> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.trace-db.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.trace-db.com/_mcp/server.

# Hosted Alpha

TraceDB Cloud is invite-only in v0.1.1. Public health endpoints may be
reachable, but product routes require scoped bearer keys issued through the
hosted control plane.

Hosted Alpha exists to prove the managed path without turning the hosted
service into the public runtime contract. The same `/v1` API and SDK wire
contract apply, but account setup, organization membership, quotas, API-key
issuance, and provider operations live in the hosted control plane.

## Access Model

* Users enter through an operator-issued invite.
* Authentication and OTP email are hosted-control-plane concerns.
* API access uses bearer keys scoped to a tenant, database, branch, and allowed
  scopes.
* Customer-visible hosted mail must use the `trace-db.com` domain.
* Hidden operator/bootstrap mail remains an internal operator path, not a
  customer contract.

## Hosted API Boundary

The hosted gateway verifies bearer keys before forwarding protected requests to
the engine. Client-supplied actor headers are not trusted. The gateway strips
spoofed actor metadata, injects actor metadata derived from verified claims,
and forwards the private engine token only after authorization succeeds.

Use [API authentication](/api/authentication) for the public request contract
and [Managed Routing](/operations/managed-routing) for gateway behavior.

## v0.1.1 Finish Line

v0.1.1 Hosted Alpha must prove:

* Fern docs and API reference publish from the current OpenAPI contract.
* TypeScript, Python, and Rust SDK package surfaces are staged for
  invite/private package access at v0.1.1.
* Invite, OTP, scoped API-key issuance, and hosted smoke flows work remotely.
* Gateway actor-header stripping and trusted injection are verified against the
  hosted API.
* SES/DKIM-backed customer mail is verified before real invite or OTP mail is
  treated as ready.

Full runtime S3 rehydrate from WAL/checkpoint state after an engine restart is
not a v0.1.1 release blocker. The public runtime may document the S3 contract
and AWS/IAM baseline, but the full hosted rehydrate proof belongs to v0.1.2.

## Non-Claims

Hosted Alpha is not a managed disaster-recovery guarantee, public SLA, public
benchmark claim, or promise of cross-replica exactly-once behavior. Those claims
require separate design, implementation, and provider receipts.