feat(B3): cortex upstream entitlement client (#57) + chained provider

cortex can now validate locally-unrecognised bearer keys against the
helexa-upstream authority and reserve/settle their budget there — mesh
accounts work for real inference. The EntitlementProvider trait is the
seam, so cortex's enforcement (auth.rs, metering.rs) is otherwise
unchanged.

- entitlements_upstream.rs: UpstreamEntitlementProvider over reqwest →
  B2's /authz/v1 (resolve/reserve/settle/release/snapshot), presenting the
  operator client bearer. Maps the wire contract back to the trait: granted
  → Reservation, rejected → BudgetError, 401 → InvalidKey. Fail-closed —
  unreachable resolve → AuthError::Unavailable (503, never 401);
  unreachable reserve → retryable BudgetError::RateLimited (refuse, never
  serve un-authorized). settle/release are best-effort (the upstream
  sweeper reaps a lost one).
- entitlements_chain.rs: ChainedEntitlementProvider tries local first
  (operator + infra keys, no network), falls through to upstream for
  unknown keys, and dispatches reserve/settle/release/snapshot to whichever
  backend resolved each account (local treats unknown principals as
  uncapped, so it can't be the blind default).
- cortex-core: AuthError::Unavailable{retry_after_secs}; [upstream] config
  (enabled/url/bearer/timeout). auth.rs maps Unavailable → 503 +
  Retry-After distinctly from InvalidKey → 401, regardless of require_auth.
- state.rs wires the chain when [upstream].enabled, else stays purely local.

Tests (upstream_chain.rs, 4): local key resolves without touching upstream;
unknown key falls through to a mock upstream; unknown-everywhere → 401
InvalidKey; upstream-unreachable → Unavailable (503-mapped), with local keys
still resolving. Existing gateway suites updated for the new config field.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F6o3ddqmYNh9kzdwq6eowh

.gitignore

@@ -1,6 +1,9 @@
 /target
 /bench/node_modules
 /bench/dist
+/helexa.ai/node_modules
+/helexa.ai/dist
+helexa.ai/.env.local
 *.swp
 *.swo
 .idea/

Cargo.lock

@@ -2082,10 +2082,14 @@ dependencies = [
  "axum",
  "chrono",
  "clap",
+ "cortex-core",
  "figment",
+ "reqwest",
  "serde",
  "serde_json",
+ "sha2",
  "sqlx",
+ "subtle",
  "thiserror 2.0.18",
  "tokio",
  "tower-http",

cortex.example.toml

@@ -90,3 +90,18 @@ account_id = "operator"
 key_id = "infra"
 # No hard_cap → uncapped operator infra key (own fleet, own use). Still
 # metered for visibility.
+
+# -- Upstream (helexa mesh) entitlements client (#57) --------------------
+# When enabled, a bearer key NOT found in [[entitlements.keys]] above is
+# validated against the helexa-upstream authority (mesh accounts), and its
+# budget is reserved/settled there. Operator-local keys (incl. the infra
+# key) never leave this process. Fail-closed: if upstream is unreachable a
+# request is refused (503 + Retry-After), never served un-authorized.
+# Disabled by default — a standalone operator runs purely local.
+[upstream]
+enabled = false
+# url = "https://upstream.helexa.ai"
+# Shared client bearer this cortex presents (maps to an operator_id
+# upstream). Override via CORTEX_UPSTREAM__BEARER in prod.
+# bearer = "replace-with-operator-client-secret"
+# timeout_secs = 5

crates/cortex-core/src/config.rs

@@ -22,6 +22,36 @@ pub struct GatewayConfig {
     /// setups keep working until keys are configured.
     #[serde(default)]
     pub entitlements: EntitlementsConfig,
+    /// helexa-upstream client (#57). When enabled, keys not found in the
+    /// local `[entitlements]` config are validated against the mesh
+    /// authority, and budget is reserved/settled there. Disabled by default
+    /// — a single operator runs purely local.
+    #[serde(default)]
+    pub upstream: UpstreamClientConfig,
+}
+
+/// `[upstream]` — the helexa-upstream authority client (#57). Locally
+/// unrecognised bearer keys are resolved against `url`'s `/authz/v1` surface
+/// (mesh accounts); local keys (operator + infra) never leave the process.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct UpstreamClientConfig {
+    /// Enable the upstream fallthrough. Off → purely local entitlements.
+    #[serde(default)]
+    pub enabled: bool,
+    /// Base URL of helexa-upstream (e.g. "https://upstream.helexa.ai").
+    #[serde(default)]
+    pub url: String,
+    /// Shared client bearer this cortex presents to `/authz/v1` (maps to an
+    /// operator_id upstream). Sent as `Authorization: Bearer <bearer>`.
+    #[serde(default)]
+    pub bearer: String,
+    /// Per-call timeout (seconds) to upstream.
+    #[serde(default = "default_upstream_timeout")]
+    pub timeout_secs: u64,
+}
+
+fn default_upstream_timeout() -> u64 {
+    5
 }
 
 /// `[entitlements]` — the local/static [`crate::entitlements::EntitlementProvider`]
@@ -129,6 +159,7 @@ impl Default for GatewayConfig {
             neurons: vec![],
             models_config: default_models_path(),
             entitlements: EntitlementsConfig::default(),
+            upstream: UpstreamClientConfig::default(),
         }
     }
 }

crates/cortex-core/src/entitlements.rs

@@ -81,12 +81,19 @@ pub struct BudgetSnapshot {
     pub reserved: u64,
 }
 
-/// Authentication failure — the bearer key could not be resolved. Maps to
-/// `401 invalid_api_key` (#49/#63).
+/// Authentication failure — the bearer key could not be resolved.
 #[derive(Debug, thiserror::Error)]
 pub enum AuthError {
+    /// The key is genuinely unknown → `401 invalid_api_key` (#49/#63).
     #[error("invalid or unknown API key")]
     InvalidKey,
+    /// The authority that could resolve the key is unreachable (e.g. the
+    /// helexa-upstream client failed, #57). Fail **closed** but distinctly:
+    /// a transient outage must surface as `503 service_unavailable` +
+    /// `Retry-After`, never `401` — a real key must not be rejected as
+    /// invalid during an upstream blip.
+    #[error("entitlement authority unavailable; retry in {retry_after_secs}s")]
+    Unavailable { retry_after_secs: u64 },
 }
 
 /// Why a reservation was refused. Carries enough for the caller to build the

crates/cortex-gateway/src/auth.rs

@@ -22,7 +22,7 @@ use axum::http::header::AUTHORIZATION;
 use axum::http::{HeaderMap, HeaderValue};
 use axum::middleware::Next;
 use axum::response::Response;
-use cortex_core::entitlements::{HEADER_ACCOUNT_ID, HEADER_KEY_ID};
+use cortex_core::entitlements::{AuthError, HEADER_ACCOUNT_ID, HEADER_KEY_ID};
 use cortex_core::error_envelope::OpenAiError;
 use std::sync::Arc;
 
@@ -83,14 +83,25 @@ pub async fn require_principal(
                 req.extensions_mut().insert(principal);
                 next.run(req).await
             }
-            // An unrecognized key only hard-fails when auth is *required*.
-            // In allow-anonymous mode (the default) we must IGNORE it and
-            // serve the request unauthenticated — otherwise the placeholder
-            // keys that OpenAI-compatible clients send by default (opencode,
-            // Open WebUI, Agent Zero, litellm) would all break, even though
-            // the operator never opted into auth. Pre-#49 the bearer was
-            // never inspected at all; this preserves that for require_auth=false.
-            Err(_) => {
+            // The entitlement authority is unreachable (upstream client
+            // blip, #57). Fail **closed but distinct**: a transient outage
+            // must not reject a real key as `401 invalid_api_key` — it's a
+            // retryable `503`. This holds regardless of require_auth: we
+            // can't safely serve a key we couldn't authorize.
+            Err(AuthError::Unavailable { retry_after_secs }) => {
+                envelope_response(OpenAiError::service_unavailable(
+                    "entitlement authority temporarily unavailable",
+                    Some(retry_after_secs),
+                ))
+            }
+            // A genuinely unrecognized key only hard-fails when auth is
+            // *required*. In allow-anonymous mode (the default) we IGNORE it
+            // and serve unauthenticated — otherwise the placeholder keys that
+            // OpenAI-compatible clients send by default (opencode, Open WebUI,
+            // Agent Zero, litellm) would all break though the operator never
+            // opted into auth. Pre-#49 the bearer was never inspected; this
+            // preserves that for require_auth=false.
+            Err(AuthError::InvalidKey) => {
                 if fleet.require_auth {
                     unauthorized("invalid API key")
                 } else {

