | Live |
| Shared cache | Shared trap memory: a stored stop is matched by code structure alone, across vendors, models and tenants | Live |
| Token firewall (logit bias) | GPT path only; discourages the trapped pattern on the next generate | Live |
| BYOK forward | OpenAI, Anthropic, xAI, Gemini | Live |
| Time-boxed subprocess | Default probe on the public host | Live |
| Firecracker overlay | Same time-box contract when the host has KVM | Planned |
| Public self-serve mint | POST /v1/signup · Trial 2,000 loops, all three controls · name + work email + company (phone optional) | Live |
Firecracker is planned, not built. It would not change cache math or edit model text. The public box at
api.reacontrolplane.com currently uses a time-boxed subprocess probe. Health stays 1.4.8-prod.Honesty on speed
Repeats of the same failing structure are fast because the model is not called. First-seen runaways pay the probe time box but the model is not called; repeats are answered from cache without the probe. Local models do not infer faster because of REA — they get the same timeout and cache contract.
Who holds what
REA holds
The REA key, loop budget, cache, timeout policy, your declared PreFlight rules, and class-only TraceGuard receipts. Not message text. Not card numbers. Not a fallback vendor key for your traffic.