Platform repos

quill-cloud-proxy and the other infrastructure repos in Lore-Hex.

Research snapshot: 2026-10-19. Sources: gh api repos/Lore-Hex/<repo> (metadata, commits, contributors), shallow clones (git clone --depth 1) read without building or running anything, and cross-references in quill-router (src/trusted_router/routes/internal/gateway.py, README.md, tests/test_provider_check_contract_parity.py).

"Size" is the GitHub repo size (KB, includes history/assets). LOC counts are raw line counts per language in the shallow clone, including tests and excluding third_party/ and node_modules/.

1. Summary table

Main takeaways:

• quill-cloud-proxy is the only repo here on the production request path besides quill-router itself. The other repos are SDK-level clients (onprem, AllRouter, BurstyRouter, Fusion-Draco, SREChat agents), supply-side tooling (confidential-stack, neocloud, provider-check, reverse-harness), mirrors (lightning-router), or unrelated/dormant (OpenChat, trustedrouter-eu).
• Almost everything is written by one engineer, Joseph Perla (jperla). Bus factor is effectively 1 across the whole platform.
• License mix: BUSL-1.1 for the moat (proxy, infra, lightning), Elastic-2.0 for local routers, Apache-2.0 for ecosystem/supply-side, AGPL for chat.

2. Deep dive: quill-cloud-proxy

2.1 What it is

The prompt-handling data plane of TrustedRouter. It is the code behind api.trustedrouter.com (alias api.quillrouter.com). quill-router is the control plane (keys, billing, catalog, routing decisions, Spanner). It never sees prompts. quill-cloud-proxy is the attested gateway. Its stated rule: "The signed workload image is the boundary." The control-plane client package doc says it "sends API-key lookup hashes, model/routing preferences, and token counts; it never sends prompt or completion text."

Created 2026-04-28. Pushed several times per day. CI badges: ci.yml, deploy-enclave-gcp.yml, publish-trust-page.yml.

2.2 Layout

Go build tags choose the cloud and provider set at compile time: cloud_aws,llm_bedrock, cloud_aws,llm_multi, cloud_gcp,llm_vertex, cloud_gcp,llm_multi, cloud_azure,llm_multi. Direct dependencies are kept small: AWS SDK (Bedrock), hf/nsm, mdlayher/vsock, x/crypto, x/net.

2.3 Public surface (served inside the enclave)

/v1/chat/completions, /v1/responses (+ /input_tokens, /compact), /v1/messages (Anthropic), /v1/embeddings, /v1/images/*, /v1/audio/{speech,transcriptions}, /v1/videos, /v1/batches, /v1/files, /v1/models, /v1/key, /v1/decide, /v1/evaluate, /v1/tools/fetch, and /attestation?nonce= (nonce-bound evidence that also binds the workload TLS cert). The request boundary is an allowlist: unknown fields return 400 with error.param, and known-but-unsupported OpenRouter controls return 501 not_supported_in_alpha. provider.data_collection is forced to deny.

2.4 Control-plane contract (enclave to quill-router)

• Base URL: TR_CONTROL_PLANE_BASE_URL, or the bootstrap TrustedRouterBaseURL. Routes are mounted under /v1 in quill-router (routes/internal/gateway.py).
• Auth: shared secret header x-trustedrouter-internal-token (TR_INTERNAL_GATEWAY_TOKEN). On GCP it is loaded from Secret Manager as QUILL_TRUSTEDROUTER_INTERNAL_SECRET, behind the attestation gate.
• Endpoints the enclave calls, ranked by how often the client code references them:

• Money-safety rule (internal/trustedrouter/endpoints.go): endpoints are an ordered list, but production configures one billing authority. Failover to a later endpoint is allowed only on a tagged dial failure, because then no request byte could have reached a server. Any later failure is ambiguous, and re-sending could escrow or bill twice. Settle and refund are pinned to the authority that created the hold.
• 402 insufficient_credits backoff (QUILL_BILLING_402_BACKOFF_MS, default 5 s): identical denied requests are answered locally for one window. The cache keys on digests only and holds at most 4096 entries.
• Spend lease (internal/spendlease): a JWS-signed local-admission budget (TTL ≤ 60 s) so the enclave can eventually admit without a synchronous authorize round-trip. Stage A is shadow-only. Stage C is gated behind a separately measured flag.
• Shared contracts with quill-router: billingv1 consumes the same testdata/async_settlement/billing_v1.json fixtures, SHA-pinned, with Python-compatible canonical JSON hashing. Signed receipts follow docs/design/signed-receipts-wire-format.md. Production rollouts use a coordinator loaded from a pinned quill-router commit and SHA (tools/cloud-rollout-source.json), under a cross-repo "two-cloud limit": at most two clouds change at once while a third stays healthy.