crates/cortex-gateway/src/entitlements_chain.rs

@@ -0,0 +1,112 @@
+//! Chained entitlement provider (#57): operator-local keys first, mesh
+//! upstream for everything else.
+//!
+//! `resolve` tries the [`LocalEntitlementProvider`] (operator + infra keys —
+//! never a network hop); only a locally-unknown key falls through to
+//! [`UpstreamEntitlementProvider`]. Because the local provider treats an
+//! unconfigured principal as uncapped, reserve/settle/release/snapshot must
+//! **not** blindly hit local — they dispatch to whichever backend resolved
+//! that account, remembered in a map keyed by `account_id` (populated at
+//! resolve time).
+
+use crate::entitlements_local::LocalEntitlementProvider;
+use crate::entitlements_upstream::UpstreamEntitlementProvider;
+use async_trait::async_trait;
+use cortex_core::entitlements::{
+    AuthError, BudgetError, BudgetSnapshot, EntitlementProvider, Principal, Reservation,
+};
+use std::collections::HashMap;
+use tokio::sync::RwLock;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Backend {
+    Local,
+    Upstream,
+}
+
+pub struct ChainedEntitlementProvider {
+    local: LocalEntitlementProvider,
+    upstream: UpstreamEntitlementProvider,
+    /// account_id → which backend owns it, learned at resolve time.
+    backends: RwLock<HashMap<String, Backend>>,
+}
+
+impl ChainedEntitlementProvider {
+    pub fn new(local: LocalEntitlementProvider, upstream: UpstreamEntitlementProvider) -> Self {
+        Self {
+            local,
+            upstream,
+            backends: RwLock::new(HashMap::new()),
+        }
+    }
+
+    async fn record(&self, account_id: &str, backend: Backend) {
+        self.backends
+            .write()
+            .await
+            .insert(account_id.to_string(), backend);
+    }
+
+    /// The backend that owns `account_id`. Defaults to `Upstream` for an
+    /// account never resolved this process-lifetime (a resolve always
+    /// precedes reserve in a request, so this is just a safe fallback —
+    /// upstream fails closed if the account is bogus).
+    async fn backend_for(&self, account_id: &str) -> Backend {
+        self.backends
+            .read()
+            .await
+            .get(account_id)
+            .copied()
+            .unwrap_or(Backend::Upstream)
+    }
+}
+
+#[async_trait]
+impl EntitlementProvider for ChainedEntitlementProvider {
+    async fn resolve(&self, api_key: &str) -> Result<Principal, AuthError> {
+        match self.local.resolve(api_key).await {
+            Ok(p) => {
+                self.record(&p.account_id, Backend::Local).await;
+                Ok(p)
+            }
+            Err(AuthError::InvalidKey) => {
+                let p = self.upstream.resolve(api_key).await?;
+                self.record(&p.account_id, Backend::Upstream).await;
+                Ok(p)
+            }
+            Err(e) => Err(e),
+        }
+    }
+
+    async fn reserve(
+        &self,
+        principal: &Principal,
+        max_tokens: u64,
+    ) -> Result<Reservation, BudgetError> {
+        match self.backend_for(&principal.account_id).await {
+            Backend::Local => self.local.reserve(principal, max_tokens).await,
+            Backend::Upstream => self.upstream.reserve(principal, max_tokens).await,
+        }
+    }
+
+    async fn settle(&self, reservation: Reservation, actual_tokens: u64) {
+        match self.backend_for(&reservation.principal.account_id).await {
+            Backend::Local => self.local.settle(reservation, actual_tokens).await,
+            Backend::Upstream => self.upstream.settle(reservation, actual_tokens).await,
+        }
+    }
+
+    async fn release(&self, reservation: Reservation) {
+        match self.backend_for(&reservation.principal.account_id).await {
+            Backend::Local => self.local.release(reservation).await,
+            Backend::Upstream => self.upstream.release(reservation).await,
+        }
+    }
+
+    async fn snapshot(&self, principal: &Principal) -> Option<BudgetSnapshot> {
+        match self.backend_for(&principal.account_id).await {
+            Backend::Local => self.local.snapshot(principal).await,
+            Backend::Upstream => self.upstream.snapshot(principal).await,
+        }
+    }
+}

crates/cortex-gateway/src/entitlements_upstream.rs

@@ -0,0 +1,246 @@
+//! helexa-upstream client (#57): an [`EntitlementProvider`] that resolves
+//! keys and reserves/settles budget against the mesh authority's
+//! `/authz/v1` surface (B2). It is "just another impl of the trait" — cortex
+//! enforcement (`auth.rs`, `metering.rs`) is unchanged.
+//!
+//! **Fail closed.** When upstream is unreachable, `resolve` returns
+//! [`AuthError::Unavailable`] (→ `503`, never `401`) and `reserve` refuses
+//! with a retryable [`BudgetError::RateLimited`] — a request is never served
+//! on an un-authorized key, and a real key is never rejected as invalid
+//! during a blip.
+
+use async_trait::async_trait;
+use cortex_core::config::UpstreamClientConfig;
+use cortex_core::entitlements::{
+    AuthError, BudgetError, BudgetSnapshot, EntitlementProvider, Principal, Reservation,
+};
+use serde::Deserialize;
+use std::time::Duration;
+
+/// Retry-After (seconds) advertised when we fail closed on an upstream
+/// outage.
+const FAIL_CLOSED_RETRY_SECS: u64 = 5;
+
+pub struct UpstreamEntitlementProvider {
+    client: reqwest::Client,
+    base_url: String,
+    bearer: String,
+}
+
+#[derive(Deserialize)]
+struct PrincipalDto {
+    account_id: String,
+    key_id: String,
+}
+#[derive(Deserialize)]
+struct SnapshotDto {
+    hard_cap: Option<u64>,
+    spent: u64,
+    reserved: u64,
+}
+#[derive(Deserialize)]
+struct ResolveResp {
+    principal: PrincipalDto,
+    #[allow(dead_code)]
+    snapshot: Option<SnapshotDto>,
+}
+#[derive(Deserialize)]
+struct ReserveResp {
+    reservation_id: Option<i64>,
+    rejected: Option<Rejection>,
+}
+#[derive(Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+enum Rejection {
+    InsufficientQuota {
+        requested: u64,
+        available: u64,
+    },
+    RateLimited {
+        requested: u64,
+        available: u64,
+        retry_after_secs: u64,
+    },
+}
+
+impl UpstreamEntitlementProvider {
+    pub fn new(cfg: &UpstreamClientConfig) -> Self {
+        let client = reqwest::Client::builder()
+            .timeout(Duration::from_secs(cfg.timeout_secs))
+            .build()
+            .expect("failed to build upstream HTTP client");
+        Self {
+            client,
+            base_url: cfg.url.trim_end_matches('/').to_string(),
+            bearer: cfg.bearer.clone(),
+        }
+    }
+
+    fn url(&self, path: &str) -> String {
+        format!("{}{}", self.base_url, path)
+    }
+}
+
+#[async_trait]
+impl EntitlementProvider for UpstreamEntitlementProvider {
+    async fn resolve(&self, api_key: &str) -> Result<Principal, AuthError> {
+        let resp = self
+            .client
+            .post(self.url("/authz/v1/resolve"))
+            .bearer_auth(&self.bearer)
+            .json(&serde_json::json!({ "api_key": api_key }))
+            .send()
+            .await;
+        let resp = match resp {
+            Ok(r) => r,
+            Err(e) => {
+                tracing::warn!(error = %e, "upstream resolve unreachable; failing closed");
+                return Err(AuthError::Unavailable {
+                    retry_after_secs: FAIL_CLOSED_RETRY_SECS,
+                });
+            }
+        };
+        if resp.status().as_u16() == 401 {
+            return Err(AuthError::InvalidKey);
+        }
+        if !resp.status().is_success() {
+            return Err(AuthError::Unavailable {
+                retry_after_secs: FAIL_CLOSED_RETRY_SECS,
+            });
+        }
+        match resp.json::<ResolveResp>().await {
+            Ok(r) => Ok(Principal {
+                account_id: r.principal.account_id,
+                key_id: r.principal.key_id,
+            }),
+            Err(e) => {
+                tracing::warn!(error = %e, "upstream resolve: bad body; failing closed");
+                Err(AuthError::Unavailable {
+                    retry_after_secs: FAIL_CLOSED_RETRY_SECS,
+                })
+            }
+        }
+    }
+
+    async fn reserve(
+        &self,
+        principal: &Principal,
+        max_tokens: u64,
+    ) -> Result<Reservation, BudgetError> {
+        let fail_closed = || BudgetError::RateLimited {
+            requested: max_tokens,
+            available: 0,
+            retry_after_secs: FAIL_CLOSED_RETRY_SECS,
+        };
+        let resp = self
+            .client
+            .post(self.url("/authz/v1/reserve"))
+            .bearer_auth(&self.bearer)
+            .json(&serde_json::json!({
+                "account_id": principal.account_id,
+                "key_id": principal.key_id,
+                "max_tokens": max_tokens,
+            }))
+            .send()
+            .await;
+        let resp = match resp {
+            Ok(r) if r.status().is_success() => r,
+            Ok(r) => {
+                tracing::warn!(status = %r.status(), "upstream reserve non-2xx; failing closed");
+                return Err(fail_closed());
+            }
+            Err(e) => {
+                tracing::warn!(error = %e, "upstream reserve unreachable; failing closed");
+                return Err(fail_closed());
+            }
+        };
+        match resp.json::<ReserveResp>().await {
+            Ok(ReserveResp {
+                reservation_id: Some(id),
+                ..
+            }) => Ok(Reservation {
+                id: id as u64,
+                principal: principal.clone(),
+                reserved: max_tokens,
+            }),
+            Ok(ReserveResp {
+                rejected:
+                    Some(Rejection::InsufficientQuota {
+                        requested,
+                        available,
+                    }),
+                ..
+            }) => Err(BudgetError::InsufficientQuota {
+                requested,
+                available,
+            }),
+            Ok(ReserveResp {
+                rejected:
+                    Some(Rejection::RateLimited {
+                        requested,
+                        available,
+                        retry_after_secs,
+                    }),
+                ..
+            }) => Err(BudgetError::RateLimited {
+                requested,
+                available,
+                retry_after_secs,
+            }),
+            _ => Err(fail_closed()),
+        }
+    }
+
+    async fn settle(&self, reservation: Reservation, actual_tokens: u64) {
+        // Best-effort; a lost settle is reaped by the upstream sweeper (B2).
+        let _ = self
+            .client
+            .post(self.url("/authz/v1/settle"))
+            .bearer_auth(&self.bearer)
+            .json(&serde_json::json!({
+                "reservation_id": reservation.id as i64,
+                "actual_tokens": actual_tokens,
+            }))
+            .send()
+            .await
+            .inspect_err(
+                |e| tracing::warn!(error = %e, "upstream settle failed (sweeper will reap)"),
+            );
+    }
+
+    async fn release(&self, reservation: Reservation) {
+        let _ = self
+            .client
+            .post(self.url("/authz/v1/release"))
+            .bearer_auth(&self.bearer)
+            .json(&serde_json::json!({ "reservation_id": reservation.id as i64 }))
+            .send()
+            .await
+            .inspect_err(
+                |e| tracing::warn!(error = %e, "upstream release failed (sweeper will reap)"),
+            );
+    }
+
+    async fn snapshot(&self, principal: &Principal) -> Option<BudgetSnapshot> {
+        let resp = self
+            .client
+            .post(self.url("/authz/v1/snapshot"))
+            .bearer_auth(&self.bearer)
+            .json(&serde_json::json!({
+                "account_id": principal.account_id,
+                "key_id": principal.key_id,
+            }))
+            .send()
+            .await
+            .ok()?;
+        if !resp.status().is_success() {
+            return None;
+        }
+        let dto = resp.json::<SnapshotDto>().await.ok()?;
+        Some(BudgetSnapshot {
+            hard_cap: dto.hard_cap,
+            spent: dto.spent,
+            reserved: dto.reserved,
+        })
+    }
+}

