One layer under your agents. Nothing new to run.
Surfil is an on-device runtime plus a stateless edge - it slots beneath the agents your developers already use without a gateway to rack, a proxy to scale, or a byte of source leaving the machine. Here is exactly how it fits your stack.
Where the work runs, and what each plane sees
The device does the heavy work; the edge is stateless; the data planes hold metadata and ciphertext. The plane that sees your code never talks to the internet about it.
Device · Rust runtime
Runs the adapters, interceptor, staged pipeline and Weave engine on the developer's machine, with a local buffer.
Sees everything - on your machine. Nothing about your source ever leaves it.
Edge · Cloudflare Workers
Handles auth, entitlement, ingest, metering and signing, statelessly, scaling on demand with no state to shard.
Sees signed metadata batches over mTLS - event names, hashes, counts, never your source.
Data · D1 · Postgres · R2
Holds entitlement, devices, the audit chain and credits (D1); identity and ciphertext memory (Postgres); evidence and releases (R2).
Tenant-isolated by RLS; memory is stored as ciphertext, so the store never holds readable source.
It slots into the stack you already run
On-device runtime
The heavy work runs in a Rust runtime on each developer's machine. There is no gateway to rack and no appliance to operate.
Stateless edge
Cloudflare Workers do auth, metering and signing statelessly, so they scale on demand and per-user cost stays flat.
Your identity
SSO and OIDC, Ed25519 device tokens and least-privilege RBAC wire into the directory your org already runs.
Your data boundaries
Source stays on the device, telemetry is metadata, memory syncs as ciphertext, and tenants are RLS-isolated.
The operational load you never take on
Most of the cost of a control plane is running it. Surfil moves that weight to the device and a managed edge.
No appliance to rack
Nothing to install in your DC or VPC - the runtime lives on developer devices and the edge is fully managed.
No gateway to scale
There is no central proxy in the request path to size, shard, or get paged about at three in the morning.
No second proxy
Surfil is the one interception layer; it never chains another proxy in front of the agents you already run.
No data egress
Your source code never leaves the machine to make any of this work - zero-trace holds by construction.
The rules the architecture enforces
These do not bend per customer or per plan; each would take a rebuild to break, which is the point.
One-Layer rule
Every product is a stage on one interception point, so adding a capability never adds a hop or a failure surface.
Byte-exact passthrough
The provider prefix hash is preserved exactly and asserted in CI, so your prefix caches keep on working.
Zero-trace
Source never leaves the device; dashboards and telemetry are built from metadata - event names, hashes, timestamps.
Fail-closed
On any security path an ambiguous action is blocked by default, not allowed by default - safety is the fallback.
Signed outputs
Every paid output is Ed25519-signed and verifiable offline - the anti-bypass root of the whole metering model.
Flat cost curve
Because devices do the work and the edge is stateless, per-user cost does not bend upward as the fleet grows.
Bring your architecture questions
Read the security posture, then book a review. On-device runtime, stateless edge, signed outputs - all verifiable, none of it requiring your source to move.