Design-intent reference and simulation. Not a shipped product, not a medical device, no clinical claims.

Architecture

Status: design-intent reference stack. The demo is a simulation with fictional devices. Not a shipped product, not a medical device, no clinical claims.

Claim first

TAL decides every flow with a pure, deterministic, default-deny function over a signed policy, shapes what it allows, and emits a signed, hash-chained receipt for every decision. The control plane authors, approves, signs and disseminates policy across a six-level tenancy. Every runtime (Cloudflare Worker, container, browser) runs the same core code.

Components

packages/core: pure decision function decide(bundle, flow), canonical JSON, Ed25519 keys, signed policy bundles with rollback refusal and freshness (fresh, stale, expired), receipts and offline chain verification, replay, tenancy and RBAC, event envelopes, feature flags. No I/O.

packages/edge: TalEdge, the effectful shell: verifies bundles, decides, token bucket per flow, strict priority queue (control, telemetry, firmware, bulk), receipts, telemetry. Runtimes: Cloudflare Worker (worker.ts), Node container (server.ts, Dockerfile for ECS or Fargate), and the browser demo.

packages/control-plane: HTTP router over ports (events, policies, receipts, bundles, notifier). Adapters: memory (tests, local), Cloudflare (D1, KV, optional Queues), AWS (stub with the intended DynamoDB, S3 and SQS mapping).

packages/simulator: seeded generators for programmers, bedside monitors, telemetry gateways, OTA services and rogue flows; named scenarios; CLI that drives an edge over HTTP.

apps/site, apps/demo, apps/admin: Vite apps deployed as Workers static assets on secgenix.com, demo.secgenix.com and admin.secgenix.com.

flowchart LR
  subgraph Devices[Fictional devices]
    P[Clinician programmers]
    B[Bedside monitors]
    G[Telemetry gateway]
    O[OTA service]
    R[Rogue or unenrolled]
  end
  P & B & G & O & R --> E
  subgraph Edge[TAL edge]
    E[decide: pure, default deny] --> S[token bucket per flow]
    S --> Q[strict priority queue]
    E --> RC[signed receipt chain]
  end
  Q --> L[Legacy edge device, simulated]
  CP[Control plane: author, approve, sign] -- signed bundle --> E
  RC -- receipts --> CP

Policy dissemination

sequenceDiagram
  participant A as Author
  participant AP as Approver
  participant CP as Control plane
  participant KV as Bundle store
  participant E as Edges
  A->>CP: draft vN
  AP->>CP: approve vN (author cannot approve)
  AP->>CP: publish vN
  CP->>CP: canonicalize, sha256, Ed25519 sign
  CP->>KV: put bundle for tenant
  CP-->>E: notify (Queues, flag cp.queues)
  E->>KV: pull every 60 s, verify signature, digest, no rollback
  E->>E: refresh about 5 min, hard expiry about 24 h, then fail closed

Event driven core

Every state change is an immutable event envelope {id, type, schema, at, actor, tenantId, payload} appended to the log. Current published versions are a fold over events (foldPublished). Receipts are themselves an append-only, hash-chained log per edge, verifiable offline and replayable against the policy digest they reference.

Tenancy

Six levels: platform, partner or OEM, health system, facility, unit, device group. Role bindings attach to a node and inherit down its subtree. Roles: viewer, auditor, operator, policy-author, policy-approver, tenant-admin. Separation of duties is enforced in the router.

Portability

The control plane depends only on ports. Cloudflare is the live target. AWS mapping: Lambda (router), DynamoDB (events, policies, receipts), S3 (bundles), SQS (notifications), KMS (signing key). The AWS adapter is a typed stub today.

Known MVP limits

Edge state on Workers is per isolate. Production path: Durable Objects per edge for a single receipt chain and shared buckets.

Receipts are signed per decision; at very high flow rates batch signing (Merkle roots) is the planned optimization.

Demo auth is a header-selected demo principal behind flag cp.demoAuth. Passkeys (WebAuthn) are the designed production path, not implemented.

Phase 2: real traffic and the event driven cloud (built and live)

* Gateway (gateway/, Go): userspace WireGuard (wireguard-go plus gVisor netstack), SOCKS5, HTTP CONNECT and Linux transparent listeners all feed one engine: classify, decide against the signed allowlist (default deny), shape with per flow token buckets and strict priority (control, then clinical, then telemetry, then bulk), and emit an Ed25519 signed, hash chained receipt per flow. The Go verifier passes the same golden vectors as the TypeScript core.

* Device CLI (tal): one time token enrollment, device Ed25519 key plus WireGuard key, 24 h lease, connect (userspace), wg-config (kernel), renew, proxy-token.

* Control plane events: one Durable Object per tenant (TenantStream, SQLite) is the single writer. It assigns a gapless seq, writes the event and an outbox row in one transaction, fans out over SSE (gateway, admin, redacted public), and an alarm drains the outbox to Cloudflare Queues with retry. The queue consumer projects versioned envelopes into D1 idempotently (INSERT OR IGNORE by event id, seq guarded upserts). Receipt batches are verified against the gateway key, deduplicated by seq, gap flagged, and archived (R2 when bound, else KV).

* Bundles: every enroll, revoke or lease change bumps the version and re signs; gateways pull on SSE bundle.published or every minute and ack the applied digest.

* Auth: gateways and devices sign each request (x-sg-gw, x-sg-dev: id, timestamp, Ed25519 over method, path, ts and body hash, 5 min skew). Admin uses WebAuthn passkeys (rpId secgenix.com) yielding a 12 h HttpOnly SameSite=Strict session, or admin key signed requests for tooling. The demo login flag cp.demoAuth is off in prod; the public demo is read only.

* AWS (infra/terraform/aws-gateway): design intent for a hosted gateway on EC2 with an Elastic IP. Not applied.