crates/cortex-gateway/src/lib.rs

@@ -1,6 +1,8 @@
 pub mod anthropic_sse;
 pub mod auth;
+pub mod entitlements_chain;
 pub mod entitlements_local;
+pub mod entitlements_upstream;
 pub mod error;
 pub mod evictor;
 pub mod handlers;

crates/cortex-gateway/src/state.rs

@@ -1,4 +1,6 @@
+use crate::entitlements_chain::ChainedEntitlementProvider;
 use crate::entitlements_local::LocalEntitlementProvider;
+use crate::entitlements_upstream::UpstreamEntitlementProvider;
 use cortex_core::catalogue::ModelCatalogue;
 use cortex_core::config::{EvictionSettings, GatewayConfig, NeuronEndpoint};
 use cortex_core::entitlements::EntitlementProvider;
@@ -45,8 +47,20 @@ impl CortexState {
 
         let catalogue = ModelCatalogue::load(&config.models_config);
 
-        let entitlements: Arc<dyn EntitlementProvider> =
-            Arc::new(LocalEntitlementProvider::from_config(&config.entitlements));
+        // Local provider always handles operator + infra keys. When the
+        // upstream client is enabled (#57), wrap it in the chain so locally
+        // unknown keys fall through to the mesh authority; otherwise stay
+        // purely local.
+        let local = LocalEntitlementProvider::from_config(&config.entitlements);
+        let entitlements: Arc<dyn EntitlementProvider> = if config.upstream.enabled {
+            tracing::info!(url = %config.upstream.url, "upstream entitlement client enabled");
+            Arc::new(ChainedEntitlementProvider::new(
+                local,
+                UpstreamEntitlementProvider::new(&config.upstream),
+            ))
+        } else {
+            Arc::new(local)
+        };
 
         Self {
             nodes: RwLock::new(nodes),

crates/cortex-gateway/tests/aliases.rs

@@ -57,6 +57,7 @@ async fn test_alias_resolves_in_chat_completions() {
         }],
         models_config: models_path.to_string_lossy().to_string(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -143,6 +144,7 @@ async fn test_aliases_surface_in_v1_models() {
         }],
         models_config: models_path.to_string_lossy().to_string(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -232,6 +234,7 @@ async fn test_alias_falls_through_for_unmapped_model() {
         }],
         models_config: models_path.to_string_lossy().to_string(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));

crates/cortex-gateway/tests/auth.rs

@@ -105,6 +105,7 @@ async fn spawn_gateway(neuron_url: &str, entitlements: EntitlementsConfig) -> St
         }],
         models_config: "/dev/null".into(),
         entitlements,
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));

crates/cortex-gateway/tests/budget_enforcement.rs

@@ -81,6 +81,7 @@ async fn spawn_gateway(neuron_url: &str, key: ApiKeyConfig) -> (Arc<CortexState>
             require_auth: true,
             keys: vec![key],
         },
+        upstream: Default::default(),
     };
     let fleet = Arc::new(CortexState::from_config(&config));
     {

crates/cortex-gateway/tests/common/mod.rs

@@ -430,6 +430,7 @@ pub async fn spawn_gateway_with_state(mock_url: &str) -> (Arc<CortexState>, Stri
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));

crates/cortex-gateway/tests/error_envelope.rs

@@ -89,6 +89,7 @@ async fn error_response_no_healthy_nodes() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(cortex_gateway::state::CortexState::from_config(&config));

crates/cortex-gateway/tests/eviction.rs

@@ -72,6 +72,7 @@ fn make_fleet(endpoint: &str, defrag_after: u32) -> Arc<CortexState> {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
     Arc::new(CortexState::from_config(&config))
 }

crates/cortex-gateway/tests/feasibility_routing.rs

@@ -74,6 +74,7 @@ async fn fleet_with(big_healthy: bool, big_devices: usize) -> Arc<CortexState> {
         ],
         models_config: cat.to_string_lossy().into_owned(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
     let fleet = Arc::new(CortexState::from_config(&config));
     {

crates/cortex-gateway/tests/load_routing.rs

@@ -72,6 +72,7 @@ async fn two_neuron_fleet(endpoint_a: &str, endpoint_b: &str) -> Arc<CortexState
         ],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
     Arc::new(CortexState::from_config(&config))
 }

crates/cortex-gateway/tests/metering.rs

@@ -53,6 +53,7 @@ async fn spawn_metered_gateway(neuron_url: &str) -> (Arc<CortexState>, String) {
                 window: CapWindow::Balance,
             }],
         },
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -158,6 +159,7 @@ async fn anonymous_request_records_no_spend() {
         }],
         models_config: "/dev/null".into(),
         entitlements: EntitlementsConfig::default(),
+        upstream: Default::default(),
     };
     let fleet = Arc::new(CortexState::from_config(&config));
     {

crates/cortex-gateway/tests/model_cost.rs

@@ -66,6 +66,7 @@ harness = "candle"
         }],
         models_config: cat_path.to_string_lossy().into_owned(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));

crates/cortex-gateway/tests/model_limits.rs

@@ -55,6 +55,7 @@ capabilities = ["text"]
         }],
         models_config: cat_path.to_string_lossy().into_owned(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));

crates/cortex-gateway/tests/poller.rs

@@ -32,6 +32,7 @@ async fn test_poller_discovers_models() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -84,6 +85,7 @@ async fn test_poller_updates_gateway_models_endpoint() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -156,6 +158,7 @@ async fn test_models_endpoint_unions_capabilities_across_nodes() {
         ],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -219,6 +222,7 @@ async fn test_poller_marks_unreachable_node_unhealthy() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -273,6 +277,7 @@ async fn test_poller_removes_stale_models() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -304,6 +309,7 @@ async fn test_poller_removes_stale_models() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet2 = Arc::new(CortexState::from_config(&config2));
@@ -386,6 +392,7 @@ async fn test_poller_captures_activation_from_health() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));
@@ -431,6 +438,7 @@ async fn test_poller_parses_recovering_status() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
 
     let fleet = Arc::new(CortexState::from_config(&config));

crates/cortex-gateway/tests/prompt_prevalidation.rs

@@ -75,6 +75,7 @@ async fn spawn_gateway(neuron: &str, context: usize) -> String {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
     let fleet = Arc::new(CortexState::from_config(&config));
     {

