Pulse Gateway

The gateway speaks both wire protocols the AI world uses — OpenAI'schat/completions and Anthropic'smessages. Point any existing client at it: PII is masked before egress, the right model is chosen per call, and a signed, chained, offline-verifiable certificate is issued for every completion.

import Anthropic from '@anthropic-ai/sdk'

// Same gateway, Anthropic dialect — /v1/messages.
const client = new Anthropic({
  baseURL: 'https://api.pulse-labs.fr',       // no /v1 — the SDK adds it
  apiKey: process.env.PULSE_API_KEY,          // sk_live_... developer key
})

const { data, response } = await client.messages
  .create({
    model: 'pulse-auto',
    max_tokens: 1024,
    messages: [{ role: 'user', content: 'Summarise this contract clause…' }],
  })
  .withResponse()

data.content                            // Anthropic content blocks
response.headers.get('x-pulse-proof')   // same proof registry as the OpenAI dialect

// Same SDK, same one changed line — the model name selects the capability.

// Served by YOUR agent: its system prompt, memory, documents and tools.
await client.chat.completions.create({
  model: 'agent:demo-cfo',
  messages: [{ role: 'user', content: 'What is our runway looking like?' }],
})

// Grounded in the workspace knowledge base — the retrieved passages are
// hashed into the certificate (level-2 proof: "based on these exact sources").
await client.chat.completions.create({
  model: 'pulse-auto+cortex',
  messages: [{ role: 'user', content: 'Summarise our onboarding checklist.' }],
})

// Flags compose. The legal agent, forced local — nothing leaves the machine.
await client.chat.completions.create({
  model: 'agent:legal+sensitive',
  messages: [{ role: 'user', content: 'Review this clause…' }],
})

{
  "payload": {
    "v": 1,
    "id": "pf_a059713a…",
    "issuer": "pulse-gateway",
    "issuedAt": "2026-07-28T13:14:02.481Z",
    "chainIndex": 12,                   // append-only position
    "prevHash": "90a8ecd956…",          // hash of certificate #11 — deletion leaves a hole
    "request":  { "model": "agent:demo-cfo", "sha256": "b2205bba…" },
    "address":  { "kind": "agent", "agent": "demo-cfo" },   // which capability served the call
    "grounding": [                      // level-2 proof — present for agent: / +cortex calls
      { "source": "script-etat-des-lieux.md", "chunkId": "ck_…",
        "page": null, "sha256": "11d10642e4bb…" }
    ],
    "egress":   {                       // what actually left toward the provider
      "provider": "ollama", "model": "llama3.1:8b",
      "sha256": "876be067…",
      "pii": { "masked": 2, "categories": ["EMAIL", "NAME"] }
    },
    "response": { "sha256": "ae792e49…", "finishReason": "stop",
                  "usage": { "promptTokens": 53, "completionTokens": 38, "totalTokens": 91 } },
    "routing":  { "taskType": "agent",
                  "reason": "agent:demo-cfo → persona pipeline (memory, knowledge, tools)" }
  },
  "payload_hash": "sha256(canonical-json(payload))",
  "signature": "base64 Ed25519 over payload_hash",
  "algorithm": "Ed25519"
}

// Offline verification — no API key, no network trust required.
// Inputs: the certificate JSON + the gateway's public key (GET /v1/gateway/public-key).

import crypto from 'node:crypto'

function canonicalJson(v) {
  if (v === null || typeof v !== 'object') return JSON.stringify(v)
  if (Array.isArray(v)) return `[${v.map(canonicalJson).join(',')}]`
  const e = Object.entries(v).filter(([, x]) => x !== undefined).sort(([a], [b]) => (a < b ? -1 : 1))
  return `{${e.map(([k, x]) => `${JSON.stringify(k)}:${canonicalJson(x)}`).join(',')}}`
}

const recomputed = crypto.createHash('sha256').update(canonicalJson(cert.payload), 'utf8').digest('hex')
const authentic =
  recomputed === cert.payload_hash &&
  crypto.verify(null, Buffer.from(cert.payload_hash, 'utf8'),
    crypto.createPublicKey(publicKeyPem), Buffer.from(cert.signature, 'base64'))