Skip to content
Wayglass

Cloudflare components

Everything server-side is one Worker script named wayglass and the Cloudflare products bound to it. The Worker reaches Artifacts only through Workers bindings, never through an API token with Artifacts access.

Cloudflare components: the Worker and its bindings, and the us and eu Artifacts namespacesWorker wayglass and bindingsJurisdiction usJurisdiction eudeploybindingeventsWorkers Buildsdeploys on push to mainClientsHTTPS with a keyWorkers AIAI Gateway, not used yetProject DOone per project: intents,decisions, sessions, auditWorker/v1/* API, /v1/public/*,static web and /console/Registry DOagent key hashesPolicy evaluatorGo compiled to WasmQueue artifacts-eventsrepo.pushed and friendsArtifacts namespace wayglassbinding ARTIFACTStrunks and forks of us projectsArtifacts namespace wayglass-eubinding ARTIFACTS_EUtrunks and forks of eu projects
Works liveBuilt, not verified liveStubbedPlannedSelect a box to see its status.

The jurisdiction split

Section titled “The jurisdiction split”

Each project lives in exactly one namespace, chosen when it is created (wayglass init --jurisdiction us|eu) and fixed afterwards, because a namespace’s jurisdiction is set when the namespace is created and cannot change.

wayglass wayglass-eu
Worker binding ARTIFACTS ARTIFACTS_EU
Jurisdiction us eu
Holds Trunk and intent forks of us projects Trunk and intent forks of eu projects
Jurisdiction tag on changes us eu, so EU-only rules such as PII to quarantine apply

A binding cannot report its own namespace or jurisdiction, so the Worker configuration states both, and the Worker feeds the project’s jurisdiction to the policy evaluator. A client cannot claim a different one.

Pieces

Section titled “Pieces”
  • Worker at api.wayglass.dev. Routes under /v1/* run first; everything else is static assets (the public audit view at / and the review console at /console/).
  • Project Durable Object, SQLite-backed, one per project: intents, pushes, decisions, approvals, sessions, and the append-only audit log.
  • Registry Durable Object: SHA-256 hashes of per-agent keys and the name each key is bound to.
  • Policy evaluator: the Go policy code compiled to WebAssembly and run inside the Worker, so the server-side decision and the CLI’s local preview use the same code.
  • Queue artifacts-events: new trunks get an Artifacts event subscription for pushes; the Worker consumes the events and counts trunk pushes.
  • Workers Builds: builds and deploys the Worker from main.
  • Workers AI: bound and pointed at AI Gateway wayglass, but no route uses it yet. See its status.