crates/cortex-gateway/tests/proxy_basic.rs

@@ -118,6 +118,7 @@ async fn test_no_healthy_nodes() {
         }],
         models_config: "/dev/null".into(),
         entitlements: Default::default(),
+        upstream: Default::default(),
     };
     let fleet = std::sync::Arc::new(cortex_gateway::state::CortexState::from_config(&config));
 

crates/cortex-gateway/tests/upstream_chain.rs

@@ -0,0 +1,105 @@
+//! B3: the chained entitlement provider (local → upstream) and fail-closed
+//! semantics, exercised against a mock helexa-upstream `/authz/v1`.
+
+use axum::{Json, Router, routing::post};
+use cortex_core::config::{ApiKeyConfig, EntitlementsConfig, UpstreamClientConfig};
+use cortex_core::entitlements::{AuthError, EntitlementProvider};
+use cortex_gateway::entitlements_chain::ChainedEntitlementProvider;
+use cortex_gateway::entitlements_local::LocalEntitlementProvider;
+use cortex_gateway::entitlements_upstream::UpstreamEntitlementProvider;
+use serde_json::{Value, json};
+use tokio::net::TcpListener;
+
+/// Mock upstream: `mesh-key` resolves to a mesh account; anything else 401.
+/// reserve always grants reservation 1.
+async fn spawn_mock_upstream() -> String {
+    async fn resolve(Json(body): Json<Value>) -> axum::response::Response {
+        use axum::response::IntoResponse;
+        if body["api_key"] == "mesh-key" {
+            Json(json!({"principal": {"account_id": "mesh-acct", "key_id": "mesh-key-1"}}))
+                .into_response()
+        } else {
+            (
+                axum::http::StatusCode::UNAUTHORIZED,
+                Json(json!({"error": {"code": "invalid_api_key"}})),
+            )
+                .into_response()
+        }
+    }
+    async fn reserve() -> Json<Value> {
+        Json(json!({ "reservation_id": 1 }))
+    }
+    let app = Router::new()
+        .route("/authz/v1/resolve", post(resolve))
+        .route("/authz/v1/reserve", post(reserve));
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+    format!("http://{addr}")
+}
+
+fn local_with_key() -> LocalEntitlementProvider {
+    let cfg = EntitlementsConfig {
+        require_auth: false,
+        keys: vec![ApiKeyConfig {
+            key: "local-key".into(),
+            account_id: "op".into(),
+            key_id: None,
+            hard_cap: None,
+            window: Default::default(),
+        }],
+    };
+    LocalEntitlementProvider::from_config(&cfg)
+}
+
+fn chain(local: LocalEntitlementProvider, url: &str) -> ChainedEntitlementProvider {
+    let upstream = UpstreamEntitlementProvider::new(&UpstreamClientConfig {
+        enabled: true,
+        url: url.to_string(),
+        bearer: "client-secret".into(),
+        timeout_secs: 5,
+    });
+    ChainedEntitlementProvider::new(local, upstream)
+}
+
+#[tokio::test]
+async fn local_key_resolves_locally() {
+    let url = spawn_mock_upstream().await;
+    let c = chain(local_with_key(), &url);
+    let p = c.resolve("local-key").await.expect("local resolves");
+    assert_eq!(p.account_id, "op");
+}
+
+#[tokio::test]
+async fn unknown_key_falls_through_to_upstream() {
+    let url = spawn_mock_upstream().await;
+    let c = chain(local_with_key(), &url);
+    let p = c.resolve("mesh-key").await.expect("upstream resolves");
+    assert_eq!(p.account_id, "mesh-acct");
+    assert_eq!(p.key_id, "mesh-key-1");
+}
+
+#[tokio::test]
+async fn unknown_everywhere_is_invalid_key() {
+    let url = spawn_mock_upstream().await;
+    let c = chain(local_with_key(), &url);
+    match c.resolve("nope").await {
+        Err(AuthError::InvalidKey) => {}
+        other => panic!("expected InvalidKey, got {other:?}"),
+    }
+}
+
+#[tokio::test]
+async fn upstream_unreachable_fails_closed_as_unavailable() {
+    // No mock — point at a dead port. A locally-unknown key must surface
+    // Unavailable (→ 503), never InvalidKey (→ 401).
+    let c = chain(local_with_key(), "http://127.0.0.1:1");
+    match c.resolve("some-mesh-key").await {
+        Err(AuthError::Unavailable { retry_after_secs }) => assert!(retry_after_secs > 0),
+        other => panic!("expected Unavailable, got {other:?}"),
+    }
+    // A local key still resolves without touching upstream.
+    assert_eq!(c.resolve("local-key").await.unwrap().account_id, "op");
+}

crates/helexa-upstream/Cargo.toml

@@ -42,6 +42,12 @@ sqlx = { version = "0.8", default-features = false, features = [
     "uuid",
 ] }
 uuid = { version = "1", features = ["v4", "serde"] }
+sha2 = "0.10"
+subtle = "2.6"
+
+# cortex-core for the shared #63 OpenAiError envelope on the authz surface.
+cortex-core = { workspace = true }
 
 [dev-dependencies]
 figment = { workspace = true, features = ["test"] }
+reqwest = { workspace = true }

