The engine

 Web · PWA · Native window · SDKs · CLI · Sweep Connect · MCP · A2A
                    │  (thin clients)
                    ▼
        ┌──────────────────────────────┐
        │  Public API  (api.trustysweep.com)
        │  auth · scopes · idempotency · rate limits · problem+json
        └──────────────┬───────────────┘
                       ▼
  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐
  │ Action        │  │ Shadow Sweep │  │ Commercial    │
  │ Authorization │  │ plan/commit  │  │ Authorization │
  │ Engine        │  │ engine       │  │ Ledger        │
  └──────┬────────┘  └──────┬───────┘  └──────┬────────┘
         └──────────────────┼─────────────────┘
                            ▼
                ┌────────────────────────┐
                │ Sweep state machine     │  DISCOVERED → … → VAULT_COMMITTED → SOURCE_ACTION_QUEUED → … → RECLAIM_CONFIRMED
                └───────────┬────────────┘
        ┌───────────────────┼────────────────────┐
        ▼                   ▼                    ▼
  Provider Adapters     Trusty Vault        Trusty Meter Engine
  (bidirectional)       (R2, manifests)     (events → rating → Stripe)

• Provider Adapters are capability-driven and bidirectional: read, list, delta, quota, fetch, write, trash, untrash, copy, move. Each publishes an honest capability matrix (GET /v1/providers).
• The state machine is one deterministic table. Source removal for preserved objects is only reachable from VAULT_COMMITTED with verification proof.
• Shadow Sweep turns intent into a hashed, expiring plan with preconditions.
• Action Authorization decides who may do what; Commercial Authorization decides what may be charged.
• Receipts bind the execution to the plan hash and are signed.
• The Digital State Graph records provenance across all of the above.