Sirloin

Sirloin

Responsibility

Sirloin is the main Go API. It serves gRPC and REST surfaces and owns billing, media user-facing state, credits, shop state, admin and audit state, autoscaling records, and MCP/Foxy360 runtime persistence.

Onboarding funnels

Sirloin owns onboarding funnel drafts, publications, archival and signup attribution. See Onboarding Funnels for the operator workflow and metric definitions.

Runtime

The service runs as a Go binary from apps/sirloin/cmd/app and is wired by docker-compose and apps/sirloin/railway.json.

Primary Source Paths

• apps/sirloin/cmd/app/
• apps/sirloin/internal/app/services/
• apps/sirloin/internal/app/worker/
• apps/sirloin/internal/pkg/models/

Contracts And Generated References

• Proto contracts: proto/sirloin/v5/
• Generated Go stubs: apps/sirloin/internal/pkg/pb/
• Generated proto docs: api/server.md
• Generated Brain client consumed by sirloin: apps/sirloin/pkg/brain-client/

Related Flows

• Billing
• Media Generation
• Authentication

Related Standards

• Billing Pricing
• Media Credit Costs
• Auth Boundaries

Related Decisions

Billing and payment ADRs live under docs/src/content/docs/decisions/.

Operations

Billing docs now live under decisions, standards, flows, and operations pages. Start with Billing Operational Runbook after the operations migration lands.

Media tagging preflight

The Strip button runs the engine in apps/sirloin/internal/app/services/mediapreflight/. It checks a private selection of 30 catalogue examples: 10 images, 15 videos and 5 five-image carousels. It reads SQL, uncached Brain points and served media objects, then uses the tagging worker’s preparation and request builder without sending a model request. It does not enroll sources or activate tagging.

Upload a JSON object with a selection array. Each row has example_id (a distinct UUID), media_type (Image, Video, or Carousel), categories (comma-separated names), content_level (SFW, SSFW, NSFW, or EXPLICIT), and carousel_images (5 for carousels). Short media and content labels match their corresponding stored MEDIA_TYPE_ and MEDIA_EXPLICITNESS_LEVEL_ values. Keep real IDs in the private selection file. The server uses its configured database, S3, Brain and managed media scratch root; FFmpeg and ffprobe must be available there. The button replaces the separate operator CLI.

Download the complete JSON receipt from Strip. Per-item preparation logs cannot establish source verification or selection identity. The receipt binds the selection hash, binary source revision, target database, recipe and vocabulary to before/after source checks. A passing read-only receipt does not authorize paid dispatch.

Strip submits the unchanged selection through StripStartMediaPreflight and reads job state and the receipt through StripGetMediaPreflight. These RPCs use the same closed-VPC trust boundary as other Strip methods: an unset service token does not block them; a configured token is still enforced. Strip verifies the Clerk session, and each Sirloin call checks the operator’s current Admin or Root role. No preflight-specific credential setup is required. A single active River job limits media preparation load. There are no automatic retries, new database tables, or provider calls. The worker has a 30-minute timeout and stores the receipt in River output metadata. An item failure still produces a completed job with a failing receipt. An operational failure returns a sanitized job error. Existing completed-job retention is 24 hours. Sources: apps/sirloin/internal/app/services/strip/stripmediapreflight.go, apps/sirloin/internal/app/worker/mediapreflight.go, and apps/sirloin/internal/pkg/riverjobs/riverjobs.go.

Local Commands

make run-tests-all requires the sandbox or integration environment variables used by Sirloin integration tests.

• cd apps/sirloin && make lint
• cd apps/sirloin && make run-tests
• cd apps/sirloin && make run-tests-all
• cd apps/sirloin && make ci-all