crates/helexa-upstream/src/authz.rs

@@ -0,0 +1,284 @@
+//! `/authz/v1` — the machine surface cortex's `UpstreamEntitlementProvider`
+//! (#57) consumes. It mirrors the `cortex_core::entitlements::EntitlementProvider`
+//! trait 1:1 (resolve / reserve / settle / release / snapshot) over the B1
+//! ledger.
+//!
+//! Contract notes for the cortex client:
+//! - A **non-2xx** response means the authority could not give an
+//!   authoritative answer (bad caller auth, malformed request, server
+//!   error) → the client should **fail closed**.
+//! - `reserve` returns **200** whether granted or budget-refused: the body
+//!   carries either `reservation_id` or a `rejected` discriminant. A budget
+//!   refusal is an authoritative answer, not a transport failure.
+//! - Rejections that are genuinely auth failures use the #63 `OpenAiError`
+//!   envelope so they can be surfaced verbatim.
+
+use crate::crypto::sha256;
+use crate::error::envelope_response;
+use crate::ledger::{self, LedgerError};
+use crate::state::AppState;
+use axum::extract::{Request, State};
+use axum::http::{StatusCode, header};
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+use axum::routing::post;
+use axum::{Json, Router};
+use cortex_core::error_envelope::OpenAiError;
+use serde::{Deserialize, Serialize};
+use subtle::ConstantTimeEq;
+use uuid::Uuid;
+
+/// The operator a validated client bearer identifies (served-usage
+/// attribution, #58). Inserted into request extensions by [`client_auth`].
+#[derive(Debug, Clone)]
+pub struct OperatorId(pub String);
+
+/// Build the `/authz/v1` router with the client-auth layer applied.
+pub fn router(state: &AppState) -> Router<AppState> {
+    Router::new()
+        .route("/authz/v1/resolve", post(resolve))
+        .route("/authz/v1/reserve", post(reserve))
+        .route("/authz/v1/settle", post(settle))
+        .route("/authz/v1/release", post(release))
+        .route("/authz/v1/snapshot", post(snapshot))
+        .layer(axum::middleware::from_fn_with_state(
+            state.clone(),
+            client_auth,
+        ))
+}
+
+// ── client auth (shared bearer → operator_id) ───────────────────────
+
+/// Validate the caller's `Authorization: Bearer` against the configured
+/// client tokens (constant-time) and stamp the `operator_id`. When no tokens
+/// are configured the surface is open (dev) and a synthetic operator is
+/// used.
+async fn client_auth(State(state): State<AppState>, mut req: Request, next: Next) -> Response {
+    let tokens = &state.config.client_auth.tokens;
+    if tokens.is_empty() {
+        req.extensions_mut().insert(OperatorId("dev".into()));
+        return next.run(req).await;
+    }
+    let presented = req
+        .headers()
+        .get(header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .map(str::trim)
+        .unwrap_or("");
+    let matched = tokens
+        .iter()
+        .find(|t| t.token.as_bytes().ct_eq(presented.as_bytes()).into());
+    match matched {
+        Some(t) => {
+            req.extensions_mut()
+                .insert(OperatorId(t.operator_id.clone()));
+            next.run(req).await
+        }
+        None => envelope_response(OpenAiError::invalid_api_key(
+            "missing or invalid client credentials",
+        )),
+    }
+}
+
+// ── DTOs ────────────────────────────────────────────────────────────
+
+#[derive(Deserialize)]
+struct ResolveReq {
+    api_key: String,
+}
+
+#[derive(Serialize)]
+struct PrincipalDto {
+    account_id: String,
+    key_id: String,
+}
+
+#[derive(Serialize)]
+struct SnapshotDto {
+    hard_cap: Option<i64>,
+    spent: i64,
+    reserved: i64,
+}
+
+#[derive(Serialize)]
+struct ResolveResp {
+    principal: PrincipalDto,
+    snapshot: SnapshotDto,
+}
+
+#[derive(Deserialize)]
+struct ReserveReq {
+    account_id: String,
+    key_id: String,
+    max_tokens: i64,
+}
+
+#[derive(Serialize, Default)]
+struct ReserveResp {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    reservation_id: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    rejected: Option<Rejection>,
+}
+
+#[derive(Serialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+enum Rejection {
+    InsufficientQuota {
+        requested: i64,
+        available: i64,
+    },
+    // Part of the frozen wire contract so the cortex client (#57) can map it
+    // without a later breaking change. Not yet constructed: the B1 ledger
+    // implements Balance caps only; rolling-window key sub-caps (which yield
+    // this) land in a follow-up.
+    #[allow(dead_code)]
+    RateLimited {
+        requested: i64,
+        available: i64,
+        retry_after_secs: u64,
+    },
+}
+
+#[derive(Deserialize)]
+struct SettleReq {
+    reservation_id: i64,
+    actual_tokens: i64,
+}
+
+#[derive(Deserialize)]
+struct ReservationRef {
+    reservation_id: i64,
+}
+
+#[derive(Deserialize)]
+struct SnapshotReq {
+    account_id: String,
+    key_id: String,
+}
+
+// ── handlers ────────────────────────────────────────────────────────
+
+/// `POST /authz/v1/resolve` — bearer key → principal + snapshot, or
+/// `401 invalid_api_key` (also for a deactivated account: no clue).
+async fn resolve(State(state): State<AppState>, Json(req): Json<ResolveReq>) -> Response {
+    match ledger::resolve_key(&state.pool, &sha256(&req.api_key)).await {
+        Ok(Some(p)) => Json(ResolveResp {
+            principal: PrincipalDto {
+                account_id: p.account_id.to_string(),
+                key_id: p.key_id.to_string(),
+            },
+            snapshot: SnapshotDto {
+                hard_cap: Some(p.hard_cap),
+                spent: p.key_spent,
+                reserved: p.key_reserved,
+            },
+        })
+        .into_response(),
+        Ok(None) => envelope_response(OpenAiError::invalid_api_key("invalid or unknown API key")),
+        Err(e) => {
+            tracing::error!(error = %e, "resolve query failed");
+            envelope_response(OpenAiError::service_unavailable("authority error", Some(5)))
+        }
+    }
+}
+
+/// `POST /authz/v1/reserve` — 200 with `reservation_id` (granted) or
+/// `rejected` (budget). Non-2xx only for bad input / server error.
+async fn reserve(State(state): State<AppState>, Json(req): Json<ReserveReq>) -> Response {
+    let (Ok(account_id), Ok(key_id)) = (
+        Uuid::parse_str(&req.account_id),
+        Uuid::parse_str(&req.key_id),
+    ) else {
+        return bad_request("account_id and key_id must be UUIDs");
+    };
+    match ledger::reserve(&state.pool, account_id, key_id, req.max_tokens).await {
+        Ok(reservation_id) => Json(ReserveResp {
+            reservation_id: Some(reservation_id),
+            rejected: None,
+        })
+        .into_response(),
+        Err(LedgerError::InsufficientQuota {
+            requested,
+            available,
+        }) => Json(ReserveResp {
+            reservation_id: None,
+            rejected: Some(Rejection::InsufficientQuota {
+                requested,
+                available,
+            }),
+        })
+        .into_response(),
+        Err(LedgerError::AccountNotFound | LedgerError::KeyNotFound) => {
+            // Resolve succeeded earlier; the principal vanished (archived /
+            // deactivated). Treat as no budget — fail closed at the client.
+            Json(ReserveResp {
+                reservation_id: None,
+                rejected: Some(Rejection::InsufficientQuota {
+                    requested: req.max_tokens,
+                    available: 0,
+                }),
+            })
+            .into_response()
+        }
+        Err(LedgerError::Db(e)) => {
+            tracing::error!(error = %e, "reserve failed");
+            envelope_response(OpenAiError::service_unavailable("authority error", Some(5)))
+        }
+    }
+}
+
+/// `POST /authz/v1/settle` — idempotent; `204`.
+async fn settle(State(state): State<AppState>, Json(req): Json<SettleReq>) -> Response {
+    match ledger::settle(&state.pool, req.reservation_id, req.actual_tokens).await {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(e) => {
+            tracing::error!(error = %e, "settle failed");
+            envelope_response(OpenAiError::service_unavailable("authority error", Some(5)))
+        }
+    }
+}
+
+/// `POST /authz/v1/release` — idempotent; `204`.
+async fn release(State(state): State<AppState>, Json(req): Json<ReservationRef>) -> Response {
+    match ledger::release(&state.pool, req.reservation_id).await {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(e) => {
+            tracing::error!(error = %e, "release failed");
+            envelope_response(OpenAiError::service_unavailable("authority error", Some(5)))
+        }
+    }
+}
+
+/// `POST /authz/v1/snapshot` — `{hard_cap, spent, reserved}` or `404`.
+async fn snapshot(State(state): State<AppState>, Json(req): Json<SnapshotReq>) -> Response {
+    let (Ok(account_id), Ok(key_id)) = (
+        Uuid::parse_str(&req.account_id),
+        Uuid::parse_str(&req.key_id),
+    ) else {
+        return bad_request("account_id and key_id must be UUIDs");
+    };
+    match ledger::snapshot(&state.pool, account_id, key_id).await {
+        Ok(Some((hard_cap, spent, reserved))) => Json(SnapshotDto {
+            hard_cap: Some(hard_cap),
+            spent,
+            reserved,
+        })
+        .into_response(),
+        Ok(None) => StatusCode::NOT_FOUND.into_response(),
+        Err(e) => {
+            tracing::error!(error = %e, "snapshot failed");
+            envelope_response(OpenAiError::service_unavailable("authority error", Some(5)))
+        }
+    }
+}
+
+fn bad_request(msg: &str) -> Response {
+    envelope_response(OpenAiError::new(
+        400,
+        "invalid_request_error",
+        "invalid_request",
+        msg,
+    ))
+}

crates/helexa-upstream/src/config.rs

@@ -18,6 +18,50 @@ pub struct UpstreamConfig {
     pub grant: GrantSettings,
     #[serde(default)]
     pub abuse: AbuseSettings,
+    #[serde(default)]
+    pub client_auth: ClientAuthSettings,
+    #[serde(default)]
+    pub authz: AuthzSettings,
+}
+
+/// `[client_auth]` — credentials operators' cortexes present to `/authz/v1`.
+/// Each token maps to an `operator_id` (served-usage attribution, #58). This
+/// transport credential is distinct from end-user API keys (which ride in
+/// the `resolve` body). v2 adds mTLS.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ClientAuthSettings {
+    /// When empty the authz surface is **open** (dev only; logged at warn).
+    #[serde(default)]
+    pub tokens: Vec<ClientToken>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ClientToken {
+    /// Shared bearer a cortex presents.
+    pub token: String,
+    /// Operator this token identifies.
+    pub operator_id: String,
+}
+
+/// `[authz]` — reservation lifecycle knobs.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthzSettings {
+    /// Open reservations older than this are swept (released), self-healing
+    /// a reservation whose settle/release from cortex was lost.
+    #[serde(default = "default_reservation_ttl")]
+    pub reservation_ttl_secs: u64,
+    /// How often the sweeper runs.
+    #[serde(default = "default_sweep_interval")]
+    pub sweep_interval_secs: u64,
+}
+
+impl Default for AuthzSettings {
+    fn default() -> Self {
+        Self {
+            reservation_ttl_secs: default_reservation_ttl(),
+            sweep_interval_secs: default_sweep_interval(),
+        }
+    }
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -92,6 +136,12 @@ fn default_free_grant() -> i64 {
 fn default_fingerprint_threshold() -> i64 {
     5
 }
+fn default_reservation_ttl() -> u64 {
+    120
+}
+fn default_sweep_interval() -> u64 {
+    60
+}
 
 impl UpstreamConfig {
     /// Load from a TOML file with `UPSTREAM_`-prefixed env overrides

crates/helexa-upstream/src/crypto.rs

@@ -0,0 +1,12 @@
+//! Hashing helpers. API keys and top-up codes are stored only as their
+//! sha256 (they are high-entropy secrets; sha256 is the fast, sufficient
+//! choice — argon2 is reserved for low-entropy passwords).
+
+use sha2::{Digest, Sha256};
+
+/// sha256 of `input`, as raw bytes (matches the `BYTEA` columns).
+pub fn sha256(input: &str) -> Vec<u8> {
+    let mut h = Sha256::new();
+    h.update(input.as_bytes());
+    h.finalize().to_vec()
+}

crates/helexa-upstream/src/error.rs

@@ -0,0 +1,21 @@
+//! Adapter from the shared, axum-agnostic
+//! [`cortex_core::error_envelope::OpenAiError`] (#60/#63) to an axum
+//! response, with `Retry-After`. The `/authz/v1` surface speaks the #63
+//! envelope so cortex (an OpenAI-compatible proxy) can forward rejections
+//! verbatim. (The future `/web/v1` surface uses a plain JSON error shape.)
+
+use axum::http::{HeaderValue, StatusCode, header};
+use axum::response::{IntoResponse, Json, Response};
+use cortex_core::error_envelope::OpenAiError;
+
+pub fn envelope_response(err: OpenAiError) -> Response {
+    let status = StatusCode::from_u16(err.status).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+    let retry_after = err.retry_after_secs;
+    let mut response = (status, Json(err.body())).into_response();
+    if let Some(secs) = retry_after
+        && let Ok(value) = HeaderValue::from_str(&secs.to_string())
+    {
+        response.headers_mut().insert(header::RETRY_AFTER, value);
+    }
+    response
+}

crates/helexa-upstream/src/ledger.rs

@@ -20,6 +20,103 @@
 use sqlx::postgres::PgPool;
 use uuid::Uuid;
 
