Agent black-start and islanding

When your model provider, orchestrator, or auth service fails completely, your fleet does not have to thrash with it. This product holds restoration as a pre-committed, fleet-level object: a signed island declaration switches every agent at once to a pre-registered island manifest — minimal whitelisted tools, no irreversible effects, fleet and per-agent token caps, load-shedding tiers as island capacity shrinks — instead of forty agents retrying a dead upstream in no order. On recovery, a pre-registered cranking path re-boots the fleet in dependency order (black-start agents first, then tool services, then workers), each step gated on health, a canary task, and effect reconciliation before the next step energises. Islands do not silently rejoin: island-period effects are reconciled at a re-synchronisation gate — clean effects merge, duplicates are suppressed, conflicts route to a rewind list — and full authority returns only after resync plus acknowledgement. Proven in the lab: 35/35 tests; in a seeded 20-tick outage the uncoordinated control burned 21,600 retry tokens with 3 duplicate effects and 2 cascades, the managed island burned 500 capped tokens with 0 duplicates and 0 cascades.

Prices

• Solo $19/mo per operator — 1 fleet, island manifest + cranking path, island token allowance capped in the manifest; first island drill (simulated outage + crank) free, one time per operator.
• Fleet $39/mo per operator — up to 5 fleets, multi-island re-synchronisation reports.
• Per-declaration API $0.005/check (x402, Base USDC) — one island-state / crank-position query.

Start

POST /register {"operator": "your-name"} → per-customer token + per-operator declaration signing key (each shown once). POST /trial claims the one-time free first island drill. POST /rpc speaks the 13-method JSON-RPC surface (register_fleet, make_declaration, declare_island, agent_state, island_act, charge_tokens, upstream_apply, begin_recovery, crank_energise, crank_status, resync, acknowledge_divergences, ping) with your Bearer token; declarations are signed with your declaration key and bound to the manifest hash, with expiry + nonce replay protection. POST /check {"fleet": "...", "agent": "..."} is the $0.005 island-state / crank-position check (plan/trial included, else x402). POST /subscribe {"plan": "solo"|"fleet"} with a verified x402 payment starts a plan. GET /rewind and POST /rewind/acknowledge are the product's own rewind route. POST /reports/resync returns the Fleet-tier multi-island report. MCP JSON-RPC at POST /mcp (tools: island_state_check, crank_position, resync_report). Machine docs: /openapi.json, /llms.txt, /.well-known/x402, terms at /terms, privacy at /privacy. Framework adapters (LangGraph / CrewAI / AutoGen) ship in the product tree under src/adapters/ — honest thin adapters over this API.

Limits (stated plainly)

• Runtime binding (blueprint 17): island enforcement binds to your runtime via the shipped framework adapters (LangGraph / CrewAI / AutoGen, in the product tree) plus this server-side gate — an agent that never consults the service or an adapter is outside the gate.
• Capped shape only (blueprint 19): an uncapped island is not offered. Island burn in the lab was token-accounted against a simulated workload; no real fallback-model inference ran, and no real fallback-model burn measurement has landed — worst-case burn is the manifest cap, a manifest choice, not an outage-duration variable.
• Rewind route (blueprint 20): routed key conflicts land on this product's own rewind list endpoint (record + operator acknowledgement). The CARD-034 effect-rewind registry (P35) is a separate live product; it is not silently substituted here.
• FTO (blueprint 23): FTO screen LEGAL-148 is on file, verdict AMBER (keep-clear conditions documented in the memo).
• This is a grid-restoration transplant; demand is UNMEASURED. Lab damage split (seeded 20-tick outage, 9 agents): uncoordinated control 21,600 retry tokens + 3 duplicates + 2 cascades vs managed island 500 capped tokens, 0 duplicates, 0 cascades — a seeded measurement, not a field result.
• The product does not provide the fallback model itself, does not guarantee any upstream provider's recovery, and does not merge a key conflict automatically — conflicts route to the rewind list.
• Lost-token / lost-declaration-key recovery is a manual step via support@textforagents.com; keys and tokens can be rotated any time while authenticated (POST /rotate-token, POST /rotate-declaration-key).

Support: support@textforagents.com · Provider: TextForAgents LLC