2.5 Per-cloud trust posture

2.6 Build, release, attestation reproducibility

• Local dev: make sync (uv), make check (ruff, mypy --strict, pytest for the parent; go build/vet/lint/test across all five tag sets; deploy-script guards), make run-mock (parent + mock enclave on a Unix socket, localhost:8443).
• AWS reproducibility: tools/verify-pcr0.sh runs docker buildx --no-cache --platform linux/amd64 with the exact release build args (BUILD_TAGS=cloud_aws,llm_multi, QUILL_TLS_MODE=acme, QUILL_API_HOST=api-aws.trustedrouter.com) and then nitro-cli describe-eif, and compares the result to trust-page/pcr0.txt. A test (tools/test_verify_pcr0_build_args.py) fails if verify and release args drift.
• GCP release: make gcp-release (tools/release-gcp.sh) builds Dockerfile.enclave.gcp.multi, pushes to us-central1-docker.pkg.dev/quill-cloud-proxy/quill/enclave-multi:gcp-release-<sha>, resolves the OCI digest, and writes the trust files. deploy-enclave-gcp.yml waits for CI green on the same commit, runs offline Stage D gates, builds in Cloud Build, writes and commits trust artifacts, waits for the signed public trust set, reserves GCP across both repos, then rolls each region in turn: drain DNS, roll MIG, attest healthy, per-instance streaming gate, synthetic canary.
• Signing: each plane's records are signed by publish-trust-{gcp,aws,azure}.yml under that plane's identity, which produces .bundle files and explains the ~1100 bot commits. Publishers refuse unsigned or mismatched copies (check-trust-signatures.py, check-trust-copies.py). AWS and Azure records are captured from live attestations with capture-plane-measurements.py.
• Client verification: compare the live Confidential Space JWT submods.container.image_digest claim to image-digest-gcp.txt. The SDKs, and the "device service" mentioned in the README, check that the cert in the TLS session is the one bound in the nonce'd attestation before sending a prompt. The flow is PCR0/digest → attestation doc → cert fingerprint → TLS session.

2.7 Component diagram

flowchart LR
  subgraph Client
    SDK[OpenAI / TR SDKs<br/>browser, BurstyRouter, onprem...]
  end
  subgraph Edge
    DNS[Geo DNS / Cloudflare<br/>api.trustedrouter.com]
    NLB[TCP passthrough LB<br/>AWS NLB / GCP LB]
  end
  subgraph TEE["Attested workload (quill-cloud-proxy enclave-go)"]
    TLS[enclavetls<br/>ACME cert, key in TEE]
    HTTP[cmd/enclave HTTP router<br/>allowlist validation]
    ATT[attestation<br/>/attestation?nonce]
    TRC[internal/trustedrouter<br/>control-plane client]
    BYOK[byokcache<br/>KMS unwrap + AES-GCM]
    LLM[internal/llm<br/>multi-provider dispatcher]
    WS[websearch / webfetch<br/>Exa in-enclave]
    RCPT[receipt signer]
    BOOT[bootstrap<br/>attested secret fetch]
  end
  SIDE[attest-sidecar<br/>Tinfoil / NEAR / Chutes verifier]
  PARENT[parent/ Python<br/>AWS-only TCP-vsock pump, usage]
  CP[(quill-router control plane<br/>/v1/internal/gateway/*<br/>Spanner)]
  SM[(Secret Manager / KMS / Key Vault<br/>attestation-gated)]
  PROV[Upstream providers<br/>Anthropic, Vertex, Bedrock, Azure,<br/>OpenRouter, confidential providers]
  TRUST[trust-page<br/>trust.trustedrouter.com<br/>signed digests / PCR0 / hostdata]

