Product — TaskQ

The control-plane loop

The same discipline on every request.

The Gateway owns auth, balance, policy, placement, lease, proof, usage, settlement, and customer-facing response headers.

01Authenticate

Customer bearer + entitlement.

02Resolve policy

Defaults + request constraints merge without loosening.

03Select worker

Cheapest compliant capacity.

04Open proof

HashIQ entry begins.

05Execute

Relay or queue plane.

06Close proof

Usage, hashes, status.

07Settle

Journal maps to chain.

gateway — request lifecyclepublic edge

receive → authenticate → balance_gate
resolve_policy → resolve_byok_handle
query_registry → solve_placement
acquire_lease → open_hashiq_entry
route_to_plane → capture_usage
close_chain → write_settlement
return x-taskq-chain-key

Two planes

Chat and agentic work have different physics.

Relay keeps synchronous API shape. Queue handles long-running execution and artifacts. They share auth, policy, proof, billing, and settlement.

RELAY — Synchronous API

Chat, completions, model listing, token counting, and streaming SSE. Defaults to pinned, enclave, or customer-owned custody.

QUEUE — Agentic jobs

Long-running work: reports, patches, code edits, files, artifacts, and checkpointed deliverables.

SHARED — One proof surface

Both planes emit HashIQ evidence, placement decisions, usage records, and settlement references.

Placement engine

Policy-bound routing is not load balancing.

TaskQ solves over jurisdiction, custody, attestation, certification, health, capacity, price, and deterministic tie-breakers. Hard constraints never relax.

Constraint	Decision	Result
Must run in Canada	must_run_in: CA	Workers outside Canada are excluded before price is considered.
No US execution	must_not_run_in: US	A cheaper US worker cannot silently win.
Audited custody	key_custody: pinned\|enclave	Plain leased workers are rejected for sync credential unwrap.
Cost ceiling	max_price	If no eligible worker fits, the system refuses with proof.

BYOK custody

The customer owns the upstream relationship.

Fingerprints, not keys. Credential values never belong in logs, chain entries, crash dumps, or UI.
Key domains. Credentials can be scoped to Canada, EU, customer-owned HSM, or future enclave domains.
Every unwrap logged. Credential access becomes a visible proof event attached to the request.

credential.access — customer-visible

hashiq — minimum entry · request.closed

HashIQ

The receipt is the customer-facing surface of the chain.

Binds everything: request hashes, response hashes, policy hashes, placement proofs, credential fingerprints, worker references, usage, settlement, and external anchors into signed evidence.
BYOW operators: capacity enters with signed identity, jurisdictional attributes, pricing, health, capability, and attestation tiers — self, evidence, audited, TEE.
Compliance plane: enforces hard policy, monitors access, produces audit reports, exports chain segments with verifier material.

Settlement ledger

Every dollar movement maps back to the proof trail.

TaskQ’s commercial model is control, placement, proof, retention, reporting, and capacity settlement. The upstream provider spend remains customer-owned through BYOK.

settlement — journal · chain-linked

{
  "chain_seq": 184467,
  "request_id": "req_...",
  "operator_id": "op_worlds_energy",
  "lines": [
    {"account":"customer_balance", "direction":"debit"},
    {"account":"taskq_platform_revenue", "direction":"credit"},
    {"account":"operator_payable", "direction":"credit"}
  ]
}

One Gateway. Two execution planes. Every request proven.