qodiqa
SpecificationRun a simulation

Product · Gateway

qodiqa Gateway

A self-hosted gateway that checks signed consent before any AI provider is called, and returns evidence anyone can verify.

  • 7 stages
Run a simulationView on GitHub

Every request passes the same gate.

  1. Applications and agents send a signed request to the gateway.
  2. Seven stages decide in order: ingress, request validation, identity and proof, consent and policy, execution, output and evidence, delivery and verification.
  3. Only after execution does the provider router call an AI provider. A blocked request never reaches it.
  4. The decision is recorded in the audit chain, the transparency log and a signed receipt, and an independent verifier checks it offline.

What is signed, and by which key.

  1. A signed artifact lives at most 60 seconds, works once and is bound to the method, path and body.
  2. An execution check and an INTENT entry come before the provider call.
  3. The audit chain, a Merkle leaf and a signed checkpoint record the decision, under three separate Ed25519 trust domains.
  4. A receipt names one entry and one leaf, and an offline verifier checks it.

Build it, run it, decide on it.

Start the sandbox in three commands, check the facts, then see how it deploys and what it means for your team.

Quickstart

Terminal
git clone https://github.com/qodiqa/qodiqa-gateway.git && cd qodiqa-gateway
docker compose -f docker-compose.quickstart.yml up

ExpectedThe gateway listens on http://127.0.0.1:3000; /health answers {"status":"ok", ...}.

Terminal
docker compose -f docker-compose.quickstart.yml logs | grep "Authorization: Bearer"

ExpectedOne log line with Authorization: Bearer <key>. Keep the key for the next step.

Terminal
SK=<the key from the log>
ARTIFACT=$(curl -s -X POST localhost:3000/sign -H "Authorization: Bearer $SK" -H 'content-type: application/json' \
  -d '{"request":{"method":"POST","path":"/ai/chat","body":{"prompt":"hello"}},"payload":{"userId":"me"},"ttl":60000}' \
  | jq -c '.artifact // .' | base64 | tr -d '\n')
curl -s -X POST localhost:3000/ai/chat -H 'content-type: application/json' -H "x-qodiqa-artifact: $ARTIFACT" -d '{"prompt":"hello"}'
# {"decision":"EXECUTE","response":"[sandbox] hello", ...}

Expected{"decision":"EXECUTE","response":"[sandbox] hello", ...}

The sandbox uses a built-in stand-in for the AI model, so no provider account is needed. It is for evaluation, not for deployment. Full quickstartUse the prompt sandbox-block-me please in both places to see a BLOCK.

DocumentationGitHubSpecificationAPIScope and limits