Product surface & docs · TrustedRouter Field Manual
Week 1

Product surface & docs

Every API surface, provider, script, and doc in the repo, indexed.

Video 07 The product surface · Endpoints by plane, router aliases, providers and privacy flags, web surfaces.

Scope: what a user sees (APIs, router aliases, web pages, growth programs), plus everything in the repo outside the core Python router: frontend/, sites/, clickhouse/, experiments/, interviews/, release/, skills/, scripts/, and a navigable index of docs/. Repo root: /Users/elevenarms/Code/trustedrouter/quill-router (all paths below are relative to it). Snapshot: main @ 778120494, 2026-10-19.

The most important architecture fact for this area: the repo is the control plane (trustedrouter.com). Prompt-bearing endpoints (chat, messages, responses, embeddings, images, video, TTS, transcription, fetch, batch) run in the attested gateway (api.trustedrouter.com, in the separate quill-cloud-proxy repo, running in GCP Confidential Space). In production the control plane does not register /chat/completions, /messages, /responses or /embeddings (README.md:211-214). Media endpoints are registered here only as not_supported() stubs that exist for the OpenAPI document (src/trusted_router/routes/compat.py:36-130). The gateway calls back into this repo via /internal/gateway/{authorize,settle,refund} (src/trusted_router/routes/internal/gateway.py:2492-2561, README.md:501-515). This repo owns catalog, pricing, capability metadata, routing candidates, billing, and the web UI for every feature.

1. Product mindmap

mindmap
  root((TrustedRouter))
    Inference API (attested gateway)
      Chat Completions /v1/chat/completions
      Anthropic Messages /v1/messages
      Responses /v1/responses
      Embeddings /v1/embeddings
      Images /v1/images
      Video async /v1/videos
      TTS /v1/audio/speech
      Transcription /v1/audio/transcriptions
      Web Fetch /v1/tools/fetch
      Batch API, 30-day encrypted artifacts
      Decide /v1/decide
    Router models
      trustedrouter/auto
      Privacy floors zdr / e2e / confidential
      Region eu
      Tiers frontier advanced professional efficient
      cheap fast free monitor
      green (energy-filtered)
      Combo / fusion graphs Zeus Prometheus Plato Socrates synth
      Polyphemus selector
      Decision models trev mev zev ...
      nyte/ alias namespace
    Routing controls
      provider.min_privacy
      order / only / ignore
      preferred_max_latency / min_throughput
      cache affinity
      strict budget admission
    Trust and proof
      /attestation nonce
      Inference receipts and receipt keys
      /trust release digests
      Provider privacy tiers
    Account and money
      API keys and limits
      Credits: Stripe, ACH, stablecoin, PayPal, Adyen, x402, Lightning
      Auto refill, credit transfers
      BYOK envelope-encrypted keys
      Workspaces and members
      Broadcast to PostHog / OTLP
    Creator economy
      Custom models tr-custom-model/*
      User-hosted models user-*
      Sign in with TrustedRouter OAuth 2.1
      Routable payouts / earnings
      MCP server and advisor
    Web
      Marketing homepage and SEO landing pages
      /chat playground
      /console dashboard
      /models /providers /compare
      /status /leaderboard /benchmarks /fleet
      /docs hub and API reference
    Growth
      Token Exchange regional sites
      Green Tokens
      Social rewards credit
      Revenue loop CRM and founder interviews
      Acquisition attribution and Google Ads
      Provider marketplace
Diagram source
mindmap
  root((TrustedRouter))
    Inference API (attested gateway)
      Chat Completions /v1/chat/completions
      Anthropic Messages /v1/messages
      Responses /v1/responses
      Embeddings /v1/embeddings
      Images /v1/images
      Video async /v1/videos
      TTS /v1/audio/speech
      Transcription /v1/audio/transcriptions
      Web Fetch /v1/tools/fetch
      Batch API, 30-day encrypted artifacts
      Decide /v1/decide
    Router models
      trustedrouter/auto
      Privacy floors zdr / e2e / confidential
      Region eu
      Tiers frontier advanced professional efficient
      cheap fast free monitor
      green (energy-filtered)
      Combo / fusion graphs Zeus Prometheus Plato Socrates synth
      Polyphemus selector
      Decision models trev mev zev ...
      nyte/ alias namespace
    Routing controls
      provider.min_privacy
      order / only / ignore
      preferred_max_latency / min_throughput
      cache affinity
      strict budget admission
    Trust and proof
      /attestation nonce
      Inference receipts and receipt keys
      /trust release digests
      Provider privacy tiers
    Account and money
      API keys and limits
      Credits: Stripe, ACH, stablecoin, PayPal, Adyen, x402, Lightning
      Auto refill, credit transfers
      BYOK envelope-encrypted keys
      Workspaces and members
      Broadcast to PostHog / OTLP
    Creator economy
      Custom models tr-custom-model/*
      User-hosted models user-*
      Sign in with TrustedRouter OAuth 2.1
      Routable payouts / earnings
      MCP server and advisor
    Web
      Marketing homepage and SEO landing pages
      /chat playground
      /console dashboard
      /models /providers /compare
      /status /leaderboard /benchmarks /fleet
      /docs hub and API reference
    Growth
      Token Exchange regional sites
      Green Tokens
      Social rewards credit
      Revenue loop CRM and founder interviews
      Acquisition attribution and Google Ads
      Provider marketplace

2. Feature table: endpoint → owning module

"Gateway" = real implementation lives in quill-cloud-proxy; this repo supplies metadata/billing plus a stub. Router mounts every API router at both / and /v1 (src/trusted_router/main.py:727-728).

