SZL RouterControl interface
CONTROL PLANE · CHECKING

SOVEREIGN-FIRST · OPENAI-COMPATIBLE · RECEIPT-BOUND

Route by policy.
Inspect every hop.

A fail-closed inference gateway with deterministic policy, bounded provider attempts, and inspectable answer receipts. Configuration, completed inference, and source identity each have their own evidence.

API contract

CONFIGURATION ADMISSION

Readiness boundaries

EVIDENCE BY LAYER

Control interface

Checking control readiness.

Inference configuration

Checking configuration admission.

Local provider

Checking local provider configuration.

A local provider must be configured on the router host.

Model identity

Checking model identity.

A model alias does not identify loaded weights.

Configured inference does not establish provider reachability, loaded model identity, or a completed answer. Local model observations are snapshots; refresh the registry to read current residency. Send a request below to inspect its outcome.

Registry—
Providers—
Egress—
Plan receipt—

POLICY INPUT

Plan a route

Choose a listed alias or enter one to inspect policy. A listed alias does not establish a loaded model.

No provider bound. Policy may choose any eligible provider.

SELECTION EVIDENCE

Candidate ladder

NOT RUN
No route plan has been computed.

Policy rank includes candidates with unavailable credentials. A first-ranked provider is a plan choice; execution may skip it or fail over.

BOUNDED INFERENCE

Send a completion

NOT RUN

Use the router caller credential. The field is cleared on dispatch and the token is sent only to this router in the authorization header.

Uses the model, classification, and cost policy above. The router may contact an admitted local or remote provider. Inference can spend provider credits. A bounded route may take up to roughly 11 minutes; duplicate submissions are disabled.

Assistant output

No answer received.

Provider attempts

  1. No attempt evidence received.

Completion model identity

UNAVAILABLE · no completion received

No loaded model identity evidence received.

CONTENT CONSISTENCY

Answer receipt verification

UNAVAILABLE

UNSIGNED_HONEST · These hashes bind content. A successful response may include a model identity claim, but signer and loaded weight identity require separate verification. Verification is performed by this router, with no independent witness.

No consistency checks received.
Exact completion or failure receipt
No receipt received.

SEPARATE PROVIDER ALLOWANCES

Free-tier evaluation options

Read-only research, not free tokens added to Codex. Inspect exact models, dated source claims and disabled configuration proposals. Nothing here registers a provider, sends a prompt, reads a key or enables a paid fallback.

NOT REQUESTED · account eligibility, quota and model quality unverified

Account-specific zero billing, remaining quota, disclosure rights and native synthetic tests must qualify separately before any activation. Cost tier zero is an ordinal, not a dollar cap. Existing completion and provider controls are unchanged.

ALLOWLISTED REGISTRY

Provider readiness

SECRETS NEVER SHOWN

EXACT JSON

Plan receipt

Waiting for a policy input.

REPORTED SOURCE

Source evidence

EXTERNAL READBACK REQUIRED
Checking source evidence.

A reported revision and file hashes support inspection. Exact deployed source still requires comparison with canonical GitHub bytes.

01

Default deny

Egress is off until a validated provider registry, caller credential, and explicit enable flag converge. HTTPS providers also require an exact hostname allowlist and upstream credential.

02

Sovereignty first

Eligible candidates sort by sovereignty, priority, cost, then stable provider identity. Arrival order never chooses the route.

03

Receipt per answer

Request, plan, attempts, provider, upstream model, response, and elapsed time are committed without recording secret material.