Build on L1

GoFundNode L1 is a typed-task residential execution platform. You declare a task type; the platform schedules it onto opt-in residential devices; operators earn fiat for verified, completed work.

What it is

You are a buyer application (a "tenant"). You call typed task APIs over the signed v1 surface. The platform owns scheduling, the node runtime, payload encryption, billing, settlement, operator approvals, and the target-signature registry — all tenant-generic. apply.fun is simply the first tenant (and the launch task type is ats.application); it is not the platform.

What it is NOT

• Not a raw proxy network.
• Not a public Playwright / CDP / browser endpoint. You never receive raw browser, proxy, or desktop-control access to a node.
• Not a generic remote-control product.

This is deliberate: typed tasks are what make scheduling, safety, rate-limiting, and per-target metrics possible. A buyer that wanted raw browser access would break all of those guarantees, so the platform does not expose them.

The shape of an integration

1. Provision. Get a tenant id, an HMAC secret, a webhook secret, a webhook URL, and an allowed_job_types allowlist. See Onboarding.
2. Top up. Fund a fiat credit balance.
3. Submit. POST /v1/submissions with your jobType + a typed payload. The platform quotes, holds, schedules, and dispatches to an eligible node.
4. Receive. A signed webhook reports the settled outcome; the unused credit hold is refunded.

Bringing a new task type (beyond ats.application)

New job types are a platform-side addition, coordinated with GoFundNode — they are not self-serve from the tenant API. A task type carries:

• A stable, signed, versioned TaskTypeManifest (non-sensitive, cacheable) describing the workflow, evidence requirements, and resource floor.
• A rate card entry (pricing weights per metered dimension, per tier).
• A target-signature mapping that selects an execution engine empirically — tenants do not pick engines or nodes.
• A payload schema validated at submit.

If your task is side-effecting and irreversible (like submitting a form), the platform enforces dedup-at-target probes and routes failures to manual review rather than blind retry — see the architecture ADRs.

Boundaries you inherit

• Tenant isolation. Your payloads are encrypted under a tenant key envelope; one tenant's data never bleeds to another, and no apply.fun-specific behavior is baked into the core.
• Operator approvals are hard filters. Operators approve which tenants and categories run on their device; the scheduler enforces this before execution.
• Central authority. Routing, cancellation, retry, reclassification, and rate-limit state are owned centrally — the edge holds only one active lease.
• Fiat economics. Customer credits and operator payouts are fiat; no token, wallet, or stored value (ADR-046).