Platform Architecture

One platform. Gateway, nodes, registry, and identity — fully wired.

0trace is not a single binary you run once. It is a distributed execution platform: a gateway that enforces policy, nodes that execute in parallel, an agent registry with declared identities, and a skill registry with cryptographic provenance.

Deploy the Platform Execution model

Architecture

Gateway orchestrates. Nodes execute. Trust never moves.

The gateway is the single authoritative control plane. Nodes are fungible, stateless workers. Every execution envelope is Ed25519-signed by the gateway before a node will touch it.

Clients / CLI / Web

↓ port 8743

Gateway

zt serve --port 8743

API Handler Skill runs, policy, audit, keys

Policy Engine 4-layer capability enforcement

Node Registry Heartbeat monitor, drain, dispatch

Audit Chain SHA-256 hash-chained tamper-evident log

Ed25519-signed dispatch envelope

↓ ↓ ↓

Node

zt node start :9100

capacity: 8

labels: us-east-1

Node

zt node start :9101

capacity: 4

labels: gpu:true

Node

zt node start :9102

capacity: 8

labels: eu-west-1

🔐 Ed25519 mutual authentication — nodes prove possession of private key at registration. Gateway verifies every dispatch envelope. Nodes verify gateway signature before executing any job. No persistent key material on disk.

Start the gateway

# Start the gateway (control plane)
zt serve --host 0.0.0.0 --port 8743 --db prod.db

# Gateway API + Dashboard: https://gateway:8743
# Auth token printed to stderr — never logged

Start an execution node

# Start execution nodes (workers)
zt node start \
  --gateway http://gateway.internal:8743 \
  --token <api-token> \
  --capacity 8 \
  --node-id worker-01 \
  --labels '{"region":"us-east-1"}'

Node Lifecycle

Stateless workers. Graceful failure. Automatic recovery.

Online

Registered and heartbeating every 10s. Receiving dispatched jobs from gateway.

Draining

Finishing in-flight executions. Gateway stops dispatching new jobs. Safe for maintenance.

Offline

Gracefully deregistered via DELETE. Node process exits cleanly after drain completes.

Unreachable

No heartbeat for 30s. Gateway marks node dead, fails all in-flight runs automatically.

Label-based routing

Nodes advertise JSON labels at registration — region, gpu, memory. The dispatcher routes jobs to the least-loaded node matching the skill's declared selector. Without a selector, round-robin across all online nodes by active execution count.

zt node start --labels '{"gpu":"true","vram":"24gb"}'

Agent Registry

Every agent has a declared identity. No anonymous execution.

Agents are registered entities with roles, signing keys, and org membership. They are not just process labels — they are verifiable principals in the audit trail.

Ed25519 signing keys

Each agent generates an ephemeral keypair on start. Gateway verifies proof-of-possession at registration. No persistent key material on disk — keys are fresh on every deployment.

Roles and org membership

Agents belong to orgs and carry roles. Role determines what team actions they can take, what skills they can access, and what audit events they emit.

Team composition

Agents are assigned to teams. Teams define coordination rules, shared skill access, and escalation paths. Org-aware RBAC at every level.

Versioned and auditable

Agent registrations are events in the audit chain. Deregistration, key rotation, and team reassignment are all hash-logged and independently verifiable.

Agents → Registry

research-coordinator

Coordinator · Data Team

247 runs

summarize-agent

Processor · Data Team

1842 runs

compliance-reviewer

Reviewer · Legal Team

89 runs

report-generator

Writer · Data Team

412 runs

Agent Authorization

OAuth-style scopes. Two enforcement layers.

Agent-level scopes set the ceiling. Skill declarations set the floor. Both must pass before a single line of DSL executes. Scope grants and revocations are hash-logged.

