Skip to content

achilliesbot/flow-core

Repository files navigation

FlowCoreAPI — Unified IAM Pre-Execution Gateway

"One call. Full stack. One proof."

Python License: MIT ACP Live

FlowCoreAPI is the unified IAM entry point for the full Achilles pre-execution stack. Instead of calling MemGuard, NoLeak, EP, and RiskOracle individually — four separate API calls, four separate responses, four separate proof hashes — an agent calls FlowCore once and gets back a single unified response with one proof hash covering the entire pre-execution flow.

Not EP. Not NoLeak. Not MemGuard. Not RiskOracle. Not SecureExecAPI. FlowCoreAPI is the gateway — the single call that runs the whole stack.


The Problem

Agents running the full pre-execution stack face a coordination problem:

Without FlowCore:               With FlowCore:

Agent calls MemGuard     ─┐     Agent calls FlowCore  ──► approved: true
Agent calls NoLeak        │                                unifiedProofHash: 0x...
Agent calls EP            ├──   4 API calls                latencyMs: 890
Agent calls RiskOracle   ─┘     4 proof hashes
                                4 error states to handle
                                ~$0.05 total
                                                           1 API call
                                                           1 proof hash
                                                           1 error state
                                                           $0.02 total

FlowCore cuts cost, complexity, and failure surface in half.


Architecture

              Agent Intent
                   │
                   ▼
    ┌──────────────────────────┐
    │       FlowCoreAPI         │
    │   POST /flow/check        │
    │                          │
    │   x402 / MPP gate        │ ← 402 if no payment credential
    │   ERC-7710 delegation    │ ← pre-approve for high-frequency
    └──────────────┬───────────┘
                   │
    ┌──────────────▼───────────┐
    │     Route Execution       │
    │  (default: all 4 steps)  │
    └──────────────┬───────────┘
                   │
     ┌─────────────┼─────────────┬─────────────┐
     ▼             ▼             ▼             ▼
 MemGuard       NoLeak          EP         RiskOracle
 /memguard/     /noleak/    /ep/validate   /risk/check
  check          check
     │             │             │             │
  stateValid  shouldExecute    valid       riskScore
  driftScore    score        proof_hash  recommendedAction
     │             │             │             │
     └─────────────┴─────────────┴─────────────┘
                   │
    ┌──────────────▼───────────┐
    │   Unified Proof Hash      │
    │   SHA-256 of all results  │
    └──────────────┬───────────┘
                   │
                   ▼
          approved: true/false
          blockedBy: null / "ep"
          unifiedProofHash: "0x..."

Fail-Open Guarantee

Every dependency call has a 3-second hard timeout. If any service is down or slow, FlowCore uses stub values and continues. The agent is never blocked by a dependency failure.

Dependency failure matrix:

MemGuard   DOWN → stateValid=true, driftScore=0.03 (safe stub, flow continues)
NoLeak     DOWN → shouldExecute=true, score=0.75  (safe stub, flow continues)
EP         DOWN → valid=true, proof_hash=null      (safe stub, flow continues)
RiskOracle DOWN → riskScore=0.15, action=proceed   (safe stub, flow continues)

API Reference

POST /flow/check

Full pre-execution flow. Requires payment for external agents.

Request

{
  "agentId": "your_agent_id",
  "intent": {
    "type": "trade",
    "action": {
      "type": "swap",
      "capital": 50,
      "asset": "ETH"
    }
  },
  "context": {
    "walletBalance": 500,
    "memoryState": { "price": 2000 }
  },
  "route": ["memguard", "noleak", "ep", "riskoracle"]
}
Field Type Required Description
agentId string No Your agent's unique ID
intent object Yes The intent being evaluated
intent.type string No Intent type for logging
context.walletBalance number No Available capital
context.memoryState object No Current agent state
route array No API subset to run. Default: all 4

Response (200 — approved)

{
  "flowId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "approved": true,
  "blockedBy": null,
  "results": {
    "memguard":   { "stateValid": true,  "driftScore": 0.03 },
    "noleak":     { "shouldExecute": true, "score": 0.82 },
    "ep":         { "valid": true, "proof_hash": "0x..." },
    "riskoracle": { "riskScore": 0.12, "recommendedAction": "proceed", "confidence": 0.91 }
  },
  "route": ["memguard", "noleak", "ep", "riskoracle"],
  "unifiedProofHash": "0xa3f9c2e1b84d...",
  "componentProofHashes": ["0x...", "0x..."],
  "paymentProtocol": "x402",
  "latencyMs": 890,
  "timestamp": "2026-03-23T00:00:00Z",
  "schemaVersion": "v1"
}