2a. Inference & media (user-facing API on api.trustedrouter.com/v1)

Feature Endpoint Control-plane module(s) Notes / doc
Chat Completions POST /v1/chat/completions routes/inference.py:157, services/inference.py, providers.py, provider_adapters.py Registered on control plane only when control-plane inference enabled (main.py:880-884); production = gateway
Anthropic Messages POST /v1/messages routes/inference.py:307 Claude Code base URL https://api.trustedrouter.com (README.md:62-64)
Responses POST /v1/responses routes/inference.py:385 Polyphemus selector uses route type responses.polyphemus.select (polyphemus.py:3-4)
Embeddings POST /v1/embeddings, GET /v1/embeddings/models routes/inference.py:353, routes/catalog.py:489
Image generation POST /v1/images (stub), GET /v1/images/models, GET /v1/images/models/{author}/{slug}/endpoints image_generation.py:1-40 (data-only capability list), routes/catalog.py:495,505, routes/compat.py:128 docs/image-generation.md
Video generation (async) POST /v1/videos, GET /v1/videos/models, GET /v1/videos/{jobId}, .../content routes/compat.py:110-125 (stubs), video_billing.py, storage_video_jobs.py, routes/internal/video_jobs.py docs/video-generation.md
Text-to-speech POST /v1/audio/speech speech.py:1 ("never accepts speech text"), routes/compat.py:61, data/speech_pricing.json docs/text-to-speech.md
Transcription POST /v1/audio/transcriptions transcription.py:1-15, routes/compat.py:10, data/transcription_pricing.json docs/transcription.md
Web Fetch POST /v1/tools/fetch (model deepseek/fetch) web_fetch.py:7-9, routes/compat.py:39-58 Credits only; not ZDR/confidential; docs/web-fetch.md
Batch API gateway — Retains enclave-encrypted artifacts up to 30 days (README.md:194-196); public page /docs/batch (routes/public.py:1330)
Decide POST /v1/decide catalog_data.py:2551-2567 (decision model IDs) Public page /docs/decide (routes/public.py:1334)
Rerank, private models POST /v1/rerank, GET /v1/private/models/... routes/compat.py:14-30 Not supported (OpenRouter-compat stubs)
Browser chat proxy POST /chat-proxy/v1/chat/completions routes/chat_proxy.py:93, routes/internal/chat_browser_key.py Powers no-signup /chat

2b. Catalog, routing, trust (public, no key)

Feature Endpoint Module
Model catalog GET /v1/models, /models/count, /models/picker, /models/{author}/{slug}/endpoints routes/catalog.py:539-633, catalog.py, catalog_data.py, catalog_registry.py
ZDR endpoints list GET /v1/endpoints/zdr routes/catalog.py:715
Regions, providers GET /v1/regions, GET /v1/providers routes/catalog.py:748,758, regions.py, provider_locations.py
User-provided models GET /v1/models/user-provided[/{id}] routes/user_models_public.py:15,26
Model change history GET (see module) routes/model_changes.py:78,94, model_changes.py, docs/model-changes.md
Model aliases (resolution) model_aliases.py:66-81 (nyte/ ↔ trustedrouter/, auto-routing → auto), catalog_aliases.py (reviewed model equivalences), docs/model-aliases.md
Request capabilities in /v1/models trustedrouter.capabilities request_capabilities.py, docs/design/model-capabilities.md
Receipts GET /.well-known/inference-receipt-keys, /trust/receipt-keys.json routes/public.py:2511-2512, receipt_keys.py, docs/client-receipts.md
Trust/release proof /trust/control-plane.json, /trust/{gcp,aws,azure}-release.json, /trust/pcr0-aws.txt, /trust/image-digest-gcp.txt routes/public.py:2482-2715, trust.py
Status / history GET /status, /status.json, /status/history routes/public.py:2128,2217,2232, synthetic/status.py
Leaderboard /leaderboard, /leaderboard/video, /leaderboard/video.json routes/public.py:2136,2156,2173, frontend/src/leaderboard.ts, docs/status-leaderboard-evidence.md
Benchmarks /benchmarks, /benchmarks/reports/{period}[.json], /rankings routes/public.py:1922-1950, benchmark_reports.py, monthly_benchmarks.py
Fleet /fleet, /fleet.json routes/public.py:2185,2194
Model picker data /choose, /choose/catalog.json, /ai-iq/models.json routes/public.py:1664-1690, choose_catalog.py, ai_iq.py
MCP POST /mcp, POST /mcp/advisor, /.well-known/mcp.json routes/mcp.py:74, routes/mcp_advisor.py:350, routes/public.py:2013-2014, mcp_skills.py
LLM-readable docs /llms.txt, /llms-full.txt, /docs/llms.txt routes/public.py:2077-2107
OpenAPI /api/reference, /redoc routes/public.py:1120-1210, public_openapi.py