+/// A bearer key resolved to its principal + a budget snapshot.
+#[derive(Debug, Clone)]
+pub struct ResolvedPrincipal {
+    pub account_id: Uuid,
+    pub key_id: Uuid,
+    /// Effective per-key absolute cap (the key sub-cap; the account cap
+    /// still binds at reserve time).
+    pub hard_cap: i64,
+    pub key_spent: i64,
+    pub key_reserved: i64,
+}
+
+/// Resolve a key by its `sha256` hash to its principal, or `None` when the
+/// key is unknown/archived **or its account is deactivated** (the silent
+/// abuse flag — indistinguishable from an unknown key, by design: no clue).
+pub async fn resolve_key(
+    pool: &PgPool,
+    key_hash: &[u8],
+) -> Result<Option<ResolvedPrincipal>, sqlx::Error> {
+    let row = sqlx::query(
+        "SELECT k.id AS key_id, k.account_id, k.limit_kind, k.limit_value, \
+                k.key_spent, k.key_reserved, a.allocation_total \
+         FROM api_keys k JOIN accounts a ON a.id = k.account_id \
+         WHERE k.key_hash = $1 AND k.status = 'active' AND a.status = 'active'",
+    )
+    .bind(key_hash)
+    .fetch_optional(pool)
+    .await?;
+    Ok(row.map(|r| {
+        let total: i64 = sqlx::Row::get(&r, "allocation_total");
+        let limit_kind: String = sqlx::Row::get(&r, "limit_kind");
+        let limit_value: i64 = sqlx::Row::get(&r, "limit_value");
+        ResolvedPrincipal {
+            account_id: sqlx::Row::get(&r, "account_id"),
+            key_id: sqlx::Row::get(&r, "key_id"),
+            hard_cap: resolve_abs_cap(&limit_kind, limit_value, total),
+            key_spent: sqlx::Row::get(&r, "key_spent"),
+            key_reserved: sqlx::Row::get(&r, "key_reserved"),
+        }
+    }))
+}
+
+/// Per-key budget snapshot `(hard_cap, spent, reserved)`, or `None` if the
+/// key/account isn't an active pair.
+pub async fn snapshot(
+    pool: &PgPool,
+    account_id: Uuid,
+    key_id: Uuid,
+) -> Result<Option<(i64, i64, i64)>, sqlx::Error> {
+    let row = sqlx::query(
+        "SELECT k.limit_kind, k.limit_value, k.key_spent, k.key_reserved, a.allocation_total \
+         FROM api_keys k JOIN accounts a ON a.id = k.account_id \
+         WHERE k.id = $1 AND k.account_id = $2 AND k.status = 'active' AND a.status = 'active'",
+    )
+    .bind(key_id)
+    .bind(account_id)
+    .fetch_optional(pool)
+    .await?;
+    Ok(row.map(|r| {
+        let total: i64 = sqlx::Row::get(&r, "allocation_total");
+        let limit_kind: String = sqlx::Row::get(&r, "limit_kind");
+        let limit_value: i64 = sqlx::Row::get(&r, "limit_value");
+        let cap = resolve_abs_cap(&limit_kind, limit_value, total);
+        (
+            cap,
+            sqlx::Row::get::<i64, _>(&r, "key_spent"),
+            sqlx::Row::get::<i64, _>(&r, "key_reserved"),
+        )
+    }))
+}
+
+/// Release every `open` reservation older than `max_age_secs`, returning
+/// each one's reserved tokens to its account and key in a single statement.
+/// The lost-settle self-heal. Returns the number swept.
+pub async fn sweep_stale(pool: &PgPool, max_age_secs: i64) -> Result<u64, sqlx::Error> {
+    // Data-modifying CTEs: release stale rows, then fold their reserved sums
+    // back into accounts and api_keys. All in one atomic statement.
+    let result = sqlx::query(
+        "WITH stale AS ( \
+             UPDATE reservations SET state = 'released', settled_at = now() \
+             WHERE state = 'open' AND created_at < now() - make_interval(secs => $1) \
+             RETURNING account_id, key_id, reserved \
+         ), acct AS ( \
+             UPDATE accounts a SET allocation_reserved = allocation_reserved - s.total \
+             FROM (SELECT account_id, SUM(reserved) AS total FROM stale GROUP BY account_id) s \
+             WHERE a.id = s.account_id \
+         ) \
+         UPDATE api_keys k SET key_reserved = key_reserved - s.total \
+         FROM (SELECT key_id, SUM(reserved) AS total FROM stale GROUP BY key_id) s \
+         WHERE k.id = s.key_id",
+    )
+    .bind(max_age_secs as f64)
+    .execute(pool)
+    .await?;
+    Ok(result.rows_affected())
+}
+
 /// Resolve a key's per-key cap to an absolute token count.
 ///
 /// `percent` is `floor(allocation_total * limit_value / 100)`; `hardcap` is

crates/helexa-upstream/src/lib.rs

@@ -7,12 +7,16 @@
 //! of the `/authz/v1` surface; the helexa.ai frontend is a client of the
 //! `/web/v1` surface.
 //!
-//! B1 (this milestone) lands the crate skeleton, the full Postgres schema
-//! (`migrations/`), the reserve→settle ledger ([`ledger`]) with its
-//! no-overshoot guarantee, and `/health`.
+//! Landed so far: B1 — schema + reserve→settle [`ledger`] (no-overshoot) +
+//! `/health`. B2 — the `/authz/v1` [`authz`] surface (resolve/reserve/
+//! settle/release/snapshot) with shared-bearer client auth and a
+//! stale-reservation sweeper.
 
+pub mod authz;
 pub mod config;
+pub mod crypto;
 pub mod db;
+pub mod error;
 pub mod handlers;
 pub mod ledger;
 pub mod state;
@@ -20,22 +24,35 @@ pub mod state;
 use anyhow::Result;
 use config::UpstreamConfig;
 use state::AppState;
+use std::time::Duration;
 use tower_http::trace::TraceLayer;
 
 /// Build the axum application.
 pub fn build_app(state: AppState) -> axum::Router {
     axum::Router::new()
         .merge(handlers::routes())
+        .merge(authz::router(&state))
         .layer(TraceLayer::new_for_http())
         .with_state(state)
 }
 
-/// Start the service: connect Postgres, run migrations, bind the listener.
+/// Start the service: connect Postgres, run migrations, spawn the
+/// reservation sweeper, bind the listener.
 pub async fn run(config: UpstreamConfig) -> Result<()> {
     let pool = db::connect_and_migrate(&config.db.url, config.db.max_connections).await?;
     let listen = config.server.listen.clone();
     let state = AppState::new(pool, config);
 
+    if state.config.client_auth.tokens.is_empty() {
+        tracing::warn!(
+            "no [client_auth] tokens configured — the /authz/v1 surface is OPEN (dev only)"
+        );
+    }
+
+    // Stale-reservation sweeper: releases open reservations whose
+    // settle/release from cortex was lost, self-healing allocation_reserved.
+    spawn_sweeper(&state);
+
     let addr = listen.parse::<std::net::SocketAddr>()?;
     tracing::info!("helexa-upstream listening on {addr}");
 
