A deterministic contract layer
around your APIs.

Each component runs in its own process, with explicit interfaces between them. You can self-host the whole stack, run the cloud-managed control plane against your own proxy, or operate the proxy alone behind your existing infrastructure.

The proxy's behavior is governed by a single mode at any time, settable per-service or globally. Modes are explicit: there is no ambiguity about whether a request will reach upstream, return a recording, or fall through to the inference cascade.

When the proxy is in MOCK mode, every request runs through the cascade in this order. The cascade short-circuits at the first stage that produces a match. The earliest stages — exact, session-verbatim, statechart, smart-swap — are deterministic and require zero inference. The LLM is reached only when nothing else applies, and only on Pro and Team; Free tier stops at smart-swap.

1. 1

   Exact match

   The recorded library is keyed on (method, normalized URI). An exact hit returns the recorded response verbatim — same body, same headers, same status. No model. No randomness.

2. 2

   Session-verbatim replay

   During an active session the proxy keeps an in-memory, byte-exact copy of everything it just saw — bodies and headers, including Set-Cookie and CSRF tokens. A request that matches that live capture replays it byte-for-byte (header X-Ghost-Mock: session-verbatim), so a stateful flow stays coherent inside the session. This buffer is RAM-only: it never touches disk and is gone on restart or the next LEARN window.

3. 3

   Statechart / resource transition

   Linked Mocks. A POST to a resource route creates the resource; a subsequent PATCH/POST advances a Harel statechart that rewrites the status field (header X-Ghost-Transition). This is what makes POST /charges → GET /charges/{id} return the created resource instead of a 404, and keeps Stripe-shaped charge/subscription/order lifecycles coherent across calls.

4. 4

   Smart swap

   When the URI structurally matches a recorded route but with different parameter values, the proxy substitutes the variable segments deterministically. Free-tier opt-in; on by default for Pro and Team. Free tier stops here — the AI stages below do not fire.

5. 5

   Inference fallback

   When the cascade reaches a recorded route with insufficient examples, the inference server proposes a response grounded by the recordings for that route. Confidence threshold applies — low-confidence outputs fall through. Pro and Team tiers.

6. 6

   Generative synthesis

   For routes with no recorded match, the inference server synthesizes a response from the contract — the response schema inferred from neighboring traffic, the convention extracted from the rest of the service. Pro and Team tiers; last resort.

7. 7

   Unmatched response

   The cascade exhausted. The proxy returns a configurable default — by default a 404 with a JSON body that names the missing route. The unmatched call is logged for the dashboard so the operator can decide whether to record it or accept the gap.

Every licensed feature is checked at three independent points: the proxy (when JWT claims are parsed at startup), the control plane (on every API request), and the dashboard (when the UI renders). All three must agree for a feature to operate. A bug in any one layer cannot silently grant access through the other two.

The proxy writes captures to append-only JSONL on a shared volume. The control plane reads from JSONL and reconciles into Postgres with explicit upsert semantics. Postgres is the canonical state; JSONL is the format the proxy can write to disk without taking a database connection on the request hot path. Once a mock is scrubbed, the scrubbed timestamp is a one-way seal — the sync layer refuses to overwrite a scrubbed row with an unscrubbed one.

The agent caches its validated license features for five minutes on the happy path. When the platform is unreachable — regional AWS outage, network partition, scheduled maintenance — the cache stays valid for a four-hour grace window. During that window the agent continues to serve the customer's licensed tier with a structured warning emitted on every served request. After the window closes, degradation is explicit: the agent falls back to free-tier features with a logged event, never a silent downgrade.

The control plane's drift detector, fidelity recompute loop, and optional repair-proposer loop all absorb transient errors and resume on the next tick. A blip in any single subsystem does not cascade into the request path the proxy serves.