Response (200 — blocked)

{
  "flowId": "...",
  "approved": false,
  "blockedBy": "ep",
  "results": { "...": "..." },
  "unifiedProofHash": "0x...",
  "latencyMs": 312
}

Response (402 — payment required)

{
  "status": 402,
  "amount": "0.02",
  "currency": "USDC",
  "network": "base",
  "value": "Replaces 4 separate API calls with one unified call",
  "erc7710": "Pre-approve spend limit for high-frequency calls"
}

POST /flow/route

Call a custom subset of APIs. Cheaper — use when you don't need the full stack.

{
  "agentId": "your_agent",
  "intent": { "type": "publish", "action": {} },
  "route": ["ep"]
}

GET /health

{
  "status": "ok",
  "service": "flowcore",
  "version": "v1",
  "routes": ["memguard", "noleak", "ep", "riskoracle"]
}

Routing

Default route:    memguard → noleak → ep → riskoracle
Custom routes:    any subset in any order

Examples:
  ["ep"]                    — IAM check only ($0.01)
  ["ep", "riskoracle"]      — IAM + risk ($0.015)
  ["memguard", "noleak"]    — state + execution ($0.015)
  ["memguard", "noleak", "ep", "riskoracle"]  — full stack ($0.02)

Quickstart

git clone https://github.com/achilliesbot/flow-core.git
cd flow-core
pip install -r requirements.txt
python flowcore_server.py

Server starts on port 5092.

Test It

# Full flow (internal agent — no payment required)
curl -X POST http://localhost:5092/flow/check \
  -H "Content-Type: application/json" \
  -d '{
    "agentId": "achilles",
    "intent": {
      "type": "trade",
      "action": {"type": "swap", "capital": 50}
    },
    "context": {"walletBalance": 500}
  }'

# Custom route — EP only
curl -X POST http://localhost:5092/flow/route \
  -H "Content-Type: application/json" \
  -d '{
    "agentId": "achilles",
    "intent": {"type": "publish"},
    "route": ["ep"]
  }'

# Health
curl http://localhost:5092/health

Environment Variables

Variable Default Description
PORT 5092 Server port (Render sets automatically)
EP_GUARD_URL https://achillesalpha.onrender.com/ep/validate EP endpoint
NOLEAK_URL https://achillesalpha.onrender.com/noleak/check NoLeak endpoint
MEMGUARD_URL https://achillesalpha.onrender.com/memguard/check MemGuard endpoint
RISKORACLE_URL https://achillesalpha.onrender.com/risk/check RiskOracle endpoint
PAYMENT_WALLET USDC destination on Base
DATABASE_URL local postgres Postgres connection string

Pricing

Tier Price Route
EP only $0.01/call ["ep"]
Custom subset $0.01/call Any 1-2 step route
Full stack $0.02/call All 4 steps (default)
Batch $0.05+ Multi-intent flows

vs calling individually: MemGuard ($0.01) + NoLeak ($0.01) + EP ($0.01) + RiskOracle ($0.01) = $0.04. FlowCore full stack = $0.02. 50% cheaper. One call. One proof.


Postgres Schema

CREATE TABLE flowcore_calls (
  id SERIAL PRIMARY KEY,
  timestamp TIMESTAMPTZ DEFAULT NOW(),
  caller_agent_id TEXT,
  intent_type TEXT,
  approved BOOLEAN,
  blocked_by TEXT,
  route JSONB,
  unified_proof_hash TEXT,
  latency_ms INTEGER,
  payment_protocol TEXT,
  schema_version TEXT DEFAULT 'v1'
);

Live on Virtuals ACP

Field Value
Offering flow-core
Price $0.02/call (full stack)
Registry app.virtuals.io/acp

The Complete Olympus Stack

Product Question ACP Price
MemGuard Is my state valid? memguard-check $0.01
NoLeak Should I execute? noleak-check $0.01
EP AgentIAM Am I authorized? ep-guard $0.01
RiskOracle What is my risk? pre-risk-check $0.01
SecureExecAPI Execute safely? secure-exec $0.01
FlowCoreAPI All of the above? flow-core $0.02

Built by Achilles. Bootstrapped. Zero VC. All production.


License

MIT

About

Unified IAM pre-execution gateway. One call replaces MemGuard + NoLeak + EP + RiskOracle. x402/MPP payment gate, unified proof hash.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors