DEFAULT
Deny on uncertainty
Absent or stale authorization, consent, inventory approval, or ledger state resolves to deny and no-bid.
Platform· v1.0 target architecture
Six planes.
One authority model.
AdBid is organized as independently operable planes so that a bidding edge, a control plane, and an agent interface can evolve without forking policy. Writes always land in canonical services.
01 / TOPOLOGY
Nothing bypasses the governance plane.
The governance plane spans the others. Identity, consent, financial authority, evidence, and emergency stops are enforced at every boundary, including the edge.
| Plane | Owns | Representative components |
|---|---|---|
| Presentation | Marketing, auth, cockpit, billing, docs, PWA | HTML/HTMX cockpit; account and billing pages; documentation |
| API & agent | REST/OpenAPI, GraphQL, MCP, A2A, WebMCP, CLI/SDK, webhooks | 95 REST operations; 53-tool MCP catalog; scoped browser tools |
| Orchestration | Jobs, approvals, policies, model evaluation, deployment plans | Durable tasks, review gates, staged snapshot promotion |
| Execution | RTB edge, ad serving, adapters, privacy filters, budget enforcement | Rust bidder; OpenRTB router; channel adapters |
| Data | Transactional store, event log, analytics, search, object store | Append-only events; tenant-scoped analytics; provenance |
| Governance | Identity, access, consent, warrants, evidence, stops | Policy engine; Ed25519 warrants; receipts; audit ledger |
02 / THE EDGE
The bidder consumes signed state, not live configuration.
Edge nodes receive immutable BidderSnapshot bundles: campaigns, ceilings, audience indexes, permitted supply, creative IDs, approved strategies, brand policy, pricing limits, warrant bindings, freshness thresholds, and model hashes. Publication is staged and acknowledged.
A snapshot is promoted atomically. Rollback switches the active snapshot while preserving financial liabilities and monotonic counters — and no rollback can reverse settled spend.
The control plane keeps durable desired state and reconciles it with observed state on every target. A queued job is not a deployed change.
Snapshot fields (excerpt)
jsonbidder-snapshot.json
{
"snapshot_id": "snap_01JEX",
"tenant_id": "tnt_acme",
"campaigns": [ "camp_88f1" ],
"warrant_bindings": [ "w_7f3a" ],
"max_cpm_micros": 2400,
"freshness_floor_s": 30,
"model_hash": "sha256:…"
}03 / ISOLATION
Tenant scope is enforced everywhere.
Domain objects are tenant-scoped at the database, application, search, cache, analytics, event, and export boundary. An administrator is not an unrestricted bypass.
TRACE
Every request carries context
Principal, tenant, actor type, trace ID, policy version, and optional delegation chain travel with the call.
RECONCILE
Desired vs observed
Requested change, planned diff, approval, attempt, provider response, observed state, and receipt are stored separately.
Read the architecture in the spec.
Chapters 03–05 cover topology, stack, and the RTB contract. The public docs summarize the interfaces.