Cloud Resolver Data Plane

The Cloud Resolver is the high-throughput Go data plane daemon powering AgentSecrets Cloud.

It acts as a secure intermediary for outbound HTTP/HTTPS requests from AI agents and backend microservices, substituting placeholder handles with real decrypted credentials directly on the wire inside isolated, non-swappable volatile RAM.

---

Data Plane Architecture

                                    CLOUD RESOLVER INTERNAL ARCHITECTURE
                                              ┌──────────────┐
                                              │  Client SDK  │
                                              └──────┬───────┘
                                                     │ HTTPS Request with AS_SECRET_KEY
                                                     ▼
                                      ┌──────────────────────────────┐
                                      │   Cloud Resolver (:8765)     │
                                      │   or POST /v1/resolve        │
                                      └──────────────┬───────────────┘
                                                     │
               ┌─────────────────────────────────────┼─────────────────────────────────────┐
               ▼                                     ▼                                     ▼
      [ In-Memory State ]                  [ Allowlist Radix Trie ]              [ Volatile Key Store ]
      - O(1) SHA-256 Token Map             - Sub-microsecond match               - memguard.LockedBuffer
      - Capability Gate                    - Wildcard domain filter              - Zero swap to disk
               │                                     │                                     │
               └─────────────────────────────────────┼─────────────────────────────────────┘
                                                     │
                                                     ▼
                                     ┌───────────────────────────────┐
                                     │    Outbound Wire Injection    │
                                     │    (Substitutes Real Token)   │
                                     └───────────────┬───────────────┘
                                                     │ TLS 1.3 Outbound Call
                                                     ▼
                                      Target API (api.stripe.com)
                                                     │
                                                     ▼
                                     ┌───────────────────────────────┐
                                     │  Streaming Response Redactor  │
                                     │  (Scans & Scrubs Echoed Keys) │
                                     └───────────────┬───────────────┘
                                                     │
                                                     ▼
                                     ┌───────────────────────────────┐
                                     │   Lock-Free Audit Buffer      │
                                     │   (Asynchronous Batch Queue)  │
                                     └───────────────┬───────────────┘
                                                     │
                                                     ▼
                                      Sanitized Response to Calling Process

---

Technical Specifications & Security Properties

1Volatile Memory Safety ()

All decrypted workspace Data Encryption Keys (DEKs) and resolved credential buffers are stored exclusively in volatile memory allocated via memguard and protected by mlock(2) system calls:

• Zero Disk Swapping: Operating system page swapping to disk is strictly disabled for secret buffers.
• Process Memory Scrubbing: Sensitive byte slices are zeroed out immediately after request serialization.
• Signal Handling: Process termination signals (SIGINT, SIGTERM) trigger memguard.Purge(), destroying all in-memory keys instantly.

2High-Throughput / Low-Latency Engine

• Processing Overhead: Introduces less than 0.5 ms processing latency to outbound HTTP calls.
• Throughput Capacity: Benchmarked to process over 5,000 requests per second per resolver core.
• Zero-Allocation Pools: Utilizes sync.Pool for byte buffers and streaming readers to eliminate garbage collection pauses on the hot execution path.

3Multi-Pattern Streaming Redaction

If an upstream API returns an error containing an echoed credential (e.g. 401 Unauthorized: Invalid API key sk_live_...), the streaming redaction scanner intercepts the response body and masks all occurrences with [REDACTED]:

---

Invocation Interfaces

The Cloud Resolver exposes two standard transport interfaces:

Interface 1: Forward HTTPS Proxy (:8765)

Standard HTTP CONNECT tunneling and transparent proxy routing for tools and SDKs that support HTTP_PROXY:

export HTTP_PROXY="https://resolver.agentsecrets-website.vercel.app:8765"

Interface 2: Direct Enveloping REST API (POST /v1/resolve)

For serverless runtimes (AWS Lambda, Cloudflare Workers) and AI agent tool calling definitions where running a proxy daemon is impractical, send structured JSON payloads to POST /v1/resolve.

---

Health & Diagnostic Probes

The Cloud Resolver exposes a standardized health probe on /healthz:

curl -i https://resolver.agentsecrets-website.vercel.app/healthz

Response (200 OK):

{
  "status": "healthy",
  "service": "agentsecrets-cloud-resolver",
  "timestamp": "2026-08-23T00:00:00Z"
}