The CTO view

History, velocity, risk register, and a 30/60/90-day plan.

Snapshot taken 2026-10-19 at main @ 778120494. Everything here comes from read-only git / gh queries and repository docs. No production system was touched. Raw numbers: 11-stats.json.

TL;DR

• Age: 5.5 months. The first commit, "TrustedRouter alpha control plane", landed 2026-05-03. The project dropped its alpha label the same day.
• Scale: 3,213 commits, 1,711 merged PRs, ~194k LOC of Python in src/, ~343k LOC of Python tests, a ~20k LOC Go fast-path service and a set of TLA+ proofs. It runs live on three clouds (GCP primary, plus AWS and Azure as standalone deployments).
• Team: effectively one founder-engineer (Joseph Perla, 76% of commits). He drives a fleet of AI coding agents: 741 merged PRs come from codex/* branches and 51 from fable/*. A second human (Jasmine Lee, front-end/site work) joined in September 2026. A pricing bot makes 17% of all commits.
• Velocity: about 600 commits and about 400 merged PRs a month, with commits spread across all 24 hours. That is agent-paced, not human-paced.
• Biggest risks: bus factor of 1. Money-path complexity (async settle "shadow v2", 110 source files and ~26k LOC of evidence machinery). Spanner contention, the source of most incidents. A large multi-cloud cost footprint for a single operator.
• Moat: hardware attestation (Confidential Space / Nitro / SEV-SNP) plus public BUSL source. Anyone can verify that the running binary matches the repo.

1. Timeline

Dates are inferred from commit messages and the history of key files.

timeline
    title TrustedRouter (quill-router) — 2026
    May 2026 : 05-03 First commit, production the same day (GCP Cloud Run + Confidential Space gateway, Spanner ledger, BYOK, OAuth, MetaMask sign-in)
             : 05-07 Auto-deploy to Cloud Run on push to main
             : 05-09/10 Multi-region Stage 0 (nam6 Spanner, us-east4, Bigtable), AWS Nitro image-fetch, Cloudflare LB
             : 05-11 Provider wave (Parasail, Lightning AI, GMI) and hourly price-refresh bot
    Jun 2026 : 06-22 x402 stablecoin funding
             : Chat playground and SEO model pages
    Jul 2026 : 07-03 Relicense Apache-2.0 → BUSL-1.1 (TrustedOS page the same day)
             : 07-03 Durable settle outbox design
             : 07-26 Storage ports, conformance suite, ClickHouse analytics proof
    Aug 2026 : 08-05/06 AWS (Nitro + Fargate) and Azure (SEV-SNP + Container Apps) own control planes live
             : ClickHouse 3-zone replicated cluster, Parquet archive, rollups
             : Peak month — 833 commits, 575 merged PRs
    Sep 2026 : 09-05..09-26 Spanner incident cluster (CPU, shard contention, grant storm)
             : 09-11 Enterprise Token Exchange launch; 09-20 regional Token Exchange sites
             : 09-14 LightningRouter (BTC Lightning USD funding, isolated infra)
             : 09-21 Polyphemus catalog / selector billing
             : Jasmine Lee joins (site and design)
    Oct 2026 : 10-03 Fast admission + batched settlement design approved (Go fastpath, TLA+)
             : 10-10..10-18 Async-settle shadow incidents; shadow v2 evidence policy (10-11)
             : 10-18 Bedrock provider merged
             : 10-19 Shadow v2 opt-in pins for probe workspace (design §15.8 step 5)