2c. Account/control-plane API (authenticated, trustedrouter.com/v1)

Feature Endpoints Module
API keys GET /key, GET/POST /keys, /keys/bulk-delete, GET/PATCH/DELETE /keys/{hash} routes/keys.py:89-243
Credits & billing /credits, /credits/summary, /billing/checkout, /billing/paypal/orders/{id}/capture, /billing/x402/{fund,settle}, /billing/portal, /billing/payment-methods/setup, /credits/coinbase routes/billing.py:54-289, services/stripe_billing.py, services/paypal_billing.py, services/adyen_billing.py, services/x402_billing.py
Credit transfers POST/GET /credits/transfers routes/credit_transfers.py:51,68
Activity /activity, /generation, /generation/content routes/activity.py:18-95
BYOK /byok/providers[/{provider}] routes/byok.py:28,41, byok_crypto.py
Broadcast observability /broadcast/destinations[...] routes/broadcast.py:31-113, README.md:220-232
Workspaces /workspaces[...], /organization/members routes/workspaces.py:21-131
Custom models GET/POST /custom-models, GET/PATCH/DELETE /custom-models/{id} routes/custom_models.py:30-141, custom_model_rules.py, docs/custom-models.md
User-hosted models /user-models[...] incl. clock-in/out, heartbeat, probe, rotate-secrets, earnings/transfer routes/user_models.py:54-351, docs/design/reverse-harness-contract.md
Sign in with TrustedRouter (OAuth 2.1) /oauth/authorize, /oauth/token, /oauth/apps, /auth/approve, /auth/fund routes/oauth_keys.py:70-281, routes/oauth_apps.py:80-116, oauth_provider.py, docs/sign-in-with-trustedrouter.md
Payouts /payouts[...], /payouts/onboarding routes/payouts.py:56-164, docs/routable-payouts.md
Notify (SMS/voice) /notify, /notify/phone/{start,confirm}, /notify/texml routes/notify.py:59-213
Bedrock group buy /v1/bedrock-group-buy[...], /bedrock-group-buy/pledge routes/bedrock_group_buy.py:44-222
Acquisition events POST /analytics/events routes/acquisition.py:74, acquisition.py:1-4
Lightning feedback POST /lightning/feedback routes/lightning_support.py:25

2d. Router model IDs (aliases a user types into model)

Model ID Meaning Source
trustedrouter/auto (auto-routing, nyte/auto) Automatic fallback across providers; no implicit privacy floor catalog_data.py:2472, model_aliases.py:66-81
trustedrouter/zdr Hard zero-data-retention floor catalog_data.py:2519,2529-2532
trustedrouter/e2e / trustedrouter/confidential Hard confidential-compute + E2EE floor catalog_data.py:2521-2523,2531
trustedrouter/eu EU-focused pool; routing policy, not a residency guarantee; pair with api-europe-west4.quillrouter.com catalog_data.py:2517, README.md:255-259
trustedrouter/frontier/advanced/professional/efficient Fixed ordered pools, one model per attempt catalog_data.py:2480-2515, README.md:234-244
trustedrouter/cheap, /fast, /free, /monitor Price/speed pools; monitor = internal uptime pool catalog_data.py:2474-2478,2534
trustedrouter/green Energy-eligible directly hosted models, hard provider filter catalog_energy.py:5, docs/green-tokens.md
Combo/fusion: zeus-*, prometheus-*, plato-*, socrates-*, synth, fusion, advisor Versioned multi-model graphs (parallel panel + judge/synthesizer, optional advisor) docs/combo-models-september-2026.md, evals/fusion_*.py, scripts/fusion_*_eval.py
trustedrouter/polyphemus-1.0 Selector model (picks a model; generation billed normally) polyphemus.py:1-4, docs/design/polyphemus-1.0.md
trustedrouter/{trev,mev,zev,lev,gev,dev,oev,gemmev}-1.0 Named decision models for /v1/decide catalog_data.py:2551-2559
tr-custom-model/{username}-{slug} Creator custom model (catalog model + hidden prompt) docs/custom-models.md

Routing controls: provider.min_privacy, explicit order/filters, preferred_max_latency/preferred_min_throughput, cache affinity, strict budget admission — docs/routing-controls-20260927.md, routing.py, routing_candidates.py, strict_budget.py.

3. Web UI pages (server-rendered Jinja2, served by FastAPI)

Stack: Jinja2 templates (src/trusted_router/views.py:1 "Shared Jinja2 environment"), static assets mounted at /static (routes/public.py:995), thin compiled TypeScript. No SPA framework; the console is fully server-rendered (frontend/src/dashboard.ts:1-11).

Surface Routes Templates / assets
Homepage / (routes/public.py:1214), homepage.py templates/homepage/*.html, content.json
Chat playground (no signup) /chat (routes/public.py:2368) static/chat.js, chat_controls.js, chat.css; docs/chat-playground-controls.md; Playwright suite tests-e2e/
Console dashboard /console, /console/{activity,api-keys,authorized-apps,broadcast,byok,credits,credit-transfers,custom-models,earnings,routing,settings,social-rewards,user-models,welcome,account/verification,account/preferences} routes/console/*.py, templates/console/*.html, static/console.js
Auth & OAuth consent /auth/{slug}/login (Google/GitHub), wallet SIWE routes/oauth.py:92-100, templates/auth/*, frontend/src/dashboard.ts
Catalog pages /models, /models/{id}, /providers, /providers/{slug}[/performance], /compare/models/... routes/public.py:2275-2402
Docs hub /docs, /docs/{migrate-from-openrouter,agent-setup,tagging,provider-routing,performance-routing,spend-controls,model-precision,receipts,telemetry,prompt-caching,batch,decide,web-search,video,mcp,notify,evals,provider-conformance,synth,fusion,x402,user-models,custom-models} routes/public.py:1274-1378,1701
Status/leaderboard/benchmarks see 2b frontend/src/leaderboard.ts
SEO/comparison landing pages (~60) /compare/*, /openrouter-alternative, /hipaa-llm-api, /no-log-llm-api, /deepseek-api-privacy, etc. routes/public.py:1252-1660, competitor_comparisons.py, seo_catalog.py, seo_meta.py
Growth pages /token-exchange, /new-york-token-exchange, /token-exchange/{savings,security}, /green-tokens, /index (NYTE token index), /providers/marketplace, /badge, /media-kit routes/public.py:1717-1795, frontend/src/token-index.ts
Legal/compliance /legal/{dpa,baa,soc2-readiness,hipaa-readiness,subprocessors}[.json], /privacy, /terms routes/public.py:1834-1910

4. Growth programs

Program What it is Where
Token Exchange Static enterprise-acquisition microsites: 13 markets / 30 owned domains (global thetokenexchange.com, NY nytokenexchange.com), served from a public GCS bucket + Cloud CDN behind the existing global LB. Pages poll live price/privacy evidence from GET /token-exchange/evidence/{profile}.json; the only form posts to the email-gated /token-exchange/brief (buyer deck / security pack). First-party /token-exchange/events collector → Axiom. "Token Exchange" is positioning: buying LLM tokens like a commodity market with verifiable provider evidence. sites/token-exchange/README.md:7-39, sites/token-exchange/markets.json, ADDING-MARKETS.md (read before adding a market, AGENTS.md:5-8), src/trusted_router/token_exchange.py:1-30 (evidence profiles shared-gcp/new-york/europe/dubai), routes/public.py:969-985,2199, docs/marketing/token-exchange.md, exchange_analytics.py
Green Tokens trustedrouter/green alias: provider-declared energy eligibility, hard filter, fallback stays in pool docs/green-tokens.md:1-8, catalog_energy.py
Social rewards Promo credit for new Google/GitHub signups: 150,000 µ$ at signup + 30,000 µ$ per social action (GitHub star, X follows, LinkedIn, optional YouTube), max $0.30 docs/social-rewards.md:1-15, social_rewards.py, routes/console/social_rewards.py:69-104
Revenue loop Human-approved outreach: founder audio interviews → transcribed quotes → Google Sheet CRM → short quote-based messages. No unapproved posts/sends. docs/revenue-loop.md:1-20, docs/outreach-*, docs/runs/, interviews/, docs/founder-interview.md
Acquisition attribution First-party, metadata-only funnel + Google Ads conversions/experiments acquisition.py, marketing_funnel.py, marketing_experiments.py, google_ads_*.py, scripts/axiom_growth/, docs/marketing/
Provider marketplace Supplier onboarding with catalog JSON schema routes/public.py:1717-1760, provider_portal.py
LightningRouter lightningrouter.ai funding site: Bitcoin Lightning → USD credits experiments/lightning_router/README.md, docs/lightning-*.md, scripts/lightning/
Aliases allyrouter.com, uptimerouter.com first-party aliases docs/operations/*-alias.md

5. Supported providers

Source of truth: PROVIDERS dict in src/trusted_router/catalog_data.py:468 (108 entries; Provider dataclass at catalog_data.py:26-50, default stores_content=True — "assume stored" unless cited). OpenAI-compatible base URLs/env keys: OPENAI_COMPATIBLE_PROVIDERS in src/trusted_router/providers.py:42-138; native adapters (Anthropic, Gemini, Cohere) in provider_adapters.py. Per-provider onboarding notes: docs/providers/.

Legend: ZDR / CC (confidential compute) / E2EE = explicit flag in catalog (Y = True, N = False, · = unset/unverified). Prepaid = TR-managed key available (supports_prepaid). Line = catalog_data.py line.