  SDK --> DNS --> NLB --> TLS --> HTTP
  NLB -. AWS only .-> PARENT -. vsock .-> TLS
  SDK -. verify .-> ATT
  SDK -. compare .-> TRUST
  HTTP --> TRC --> CP
  HTTP --> LLM --> PROV
  HTTP --> WS
  HTTP --> RCPT
  LLM --> BYOK --> SM
  LLM -. unix socket .-> SIDE
  BOOT --> SM
  BOOT -. internal token .-> TRC

flowchart LR
  subgraph Client
    SDK[OpenAI / TR SDKs<br/>browser, BurstyRouter, onprem...]
  end
  subgraph Edge
    DNS[Geo DNS / Cloudflare<br/>api.trustedrouter.com]
    NLB[TCP passthrough LB<br/>AWS NLB / GCP LB]
  end
  subgraph TEE["Attested workload (quill-cloud-proxy enclave-go)"]
    TLS[enclavetls<br/>ACME cert, key in TEE]
    HTTP[cmd/enclave HTTP router<br/>allowlist validation]
    ATT[attestation<br/>/attestation?nonce]
    TRC[internal/trustedrouter<br/>control-plane client]
    BYOK[byokcache<br/>KMS unwrap + AES-GCM]
    LLM[internal/llm<br/>multi-provider dispatcher]
    WS[websearch / webfetch<br/>Exa in-enclave]
    RCPT[receipt signer]
    BOOT[bootstrap<br/>attested secret fetch]
  end
  SIDE[attest-sidecar<br/>Tinfoil / NEAR / Chutes verifier]
  PARENT[parent/ Python<br/>AWS-only TCP-vsock pump, usage]
  CP[(quill-router control plane<br/>/v1/internal/gateway/*<br/>Spanner)]
  SM[(Secret Manager / KMS / Key Vault<br/>attestation-gated)]
  PROV[Upstream providers<br/>Anthropic, Vertex, Bedrock, Azure,<br/>OpenRouter, confidential providers]
  TRUST[trust-page<br/>trust.trustedrouter.com<br/>signed digests / PCR0 / hostdata]

  SDK --> DNS --> NLB --> TLS --> HTTP
  NLB -. AWS only .-> PARENT -. vsock .-> TLS
  SDK -. verify .-> ATT
  SDK -. compare .-> TRUST
  HTTP --> TRC --> CP
  HTTP --> LLM --> PROV
  HTTP --> WS
  HTTP --> RCPT
  LLM --> BYOK --> SM
  LLM -. unix socket .-> SIDE
  BOOT --> SM
  BOOT -. internal token .-> TRC

2.8 Request sequence (chat completion, synchronous settlement)

sequenceDiagram
  autonumber
  participant C as Client (SDK)
  participant G as Gateway enclave (quill-cloud-proxy)
  participant CP as Control plane (quill-router)
  participant DB as Spanner (credits / reservations)
  participant P as Upstream provider

  opt First connection / verify
    C->>G: GET /attestation?nonce=N (TLS terminated in enclave)
    G-->>C: CS JWT / Nitro doc / MAA token binding N + TLS cert
    C->>C: compare image_digest/PCR0 to trust.trustedrouter.com
  end
  C->>G: POST /v1/chat/completions (Bearer sk-tr-..., prompt)
  G->>G: allowlist validate body, hash key -> api_key_lookup_hash
  G->>G: 402 backoff cache check (digest only)
  G->>CP: POST /v1/internal/gateway/authorize<br/>x-trustedrouter-internal-token<br/>{lookup_hash, model, provider prefs, est tokens, idempotency_key}
  CP->>DB: lookup key, limits, price, reserve credits (hold)
  CP-->>G: Authorization {authorization_id, reservation, route_candidates,<br/>provider/upstream_model, BYOK envelope?, cap_micro, billing snapshot}
  opt BYOK
    G->>G: KMS-unwrap DEK, AES-GCM decrypt provider key (memory TTL)
  end
  G->>P: provider request (prompt leaves only to provider)
  alt 429/5xx before first byte
    G->>P: next route candidate
  end
  P-->>G: stream tokens + usage
  G-->>C: OpenAI-format SSE chunks, [DONE]
  alt success
    G->>CP: POST /v1/internal/gateway/settle {authorization_id, usage, cost}
    CP->>DB: capture actual, release remainder
  else upstream failure
    G->>CP: POST /v1/internal/gateway/refund {authorization_id, status, error_type}
    CP->>DB: release hold
  end
  Note over G,CP: Only metadata crosses this edge. No prompt or completion text.<br/>Settle/refund pinned to the same authority that created the hold.

