Bristlecone Logic is a deterministic machine-to-machine (M2M) microservices engine for autonomous AI agent swarms, positioned at its core as a stateless HTTP 402 micropayment gateway and pre-socket runtime defense engine, running on Arc Layer 1. The project adopts a first-principles, specification-driven zero-trust architecture, governed jointly by schema-validation contracts, deterministic state machines, and cryptographically signed enforcement boundaries.
Purpose
The platform is designed to support autonomous AI agent swarms, sub-cent metering, automated balance and rate management, hardware-isolated L2 fund sweeping, and real-time auditability. It decouples execution, billing, cryptography, and settlement through a six-layer architecture, making it suitable for agent automation scenarios that require strict cost control and execution lineage tracking.
Key Capabilities
- Deterministic Runtime Sandbox: Uses Astral's uv to manage a pinned-version Python 3.12+ virtual environment, enforces strict data contracts through Pydantic schemas (app/layer1_schemas/base.py), and rejects unapproved payloads or non-compliant agent names before network routing.
- Core Microservice Routing: A FastAPI/Uvicorn-based application factory pattern (create_app()) that handles high-concurrency API request routing, security middleware, input sanitization, and structured payload processing.
- Orchestration and Commit DAG: Manages agent decision loops through SQLite/PostgreSQL state storage, native GeminiWorker integration, an MCP tool registry, and Redis hot-path metering, enforces Commit DAG (directed acyclic graph) execution lineage, and supports BYOK routing and real-time token/dollar metering.
- Cryptographic Integrity and Fund Isolation: An HMAC-SHA256 signer (app/layer4_crypto/signer.py) and a treasury gate (app/layer4_ledgers/treasury.py) sign and verify all request envelopes and enforce a hard single-transaction spending cap of $50.00, preventing runaway costs from autonomous agents.
- Observability and Auditing: Follows OpenTelemetry standards, uses immutable JSON-Lines (audit_log.jsonl) and PostgreSQL audit logs, and captures UTC timeTracking events for pokes, execution latency, and output quality checks.
- Metering gateway and BYOK: Machine-to-machine tokens (bcl_...) are authenticated via SHA-256 hashing, and plaintext keys are not stored; the Redis Lua script (METER_LUA) atomically tracks rate limits and deducts balances with microcent precision; tenants can provide custom LLM keys to bypass main gateway billing while retaining telemetry logs.
- Hardware-isolated USDC sweeping: The AWS KMS HSM signing engine (kms_signer.py) signs Base L2 transactions in us-west-2 using an ECC_SECG_P256K1 key, and the private key never touches disk; the sweeping daemon (sweeper_daemon.py) polls the Base L2 RPC every 10 seconds, checks the hot wallet USDC balance and ETH gas reserve, constructs ERC-20 transfer payloads, and routes them to enterprise custody.
How to Use
The system provides API endpoints through FastAPI, including /api/v1/dag (create submission nodes, link parent dependencies, retrieve graph lineage), /admin (key issuance, credit top-up, sweeping), /agent (core agent execution routing), /billing (balance queries and webhook configuration). The admin interface is a Streamlit dashboard (dashboard.py). Deployment uses a multi-stage Dockerfile and Docker Compose, together with an Nginx reverse proxy, running on a Vultr VPS. The database uses PostgreSQL 16 with SQLAlchemy 2.0/Alembic migrations. Background services are mounted through systemd (bristlecone-logic.service, bristlecone-sweeper.service), and the sweeping daemon runs with DRY_RUN_MODE = True during pre-deployment validation.
Applicable Scenarios
Suitable for autonomous AI agent clusters that require sub-cent billing, strict spending caps, execution lineage tracking, and hardware-isolated fund settlement; also suitable for scenarios such as multi-tenant M2M microservices, BYOK routing, and automated USDC revenue sweeping.
Limitations
The materials do not provide complete details on public installation commands, pricing information, platform compatibility lists, or performance benchmarks. Some features (such as Arc Layer 1 integration, SSRF-safe DNS routing, malformed JSON repair) are not elaborated with specific implementation descriptions in the provided materials, and no further details are currently available.