Provider (slug) Line ZDR CC E2EE Prepaid
TrustedRouter (trustedrouter) 487 Y Y Y Y
Tinfoil (tinfoil) 823 Y Y Y Y
Privatemode (privatemode) 839 Y Y Y Y
NEAR AI (near-ai) 872 Y Y Y Y
Chutes (chutes) 1090 Y Y Y Y
Phala (phala) 782 Y Y N Y
Confidential AI (confidential-ai) 1365 Y Y N Y
0G Private Computer (zero-g) 1451 · Y N Y
Cerebras, Together, Parasail, Baseten, Telnyx, Inceptron, Nebius, Regolo, Zro, Cohere, Voyage 617, 714, 929, 1003, 1021, 1130, 1505, 2042, 1965, 2286, 2309 Y · · Y
Engy, ScaleDown, Greenference 1201, 1386, 1988 Y N N Y
Anthropic, OpenAI, Google AI Studio, Google Vertex, DeepSeek, Mistral, DeepInfra 544, 558, 582, 596, 630, 649, 1483 N · · Y
Telluvian, OpenRouter, Meta, Venice, Neurometric, Pearl, StepFun, Relace, Recraft, Black Forest Labs, Decart, NVIDIA NIM, W&B, Nscale, Databricks, Azure AI Foundry, Fortanix 469–2324 N N N Y
Kimi, Z.AI, Fireworks, xAI Grok, Novita, SiliconFlow, Lightning AI, GMI, FriendliAI, Wafer, Crusoe, Makora, DigitalOcean, Cloudflare Workers AI, Morph, Atlas Cloud, StreamLake, MiniMax, Thinking Machines, Xiaomi MiMo, Alibaba, LTX, Runway, Kling, Upstage, Sail Research, Perplexity, Reka, NextBit, AkashML, Abliterate, Mancer, Aion Labs, SambaNova, Arcee, Inception, Sakana, ElevenLabs, Krea, BytePlus, IO Intelligence, Boundless, Amazon Bedrock, Lyceum, Scaleway, Featherless, Jina, TypeSafe, Vercel AI Gateway, fal.ai, Tencent TokenHub 668–2219 · · · Y
Perceptron, Modal, Riverflow, Hyperbolic, OVHcloud, Vultr, Liquid AI, Baidu Qianfan, Darkbloom, Hugging Face, Poolside 1826–2268 · · · N (BYOK/catalog only)

Notes: Messages-native: Anthropic, TrustedRouter, Azure. Embeddings: OpenAI, Google AI Studio, Together, Tinfoil, Privatemode, Nscale, Lyceum, Jina, Cohere, Voyage. Media-only providers: Recraft, BFL, Decart, Krea, fal (image); LTX, Runway, Kling (video); ElevenLabs (speech). Provider geography is informational only (docs/provider-geography-api.md).

6. frontend/ and front-end toolchain

Item Detail
Source frontend/src/ — 4 files, ~919 LOC: dashboard.ts (sign-in modal + MetaMask SIWE against /v1/auth/wallet/*, dashboard.ts:1-11), leaderboard.ts (filter/sort/paginate), token-index.ts (NYTE token-index SVG charts, progressive enhancement), globals.d.ts
Build npm run build = tsc; compiles frontend/src/**/*.ts → src/trusted_router/static/ (tsconfig.json: rootDir, outDir, module: none, target es2020, strict, noUnused*) — outputs are plain scripts, no bundler
Lint npm run lint → ESLint flat config eslint.config.mjs (typescript-eslint, no-explicit-any warn, eqeqeq, prefer-const; ignores built static/dashboard.js); npm run lint:css → stylelint (.stylelintrc.json, stylelint-config-standard) over src/trusted_router/static/*.css
Tests npm run test:browser → Playwright (playwright.config.js: boots uvicorn with memory store on :18081, testDir tests/browser); separate /chat suite in tests-e2e/ (own package.json, playwright.config.ts)
Other build:world-map → scripts/build-world-svg.mjs (d3-geo + world-atlas); alpinejs remains a devDependency but dashboard is "No Alpine. Plain DOM."
Most UI JS Hand-written JS/CSS directly in src/trusted_router/static/ (75 entries: chat.js, console.js, custom_models.js, earnings.js, ...) — not compiled from TS
Deploy trigger frontend/src/** changes auto-deploy the control plane (AGENTS.md:52-55)

7. sites/ — Token Exchange static sites

sites/token-exchange/: Python generator (build.py, template.html, markets.json), per-region evidence (evidence-{dubai,europe,london,tokyo,shared-gcp}.json, refresh_evidence.py, stage_evidence.py), press kit (press.*, press-assets/), member badges (badge.*, member_badges.py), social images (social.py, social-images/), deploy.py (GCS + URL-map), Node verifiers (verify*.cjs), and pytest files (test_*.py). See §4.

8. Other non-core directories at a glance

Dir Contents
clickhouse/ 23 numbered SQL migrations (001_provider_benchmark_samples.sql … 023_activity_generation_id_projection_replicated.sql, each with replicated + single-node variants); Python jobs for outbox ingest (ingest_outbox.py, ingest_operational_outbox[_postgres].py), rollups (rollup_analytics.py, rollup_client_events.py, rollup_synthetic.py, rollup_reservation_overruns.py), archive/restore (archive_daily.py, verify_archive_*.py), public snapshots (build_public_snapshots.py), freshness checks, workspace directory refresh; and ~25 systemd tr-clickhouse-*.service/.timer units. Runbook: docs/clickhouse-reliability.md.
experiments/lightning_router/ Separate BUSL app for lightningrouter.ai Lightning funding (own pyproject, Dockerfile, cloudbuild, Playwright tests, web/)
interviews/ Founder interview transcripts and cleaned excerpts (2026-05-04: security-trust, positioning, objections, customer-migration); raw audio not committed (interviews/README.md)
release/ first-window-plan.json + schema: P6 async-settle-shadow first-window release pin template (router + enclave SHAs/images, REVIEW placeholders)
skills/trustedrouter-model-advisor/ Pointer SKILL.md to canonical Lore-Hex/LLM-advisor skill (model selection advisor)
fastpath/ Go fast-admission service (cmd/{fastpath,fastpathctl,fastpathwatch,loadgen}, internal/) shadowing TLA+ specs
proofs/ TLA+ specs + configs (AuditorCommit, CreditDebt, KeyCapFence, LeaseLifecycle, AutoRefillHandoff, ...) and mutation checker
infra/ Terraform for static plumbing (Cloud Armor, LB certs, Spanner, fastpath, SES, AWS alarms, WIF)
tests/, tests-e2e/ pytest suite (incl. tests/conformance/), and /chat Playwright suite

9. Repo directory map (top level)

Path Purpose
src/trusted_router/ FastAPI control plane (routes, services, storage backends, catalog, billing, templates, static)
tests/ Python tests; conformance suite is the Store contract
tests-e2e/ Playwright /chat E2E
frontend/ TypeScript sources compiled into src/trusted_router/static/
sites/ Static Token Exchange microsites
clickhouse/ Analytics schema, ingest/rollup jobs, systemd units
fastpath/ Go fast-admission service
proofs/ TLA+ formal models
infra/ Terraform
scripts/ Ops, deploy, pricing, smoke, backfill tooling (§10)
docs/ Design docs, runbooks, incidents, product docs (§11)
experiments/ LightningRouter funding app
interviews/ Founder interview material for marketing copy
release/ Release-plan pin templates
skills/ Agent skill pointer
settled 0-byte stray file (artifact)
fulltest.out, aws_ses_followup.md Stray working files at root
AGENTS.md, CLAUDE.md, README.md, SECURITY.md, LICENSE (BUSL-1.1), NOTICE Agent rules, overview, licensing
pyproject.toml, uv.lock, package.json, tsconfig.json, eslint.config.mjs, .stylelintrc.json, playwright.config.js, Dockerfile Build/tooling config

10. scripts/ categorized (92 top-level entries)

Category Entries
Deploy & release (scripts/deploy/, 124 files) rollout.sh (config-as-code ENV_VARS, AGENTS.md:57-59), deploy-gcp.sh, entrypoint.sh, publish-trust-gcs.sh, multi-cloud (aws_*, azure_*, cloud_rollout.py, cloud_*_gate.sh), ClickHouse cluster (clickhouse_*), Spanner migrations (migrate_*.sh), surfaces/edge (public_surface*.sh, internal_surface*.sh, gateway_edge*, service_surface_url_map.py), verification (verify_deployment.sh, verify_*_complete.sh, watchdog.py)
Smoke / health probes smoke_e2e.py, smoke_all_providers.py, smoke_byok_prod.py, smoke_openai_sdk.py, prod_embeddings_probe.py, run_synthetic_monitor.py, provision_synthetic_monitor.py, validate_synthetic_monitor_key.py, verify_gateway_authorization.py, verify_trust_measurements.py
Pricing & catalog pricing/ (refresh pipeline: providers, parsers, vertex, speech, transcription, video sources), ingest_openrouter_catalog.py, check_openrouter_coverage.py, check_price_coverage.py, check_price_spike.py, detect_provider_drift.py, classify_provider_routes.py, update_provider_throughput_rank.py, model_change_snapshot.py, update_model_changes.py, backfill_model_changes.py, check_request_capabilities.py, export_provider_check_contract.py, generate_public_openapi.py, import_tr_benchmarks.py, providers/sync_azure_foundry.py, reprobe_user_models.py
Billing / money ops (high risk) grant_credit.py, check_credit_row.py, consolidate_starter_credit.py, expand_billing_shards.py, shard_workspace.py, settle_negative_shards.py, stress_credit_shards.py, cleanup_legacy_credit_json.py, check_no_v1_envelopes.py, audit_typed_counters.py, backfill_lifetime_topups.py, set_lifetime_topup.py, backfill_leased_key_usage.py, backfill_reservation_terminal_at.py, generate_usage_cost_vectors.py, record_usage_baselines.py, reconcile_app_markup_payouts.py, reconcile_custom_model_payouts.py, fastpath/credit_debt_vectors.py
Async settle / shadow async_settle/ (16: shadow v2 collect/pack/activation/export, drain capacity, pilot enablement), provision_async_settle_shadow_probe_workspace.py, provision_fastpath_p1_workspace.py, provision_stage_d_probe_workspace.py
Trust / identity / payments inspect_payment_owner.py (the only sanctioned Stripe ownership lookup, AGENTS.md:66-74), reconcile_provider_trust.py, set_trust_override.py, process_trust_demotion_remainders.py, reconcile_veriff_decisions.py, check_adyen_readiness.py, backfill_byok_aad_v2.py, provision_provider_access.py
Data hygiene / Spanner audit_spanner_schema.py, tombstone_sweep.py, tombstone_sweep_plugin.py, cleanup_smoke_signups.py, check_cloud_staleness.py
Marketing / growth / assets marketing/ (OG renderers, token-exchange browser smokes), axiom_growth/ (Axiom datasets, dashboards, alerts, onboarding validation; own Dockerfile/cloudbuild), marketing_funnel_report.py, build_google_ads_experiment_matrix.py, build_media_kit.py, build_social_rewards_preview.py, generate_blog_og.py, generate_decision_blog_og.py, generate_provider_og.py, generate_region_og.py, generate_company_signin_buttons.py, import_company_affiliations.py, provision_creator_pilot.py, find_gabriella.py
Evals fusion_full_eval.py, fusion_live_eval.py, fusion_micro_eval.py
Frontend build/visual build-world-svg.mjs, build_tokens_css.py, visual_review.mjs, check_format_ordering.py
Lightning lightning/ (19: bitcoin/LND/Lexe/BTCPay node setup, web deploy)
CI / security ci/merge_shard_durations.py, security/check_repo_security_coverage.py, ops/policies/

