One product. Modular providers.

Request topology

Browser / SDK + user wallet
          │ session or product key + bounded authorization
          ▼
Go gateway ─── provider adapter ─── model API
    │                 │ output + usage
    ├── PostgreSQL: quotes, operations, usage, journals
    └── Settlement workers → x402 facilitator → Monad
               │
               └── verified receipt / reconciliation

Clear module boundaries

Identity, catalog, quotes, operations, usage, accounting, payment and reconciliation have separate responsibilities. Adapters implement provider formats and qualified capabilities behind ports. A new provider does not replace the wallet/payment core.

Durable accounting

Persist usage, outcome, immutable charge and unique settlement job atomically. Workers use leases and fencing. Provider and RPC network calls happen outside database transactions. Keep anti-replay proof and accounting journals beyond content retention.

No user deposits

The operator funds provider accounts. The user holds their own Monad tokens and authorizes a request maximum. Authorization does not reserve funds, so the operator must bound outstanding collection liability.

Implementation reference

The architecture, payment design, and protocol remain implementation specifications.