timeline
    title TrustedRouter (quill-router) — 2026
    May 2026 : 05-03 First commit, production the same day (GCP Cloud Run + Confidential Space gateway, Spanner ledger, BYOK, OAuth, MetaMask sign-in)
             : 05-07 Auto-deploy to Cloud Run on push to main
             : 05-09/10 Multi-region Stage 0 (nam6 Spanner, us-east4, Bigtable), AWS Nitro image-fetch, Cloudflare LB
             : 05-11 Provider wave (Parasail, Lightning AI, GMI) and hourly price-refresh bot
    Jun 2026 : 06-22 x402 stablecoin funding
             : Chat playground and SEO model pages
    Jul 2026 : 07-03 Relicense Apache-2.0 → BUSL-1.1 (TrustedOS page the same day)
             : 07-03 Durable settle outbox design
             : 07-26 Storage ports, conformance suite, ClickHouse analytics proof
    Aug 2026 : 08-05/06 AWS (Nitro + Fargate) and Azure (SEV-SNP + Container Apps) own control planes live
             : ClickHouse 3-zone replicated cluster, Parquet archive, rollups
             : Peak month — 833 commits, 575 merged PRs
    Sep 2026 : 09-05..09-26 Spanner incident cluster (CPU, shard contention, grant storm)
             : 09-11 Enterprise Token Exchange launch; 09-20 regional Token Exchange sites
             : 09-14 LightningRouter (BTC Lightning USD funding, isolated infra)
             : 09-21 Polyphemus catalog / selector billing
             : Jasmine Lee joins (site and design)
    Oct 2026 : 10-03 Fast admission + batched settlement design approved (Go fastpath, TLA+)
             : 10-10..10-18 Async-settle shadow incidents; shadow v2 evidence policy (10-11)
             : 10-18 Bedrock provider merged
             : 10-19 Shadow v2 opt-in pins for probe workspace (design §15.8 step 5)

Milestone table

2. Velocity

xychart-beta
    title "Commits per month (Oct = through the 19th)"
    x-axis ["May", "Jun", "Jul", "Aug", "Sep", "Oct*"]
    y-axis "Commits" 0 --> 900
    bar [401, 424, 395, 833, 555, 605]
    line [6, 79, 251, 575, 415, 385]

xychart-beta
    title "Commits per month (Oct = through the 19th)"
    x-axis ["May", "Jun", "Jul", "Aug", "Sep", "Oct*"]
    y-axis "Commits" 0 --> 900
    bar [401, 424, 395, 833, 555, 605]
    line [6, 79, 251, 575, 415, 385]

Bars show commits. The line shows merged PRs.

Observations: - The workflow moved from direct pushes (May) to a PR-per-change workflow (July onward). Only 191 merge commits exist; most PRs are squash-merged. - October is on pace for about 1,000 commits, the highest month yet: 207 commits in the last 7 days. - Commit hours: every hour from 00:00 to 23:00 local time has 47 to 190 commits. Agents work around the clock and the founder reviews and merges. - Active days: 166 of 170 calendar days.

3. Team and contributors

AI agents as a workforce. Merged-PR branch prefixes: codex/ 741, fix/ 114, fastpath/ 80, fable/ 51, feat/ 39, async-settle/ 36. Design docs record adversarial review rounds by "Codex and Fable". AGENTS.md is written for agents first. In practice the engineering org is one human architect plus several agent reviewers and implementers.

Bus factor: 1. Joseph is the sole approver of money-path design, the holder of production credentials (README points at his local key file), and the author of 76% of the code. Jasmine's work stays mostly within sites/, the homepage and templates.

4. Codebase size and health

LOC by language (tracked files, wc -l)

Tracked files: 3,814. Workflows: 28. TLA+ models in proofs/ (AuditorCommit, AutoRefillHandoff, and others).

Test-to-code ratio

• Python: 1.77 lines of test per line of source (886 test files vs 533 source files).
• Go: 1.77 to 1 as well.
• CI gates: ruff check, mypy (strict gate), pytest with at least 70% coverage, plus conformance suites against memory, Postgres and Spanner-PG, and a sharded proof_oracle differential suite (more than 1 hour).

Largest source modules

Async-settle footprint: 110 files and ~25.9k LOC in src/ matching async_settle*, most of it async_settle_shadow_v2_* evidence, gate and certificate machinery. That is about 13% of all source code, spent proving a settlement change that is still in shadow.

Hot files (last 90 days)

All authors: the top 30 are all catalog JSON (openrouter_snapshot.json 303 commits, each provider_models/*.json about 250 to 300), driven by the hourly pricing bot.