@@ -43,3 +60,19 @@ pub async fn run(config: UpstreamConfig) -> Result<()> {
     axum::serve(listener, build_app(state)).await?;
     Ok(())
 }
+
+fn spawn_sweeper(state: &AppState) {
+    let pool = state.pool.clone();
+    let ttl = state.config.authz.reservation_ttl_secs as i64;
+    let interval = Duration::from_secs(state.config.authz.sweep_interval_secs);
+    tokio::spawn(async move {
+        loop {
+            tokio::time::sleep(interval).await;
+            match ledger::sweep_stale(&pool, ttl).await {
+                Ok(n) if n > 0 => tracing::info!(swept = n, "released stale reservations"),
+                Ok(_) => {}
+                Err(e) => tracing::warn!(error = %e, "reservation sweep failed"),
+            }
+        }
+    });
+}

crates/helexa-upstream/tests/authz_pg.rs

@@ -0,0 +1,240 @@
+//! Integration tests for the `/authz/v1` surface against a real Postgres,
+//! driving the built axum app over HTTP. Gated on `UPSTREAM_TEST_DATABASE_URL`
+//! (skips cleanly when unset, so CI stays green without a DB):
+//!
+//!   UPSTREAM_TEST_DATABASE_URL=postgres://helexa:helexa@localhost/helexa_test \
+//!     cargo test -p helexa-upstream --test authz_pg
+
+use helexa_upstream::config::{ClientToken, UpstreamConfig};
+use helexa_upstream::crypto::sha256;
+use helexa_upstream::db::connect_and_migrate;
+use helexa_upstream::state::AppState;
+use serde_json::{Value, json};
+use sqlx::Executor;
+use sqlx::Row;
+use sqlx::postgres::PgPool;
+use uuid::Uuid;
+
+const CLIENT_TOKEN: &str = "test-operator-token";
+
+async fn spawn_or_skip(test: &str) -> Option<(String, PgPool)> {
+    let Ok(url) = std::env::var("UPSTREAM_TEST_DATABASE_URL") else {
+        eprintln!("skipping {test}: UPSTREAM_TEST_DATABASE_URL not set");
+        return None;
+    };
+    let pool = connect_and_migrate(&url, 16).await.expect("migrate");
+
+    let mut config = UpstreamConfig {
+        server: Default::default(),
+        db: helexa_upstream::config::DbSettings {
+            url,
+            max_connections: 16,
+        },
+        grant: Default::default(),
+        abuse: Default::default(),
+        client_auth: Default::default(),
+        authz: Default::default(),
+    };
+    config.client_auth.tokens.push(ClientToken {
+        token: CLIENT_TOKEN.into(),
+        operator_id: "op-test".into(),
+    });
+
+    let state = AppState::new(pool.clone(), config);
+    let app = helexa_upstream::build_app(state);
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        axum::serve(listener, app).await.unwrap();
+    });
+    Some((format!("http://{addr}"), pool))
+}
+
+/// Seed an account with `total` allocation and an active key with raw value
+/// `raw` (percent=100). Optionally deactivate the account. Returns
+/// (account_id, key_id).
+async fn seed_key(pool: &PgPool, total: i64, raw: &str, deactivated: bool) -> (Uuid, Uuid) {
+    let user_id: Uuid = pool
+        .fetch_one(
+            sqlx::query(
+                "INSERT INTO users (email, password_hash, email_verified) VALUES ($1,'x',true) RETURNING id",
+            )
+            .bind(format!("u-{}@t.local", Uuid::new_v4())),
+        )
+        .await
+        .unwrap()
+        .get("id");
+    let status = if deactivated { "deactivated" } else { "active" };
+    let account_id: Uuid = pool
+        .fetch_one(
+            sqlx::query(
+                "INSERT INTO accounts (owner_user_id, allocation_total, status) VALUES ($1,$2,$3) RETURNING id",
+            )
+            .bind(user_id)
+            .bind(total)
+            .bind(status),
+        )
+        .await
+        .unwrap()
+        .get("id");
+    let key_id: Uuid = pool
+        .fetch_one(
+            sqlx::query(
+                "INSERT INTO api_keys (account_id, key_hash, key_prefix, limit_kind, limit_value) \
+                 VALUES ($1,$2,'sk-test','percent',100) RETURNING id",
+            )
+            .bind(account_id)
+            .bind(sha256(raw)),
+        )
+        .await
+        .unwrap()
+        .get("id");
+    (account_id, key_id)
+}
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+async fn post(
+    c: &reqwest::Client,
+    url: String,
+    body: Value,
+    bearer: Option<&str>,
+) -> reqwest::Response {
+    let mut req = c.post(url).json(&body);
+    if let Some(b) = bearer {
+        req = req.bearer_auth(b);
+    }
+    req.send().await.unwrap()
+}
+
+#[tokio::test]
+async fn resolve_reserve_settle_round_trip() {
+    let Some((base, pool)) = spawn_or_skip("resolve_reserve_settle_round_trip").await else {
+        return;
+    };
+    let raw = format!("sk-{}", Uuid::new_v4());
+    let (account_id, key_id) = seed_key(&pool, 1000, &raw, false).await;
+    let c = client();
+
+    // resolve
+    let r = post(
+        &c,
+        format!("{base}/authz/v1/resolve"),
+        json!({"api_key": raw}),
+        Some(CLIENT_TOKEN),
+    )
+    .await;
+    assert_eq!(r.status(), 200);
+    let body: Value = r.json().await.unwrap();
+    assert_eq!(body["principal"]["account_id"], account_id.to_string());
+    assert_eq!(body["principal"]["key_id"], key_id.to_string());
+    assert_eq!(body["snapshot"]["hard_cap"], 1000);
+
+    // reserve 400
+    let r = post(
+        &c,
+        format!("{base}/authz/v1/reserve"),
+        json!({"account_id": account_id, "key_id": key_id, "max_tokens": 400}),
+        Some(CLIENT_TOKEN),
+    )
+    .await;
+    assert_eq!(r.status(), 200);
+    let body: Value = r.json().await.unwrap();
+    let rid = body["reservation_id"].as_i64().expect("granted");
+
+    // settle 150
+    let r = post(
+        &c,
+        format!("{base}/authz/v1/settle"),
+        json!({"reservation_id": rid, "actual_tokens": 150}),
+        Some(CLIENT_TOKEN),
+    )
+    .await;
+    assert_eq!(r.status(), 204);
+
+    // snapshot reflects spend
+    let r = post(
+        &c,
+        format!("{base}/authz/v1/snapshot"),
+        json!({"account_id": account_id, "key_id": key_id}),
+        Some(CLIENT_TOKEN),
+    )
+    .await;
+    let body: Value = r.json().await.unwrap();
+    assert_eq!(body["spent"], 150);
+    assert_eq!(body["reserved"], 0);
+}
+
+#[tokio::test]
+async fn over_cap_reserve_is_rejected_not_errored() {
+    let Some((base, pool)) = spawn_or_skip("over_cap_reserve_is_rejected_not_errored").await else {
+        return;
+    };
+    let raw = format!("sk-{}", Uuid::new_v4());
+    let (account_id, key_id) = seed_key(&pool, 100, &raw, false).await;
+    let c = client();
+    let r = post(
+        &c,
+        format!("{base}/authz/v1/reserve"),
+        json!({"account_id": account_id, "key_id": key_id, "max_tokens": 999}),
+        Some(CLIENT_TOKEN),
+    )
+    .await;
+    assert_eq!(r.status(), 200, "budget refusal is an authoritative 200");
+    let body: Value = r.json().await.unwrap();
+    assert!(body["reservation_id"].is_null());
+    assert_eq!(body["rejected"]["kind"], "insufficient_quota");
+    assert_eq!(body["rejected"]["available"], 100);
+}
+
+#[tokio::test]
+async fn deactivated_account_resolves_as_invalid_no_clue() {
+    let Some((base, pool)) = spawn_or_skip("deactivated_account_resolves_as_invalid_no_clue").await
+    else {
+        return;
+    };
+    let raw = format!("sk-{}", Uuid::new_v4());
+    seed_key(&pool, 1000, &raw, true).await; // deactivated
+    let c = client();
+    let r = post(
+        &c,
+        format!("{base}/authz/v1/resolve"),
+        json!({"api_key": raw}),
+        Some(CLIENT_TOKEN),
+    )
+    .await;
+    // Indistinguishable from an unknown key.
+    assert_eq!(r.status(), 401);
+    let body: Value = r.json().await.unwrap();
+    assert_eq!(body["error"]["code"], "invalid_api_key");
+}
+
+#[tokio::test]
+async fn missing_client_auth_is_401_before_db() {
+    let Some((base, pool)) = spawn_or_skip("missing_client_auth_is_401_before_db").await else {
+        return;
+    };
+    let raw = format!("sk-{}", Uuid::new_v4());
+    seed_key(&pool, 1000, &raw, false).await;
+    let c = client();
+    // No bearer → rejected by client_auth.
+    let r = post(
+        &c,
+        format!("{base}/authz/v1/resolve"),
+        json!({"api_key": raw}),
+        None,
+    )
+    .await;
+    assert_eq!(r.status(), 401);
+    // Wrong bearer → also rejected.
+    let r = post(
+        &c,
+        format!("{base}/authz/v1/resolve"),
+        json!({"api_key": raw}),
+        Some("wrong"),
+    )
+    .await;
+    assert_eq!(r.status(), 401);
+}