11. docs/ index

63 top-level files + 18 subdirectories. Categories: Product (user-facing feature docs), Routing/Catalog, Billing/Payments, Trust/Security, Ops/Runbook, Analytics/Data, Design (architecture proposals), Growth/Marketing, Provider, Evidence (dated snapshots).

11a. Top-level docs

Doc Category Summary
image-generation.md Product Normalized /v1/images API; discover per-endpoint capabilities first
video-generation.md Product Async /v1/videos; Seedance/LTX/Gemini Omni launch models; microdollar reserve/settle
text-to-speech.md Product /v1/audio/speech, OpenRouter-compatible, raw audio
transcription.md Product /v1/audio/transcriptions in attested gateway; audio parsed in memory only
web-fetch.md Product /v1/tools/fetch page → Markdown (DeepSeek Fetch)
chat-playground-controls.md Product /chat model settings (reasoning on/off/default)
custom-models.md Product tr-custom-model/{user}-{slug}: catalog model + hidden prompt
model-aliases.md Product nyte/ ≡ trustedrouter/; auto-routing spellings
green-tokens.md Product/Growth trustedrouter/green energy-filtered pool
combo-models-september-2026.md Product Zeus/Prometheus/Plato/Socrates combo graph composition
scaledown.md Product ScaleDown task models (four specialized text tasks)
sign-in-with-trustedrouter.md Product OAuth 2.1 authorization server for apps
client-receipts.md Trust Enclave receipt signing-key discovery endpoints
routing-controls-20260927.md Routing Latency/throughput prefs, cache affinity, strict budget admission
provider-routing-evidence.md Routing/Evidence 2026-10-09 seven-day provider prior snapshot
provider-geography-api.md Routing Geography metadata is informational only
request-contract-diagnostics.md Routing Chat/Responses option validation before billing auth
gateway-contract-warnings.md Routing Adapter rejection (400/422) warnings
openrouter-coverage.md Routing ROUTE_COVERAGE as OpenRouter API parity source
model-changes.md Catalog Public model change history workflow
cache-read-pricing.md Billing Cache-read pricing flow + per-provider audit (76 sources)
async-settlement-billing-v1.md Billing Frozen dormant billing v1 contract
async-settle-frozen-main-inventory.md Billing Frozen-main execution inventory (330 modules)
authorize-workspace-read-proof.md Billing Retired mutation proof for authorize read collapse
adyen-rollout.md Payments Adyen as dark prepaid funding rail
paypal-inbox-reconciliation.md Payments Refunded-uncredited PayPal captures
routable-payouts.md Payments Creator payouts via Routable
trust-provider-slice1b.md Payments/Trust PayPal/Adyen adverse trust facts
lightning-btcpay.md Payments BTCPay dashboard on tr-bitcoin-1
lightning-funding-production.md Payments LightningRouter funds USD credits; no prompts
lightning-lexe.md Payments Lexe backend migration prep
lightning-liquidity.md Payments Receiving liquidity (Lexe now)
lightning-receiving-node.md Payments Merchant receiving node, not routing
bitcoin-node.md Payments Bitcoin backend for LightningRouter
security.md Security OAuth app redirect/security notes
client-telemetry.md Analytics Client-observed reliability telemetry contract v1
clickhouse-reliability.md Analytics/Ops Canonical ClickHouse analytics runbook
clickhouse-sharding.md Analytics Sharding gate (1 shard × 3 replicas today)
clickhouse-synthetic-backfill.md Analytics Executed backfill of synthetic flag
status-leaderboard-evidence.md Analytics How status/leaderboard monthly views are computed
spanner-reliability.md Ops Spanner nam6 Enterprise Plus posture
runbook.md Ops Operator runbook keyed by symptom
runbook-github-outage.md Ops GitHub down vs repo gone
provider-independent-deploys.md Ops Provider health separate from release gates
speculation-protocol-v1.md Design Speculation wire contract (pure module)
speculation-protocol-v1-mutations.md Design/Evidence Mutation evidence for speculation protocol
speculation-shadow-runbook.md Ops Speculative invocation router shadow (flag off)
speculation-shadow-validation.md Evidence PR3 round 6 validation
speculation-shadow-mutations.json Evidence Mutation data
confidential-model-coverage-2026-10-15.md Evidence Confidential coverage (Qwen 3.8 27B listing)
provider-inference-locations-2026-09-26.md Evidence Physical execution-location evidence
venice-deepseek-september-2026.md Provider Venice DeepSeek Flash retirement migration
founder-interview.md Growth Founder interview workflow for copy
revenue-loop.md Growth Human-approved outreach loop, Google Sheet CRM
revenue-loop-google-sheet.csv Growth CRM column template
outreach-approval-packet.md Growth Per-lead approval packet
outreach-quote-bank.csv Growth Founder quote bank
social-approval-queue.csv Growth Social post approval queue
social-rewards.md Growth Signup + social action promo credit
openrouter-seo-audit.md Growth 2026-06-02 SEO audit vs OpenRouter