sequenceDiagram
  autonumber
  participant C as Client (SDK)
  participant G as Gateway enclave (quill-cloud-proxy)
  participant CP as Control plane (quill-router)
  participant DB as Spanner (credits / reservations)
  participant P as Upstream provider

  opt First connection / verify
    C->>G: GET /attestation?nonce=N (TLS terminated in enclave)
    G-->>C: CS JWT / Nitro doc / MAA token binding N + TLS cert
    C->>C: compare image_digest/PCR0 to trust.trustedrouter.com
  end
  C->>G: POST /v1/chat/completions (Bearer sk-tr-..., prompt)
  G->>G: allowlist validate body, hash key -> api_key_lookup_hash
  G->>G: 402 backoff cache check (digest only)
  G->>CP: POST /v1/internal/gateway/authorize<br/>x-trustedrouter-internal-token<br/>{lookup_hash, model, provider prefs, est tokens, idempotency_key}
  CP->>DB: lookup key, limits, price, reserve credits (hold)
  CP-->>G: Authorization {authorization_id, reservation, route_candidates,<br/>provider/upstream_model, BYOK envelope?, cap_micro, billing snapshot}
  opt BYOK
    G->>G: KMS-unwrap DEK, AES-GCM decrypt provider key (memory TTL)
  end
  G->>P: provider request (prompt leaves only to provider)
  alt 429/5xx before first byte
    G->>P: next route candidate
  end
  P-->>G: stream tokens + usage
  G-->>C: OpenAI-format SSE chunks, [DONE]
  alt success
    G->>CP: POST /v1/internal/gateway/settle {authorization_id, usage, cost}
    CP->>DB: capture actual, release remainder
  else upstream failure
    G->>CP: POST /v1/internal/gateway/refund {authorization_id, status, error_type}
    CP->>DB: release hold
  end
  Note over G,CP: Only metadata crosses this edge. No prompt or completion text.<br/>Settle/refund pinned to the same authority that created the hold.

3. Per-repo sections

3.1 quill-cloud-infra

• Purpose: Terraform for quill-cloud-proxy. AWS us-east-1 (envs/prod), AWS EU eu-west-3 (envs/aws-eu-prod), Azure uaenorth analytics (envs/azure-prod), Azure TEE scaffolding (envs/azure-tee), GCP (envs/gcp-prod, four enclave regions, analytics in us-central1).
• Key dirs: modules/{network,compute,alb,nlb,kms,ecr,dynamodb,iam,s3,github-oidc,cloudtrail,aws,azure,gcp}, envs/*, gcp/bringup.sh.
• Design rules worth knowing: each cloud keeps its Terraform state in that cloud, so an AWS outage cannot block Azure fixes. Pre-existing resources are imported, never created (each env has import.sh). Terraform owns the static half of the GCP fleet (MIG shells, service account, firewall) and ignores template versions. The measured half (instance templates carrying image digests) and Azure enclave container groups stay in quill-cloud-proxy/tools because widening and narrowing attestation pins cannot be expressed in plan/apply. It recently adopted the Spanner instance and owns its autoscaling policy.
• Run: a one-time bootstrap creates the state bucket and lock table, then terraform apply -target=module.github_oidc, and later applies run from GitHub Actions OIDC.
• License: BUSL-1.1. Activity: last main commit 2026-08-25.

