REA You hold
Model keys. Model invoices. The repo. The agent config.
Architecture
Structure first. Model second.
The plane sits in front of the vendor API. It does not live inside the model and it does not rewrite the answer.
Request path
1 HTTPS ends at Caddy
2 Gateway checks the REA key
3 Rate window and monthly loop budget
4 Extract code, if any, and hash the structure
5 Look in Redis
hit -> return the stored completion
miss -> probe the snippet (~150 ms)
6 On timeout or crash, remember the hash
7 GPT path may attach logit bias
8 Call OpenAI or Anthropic with your key
9 Store the result · return vendor JSON + rea_meta
How the fingerprint works
Incoming code is parsed into an abstract syntax tree and reduced to a 64-bit structural hash. Comments and whitespace do not create a new key. Two infinite loops that differ only in wording still match. A Redis hit returns the prior completion and sets cache_hit to true.
Layers
| Layer | Job | State |
|---|---|---|
| FastAPI gateway | OpenAI-compatible listener | Live |
| Tenant ledger | Key, tier, loop pool, active flag | Live |
| AST engine | Structural fingerprint | Live |
| Redis | Hash cache and per-minute counters | Live |
| Token firewall | Logit bias on GPT after a known trap | Live |
| Process sandbox | Default probe on the public API host | Live |
| Firecracker overlay | Same 150 ms contract, in a microVM when the host exposes KVM | Ready in code · used when KVM is present |
| BYOK forward | OpenAI and Anthropic | Live |
| Gemini forward | Same header pattern | Next |
Firecracker is isolation, not speed. It does not change cache math and it does not edit model text. The public box at
api.reacontrolplane.com uses the process sandbox until that host exposes /dev/kvm. Health stays 1.4.8-prod either way.Honesty on speed
Repeats of the same failing structure are fast because the model is not called. First-seen failures still pay sandbox time plus the model. Local models do not infer faster because of REA — they get the same timeout and cache contract.
Who holds what
REA holds
The REA key, loop budget, cache, and timeout policy. Not card numbers. Not a fallback vendor key for customer traffic.