Anchorage is a pair of open-source packages for Mastra applications on Cloudflare:
- breakwater enforces policy at agent and connector boundaries.
- flowsafe runs workflows and agents durably, turns suspensions into human approvals, and verifies physically isolated deployment state.
Start with the task you need to complete. The generated API reference is useful after you understand the lifecycle and trust boundaries.
| Goal | Read |
|---|---|
| Decide whether Anchorage fits your system | Product boundaries |
| Install the packages and reach a first gated run | Getting started |
| Choose the correct package or export | API reference map |
| See the system running | Live demo |
| Topic | What it covers |
|---|---|
| Breakwater architecture | Processor, tool-boundary, audit, and tenancy responsibilities |
| Policy engine | Input/output channels, streaming behavior, content inspection, and tool policies |
| Connector interface | Permission manifests, grant enforcement, egress, idempotency, dry-run, rate limits, and stores |
| Connector authoring guide | A complete connector implementation and test expectations |
| Agent CLI connectors | Claude Code and Codex as approval-gated workspace editors |
| Topic | What it covers |
|---|---|
| Approval system | Queue lifecycle, REST API, separation of duties, grant derivation, live UI, and failure recovery |
| Flowsafe architecture | Components, deployment boundaries, storage, and host composition |
| Durable Object runner | Run identity, D1 snapshots, restart behavior, concurrency, retention, and decommissioning |
| Durable agents | Threads, memory, signals, goals, schedules, background tasks, providers, and restart resume |
| Agent memory isolation | Opaque thread ids, validated resource keys, deployment verification, recall isolation, and TTL |
| Topic | What it covers |
|---|---|
| Deployment reference | Baseline and advanced host choices, bindings, secrets, routes, and alarm-driven duties |
| Operations runbook | Local validation, production checks, retention, decommissioning, and incident response |
| Security threat model | Assets, trust boundaries, controls, residual risks, and deployment obligations |
| Observability and quality | Audit, metrics, notifications, SIEM export, and repository gates |
- Generated API reference
- API reference map
- breakwater package README
- flowsafe package README
- Baseline Worker template
- Advanced agent starter
- Runnable workflow examples
- Showcase application
Documents under proposals/ are design records with an explicit status. Shipped behavior is documented in the guides above and in exported types.