docs(studio): rewrite architecture for the shipped Node runtime

[Ang-dot]

📋 Merge order

One of four related docs PRs. Recommended sequence:

#	PR	Depends on
1	#885 — Studio Node path + nav order	—
2	#884 — TypeScript SDK quickstart	rebased on #885; fast-forwards after it
3	#886 — Studio architecture	independent
4	#887 — remaining Studio pages	independent

#882 (SDK server-module fixes) is independent of all four.

---

Summary

Completes the Studio Node-path work started in #885, which deliberately left this page alone to stay reviewable. architecture.md described a two-artifact Python system that does not ship. Verified against the published @bnbagent/studio-cli@0.0.12 tarball.

What was wrong

Page said	Reality
"two deployable artifacts", Layer A + Layer B, app/service/ on EC2/Fargate, a "keyless" boundary, InvokeAgentRuntime action envelopes (quote/fulfill/settle)	None of it exists. One runtime holds the only key and signs in-process.
L4 = bnbagent_studio_core; L1 lists app/service/*	L4 is the published @bnbagent/studio-runtime; there is no service tier
A frameworks/ recipe axis, default Google ADK	No frameworks/ directory exists in recipes/ at all. Real axes: agent, wallet, runtimes/{agentcore,azure-foundry}, providers/pieverse-llm, tools-chain, x402-buyer
Emitted main.py, managed_model.py, tools.py, signing.py, service.py	The shipped templates are TypeScript: signing.ts, sellerCore.ts, unifiedMain.ts, mcpMain.ts, dualMain.ts, executor.ts, agentCard.ts, model.ts, tools.ts, chainTools.ts, x402Buyer.ts

What replaced it

The invariants as they actually are:

• The two bounded ERC-8183 operations. negotiate clamps price against studio.toml in deterministic code and signs EIP-191 — no LLM touches money. notify_funded verifies the funded job on-chain (signed terms, assigned provider, status, budget, funded state) before doing paid work.
• The signing boundary. Fixed code in app/agent/src/signing.ts or the bounded x402 handler, never an LLM-callable tool; the model's chain tools are read-only. The keystore sits at the workspace root, outside the deploy codeLocation.
• Manual settle — bag erc8183 settle <jobId>; Studio never auto-settles a buyer's job.
• Which entrypoint binds which port, and that dualMain.ts is AgentCore-only. That last detail is the mechanical reason Foundry deploys A2A scaffolds only — runtimes/azure-foundry/ ships no dualMain template. The A2A entrypoint is byte-identical across both runtimes (pinned by a parity test), so one image deploys to either cloud.

Also refreshed the mermaid diagram and the commerce-flow sequence to the real negotiate → fund → notify_funded → submit → buyer-decides path.

Also fixed

Dropped two Further reading links into bnb-chain/bnbagent-studio/docs/design/ — that repo returns 404, so both were dead.

Verification

• grep for Layer A|Layer B|keyless|EC2|Fargate|app/service|service.py|main.py|managed_model|bnbagent_studio_core|frameworks/|Google ADK|InvokeAgentRuntime|six-layer|two deployable returns one deliberate hit: "There is no separate keyless service tier and no cross-service invoke hop."
• every relative link resolves; code fences balanced
• recipe axes and template filenames enumerated directly from the tarball (find recipes -name '*.tmpl')

Merge order

Independent of #885/#884 — this touches only architecture.md, which neither of those modifies.

[hashdit-bot]

Pull Request Review

This documentation-only PR rewrites the BNB Agent Studio architecture to describe the shipped TypeScript/Node.js runtime rather than the previously documented two-artifact Python design. It documents the single-runtime signing boundary, bounded ERC-8183 and x402 flows, actual recipe and entrypoint layout, workspace isolation, cloud runtime differences, and manual settlement behavior.

Sensitive Content

No sensitive content detected.

Security Issues

No serious security issues detected.

---

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.