Humans and agents, non-test:

Reading: churn concentrates in the money/hot path (gateway, storage) and in config/deploy. Those are the highest-risk files and also the most edited.

5. Open work

38 open PRs (12 drafts). Themes: - New providers / catalog (about 12): Hixtube, Regolo, CoralBricks, NextBit EU, Verda, Redpill/Meta/General Compute/Infomaniak, Poolside, Fortanix-on-Azure. - Routing correctness: context-window-aware routing (#1800); tool/response_format capability filtering (#1798). - Money path / async settlement: regional Bigtable settlement journal (#1403, dormant), stage C/D admission (#1296, #1055), idempotent-replay key-hold leak (#1239), fastpath renewal-lock release (#1844). - Infra: control LB URL map into Terraform (#1862). - Dependabot backlog: 10 PRs, the oldest from 2026-08-31 (actions/checkout 4→7, setup-gcloud 2→3, psycopg, google-cloud-storage 3.x).

30 open issues (only 15 were ever closed through Issues; most work is tracked in PRs and design docs). Notable: - #402 _client_ip trusts the first X-Forwarded-For. Spoofable rate-limit identity (open since 2026-08-02). - #334 Spanner is 99.97% garbage: 5.4M dead rows plus 9.4M live rows with no TTL. - #333 Inject the store instead of using the STORE module global (test pollution; once broke 136 tests). - #128 Hot-tenant shard-0 counter-row lock contention (root cause of settle latency). - #850 Deploy pipeline starves under merge pressure (each run defers to a newer main and still reports success). - #1178 Repository security coverage gap. #1720 CI Postgres image rate-limited by ECR. - Freshness alarms left open: #817 ClickHouse archive, #638 AWS-EU analytics drain, #630 client telemetry. - Multi-cloud lag: #1272 retirements not yet promoted to AWS/Azure; #1825 Azure peer-status stall.

6. Incidents (25 write-ups, 2026-09-05 → 2026-10-18)

Write-ups are thorough. They separate confirmed causes from open questions, keep tenant data out, and refuse to overclaim fixes. That is a strong engineering culture. The incident rate, about 1 every 2 days in the last 6 weeks, is the headline concern.

7. Design docs in flight (docs/design/, 46 files)

8. Synthesis

Architecture strengths

1. Verifiable trust boundary. The prompt path (api.trustedrouter.com) terminates TLS inside attested enclaves (GCP Confidential Space, AWS Nitro, Azure SEV-SNP/MAA). The control plane never sees prompts, and the public repo matches the measured image digest. That is a real, demonstrable differentiator.
2. Storage behind a Protocol, with an executable contract. tests/conformance/ runs memory, Postgres and Spanner-PG. One PostgresStore covers Aurora DSQL, Cosmos/Citus and Spanner-PG.
3. Multi-cloud as independent deployments. Identity federates but credits do not, which avoids a cross-cloud ledger.
4. Formal rigor on money. TLA+ specs, differential proof_oracle tests and conformance tests are required for any reserve/settle/refund change.
5. Ops as code. Env vars live in rollout.sh, Terraform covers Spanner and Cloud Armor, prod smoke runs on every push, and a trust-drift workflow checks the published image.
6. Analytics separated from OLTP. ClickHouse (3-zone, Keeper, Parquet archive with 7-year retention) offloads Spanner.

Tech debt and risk register

Cost drivers (qualitative; no billing data was queried)

• Spanner: Enterprise Plus, nam6 multi-region, 5 replica locations, autoscaled 1,000–10,000 PU (floor raised from 400→600→1,000 after the September CPU incidents). Likely the largest fixed line. Issue #334 says 99.97% of rows are garbage, so storage cost is inflated.
• ClickHouse: three-zone replicated cluster with 500 GB SSD per replica on GCP, plus per-cloud instances and a GCS Parquet archive.
• Compute: Cloud Run in several regions with warm minimum instances. Confidential Space VMs. AWS Nitro + Fargate. Azure SEV-SNP + Container Apps.
• Bigtable (regional quota, analytics legacy) still runs alongside.
• Upstream inference: pass-through COGS, offset by routing markup.

