One install. One interception point. One signed network.
This page walks the whole path - from the install command to the moment someone who doesn't trust us verifies your receipt offline. Nothing is hand-waved.
One install beside every agent
Core detects the agents you already run and consolidates their scattered configuration into a single point - without changing how you invoke anything. The output below is illustrative product UI.
A single point, byte-exact
Every agent request crosses exactly one on-device boundary. Passthrough is byte-exact - the provider sees the identical prefix bytes, so your prefix cache keeps working. That's asserted in CI, not assumed.
One device-side pipeline. Every product is a stage; every stage writes to the same spine.
Why one point matters
One interception layer means one place to reason about security, one cost ledger, one memory. The One-Layer rule is permanent: we will never chain a second proxy behind the first - not even to sell you something.
Why byte-exact matters
Providers cache your prompt prefix; break the bytes and you silently pay full price on every request. Surfil's passthrough preserves the provider prefix hash exactly, and CI fails if it ever doesn't.
Five stages, in order, every request
The stage order is deliberate: safety rules first, cost decisions second, and only then measurement, recording and memory.
security
Guard evaluates every tool-call and payload pre-flight: secret patterns, OWASP-scored injection, sandbox rules. Fail-closed - if policy can't be evaluated, the call doesn't run.
cost
Cap measures what each request really needed: prefix-cache alignment, redundant context, model fit. Savings are computed before/after on your own traffic, never assumed.
quality
Bench scores what came back - fixes-per-task, cost-per-fix - per repository, so 'which model is worth it here' becomes a measured answer.
observability
Radar records the session as metadata: what ran, what it cost, what was blocked. Enough to see and rewind - never enough to reconstruct your source.
memory
Mind writes settled facts to Weave with provenance and a code hash; Pilot reads them back with citations. The next session starts warm instead of from zero.
Everything lands in Weave
Weave is the signed knowledge network every stage writes to - plain, portable, and self-policing about staleness.
Signed Markdown
Facts are .md files with frontmatter: provenance, signature, code hash. Readable in any editor, verifiable by anyone.
Stale flags itself
Each fact pins the code it describes by hash. Code changes → hash mismatches → the fact auto-flags STALE. No confidently wrong memory.
Portable by design
surfil export packs the whole network into a .surfilpkg. Your knowledge leaves with you - receipts keep verifying after you're gone.
The output is a signature, not a dashboard
Execution is unmetered. When Surfil produces something of provable value - a savings receipt, a benchmark, an attestation - the edge signs it. That signed output is the metered unit, and the proof. Illustrative UI:
Heavy device, stateless edge
The split is the zero-trace guarantee and the pricing model at once: your machine does the sensitive work, the edge only signs and meters.
On your device
runtime · RustAdapters, the interceptor, all five pipeline stages, the Weave engine and the local buffer. Your source, prompts and diffs exist only here.
At the edge
workers · statelessStateless workers for auth, entitlement, ingest, metering and signing. They see signed batches of metadata - never code. Cost stays flat per user.
Walk the path on your own machine
Install, consolidate, run a normal week, verify the receipt. Every step above is reproducible - and reversible byte-for-byte if you change your mind.