helexa-upstream.example.toml

@@ -21,3 +21,17 @@ url = "postgres://helexa:helexa@localhost/helexa_upstream"
 # When this many accounts share one registration fingerprint, all are
 # silently deactivated (no notice to the user).
 # fingerprint_account_threshold = 5
+
+# -- Client auth: credentials operators' cortexes present to /authz/v1.
+# Each token maps to an operator_id (served-usage attribution). When no
+# tokens are configured the authz surface is OPEN (dev only). Distinct from
+# end-user API keys, which ride inside the resolve request body.
+# [[client_auth.tokens]]
+# token = "replace-with-a-strong-shared-secret"
+# operator_id = "lair-cafe"
+
+[authz]
+# Open reservations older than this are swept (released), self-healing a
+# reservation whose settle/release from a cortex was lost.
+# reservation_ttl_secs = 120
+# sweep_interval_secs = 60

helexa.ai/.env.example

@@ -0,0 +1,20 @@
+# helexa.ai frontend env. Copy to .env.local for local dev (gitignored).
+
+# Mesh data-plane (helexa-router, OpenAI-compatible inference). In dev,
+# vite proxies /v1 and /health here.
+VITE_ROUTER_BASE_URL=http://localhost:8088
+
+# Account control-plane (helexa-upstream). In dev, vite proxies /api here
+# (rewritten to /web/v1).
+VITE_ACCOUNT_BASE_URL=http://localhost:8090
+
+# Public-beta banner.
+VITE_PUBLIC_BETA=true
+
+# Models for the chat workspace (F3+).
+# VITE_ANON_MODEL=...
+# VITE_DEFAULT_MODEL=...
+
+# Develop the account dashboard (F4) against an in-browser mock before the
+# upstream account API ships.
+# VITE_USE_MOCK_ACCOUNT_API=true

helexa.ai/.gitignore

@@ -0,0 +1,6 @@
+node_modules
+dist
+*.local
+.env.local
+.env.*.local
+*.tsbuildinfo

helexa.ai/README.md

@@ -0,0 +1,34 @@
+# helexa.ai
+
+The public-beta frontend for the helexa mesh: a chat-first landing experience
+(anonymous + authenticated, with all chat history kept client-side in
+IndexedDB — no server-side history), a `/mission` page on European digital
+sovereignty, and full account self-service (register, recover, manage API
+keys, set per-key limits, redeem top-up codes) against `helexa-upstream`.
+
+Vite + React (SWC) + TypeScript + react-bootstrap + react-router + react-i18next.
+Lives as a top-level folder in the cortex monorepo; it is **not** a Cargo crate.
+
+## Develop
+
+```sh
+cd helexa.ai
+npm install
+cp .env.example .env.local   # adjust backend URLs
+npm run dev                  # vite dev server, proxies /v1+/health → router, /api → upstream
+```
+
+Other scripts: `npm run build` (`tsc -b && vite build` → `dist/`), `npm run
+preview`, `npm run lint`, `npm run typecheck`.
+
+In dev, `vite.config.ts` proxies the mesh data-plane (helexa-router) and the
+account control-plane (helexa-upstream) same-origin. Run a local router
+(`cargo run -p helexa-router`) for the chat path and a local helexa-upstream
+for the account path.
+
+## Status
+
+F0 scaffold. Theming + i18n (33 languages, usage-ordered selector), the
+`/mission` page, the chat workspace (Dexie + streaming), and the account
+dashboard land in subsequent phases — see
+`~/.claude/plans/we-need-to-plan-modular-graham.md`.

helexa.ai/eslint.config.js

@@ -0,0 +1,23 @@
+import js from "@eslint/js";
+import globals from "globals";
+import reactHooks from "eslint-plugin-react-hooks";
+import reactRefresh from "eslint-plugin-react-refresh";
+import tseslint from "typescript-eslint";
+import { defineConfig, globalIgnores } from "eslint/config";
+
+export default defineConfig([
+  globalIgnores(["dist"]),
+  {
+    files: ["**/*.{ts,tsx}"],
+    extends: [
+      js.configs.recommended,
+      tseslint.configs.recommended,
+      reactHooks.configs.flat.recommended,
+      reactRefresh.configs.vite,
+    ],
+    languageOptions: {
+      ecmaVersion: 2020,
+      globals: globals.browser,
+    },
+  },
+]);

helexa.ai/index.html

@@ -0,0 +1,24 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>helexa.ai</title>
+    <meta name="title" content="helexa.ai" />
+    <meta
+      name="description"
+      content="helexa — near-frontier AI on a sovereign, operator-run mesh. Chat now; bring your own key."
+    />
+    <meta property="og:type" content="website" />
+    <meta property="og:url" content="https://helexa.ai/" />
+    <meta property="og:title" content="helexa.ai" />
+    <meta
+      property="og:description"
+      content="helexa — near-frontier AI on a sovereign, operator-run mesh."
+    />
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

helexa.ai/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "helexa.ai",
+  "private": true,
+  "version": "0.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc -b && vite build",
+    "preview": "vite preview",
+    "lint": "eslint .",
+    "typecheck": "tsc -b"
+  },
+  "dependencies": {
+    "@fingerprintjs/fingerprintjs": "^4.6.2",
+    "bootstrap": "^5.3.8",
+    "dexie": "^4.2.0",
+    "dexie-react-hooks": "^4.2.0",
+    "i18next": "^25.7.1",
+    "react": "^19.2.0",
+    "react-bootstrap": "^2.10.10",
+    "react-dom": "^19.2.0",
+    "react-i18next": "^16.4.0",
+    "react-icons": "^5.5.0",
+    "react-router-dom": "^7.10.1"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.39.1",
+    "@types/node": "^24.10.1",
+    "@types/react": "^19.2.5",
+    "@types/react-dom": "^19.2.3",
+    "@vitejs/plugin-react-swc": "^4.2.0",
+    "eslint": "^9.39.1",
+    "eslint-plugin-react-hooks": "^7.0.1",
+    "eslint-plugin-react-refresh": "^0.4.24",
+    "globals": "^16.5.0",
+    "typescript": "~5.9.3",
+    "typescript-eslint": "^8.46.4",
+    "vite": "^7.2.0"
+  }
+}

helexa.ai/src/App.tsx

@@ -0,0 +1,12 @@
+import { Container } from "react-bootstrap";
+
+// F0 scaffold shell. Theming, i18n, routing, the chat workspace, mission
+// page and account dashboard land in the F1+ phases.
+export default function App() {
+  return (
+    <Container className="py-5">
+      <h1 className="mb-2">helexa.ai</h1>
+      <p className="text-muted">Public beta — coming online.</p>
+    </Container>
+  );
+}

helexa.ai/src/index.css

@@ -0,0 +1,16 @@
+/* Minimal reset; the full theme (CSS custom properties, light/dark, accent
+ * palette) is ported from the reference site in F1. */
+:root {
+  color-scheme: light dark;
+}
+
+* {
+  box-sizing: border-box;
+}
+
+html,
+body,
+#root {
+  margin: 0;
+  min-height: 100vh;
+}

helexa.ai/src/main.tsx

@@ -0,0 +1,11 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import "bootstrap/dist/css/bootstrap.min.css";
+import "./index.css";
+import App from "./App.tsx";
+
+createRoot(document.getElementById("root")!).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);

helexa.ai/tsconfig.app.json

@@ -0,0 +1,28 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.app.tsbuildinfo",
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "types": ["vite/client"],
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["src"]
+}

helexa.ai/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "files": [],
+  "references": [
+    { "path": "./tsconfig.app.json" },
+    { "path": "./tsconfig.node.json" }
+  ]
+}

helexa.ai/tsconfig.node.json

@@ -0,0 +1,26 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+    "target": "ES2023",
+    "lib": ["ES2023"],
+    "module": "ESNext",
+    "types": ["node"],
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedSideEffectImports": true
+  },
+  "include": ["vite.config.ts"]
+}

helexa.ai/vite.config.ts

@@ -0,0 +1,29 @@
+import { defineConfig, loadEnv } from "vite";
+import react from "@vitejs/plugin-react-swc";
+
+// During `vite dev`, proxy the mesh data-plane (helexa-router, OpenAI-
+// compatible) and the account control-plane (helexa-upstream) so the SPA
+// talks to them same-origin without CORS. Targets are overridable via env.
+//   VITE_ROUTER_BASE_URL  — helexa-router (default http://localhost:8088)
+//   VITE_ACCOUNT_BASE_URL — helexa-upstream (default http://localhost:8090)
+export default defineConfig(({ mode }) => {
+  const env = loadEnv(mode, process.cwd(), "VITE_");
+  const router = env.VITE_ROUTER_BASE_URL || "http://localhost:8088";
+  const account = env.VITE_ACCOUNT_BASE_URL || "http://localhost:8090";
+  return {
+    plugins: [react()],
+    server: {
+      proxy: {
+        "/v1": { target: router, changeOrigin: true },
+        "/health": { target: router, changeOrigin: true },
+        // The frontend calls /api/*; helexa-upstream serves /web/v1/*.
+        "/api": {
+          target: account,
+          changeOrigin: true,
+          rewrite: (p) => p.replace(/^\/api/, "/web/v1"),
+        },
+      },
+    },
+    build: { outDir: "dist" },
+  };
+});