Strategic bets

1. Attestation as the moat. The "OpenRouter-compatible, but verifiable" wedge, open BUSL code, nonce-challenged attestation, and the "Attestation is all you need" thesis. Defensible because competitors (OpenRouter, Portkey, Cloudflare AI GW, LiteLLM) cannot easily retrofit an enclave-terminated prompt path.
2. Confidential/E2EE pools (min_privacy: confidential, fail-closed) and ZDR pools. Privacy is the product, not a feature flag.
3. Token Exchange (enterprise and regional landing sites). Moves up-market toward a compute marketplace.
4. Alternative payment rails: x402 stablecoins, Lightning (LightningRouter), Adyen/PayPal/Stripe. These reach agents and crypto-native buyers.
5. SDK and app ecosystem: JS (@lore-hex/trusted-router) and Python (trusted-router-py) SDKs, "Sign in with TrustedRouter", OAuth scopes and app economy, a one-prompt migration for coding agents.
6. Scale bet: fast admission and batched settlement designed for 100T tokens/month. This builds for a scale far beyond current load and must be paced against R2.
7. Breadth: 92 provider catalogs, image/video/TTS/transcription, task models (ScaleDown), Polyphemus.

9. 30/60/90-day plan for a new technical leader

Days 0–30: Learn, stabilize, de-risk the person

• Read AGENTS.md, docs/storage-portability/HANDOFF.md, docs/spanner-reliability.md, the 25 incident docs, and both in-flight design programs.
• Run the three CI gates and the conformance suites locally. Shadow one full deploy and one incident.
• Bus-factor actions: inventory every credential and its owner. Get second-person access to GCP, AWS, Azure, Cloudflare, Stripe and the domain registrars. Write a break-glass runbook.
• Put money-path files under CODEOWNERS requiring a human approver (gateway, storage, settle, billing).
• Close the quick security debt: #402 XFF spoofing, #1178. Merge the dependabot backlog.
• Baseline metrics: incident rate, authorize p50/p99, settle error rate, Spanner CPU and aborts, cloud spend by line item.

Days 31–60: Reduce risk in the money path and the database

• With Joseph, set a written exit criterion and date for async-settle shadow v2: cut over or delete. Freeze new evidence-machinery surface area.
• Land row sharding (#128, credit/key-usage sharding designs) and Spanner garbage cleanup with TTL (#334). Target zero Spanner-contention incidents for 30 days.
• Fix deploy-pipeline honesty (#850) and add a bake/canary stage for gateway changes.
• Start decomposing gateway.py, dashboard.py and the STORE global (#333) behind the existing Protocol.
• FinOps pass: Spanner PU floor vs. actual load, ClickHouse sizing per cloud, warm-instance counts, the value of Bigtable after the ClickHouse cutover.

Days 61–90: Scale the team and the bets

• Hire or contract one senior backend/SRE engineer for the money path and on-call. Set up a two-person on-call rotation.
• Define the agent-workforce policy: which paths agents may merge unreviewed, and which need human differential review.
• Decide fast-admission rollout pacing against real traffic growth, not the 100T design ceiling.
• Publish SLOs per cloud (availability, attestation freshness, analytics freshness) and align AWS/Azure on the same release train.
• Strategy review with the founder: rank Token Exchange, payment rails, the SDK ecosystem and provider breadth by revenue evidence from the CRM loop, then cut or defer the weakest.

Method notes

• Commit counts come from git log on main (all history). Merged PR counts come from gh pr list --state merged. Emails are redacted and only names are shown.
• LOC comes from wc -l on tracked files (no cloc/tokei available), so it includes blank and comment lines.
• Churn is the number of commits touching a file since 2026-07-21. The "human" view excludes the pricing bot and tests/.
• Cost statements are qualitative, from repo docs and Terraform. No billing or production data was queried.