Runtimes

Overview

A runtime is a single isolated execution of the Tachyonic scanner against your target. It carries an explicit target, policy, budget envelope, evidence capture, and audit trail.

You can operate runtimes from the dashboard at platform.tachyonic.co/runtimes or from the CLI under tachyonic runtime .... Both surfaces drive the same platform API.

Plans and limits

Runtime limits are enforced before infrastructure is created. If a request exceeds the plan, the API returns HTTP 402 with upgrade_required: true. Signed evidence downloads and reviewer links remain available only inside the plan's evidence retention window. After that window closes, artifact and share-link endpoints return HTTP 410.

Check the limits for your workspace:

curl -sS \
  -H "x-api-key: $TACHYONIC_PLATFORM_KEY" \
  https://api.tachyonic.sh/api/v1/entitlements | jq .

Free users should omit --region; the platform selects the default signed runtime pool. Paid regional runtimes are available through the API and dashboard. Verify each evidence bundle with tachyonic verify before relying on it in a review package.

Regions

Every runtime is pinned to one runtime pool at start.

• Free: default runtime pool only.
• Paid: default runtime pool plus aws-us-east-1 and aws-eu-west-1.

When you need a paid region from the CLI, pass --region:

tachyonic runtime start --target https://api.example.com --region aws-us-east-1

Budgets

Each runtime carries a budget that caps spend before it runs.

The platform applies the lower of your requested value and your plan limit. The runtime stops issuing inference requests when a hard cap is reached.

Approvals

Free and Pro plans require approval gates for:

• destructive_action
• credentialed_action
• exploit_attempt
• out_of_scope_access

Tools matching the runtime policy pause execution and create a pending approval. Approve or deny from the dashboard or with tachyonic runtime approve.

Team and Enterprise can run without required approval gates, but explicit policy gates still apply when present.

Egress controls

Every runtime pod runs alongside an egress-gateway sidecar that proxies outbound HTTP/HTTPS. A deny-default allowlist permits:

1. The platform callback endpoint.
2. The platform metered inference endpoint.
3. Hosts listed in policy.network.allowlist.
4. The host of your scan target.

Direct outbound is dropped at the cluster layer.

Lifecycle

Manifest

Reproducible runs use a runtime manifest:

objective: Pentest the MCP server for tool poisoning
target: https://mcp.example.com
region: aws-us-east-1
model: <alias>
policy: passive-only
budget:
  max_runtime_minutes: 30
  max_spend_usd: 5

Unknown keys are rejected. objective is the only required field. Free users should omit region unless the value is supplied by the entitlement API.

From the dashboard

1. Sign in at platform.tachyonic.co.
2. Go to Runtimes > New Runtime.
3. Choose the target endpoint, runtime pool, model, and budget.
4. Click Start Runtime for a live runtime or Create Plan for a dry run.

The runtime detail page shows state transitions, events, artifacts, findings, and the approval inbox.

From the CLI

Authenticate the same way as cloud scans:

tachyonic login

For CI or a headless shell:

tachyonic login --platform-api-key "$TACHYONIC_PLATFORM_KEY"

All commands accept --api-url or TACHYONIC_API_URL for non-default platforms.

Plan

Validate the manifest and render the runtime bundle without spending budget.

tachyonic runtime plan runtime.yml

Returns the runtime ID and status: planned.

Start

Two forms are supported.

Manifest:

tachyonic runtime start runtime.yml

Shorthand:

tachyonic runtime start --target https://api.example.com

Returns the runtime ID and status: queued.

Status

tachyonic runtime status <runtime_id>

Watch

Follow a runtime until it reaches a terminal state. Exits 0 on completed; exits non-zero on failure or cancellation.

tachyonic runtime watch <runtime_id>
tachyonic runtime watch <runtime_id> --timeout 1800 --interval 5

Events

tachyonic runtime events <runtime_id>
tachyonic runtime events <runtime_id> --follow
tachyonic runtime events <runtime_id> --limit 200

Logs

tachyonic runtime logs <runtime_id>
tachyonic runtime logs <runtime_id> --follow

Artifacts

List result artifacts with presigned URLs:

tachyonic runtime artifacts <runtime_id>

Output is a table of type, filename, bytes, and url. Fetch any URL directly with curl.

Signed evidence usually includes:

• finding_bundle_v1: the runtime result bundle.
• evidence_manifest_v1: the Ed25519 evidence manifest.

Download both and run:

tachyonic verify ./tachyonic-evidence/<runtime_id>

See Verifying Evidence.

Approve

Approve or deny a gated action surfaced by runtime status or runtime events.

tachyonic runtime approve <approval_id>
tachyonic runtime approve <approval_id> --deny
tachyonic runtime approve <approval_id> --deny --note "out of agreed scope"

Cancel

tachyonic runtime cancel <runtime_id>

Cancel is idempotent.

Share evidence

Create a reviewer link after a completed runtime:

curl -sS -X POST \
  -H "x-api-key: $TACHYONIC_PLATFORM_KEY" \
  -H "content-type: application/json" \
  -d '{"expires_in_hours":72}' \
  "https://api.tachyonic.sh/api/v1/runtimes/<runtime_id>/share" | jq .

See Share Evidence.

When things go wrong

Next steps

• Quickstart: first runtime and evidence verification.
• Share Evidence: reviewer links.
• Platform Guide: dashboard workflows.
• API Reference: call the same surface from your own tooling.
• Configuration: manifest fields in depth.