3.2 trustedrouter-confidential-stack

• Purpose: lets GPU owners run a TR-compatible endpoint with TLS terminated inside the protected workload and CPU/GPU evidence bound to the TLS key. Tiers: standard, attested, attested+custody.
• Key dirs: charts/confidential-inference (vLLM/SGLang + shim, Helm is the source of truth), kustomize/{base,coco-snp,coco-tdx} (generated, drift-checked), cmd/trcs (shim, preflight, check-endpoint, lint-manifests), internal/{shim,attest,preflight,checkendpoint,manifestlint}, deploy/dstack, docs/{threat-model,attestation-protocol,architecture,hardware,kubernetes-coco}.md.
• Run: make all, make e2e-kind (kind cluster with a stub model), helm install inference charts/confidential-inference -f examples/values-dev-gpu.yaml.
• Maturity: alpha. The README says outright that nothing has run on real CC hardware yet. Relying-party verification is explicitly out of scope; it belongs in the TR gateway (quill-cloud-proxy).

3.3 token-exchange-neocloud-in-a-box

• Purpose: an 8-GPU TDX + NVIDIA CC "neocloud" whose nodes are independently verifiable and listed on TR and the NY Token Exchange. The first operator is Hixtube. A local pilot runs Qwen3-0.6B.
• Key dirs: cmd/{nib,nib-catalog,nib-pilot-api,nib-domain-check}, internal/{verify,evidence,protocol,catalog,modelpack,pilotapi}, guest/, host/, image/, models/{glm-5.3,...}, evidence/p0..p3 (committed run evidence), PLAN.md, AGENTS.md.
• Run: make check && make build && ./build/nib --help.
• Relation: consumes tr-attestation/v0 from confidential-stack. Pilot passes provider-check (18 checks, Catalog v2). The "TrustedRouter generic verifier" is phase P4, not started. Pre-alpha.

3.4 trustedrouter-onprem

• Purpose: self-hosted gateway (OpenAI-compatible local API, per-key budgets, aliases, routing policy, trace ingestion/evals) with TR as its only hosted lane. It never silently falls back to another public router.
• Stack: Python package exp (kept for upstream sync), CLI tr-onprem. Upstream is Experiential (commit 121d8888).
• Run: pip install git+https://github.com/Lore-Hex/trustedrouter-onprem.git, TRUSTEDROUTER_API_KEY=sk-tr-v1-... tr-onprem login && tr-onprem. Dev: uv sync --extra dev; uv run ruff check .; uv run ty check; uv run pytest -q.
• Relation: plain API client of https://api.trustedrouter.com/v1. Most commits are upstream syncs.

3.5 trustedrouter-provider-check

• Purpose: prospective providers self-test against the exact contract the gateway enforces. Tiers 1-4 gate (catalog, billed sweep, chat semantics, strict SSE / usage / [DONE] / first-delta deadline / signed receipts). Tiers 5-6 are advisory (tools, structured output, perf).
• Key dirs: src/tr_provider_check/{contract.py,snapshot.py,checks/,data/contract_snapshot.json}.
• Run: uv run trustedrouter-provider-check --base-url https://host/v1 --model X [--tier 6 --json out.json].
• Relation (important): contract.py is copied byte-for-byte from quill-router symbols and identified by a content-hash contract_version. On the quill-router side, tests/test_provider_check_contract_parity.py fails if production symbols change. The fix is to re-run scripts/export_provider_check_contract.py and open a sync PR here.

3.6 lightning-router

• Purpose: public, BUSL source mirror of LightningRouter (lightningrouter.ai): pay BTC over Lightning, get TR USD credits and an API key without email.
• Relation: not a separate service or ledger. The backend is in quill-router (routes/internal/lightning.py, services/lightning.py, storage_lightning.py, tests/conformance/test_lightning.py). This repo is auto-published by github-actions[bot] after green quill-router CI, and SOURCE.json holds the upstream commit plus per-file SHA-256. Do not open PRs here; change quill-router instead.
• Run: see experiments/lightning_router/README.md.

3.7 reverse-harness

• Purpose: "be a model on TrustedRouter". Modes: proxy (front Ollama/vLLM/llama.cpp), exec (spawn an agent per request, JSONL contract), human (browser dashboard where typing pauses become chunks). Uses a Cloudflare quick tunnel.
• Contract (CONTRACT.md v1): register via POST /v1/user-models (management key) and receive a signing_secret once. clock-in triggers a signed canary probe, then heartbeat / clock-out. Three consecutive owner faults clock you out. Kinds machine / agent / human have different price bounds and budgets. Not attested, not ZDR. Payout is 70% in credits.
• Run: npx reverse-harness --mode proxy --upstream http://localhost:11434/v1 with TR_API_KEY, --model trustedrouter/user-<slug>, TR_SIGNING_SECRET.
• Relation: the attested gateway calls out to the harness (see docs/design/user-provided-model-egress.md and resolve-custom-model in the proxy). Owner APIs live in quill-router.