Agent scopes — granted by operator

# Agent scope grants (OAuth-style)
agent:inference         ✓ Granted
agent:net.egress        ✓ Granted
agent:file.read         ✓ Granted
agent:store.kv          ✓ Granted
agent:exec              ✗ Not granted → blocked

Skill capability declaration — fine-grained, source-level

# Skill capability declaration (fine-grained)
## Capabilities
- llm.invoke:anthropic
- net.egress:https://api.stripe.com
- fs.read:/workspace/reports
- secrets.read:STRIPE_KEY

# Both layers must pass before execution starts
# Agent scope = ceiling | Skill caps = exact requirements

Layer 1

Agent Scope (connection-time)

Operator grants coarse scopes — agent:net.egress, agent:inference, agent:file.read. These are the ceiling on what any skill run by this agent can do. Revoke a scope and the enforcement is immediate — no restart required.

Layer 2

Skill Capability (source-time)

Individual skills declare exact resource targets — domain, path, secret name. This is verified against the agent's scope ceiling. A skill declaring net.egress:api.stripe.com only executes if the agent has agent:net.egress AND the global policy allows it.

Every grant logged

Scope Changes in Audit Trail

Every scope.granted, scope.revoked, and scope.checked event is recorded in the hash-chained audit trail. Who granted what, when, and what ran as a result — independently verifiable.

Skill Registry

Signed Markdown. Verified provenance. No supply chain surprise.

Skills are plain .md files. They are signed with Ed25519 at publish time. Install-time verification prevents tampered or counterfeit skills from executing.

# Signed skill registry
zt skills install github:acme-org/data-pipeline@v2.1.0
✓ Signature verified: Ed25519 (key: corp-signing-key-2026)
✓ Capabilities reviewed: net.egress:api.internal, store.artifacts
✓ Installed: data-pipeline@2.1.0

zt skills list
NAME                VERSION  AUTHOR           SIGNED
research-agent      1.4.0    acme-org         ✓ Ed25519
summarize-agent     2.1.0    acme-org         ✓ Ed25519
data-pipeline       2.1.0    acme-org         ✓ Ed25519

Markdown-native

Skills are human-readable .md files. Git-reviewable. Diffable. No packaging complexity, no SDK, no compiled artifacts.

Ed25519 signed

The full skill bundle — frontmatter, capabilities, execution DSL — is signed. Content changes break the signature. Stale bundles are rejected before execution.

Capability inspection

Every capability a skill needs is declared in the file, visible to reviewers before installation. No hidden imports, no ambient authority.

Keyring management

Trusted publisher keys are stored in the gateway keyring. Trust levels: full, limited, revoked. Revocation is immediate and logged.

LLM Integration

Every LLM call is a capability-gated, audited event.

Skills call LLMs with llm.invoke — cloud or local. Provider credentials are encrypted at rest. Token counts, cost, and model identity are logged in the audit chain on every call.

Supported Providers

Anthropic Claude Cloud

OpenAI GPT-4o Cloud

Google Gemini Cloud

Grok (xAI) Cloud

Ollama Local

LM Studio Local

llama.cpp Local

Security Model

✓ llm.invoke:anthropic must be declared — blocked otherwise
✓ API keys encrypted with XChaCha20-Poly1305 at rest
✓ Per-agent credential isolation — no cross-agent key access
✓ Token count + cost estimate logged in audit chain per call
✓ System prompt inspected — credential values blocked from prompts
✓ Fallback chains: declare multiple providers, try in order
✓ Local providers make zero outbound calls — air-gap compatible

Cost Tracking

Every LLM call logs token counts and estimated cost. Full cost breakdown across all executions — by provider, agent, time range.

Anthropic claude-sonnet-4 $3.00 / $15.00

OpenAI gpt-4o $2.50 / $10.00

Ollama llama3.1:8b $0.00 / $0.00

per 1M tokens, input / output

Deploy the gateway. Register your agents. Ship with proof.

Single binary. Self-hosted. MIT license.

Get Started Security model Execution model