11b. Subdirectories

Dir Category Contents
storage-portability/ (9) Architecture — read first (AGENTS.md:10-23) HANDOFF.md, multi-cloud separation, analytics ingestion, AWS-EU/Azure canary, coverage map, Spanner emulator conformance & SQL inventory
design/ (46) Design See 11c
providers/ (16) Provider See 11d
incidents/ (25) Ops Postmortems 2026-09-05 … 2026-10-18 (Spanner CPU from operator search, credit rebalance convoy, grant storm, fastpath lease locks, ...)
runbooks/ (12) Ops Fastpath P0/P1/alerts/deploy/key-rotation/turn-off/watch, DDoS edge, gateway billing edge, identity-verification support, SES notices/reputation
operations/ (6) Ops Service-surface bulkheads, public/internal surface splits, AllyRouter/UptimeRouter aliases, Fireworks retirements
marketing/ (17) Growth Ahrefs/Google Ads experiments, attribution, Axiom growth, OG spec, launch assets, token-exchange, creator-program
homepage/ (5) Growth Homepage mockup audit, QA, evidence, social card
blog-drafts/ (8), blog-evidence/ (1) Growth Blog drafts ("attestation is all you need", etc.) + evidence JSON
brand/ (3) Growth Brand tokens JSON, content-layout, screenshots
runs/ (30) Growth Revenue-loop approval packet runs
compliance/ (2) Trust hipaa/, soc2/ readiness
security/ (1) Trust edge-surfaces.json
evals/ (2) Evidence Fusion DRACO eval notes + live results
analytics/ (1) Analytics Onboarding attempts
latency/ (1) Design RPC pause fold C3
pr-previews/ (2) Growth Docs phone layout, homepage v2 previews
token-exchange/ (1) Growth hero.jpg asset

11c. docs/design/ (46)

Theme Docs
Async settle & shadow (14) async-settle-outbox-v1, async-settle-shadow-v1, async-settle-shadow-v2 (+ -activation, -bundle, -bundle-round{2,3,6,7}, -live-export, -p5-inputs, -process-inventory, -runtime-harness-interface, -startup-harness-router) — dormant/offline evidence pipeline to certify async settle
Fast admission (8) fast-admission-and-batched-settlement (approved v25), -enclave-direct (take Python off the hot path), -spike, -tracecheck, -pilot, -p1-results, -production-rollout
Billing ledger (9) billing-typed-counters, billing-dual-system-deletion-handoff, retire-json-credit-ledger, credit-row-sharding-handoff, key-usage-row-sharding, durable-settle-outbox, settle-one-read, rpc-diet-c1, trust-tier-incremental
Payments/identity (4) x402-stablecoin-funding, oauth-scopes-and-app-economy, company-affiliations, byok-aad-v2-migration (+ byok-aad-v2-attestations.json)
Catalog/routing (7) model-capabilities, request-tagging, polyphemus-1.0, provider-latency-probe, catalog-refresh-2026-09-14, catalog-refresh-2026-09-22, together-september-2026-retirements
Infra (3) clickhouse-high-availability, two-cloud-rollouts, reverse-harness-contract
Asset shared-header-widths-2026-10-08.png

11d. docs/providers/ (16)

abliterate.md, boundless-zro-hyperbolic.md, byteplus.md, confidential-ai.md, confidential-ai-e2e-audit-2026-09-08.md (partial; do not enable E2E filter), greenference.md, meta.md, microsoft-decision-1.md, telnyx-native-catalog.md, tencent-tokenhub.md, deepseek-v41-september-2026.md, near-ai-2026-09-11-recovery.md, near-ai-deepseek-september-2026.md, 2026-09-20-alert-repairs.md, 2026-09-20-gemini-vertex-discovery.md, 2026-09-20-phala-native-discovery.md.

12. Gotchas for newcomers in this area

  1. Media/chat handlers in this repo are stubs or metadata; behavior lives in quill-cloud-proxy. Change capability lists here (image_generation.py, speech.py, transcription.py, web_fetch.py) and the gateway must agree; drift is called out as a security bug (image_generation.py:3-6).
  2. trustedrouter/auto has no privacy floor; only zdr/e2e/confidential (or provider.min_privacy) enforce one (catalog_data.py:2525-2532).
  3. Provider privacy flags default to "assume stored" (catalog_data.py:35-41). Never set ZDR/CC/E2EE without a citation.
  4. Most static JS is hand-written in src/trusted_router/static/; only 3 files compile from frontend/src. Do not edit static/dashboard.js (build output, ESLint-ignored).
  5. Token Exchange market additions must follow sites/token-exchange/ADDING-MARKETS.md (AGENTS.md:5-8).
  6. Root contains stray artifacts (settled 0 bytes, fulltest.out, aws_ses_followup.md).