3.8 TrustedRouter-Fusion-Draco

• Purpose: benchmark and marketing artifact. An agentic DRACO harness (web_search + web_fetch + bash), Gemini-3.1-Pro judge, and native trustedrouter/fusion generator. Headline: frontier + open-weights panel with a MiniMax-M3 fuser = 71.6, versus OpenRouter's best published 69.0.
• Run: uv sync (pulls trusted-router-py), then uv run python scripts/draco_agentic_solo.py ..., draco_rejudge.py, draco_report.py, draco_client_fusion.py.
• Relation: API client. Informs the fusion feature (fusion.go in the proxy). Dormant since June/Aug.

3.9 SREChat

• Purpose: multi-master BEAM chat that survives losing a cloud. One master per cloud (GCP / AWS / Azure). Coordination-free 53-bit IDs, a Redis-Stream oplog per region, convergent merges, and a chaos test in CI. Exposes the CometChat wire protocol.
• Agent: agent/sre_agent.py (stdlib Python) runs one agent per cloud with different default models (Kimi K3, GLM 5.2-Fast, DeepSeek). Each falls back to trustedrouter/auto. Read-only by default. Handles incident escalation, email, and APNs.
• Run: mix deps.get && mix test && PORT=4000 ... mix run --no-halt, or docker compose up --build.
• Relation: internal ops/coordination tool for TR's 3-cloud ops. It consumes the TR API and does not share a contract.

3.10 OpenChat

• AGPL CometChat-compatible chat server (Elixir, Redis), the ancestor of SREChat. No TR integration. Stable since Aug 2026.

3.11 AllRouter

• Purpose: one local endpoint (:8383) for local and cloud models over the OpenAI and Anthropic APIs, with concurrency, spend, privacy and fallback policy. The BackupRouter preset lets Claude Code Desktop/CLI and Codex use TR with Kimi K3 / GLM 5.2 recovery routes.
• Run: brew tap Lore-Hex/homebrew-tap && brew install allrouter, or go install github.com/Lore-Hex/AllRouter/cmd/allrouter@latest.
• License: Elastic-2.0. Dormant since 2026-08-16.

3.12 BurstyRouter

• Purpose: local-first proxy that sends to the local rig first and bursts to TR when local is full, failing, or missing the model. Routing directives include local/<name>, provider.only:["local"], and aliases. Its marketing describes the trustedrouter/zdr and trustedrouter/e2e privacy routes.
• Run: brew install burstyrouter, then burstyrouter. License: Elastic-2.0. Dormant. Functionally superseded by AllRouter.

3.13 trustedrouter-eu

• Purpose: a single index.html + CNAME on GitHub Pages that redirects eu.trustedrouter.com to trustedrouter.com/eu. No license file. Nothing to maintain.

4. Ecosystem diagram

flowchart TB
  subgraph Clients["Demand-side clients (public API, sk-tr keys)"]
    ONP[trustedrouter-onprem<br/>Python self-hosted gateway]
    ALL[AllRouter / BackupRouter<br/>Go]
    BUR[BurstyRouter<br/>Go]
    FUS[TrustedRouter-Fusion-Draco<br/>benchmark]
    SRE[SREChat agents<br/>Elixir + Python]
    LNR[lightning-router<br/>mirror of LN funding app]
  end

  subgraph Core["Core platform"]
    QCP[quill-cloud-proxy<br/>attested gateway<br/>api.trustedrouter.com]
    QR[quill-router<br/>control plane, billing, catalog<br/>trustedrouter.com]
    INFRA[quill-cloud-infra<br/>Terraform AWS/GCP/Azure]
    TRUST[trust.trustedrouter.com<br/>signed measurements]
  end

  subgraph Supply["Supply-side / provider tooling"]
    PCHK[trustedrouter-provider-check<br/>contract conformance]
    TRCS[trustedrouter-confidential-stack<br/>trcs shim + Helm]
    NIB[token-exchange-neocloud-in-a-box<br/>TDX + NVIDIA CC nodes]
    RH[reverse-harness<br/>user-provided models]
  end

  OC[OpenChat] -->|forked into| SRE
  EU[trustedrouter-eu] -->|redirect| QR

  ONP & ALL & BUR & FUS & SRE -->|/v1 inference| QCP
  LNR -.->|source exported from| QR
  QCP -->|/v1/internal/gateway/* authorize/settle/refund| QR
  QCP -->|publishes| TRUST
  INFRA -->|provisions| QCP
  INFRA -.->|Spanner instance| QR
  QR -->|vendored contract + parity test| PCHK
  TRCS -->|tr-attestation/v0| NIB
  NIB -->|must pass| PCHK
  TRCS -->|must pass| PCHK
  PCHK -->|apply to marketplace| QR
  NIB & TRCS -.->|serve as confidential upstream| QCP
  RH -->|register / clock-in owner API| QR
  QCP -->|signed push requests| RH

flowchart TB
  subgraph Clients["Demand-side clients (public API, sk-tr keys)"]
    ONP[trustedrouter-onprem<br/>Python self-hosted gateway]
    ALL[AllRouter / BackupRouter<br/>Go]
    BUR[BurstyRouter<br/>Go]
    FUS[TrustedRouter-Fusion-Draco<br/>benchmark]
    SRE[SREChat agents<br/>Elixir + Python]
    LNR[lightning-router<br/>mirror of LN funding app]
  end

  subgraph Core["Core platform"]
    QCP[quill-cloud-proxy<br/>attested gateway<br/>api.trustedrouter.com]
    QR[quill-router<br/>control plane, billing, catalog<br/>trustedrouter.com]
    INFRA[quill-cloud-infra<br/>Terraform AWS/GCP/Azure]
    TRUST[trust.trustedrouter.com<br/>signed measurements]
  end

  subgraph Supply["Supply-side / provider tooling"]
    PCHK[trustedrouter-provider-check<br/>contract conformance]
    TRCS[trustedrouter-confidential-stack<br/>trcs shim + Helm]
    NIB[token-exchange-neocloud-in-a-box<br/>TDX + NVIDIA CC nodes]
    RH[reverse-harness<br/>user-provided models]
  end

  OC[OpenChat] -->|forked into| SRE
  EU[trustedrouter-eu] -->|redirect| QR

  ONP & ALL & BUR & FUS & SRE -->|/v1 inference| QCP
  LNR -.->|source exported from| QR
  QCP -->|/v1/internal/gateway/* authorize/settle/refund| QR
  QCP -->|publishes| TRUST
  INFRA -->|provisions| QCP
  INFRA -.->|Spanner instance| QR
  QR -->|vendored contract + parity test| PCHK
  TRCS -->|tr-attestation/v0| NIB
  NIB -->|must pass| PCHK
  TRCS -->|must pass| PCHK
  PCHK -->|apply to marketplace| QR
  NIB & TRCS -.->|serve as confidential upstream| QCP
  RH -->|register / clock-in owner API| QR
  QCP -->|signed push requests| RH

5. Onboarding notes / risks

1. Read quill-cloud-proxy alongside quill-router. Billing correctness is split across the Python authorize/settle handlers and the Go client (internal/trustedrouter, billingv1). The repos share fixtures, so a change in one usually needs a fixture or parity update in the other.
2. Deploys are cross-repo coordinated (two-cloud limit, shared journal, coordinator pinned by SHA). Never delete or expire the journal to unblock a rollout.
3. Measurement changes break secret access by design. Any workload code or build-arg change produces a new digest/PCR0/hostdata, and the old one must stay in the accepted set until the new one is attested and published.
4. Bus factor ~1: virtually all human commits across these 14 repos are by jperla.
5. Confidential supply-side is pre-hardware: confidential-stack and neocloud have not run on real CC hardware. Do not market routes from them as "confidential" yet.
6. Mirrors: do not edit lightning-router directly; it is generated from quill-router.