| title | Architecture |
|---|---|
| description | Technical architecture of SINT Protocol — monorepo package map, gateway server, bridge ecosystem, and data flow. |
| sidebarTitle | Architecture |
SINT Protocol sits as a mandatory intermediary between AI decision-making and the physical world. No AI agent can actuate a physical resource without passing through the Policy Gateway.
Agent
│
▼
Token Request ──► POST /v1/tokens (Ed25519 key pair required)
│
▼
Policy Gateway ──► intercept(token, action, context)
│
├──► APPROVE ──► Actuator (with constraint envelope)
├──► DENY ──► Evidence logged, caller gets 403
└──► ESCALATE ──► Approval Queue (human-in-the-loop)
The gateway is synchronous on the critical path. Every intercept call blocks until a policy decision is made. Async patterns (SSE approval streams, WebSocket risk feeds) are additive, not substitutes for the synchronous gate.
The monorepo at sint-ai/sint-protocol is organized into packages/, apps/, and sdks/.
The gateway-server app (apps/gateway-server) is a Hono-based HTTP server — chosen for its edge-compatible runtime, typed routing, and middleware composability.
32 endpoints across 10 route modules:
| Module | Prefix | Endpoints | Auth |
|---|---|---|---|
health |
/health |
GET /, GET /ready, GET /live |
None |
intercept |
/v1/intercept |
POST / |
Ed25519 agent signature |
tokens |
/v1/tokens |
POST /, GET /:id, POST /delegate, DELETE /:id, GET / |
Ed25519 + API key |
ledger |
/v1/ledger |
GET /, GET /:id, GET /proof/:id, POST /verify, GET /export |
API key |
approvals |
/v1/approvals |
GET /, GET /:id, POST /:id/approve, POST /:id/deny, GET /stream (SSE) |
API key |
discovery |
/v1/discovery |
GET /agents, GET /agents/:id, POST /agents/register, DELETE /agents/:id |
API key |
economy |
/v1/economy |
GET /balance, POST /charge, GET /transactions |
Ed25519 agent signature |
a2a |
/v1/a2a |
POST /delegate, GET /trust-chain/:id, POST /revoke |
Ed25519 agent signature |
risk-stream |
/v1/risk |
GET /stream (WebSocket), GET /snapshot |
API key |
dashboard |
/v1/dashboard |
GET /stats, GET /agents, GET /alerts |
API key |
```typescript
// Request header
X-Agent-Id: <agentId>
X-Agent-Sig: <base64url(ed25519.sign(requestBody, privateKey))>
X-Agent-Timestamp: <unix_ms> // replay protection, ±30s window
```
The `@noble/ed25519` library handles all crypto. No dependency on Node.js `crypto` — works in edge runtimes.
```
Authorization: Bearer <api_key>
```
Keys are scoped (read-only vs. read-write) and stored hashed in PostgreSQL. Rate limiting is enforced per-key via Redis sliding window counters.
Production HTTP server. Hono + PostgreSQL + Redis. Deployable to Railway, Docker, or any Node.js 20+ host. Entry: `apps/gateway-server/src/index.ts`. CLI tool for operators. Token management, ledger inspection, agent registration, e-stop triggering. Entry: `apps/sintctl/src/index.ts`. MCP (Model Context Protocol) bridge server. Exposes SINT Gate as MCP tools, enabling LLMs (Claude, GPT-4o, etc.) to request physical actions through a standards-compliant interface. Scans existing MCP tool definitions and generates SINT capability token templates. Bootstraps governance for MCP-native AI agents. React 19 + Redux Toolkit operator interface. Real-time risk stream via WebSocket, approval queue management, agent registry, ledger explorer.
All security properties below are enforced at the protocol layer. Application-layer bypasses (e.g., calling actuators directly, skipping the gateway) are the operator's responsibility to prevent via network segmentation.
Capability tokens are Ed25519-signed JWTs. The signature covers:
// @sint/core — SintCapabilityToken
interface SintCapabilityToken {
agentId: string;
issuerId: string;
resource: string; // e.g., "robot:arm:joint_1"
action: string; // e.g., "move"
constraints: PhysicalConstraints;
tier: 1 | 2 | 3 | 4 | 5;
issuedAt: number; // unix ms
expiresAt: number; // unix ms
delegationChain: string[]; // issuer public keys, root → leaf
nonce: string; // UUID v4, prevents replay
}Tokens are verified on every intercept() call — not cached. Revocation is immediate via the ledger.
A delegated token cannot grant more permissions than its parent. Math.min() enforcement applies to all numeric constraints. Delegation depth is capped at 3 to prevent unbounded chains.
Root Token (T4, force≤100N)
└── Delegate 1 (T3, force≤50N) ✓ attenuation
└── Delegate 2 (T2, force≤20N) ✓ attenuation
└── Delegate 3 (T2, force≤30N) ✗ REJECTED — exceeds parent
The policy gateway scans every action's payload against 25+ regex patterns for prompt injection and goal hijacking attempts:
- Override instructions (
ignore previous instructions,you are now, etc.) - Exfiltration patterns (
send to,upload,transmit all) - Safety bypass attempts (
disable safety,emergency override,skip verification) - Jailbreak patterns (base64-encoded instructions, unicode lookalikes)
Matches trigger an automatic DENY with the evidence logged for audit.
Invariant I-G2: the e-stop preempts all pending and in-flight intercept calls. Once tripped, no action is approved until manually reset by an authorized operator. CSML anomaly scores above threshold auto-trip the breaker.
Every POST /v1/intercept call traverses this pipeline synchronously: