{"name":"Host.Rodeo","summary":"Agent-first LLM gateway — one OpenAI-compatible token, auto-routed to the fit-for-purpose source (free -> local/customer-owned -> paid), always fulfilled, with a signed receipt on every call showing what it would have cost elsewhere.","api":{"base":"/v1","compatible_with":"openai","auth":"Bearer token"},"inference_authority":{"version":"private-chat-v1","allowed_requests":[{"method":"POST","path":"/v1/chat/completions","model":"auto","transports":["buffered","sse"]},{"method":"GET","path":"/v1/key/self","purpose":"this key's effective policy"},{"method":"DELETE","path":"/v1/key/self","purpose":"revoke only this key"}],"privacy":"secret","allowed_tiers":["local"],"delegation":false,"account_authority":false,"max_request_bytes":8388608,"issuance":{"method":"POST","path":"/v1/keys/inference","authorization":"member session","body":{"authority":"private-chat-v1","private":true,"allowed_tiers":["local"]}},"legacy_keys":"Existing unscoped member keys keep their existing account permissions.","revocation":"New requests are denied after revocation; already admitted work is not cancelled."},"receipts_verify":{"endpoint":"POST /v1/receipts/verify","auth":"none — public on purpose: anyone handed a receipt can check it without trusting us","send":"POST the answer's X-Rodeo-* response headers as one JSON object — every header, with X-Rodeo-Signature among them (a streamed chunk carrying a top-level \"receipt\":{...} — the final finish_reason chunk, or the opt-in rodeo.receipt usage frame — and a {\"headers\":{...}} wrapper are accepted as-is; non-X-Rodeo fields are ignored)","signed_over":"every x-rodeo-* header except the signature itself, lowercased and sorted — so the headers exactly as your client received them verify unchanged","answers":{"genuine_true":"byte-for-byte what the ranch wrote","genuine_false":"a well-formed receipt that does NOT match — altered or not ours; a wrong payload shape is a 400 naming what to send, never a verdict"}},"value_statement":{"endpoint":"GET /v1/account/month/statement?month=YYYY-MM","auth":"session (signed-in member); owner-fenced — only your own rows","returns":"a signed value statement: every journaled row of the month with its price basis, anchor rates and as-of date, the surface's own totals, refusals by reason, and the verifier's name; reissuing an unchanged month returns the same statement_id","verify_offline":"tools/hostrodeo_cli/recompute.py statement.json --key <HR_RECEIPT_SIGNING_KEY> (exit 0 verified; 3 arithmetic agrees but unsigned)","reconciles_to_invoice":false},"stream_reliability":{"drills":{"header":"X-Rodeo-Drill","who":"any caller, on their OWN request only — a drill can never touch other traffic","vocabulary":{"die-before-token":"the stream opens and dies with zero content; the gateway absorbs it and your stream arrives from the next leg","die-after-chunks:N":"N real chunks then a mid-answer death — the honest failure shape (pair with the restart opt-in to rehearse recovery)","stall-first-token:S":"the first token waits S seconds — rehearse your own deadline","malformed-json":"the upstream emits non-JSON frames"},"honesty":"a drilled request carries X-Rodeo-Drill on its signed receipt; drilled deaths teach the fleet nothing and are excluded from quality figures by construction"},"restart":{"header":"X-Rodeo-Stream-Restart: allowed","what":"if the answering model dies AFTER your stream started, you receive one {\"object\":\"rodeo.restart\"} frame — discard what you have — and then a fresh, complete answer from the next model; never a splice","receipt":"X-Rodeo-Restarted-From and X-Rodeo-Discarded-Chars ride the signed receipt","default":"absent means a mid-answer death ends the stream honestly, exactly as before","bounds":"one restart per request, and the restart frame is only ever sent once the next leg's first token is in hand — a discard instruction with no fresh answer behind it is worse than an honest death, so it cannot happen"},"reading_disciplines":"two kinds of field, read at two times: HTTP response headers carry what is true at COMMIT (source, model, tier, custody, request id — log these at headers-time); the final finish_reason chunk carries the receipt with what is only knowable at the END (usage, cost, X-Rodeo-Drill, X-Rodeo-Restarted-From, X-Rodeo-Discarded-Chars, the signature). A mid-stream event cannot ride a header that was already sent.","log_the_request_id_at_headers_time":"X-Rodeo-Request-Id is present even on requests that later die mid-stream — log it when the headers arrive, not at completion, and every report you file carries its line"},"integration":{"canonical_base_url":"https://api.host.rodeo/v1","console_url":"https://host.rodeo","default_model":"auto","openapi":{"endpoint":"/v1/openapi.json","url":"https://api.host.rodeo/v1/openapi.json","source":"generated from this live contract"},"minimum_chat_call":{"method":"POST","endpoint":"/v1/chat/completions","headers":{"Authorization":"Bearer $KEY","Content-Type":"application/json"},"body":{"model":"auto","messages":[{"role":"user","content":"hi"}]}},"client_posture":["read /v1/contract during deploy/startup instead of hardcoding capabilities","send model='auto' — do not name a model and do not name a lane. Host.Rodeo reads what the request needs (tools, context length, vision, difficulty) and picks the source, the model and the tier for it. There is no faster/cheaper/longer variant of 'auto' to choose between","state only what WE cannot know — your own constraints: X-Rodeo-Sensitivity: high keeps a request on hardware you control and refuses rather than leak; X-Rodeo-Training: none routes only to providers that have said in writing they do not train on submitted data; X-Rodeo-Tiers fences which of free/local/paid may serve you. X-Rodeo-Anchor-In/-Out set your own baseline for the savings receipt","on a failure, branch on error.resolution (also the X-Rodeo-Resolution header) before you retry: 'wait' means a clock is running and retrying is right — retry_after_s carries the delay; 'needs-a-person' means no amount of waiting fixes it and retry_after_s is absent, because a number there would be a promise that waiting works; 'unknown' promises nothing. Page on 'needs-a-person', back off on 'wait'","log X-Rodeo-* receipt headers for savings, source, tier, auto objective, patience, net value, custody, and fallback proof","register /v1/webhooks for capability.changed and signal.resolved instead of polling"],"compat_covenant":{"policy":"Every request word this gateway has ever accepted keeps parsing. We remove words from the documentation, never from the parser: an integration that shipped against an older spelling keeps working without a change, forever.","why_we_stop_advertising":"A caller may tell us facts we cannot observe — how private their data is, what retention they require, which lanes they will pay for. A caller should not have to tell us conclusions we can derive: which model, which quality lane, what kind of work this is. Words of the second kind leave the documentation so that new integrations do not learn a habit this product exists to remove. They keep working for everyone who already sends them.","how_to_tell":"If a word you already send no longer appears anywhere in this contract, it is no longer advertised — and it still parses. Absence from the documentation is never removal from the parser. You do not need to change anything.","still_parsing_but_unadvertised":{"model_words":15,"sensitivity_values":0,"note":"Counts, not a list. A list would read as a menu, and choosing from one is the job this gateway takes off you. Send what you already send; it works."},"pinned_models":"A pinned model id always parses and is honoured exactly. It is also the one request shape that can cost you more than `auto` would have.","wire_protocols":{"/v1/chat/completions":"OpenAI-compatible chat, the native shape.","/v1/messages":"Anthropic Messages shape in and out — same routing, same ladder, same signed receipt headers. Send your key as `x-api-key` or `Authorization: Bearer`; both are read.","the_ruling":{"decided":"translation into the one door, not native passthrough","why":"A second wire protocol must not become a second product. Everything below the bytes is identical — the same eligibility filter, ranking, tier ladder, hedging, spend ceiling, signed receipt and error envelope — because the moment a door owns any routing of its own it starts to drift, and the drift is invisible to the caller who only ever uses that door. Translation is also the only choice that keeps the product's actual promise on this door: an Anthropic-shaped client failing over to a non-Anthropic model is the whole point, and a passthrough can only ever reach the one supplier whose dialect it is speaking.","the_alternative_we_did_not_take":"Native passthrough for lanes serving Anthropic weights: byte-for-byte fidelity and a config-only change for the caller, but it pins the request to one supplier, needs a second receipt and error path, and would have to fall back to translation the moment a competitor serves the failover — which is most of the time here.","what_does_not_cross":{"server_side_tools":"A tool with no `input_schema` runs on the provider's own infrastructure and has no client-side function behind it. We cannot execute it and do not pretend to: it is dropped and NAMED in `x_host_rodeo_unsupported_tools` on the response, because a silently ignored tool is somebody debugging their own prompt for an hour.","the_provider_error_shape":"Failures answer the one Host.Rodeo envelope, never a provider-shaped error body. One shape everywhere beats a faithful imitation on one door — see `error_shape`.","anything_not_listed_in_fields_carried":"Request fields outside `fields_carried` are not forwarded. They are not rejected either, so an SDK that always sends one keeps working."},"fields_carried":["max_tokens","messages","metadata","model","stop_sequences","stream","system","temperature","tool_choice","tools","top_p"]}},"error_shape":"Every failure on /v1 — including /v1/messages — answers the one Host.Rodeo error envelope: {\"error\": {message, type, retry_after_s, resolution, tries}}. Switch on `type`, honour `retry_after_s` (null means waiting will not help), and read `resolution` for whether this is terminal. We do not emit a second, provider-shaped error body: one shape everywhere beats a faithful imitation on one door.","how_you_learn_about_a_change":{"the_rule":"A change you have to notice is a change we got wrong. Nothing below is required reading to keep working — it is how to hear early when something moves.","pushed_to_you":{"register":"/v1/webhooks","events":{"signal.resolved":"the resolution of a feedback signal YOU sent (1:1)","capability.changed":"the platform's capability surface changed (new model/modality/profile) — re-read /v1/contract. Fires only on a MATERIAL change (debounced, coalesced); never on traffic/latency."},"why_prefer_it":"You are told once, when it happens, instead of asking all day."},"a_model_you_pinned_is_retiring":{"on_the_answer":"X-Rodeo-Model-Lifecycle rides the response that served — present only when we hold a retirement claim about that model.","ask_for_all_of_them":"GET /v1/models?lifecycle=deprecating","why_it_is_separate":"The contract surface does not change when one id starts winding down, so a pin can go stale while the version hash sits still. `auto` callers never need this — it is the cost of pinning."},"what_we_will_not_do":"Remove a request word from the parser, change what an existing field means, or retire a door you are using without it being visible here first. Adding is not a breaking change: treat unknown fields as ignorable and new `error.type` values as your default branch."}}},"generated_at":1789487236,"uptime_s":100130,"health":{"sources_total":22,"sources_available":18},"modalities":{"chat":{"endpoint":"/v1/chat/completions","sources":17,"paid_lane":{"paid_lane_costable":true,"capability":"chat","reason":"documented context and output limits at the supplier's token rates","refusal":null,"customer":"If free services and your own machines can't do chat, a paid backup can step in — Clint confirms the price before spending."}},"embedding":{"endpoint":"/v1/embeddings","sources":7,"paid_lane":{"paid_lane_costable":true,"capability":"embeddings","reason":"input tokens only, for the three reviewed OpenAI embedding models","refusal":null,"customer":"If free services and your own machines can't do embeddings, a paid backup can step in — Clint confirms the price before spending."},"stable":true,"default_model":"baai/bge-m3","models":["@cf/baai/bge-base-en-v1.5","@cf/baai/bge-large-en-v1.5","@cf/baai/bge-m3","@cf/baai/bge-small-en-v1.5","@cf/google/embeddinggemma-300m","@cf/pfnet/plamo-embedding-1b","@cf/qwen/qwen3-embedding-0.6b","Qwen3-Embedding-8B","alibaba/qwen3-embedding-0.6b","alibaba/qwen3-embedding-4b","alibaba/qwen3-embedding-8b","amazon/titan-embed-text-v2","bge-m3","bge-multilingual-gemma2","codestral-embed","codestral-embed-2505","cohere/embed-v4.0","embed-english-light-v3.0","embed-english-light-v3.0-image","embed-english-v3.0","embed-english-v3.0-image","embed-multilingual-light-v3.0","embed-multilingual-light-v3.0-image","embed-multilingual-v3.0","embed-multilingual-v3.0-image","embed-v4.0","google/gemini-embedding-001","google/gemini-embedding-2","google/text-embedding-005","google/text-multilingual-embedding-002","mistral-embed","mistral-embed-2312","mistral/codestral-embed","mistral/mistral-embed","models/gemini-embedding-001","models/gemini-embedding-2","models/gemini-embedding-2-preview","openai/text-embedding-3-large","openai/text-embedding-3-small","openai/text-embedding-ada-002","perplexity/pplx-embed-v1-0.6b","perplexity/pplx-embed-v1-4b","text-embedding-3-large","text-embedding-3-small","text-embedding-ada-002","voyage/voyage-3-large","voyage/voyage-3.5","voyage/voyage-3.5-lite","voyage/voyage-4","voyage/voyage-4-large","voyage/voyage-4-lite","voyage/voyage-code-2","voyage/voyage-code-3","voyage/voyage-finance-2","voyage/voyage-law-2"],"note":"embeddings are STABLE — pin a model for a FIXED vector dimension; 'auto' resolves to default_model deterministically (never drifts) and fails over only within the same model. The response header X-Rodeo-Embedding-Dim reports the dimension."},"rerank":{"endpoint":"/v1/rerank","sources":1,"paid_lane":{"paid_lane_costable":false,"capability":"reranking","reason":"no paid supplier in the portfolio publishes a rerank price the price feed carries","refusal":"price_unknown","customer":"This door uses free services and your own machines only — Clint can't confirm what a paid backup would charge for reranking, so he won't spend your money on it."}},"image":{"endpoint":"/v1/images/generations","sources":5,"paid_lane":{"paid_lane_costable":false,"capability":"image generation","reason":"the supplier publishes per-token AND per-image prices with no documented relationship (gpt-image-1), or no price at all (dall-e-3), so no finite bound is provable","refusal":"price_unknown","customer":"This door uses free services and your own machines only — Clint can't confirm what a paid backup would charge for image generation, so he won't spend your money on it."}},"audio_speech":{"endpoint":"/v1/audio/speech","sources":6,"paid_lane":{"paid_lane_costable":true,"capability":"speech","reason":"input characters at the documented per-1M-characters rate (tts-1, tts-1-hd)","refusal":null,"customer":"If free services and your own machines can't do speech, a paid backup can step in — Clint confirms the price before spending."},"request":{"input":"string","voice":"optional; see parameter_contracts","response_format":"optional; see parameter_contracts"},"note":"text-to-speech contracts expose source-declared voices, formats, and async-job support when available; unsupported requested values are rejected before upstream."},"audio_transcription":{"endpoint":"/v1/audio/transcriptions","sources":6,"paid_lane":{"paid_lane_costable":false,"capability":"transcription","reason":"billed per minute of audio, and the duration of an upload cannot be established before dispatch without decoding it","refusal":"price_unknown","customer":"This door uses free services and your own machines only — Clint can't confirm what a paid backup would charge for transcription, so he won't spend your money on it."}},"moderation":{"endpoint":"/v1/moderations","sources":6,"paid_lane":{"paid_lane_costable":false,"capability":"moderation","reason":"the model document publishes no price, and a zero bound is not evidence of a zero bill","refusal":"price_unknown","customer":"This door uses free services and your own machines only — Clint can't confirm what a paid backup would charge for moderation, so he won't spend your money on it."},"request":{"input":"string|array","model":"auto"},"response":{"model":"served model","results":[{"flagged":"boolean","categories":"object","category_scores":"object"}]},"note":"Content moderation is normalized to the OpenAI-compatible results[] shape; provider ids, raw policy blobs, and internal metadata are not returned."}},"chat_capabilities":{"tools":{"proven_by_sources":17},"json":{"proven_by_sources":15},"vision":{"proven_by_sources":16},"stop":{"proven_by_sources":7},"streaming":{"proven_by_sources":11},"logprobs":{"proven_by_sources":3},"n":{"proven_by_sources":2}},"routing":{"ladder":"free -> local/customer-owned -> paid","invisible_failover":true,"fidelity":"full OpenAI param pass-through; capable-source preference for soft params; unhonored soft params disclosed via X-Rodeo-Unhonored-Params; responses normalized to canonical OpenAI shape regardless of source"},"errors":{"envelope":"every /v1 failure returns {error:{message,type,resolution,retry_after_s,tries,request_id}}","resolution":{"wait":"a clock is running — retry. retry_after_s carries the delay when we measured one","needs-a-person":"no amount of waiting fixes it — something must be changed by somebody. It does NOT tell you WHAT: read `type` and `tries[].symptom` for that, and never infer a credential problem from this word alone. retry_after_s is ABSENT, because a number there would be a promise that waiting works","lower-the-floor-or-wait-for-coverage":"an X-Rodeo-Floor could not be honoured for a COVERAGE reason — the class has no certified bar yet, or the fleet cannot measurably clear it right now. Lower the floor, allow serve-best, or wait: coverage grows on its own. Reachable from both the floor gate and a floor header naming an uncertified class","unknown":"we could not read the failure. Promises nothing either way — do not infer 'wait'"},"header":"X-Rodeo-Resolution carries the same word, for a client that reads headers before bodies"},"enrichment":{"summary":"Grounding, source-cited research, follow-up chips, public media lookup, and discovery feeds behind the same authenticated /v1 gateway. Clients never call Vane, SearXNG, Serper, OpenRouter, paid providers, or local/customer-owned providers directly.","auth":"Bearer token","endpoint_convention":"route endpoint values beginning with /v1 are origin-root paths; join them against https://api.host.rodeo, not by appending them to canonical_base_url","routing":{"order":"owned/self-hosted -> free/local -> controlled external fallback","owned_first":true,"external_fallback":"used only when owned search/media/model paths are empty, unavailable, or below the request bar"},"slo_headers":{"X-Rodeo-Total-Ms":"server-side enrichment latency in milliseconds","X-Rodeo-Enrichment-Path":"owned/vane/native/public-media/fallback path used by the route","X-Rodeo-Degraded":"true only when we hand back an answer we KNOW is rough; a content problem fails over instead, so this is false in practice. For 'we rerouted', read X-Rodeo-Escalations","X-Rodeo-External-Fallback":"true when controlled external search/media fallback was used"},"safety":["public http(s) URLs only for media and discovery assets","no file:, data:, javascript:, localhost, or private-network URLs in public responses","dedupe and cap result arrays before returning them to clients","no provider internals, prompts, embeddings, scores, stack traces, raw payloads, or model names","empty arrays are valid when no safe public asset or item is available"],"routes":{"fast_search":{"endpoint":"/v1/search","method":"POST","request":{"query":"string"},"response":{"query":"string","results":"formatted grounded result block"},"purpose":"fast grounded lookup without a model-driven research loop","degrades":"503 if the search backend is unavailable"},"research":{"endpoint":"/v1/research","method":"POST","request":{"query":"string","sources":"optional array","mode":"speed|balanced|quality","maxSources":5},"unsupported_request_fields":{"model":"model:'auto' is tolerated and ignored; pinned models return 400"},"response":{"answer":"string","sources":[{"title":"string","url":"https://...","snippet":"string"}],"citationStatus":"cited|source_linked|uncited","citationPath":"vane|owned_search|owned_search_low_confidence|external_search_fallback|uncited","synthesisPath":"native|vane","synthesisStatus":"ok|timeout|exhausted|no_candidates","answerPath":"synthesis|source_digest","totalMs":"server-side latency in milliseconds"},"headers":{"X-Rodeo-Citation-Status":"cited|source_linked|uncited","X-Rodeo-Citation-Path":"vane|owned_search|owned_search_low_confidence|external_search_fallback|uncited","X-Rodeo-Synthesis-Path":"native|vane","X-Rodeo-Synthesis-Status":"ok|timeout|exhausted|no_candidates","X-Rodeo-Answer-Path":"synthesis|source_digest","X-Rodeo-Total-Ms":"server-side latency"},"purpose":"source-cited synthesis; speed/balanced use Host.Rodeo's native search-quality-gated synthesis path, quality tries the private Perplexica/Vane research path first and falls back to native when Vane is slow or unavailable","degrades":"returns a deterministic cited source digest when synthesis cannot finish; if no citations can be produced the answer is empty with citationStatus='uncited'"},"suggestions":{"endpoint":"/v1/suggestions","method":"POST","request":{"query":"string","answer":"optional string","sources":"optional source array","maxItems":4},"response":{"suggestions":["string"]},"purpose":"short follow-up question chips for product UIs","degrades":"503 when unavailable; empty array when the backend has no useful suggestions"},"public_images":{"endpoint":"/v1/images","method":"POST","request":{"query":"string","maxItems":3},"response":{"assets":[{"kind":"image","url":"https://...","sourceUrl":"https://...","title":"optional","alt":"optional"}]},"purpose":"public image lookup for venues, topics, and other public entities; not image generation","degrades":"503 when no media backend is callable; empty array when no safe public assets are found"},"public_videos":{"endpoint":"/v1/videos","method":"POST","request":{"query":"string","maxItems":3},"response":{"assets":[{"kind":"video","url":"https://...","sourceUrl":"https://...","title":"string","thumbnailUrl":"optional"}]},"purpose":"public video lookup for source-linked clips; not generated video","degrades":"503 when no media backend is callable; empty array when no safe public assets are found"},"discover":{"endpoint":"/v1/discover","method":"POST","request":{"topic":"string","city":"optional string","maxItems":5},"response":{"items":[{"title":"string","url":"https://...","source":"string","summary":"string","publishedAt":"optional"}]},"purpose":"source-linked current public items for a topic, geography, or category","degrades":"empty array when no source-linked public items are available"}}},"private_routing":{"available":false,"note":"sensitive/secret traffic routes to eligible self-hosted/customer-owned sources; fails closed (503) rather than leak","how_to_require_it":{"X-Rodeo-Sensitivity: high":"the strongest fence — only hardware you control may serve the request. Nothing leaves your machines, so retention and training are 'none' by construction","X-Rodeo-Training: none":"only providers that have STATED they do not train on submitted data. A provider that has said nothing is excluded — silence is not consent"},"unknown_means":"'unknown' on X-Rodeo-Retention or X-Rodeo-Trained-On means we have no recorded first-party statement from that provider — never that the answer is favourable. We do not invent a policy. Set one of the fences above and a provider we cannot vouch for is not offered your request"},"receipt_headers":["X-Rodeo-Fit","X-Rodeo-Tool-Fence","X-Rodeo-Repeatable","X-Rodeo-Loop","X-Rodeo-Budget-Trade","X-Rodeo-Financial-Request-Id","X-Rodeo-Platform-Actual-USD","X-Rodeo-Platform-Measured-USD","X-Rodeo-Platform-Held-USD","X-Rodeo-Financial-Attempts","X-Rodeo-Financial-Unresolved","X-Rodeo-Customer-Funded-Attempts","X-Rodeo-Source","X-Rodeo-Model","X-Rodeo-Tier","X-Rodeo-Saved-USD","X-Rodeo-Anchor","X-Rodeo-Anchor-As-Of","X-Rodeo-Anchor-Precision","X-Rodeo-Tokens-In","X-Rodeo-Tokens-Out","X-Rodeo-Anchor-Rate-In","X-Rodeo-Anchor-Rate-Out","X-Rodeo-Saved-Auditable","X-Rodeo-Verified","X-Rodeo-Unhonored-Params","X-Rodeo-Budget-Raised","X-Rodeo-Route","X-Rodeo-Route-Evidence","X-Rodeo-Model-Lifecycle","X-Rodeo-Model-Lifecycle-Evidence","X-Rodeo-Profile","X-Rodeo-Profile-Source","X-Rodeo-Custody","X-Rodeo-Local-Source","X-Rodeo-Constraint-Adherence","X-Rodeo-Auto-Objective","X-Rodeo-Auto-Objective-Readiness","X-Rodeo-Auto-Objective-Why","X-Rodeo-Auto-Objective-Source","X-Rodeo-Route-Explanation","X-Rodeo-Net-Value-USD","X-Rodeo-Provider","X-Rodeo-Region","X-Rodeo-Retention","X-Rodeo-Trained-On","X-Rodeo-Sovereign-Eligible","X-Rodeo-Receipt-Kind","X-Rodeo-Outcome","X-Rodeo-Refusal-Reason","X-Rodeo-Refusal-Explains","X-Rodeo-Content-Left-Ranch","X-Rodeo-Privacy-Declared","X-Rodeo-Privacy-Held","X-Rodeo-Resolution","X-Rodeo-Candidates","X-Rodeo-Hedges","X-Rodeo-Actual-USD","X-Rodeo-Request-Id","X-Rodeo-TTFT-Ms","X-Rodeo-Anchor-Cost-USD","X-Rodeo-Anchor-Source","X-Rodeo-Cost-Basis","X-Rodeo-Fee-USD","X-Rodeo-Fee-Capped","X-Rodeo-Escalations","X-Rodeo-Skipped","X-Rodeo-Hedge-Wins","X-Rodeo-Degraded","X-Rodeo-Total-Ms","X-Rodeo-Gateway-Overhead-Ms","X-Rodeo-Sticky","X-Rodeo-Model-Pin","X-Rodeo-Patience","X-Rodeo-Patience-Why","X-Rodeo-Auto-Objective-Inferred-Why","X-Rodeo-Signature","X-Rodeo-Signature-Ed25519","X-Rodeo-Key-Id","X-Rodeo-Decision-Id","X-Rodeo-Dry-Run","X-Rodeo-Node-Id","X-Rodeo-Node-Proof","X-Rodeo-Node-Signature","X-Rodeo-Node-Answer-Sha","X-Rodeo-Node-At","X-Rodeo-Alignment-Profile","X-Rodeo-Alignment-Mode","X-Rodeo-Alignment-Verdict","X-Rodeo-Alignment-Enforced","X-Rodeo-Alignment-Version","X-Rodeo-Alignment-Rule","X-Rodeo-Strategy","X-Rodeo-Agentic-Steps","X-Rodeo-Agentic-Tools","X-Rodeo-Agentic-Stop","X-Rodeo-Agentic-Budget-USD","X-Rodeo-Stream","X-Rodeo-Receipt","X-Rodeo-Restarted-From","X-Rodeo-Absorbed","X-Rodeo-Discarded-Chars","X-Rodeo-Search-Path","X-Rodeo-Enrichment-Path","X-Rodeo-External-Fallback","X-Rodeo-Citation-Status","X-Rodeo-Citation-Path","X-Rodeo-Synthesis-Path","X-Rodeo-Synthesis-Status","X-Rodeo-Answer-Path"],"receipt_headers_explained":{"X-Rodeo-Fit":"JSON. What this request was measured AS: score, basis (calibrated-surface), the difficulty estimate and its bin, the class and shape, the artifact digest, and the held-out proof (n, ece, brier_skill) that admitted the estimate. Absent when the class average was used — the number the router has always used needs no announcement. Never alters an explicit floor's meaning.","X-Rodeo-Tool-Fence":"Grammar: 'applied; removed=; kept=; unmeasured=; basis='. Your request carried tools, and models our own frozen tool corpus watched fail to produce a well-formed call were not offered it. `unmeasured` counts the models nobody has asked yet — kept, never counted as proven.","X-Rodeo-Repeatable":"Grammar: 'held' or 'not_held; why=<floating_alias|aggregator_rotates_weights|different_weights_than_last_turn>'. You set a seed or temperature 0, so you need the same answer twice; this says whether the thing answering you can be held still. A floating model name cannot — pin a dated one.","X-Rodeo-Loop":"Grammar: 'drifted; held=<terms>'. A later step of this tool loop asked to loosen something the first step committed to — a larger max_tokens, a wider lane, weaker privacy — and we held the loop to its original terms instead. Constraints can be tightened mid-loop and never relaxed.","X-Rodeo-Budget-Trade":"Grammar: 'served_below_bar; reason=; lane_closed=; bar=; headroom_usd='. We answered, and we did NOT spend past your monthly limit to do it — but the model that would have cleared the certified bar for this kind of work was on the lane your limit has closed. Raising the limit reaches it; nothing was billed to say so.","X-Rodeo-Financial-Request-Id":"server-generated identifier shared by the paid attempts belonging to this customer task; separate from caller correlation IDs and never an authorization credential","X-Rodeo-Platform-Actual-USD":"total measured platform-funded supplier charges across this task, including retries and unserved attempts; unknown while any admitted attempt remains unresolved or the journal cannot be read","X-Rodeo-Platform-Measured-USD":"measured subtotal of settled platform-funded attempts; an incomplete subtotal when other attempts are still held, never proof of the final task cost","X-Rodeo-Platform-Held-USD":"reserved maximum still held for platform-funded attempts awaiting resolution; a hold is not a measured charge","X-Rodeo-Financial-Attempts":"number of admitted platform-funded attempts recorded for this task, including retries and unserved attempts; unknown if the journal cannot establish the count","X-Rodeo-Financial-Unresolved":"number of platform-funded attempts still reserved, sent or unresolved; unknown if the journal cannot establish the count","X-Rodeo-Customer-Funded-Attempts":"count of paid attempts sent using customer-supplied credentials; their separate supplier invoice is not measured by our platform journal","X-Rodeo-Candidates":"how many ready stand-ins were lined up behind the one that answered you — your depth of cover on this request","X-Rodeo-Hedges":"how many we ran at once so a slow or dead one could not cost you the answer. Supplier charges can include attempts whose answer was not served","X-Rodeo-Actual-USD":"the measured cost of the complete task. `unknown` while platform attempts remain unresolved or customer-funded supplier charges are not measured","X-Rodeo-Request-Id":"the id to quote us if anything looks wrong. It is on every response, success or failure, and it reaches the signed record","X-Rodeo-TTFT-Ms":"how long you waited for the first word","X-Rodeo-Anchor-Cost-USD":"what this exact call would have cost you at the baseline named in X-Rodeo-Anchor — the figure your saving is measured against. `unknown` rather than a guess when the provider told us nothing about what it used","X-Rodeo-Anchor-Source":"whose baseline that comparison used — ours, or the one you sent with the request. We never quietly swap yours for ours","X-Rodeo-Cost-Basis":"whose price was used for this route — route-provider is the supplier's own listing; route-catalogue is an independent listing for that supplier and exact model. zero-marginal means free or your own machine; unknown means no current matching price. This is our measurement, not a reconciled provider invoice","X-Rodeo-Fee-USD":"what we charged you on top for the work of finding this answer. $0.000000 unless you have switched on savings-share","X-Rodeo-Fee-Capped":"your own fee ceiling stopped the charge — the receipt says why the fee is what it is, so a zero is never a mystery","X-Rodeo-Escalations":"how many times we had to move on to a further stand-in before one answered. 0 means our first choice served you","X-Rodeo-Skipped":"how many of the stand-ins we lined up were stepped past without being troubled — resting off a recent failure, or too alike the one already in play to count as real cover","X-Rodeo-Hedge-Wins":"how many times the spare came back first and saved you the wait. Platform cost totals include every admitted supplier attempt, not only the winner","X-Rodeo-Degraded":"true when you were served, but not by the route we would have picked with everything healthy. A working answer that tells you it was the second-best one available","X-Rodeo-Total-Ms":"how long the whole thing took, from your call landing to your answer leaving","X-Rodeo-Gateway-Overhead-Ms":"how much of that wait was us rather than the model — every millisecond the answering model spent, subtracted. Our own work, measured against us","X-Rodeo-Sticky":"whether this turn stayed on the model your conversation already settled on — kept it, set it just now, or no conversation to keep. This is what stops replies drifting in tone from turn to turn","X-Rodeo-Model-Pin":"your key pins a particular model, and that pin displaced the one this request asked for. The substitution is never silent","X-Rodeo-Patience":"how much time we understood this one to be worth — the third lever, echoed back so you can check it was actually heard","X-Rodeo-Patience-Why":"the words in your own request we read that from, so a reading you disagree with is visible instead of invisible","X-Rodeo-Auto-Objective-Inferred-Why":"we worked out what kind of work this was rather than being told, and this is the reasoning — an inference you can see is one you can correct","X-Rodeo-Signature":"the seal over this whole receipt. Send it to /v1/receipts/verify and check us, rather than take our word for any figure above","X-Rodeo-Signature-Ed25519":"the same seal in public-key form. Check it yourself with the key at /v1/receipts/public-key, offline, without asking us and without us being able to change our mind","X-Rodeo-Key-Id":"which of our published keys signed this receipt. It is inside the signature, so a seal cannot be pointed at a different key","X-Rodeo-Node-Id":"which of your own machines answered this one","X-Rodeo-Node-Proof":"whether that machine's own signature checks out: proven, not proven, or a machine we do not know. We never accuse a machine we cannot identify","X-Rodeo-Node-Signature":"your machine's own signature over this answer, made with a key only it holds — we cannot make one and cannot read it","X-Rodeo-Node-Answer-Sha":"the fingerprint of the answer your machine signed for. The words themselves are never signed away from your machine","X-Rodeo-Node-At":"when your machine signed for it, by its own clock","X-Rodeo-Decision-Id":"the handle for saying this answer was good or bad: send it back on your next call as `X-Rodeo-Last-Feedback: <id>=good|bad`. It is bound to you, so nobody else's opinion can steer your routing","X-Rodeo-Dry-Run":"nothing was actually run: you asked where this request WOULD go, and no model was called and nothing was spent","X-Rodeo-Alignment-Profile":"which of YOUR OWN named rule sets this answer was held to. Your rules, never ours — we impose no values","X-Rodeo-Alignment-Mode":"what you asked us to do when your rules are crossed — tell you about it, or refuse the answer outright","X-Rodeo-Alignment-Verdict":"what your rules made of this one. `unchecked` means no guard engine is installed on your side yet, so nothing was actually examined — we will not dress that up as a clean pass","X-Rodeo-Alignment-Enforced":"true only when a real guard engine actually examined this answer. The honest half of the verdict above","X-Rodeo-Alignment-Version":"which revision of your rules was in force, so a receipt from last month still reads true after you edit them","X-Rodeo-Strategy":"this answer was worked out over several steps with tools, rather than asked of one model in one go","X-Rodeo-Agentic-Steps":"how many rounds of work went into it","X-Rodeo-Agentic-Tools":"what was done on your behalf and how often — searches, fetches — or `none` if it never reached for anything","X-Rodeo-Agentic-Stop":"why it stopped: it finished, it reached the ceiling you set, or it reached the step limit. Never a silent overspend","X-Rodeo-Agentic-Budget-USD":"the ceiling it was working under, so the stop above can be read against the money you actually allowed","X-Rodeo-Stream":"which kind of stream you got — words as they are written, or the finished answer delivered in one piece down the same pipe. A typing effect built on the second one is a lie you should get to avoid","X-Rodeo-Receipt":"the full signed receipt is coming as a named event at the end of the stream, because what a call cost is not known until its last word. Everything above this line was true at the first word","X-Rodeo-Restarted-From":"the model that was writing your answer dropped mid-sentence and another finished the job. This names the one that died","X-Rodeo-Discarded-Chars":"how much of what you were already sent to throw away after that restart, so what you keep is exactly one answer and not two half ones","X-Rodeo-Search-Path":"where these results came from — our own search, or an outside one we fell back to","X-Rodeo-Enrichment-Path":"the same answer as above in one name shared by search and research, for a reader that handles both the same way","X-Rodeo-External-Fallback":"true when your question had to leave our own search to be answered at all; false when it never left","X-Rodeo-Citation-Status":"how tightly the answer is tied to its sources — it quotes them, or they are attached without being quoted, or we found none and say so rather than write from nothing","X-Rodeo-Citation-Path":"where those sources were found","X-Rodeo-Synthesis-Path":"who wrote the answer out of those sources","X-Rodeo-Synthesis-Status":"whether that writing step actually succeeded. When it did not you still get the sources, and this says why the answer beside them is thinner than usual","X-Rodeo-Answer-Path":"what you are actually reading — an answer written for you from the sources, or a plain digest of the sources themselves when the writing step could not deliver one"},"receipt_headers_conditional":{"X-Rodeo-Fit":"only when a qualified, artifact-matched difficulty calibration actually moved this request's score off the class average; silent otherwise","X-Rodeo-Tool-Fence":"only when a tool turn had a candidate REMOVED for having been measured unable to produce a well-formed tool call","X-Rodeo-Repeatable":"only when the caller asked for the same answer twice (seed, or temperature 0); says whether the route can carry that promise","X-Rodeo-Loop":"only when a later step of a tool loop tried to loosen a constraint step one committed to, and was held to it","X-Rodeo-Budget-Trade":"only when the model that would have cleared the certified bar sits on a lane this account's own monthly limit has closed","X-Rodeo-Financial-Request-Id":"only when this response carries a financial request context; a stream may expose the identifier before final attempt totals are available","X-Rodeo-Platform-Actual-USD":"only when this response carries a financial request context; settled response paths publish this value; streaming headers may omit final totals because they were already sent","X-Rodeo-Platform-Measured-USD":"only when this response carries a financial request context; settled response paths publish this value; streaming headers may omit final totals because they were already sent","X-Rodeo-Platform-Held-USD":"only when this response carries a financial request context; settled response paths publish this value; streaming headers may omit final totals because they were already sent","X-Rodeo-Financial-Attempts":"only when this response carries a financial request context; settled response paths publish this value; streaming headers may omit final totals because they were already sent","X-Rodeo-Financial-Unresolved":"only when this response carries a financial request context; settled response paths publish this value; streaming headers may omit final totals because they were already sent","X-Rodeo-Customer-Funded-Attempts":"only when this response carries a financial request context; settled response paths publish this value; streaming headers may omit final totals because they were already sent","X-Rodeo-Model-Lifecycle":"only when we hold a retirement claim about the model that served — reads 'deprecating'. Absent means we hold no such claim, which is the case for all but a handful of models; poll GET /v1/models?lifecycle=deprecating for the same answer across every id you pin, and read each row's `lifecycle` block for the detail","X-Rodeo-Model-Lifecycle-Evidence":"only when X-Rodeo-Model-Lifecycle is present — '&lt;tier&gt;:&lt;who&gt;', split at the FIRST colon (today: 'third_party:models.dev'). Neither half ever contains a colon","X-Rodeo-Unhonored-Params":"only when the request asked for something the served model could not honour","X-Rodeo-Budget-Raised":"only when the answer exceeded the caller's max_tokens ceiling — 'asked->served', in completion tokens","X-Rodeo-Constraint-Adherence":"only when the caller set a constraint (a system prompt) to adhere to","X-Rodeo-Resolution":"only when a request FAILED — 'wait' (a clock is running; retry_after_s carries the delay), 'needs-a-person' (somebody must change something; it does not say WHAT, so read type and tries[].symptom rather than guessing a cause), 'lower-the-floor-or-wait-for-coverage' (an X-Rodeo-Floor could not be honoured for a coverage reason — lower it, allow serve-best, or wait), or 'unknown' (we could not read the failure; promises nothing either way). Branch on this before you retry","X-Rodeo-Receipt-Kind":"only when a request was refused — reads 'refusal', so a verifier can tell a refused call from a served one","X-Rodeo-Outcome":"only when a request was refused — reads 'refused'","X-Rodeo-Refusal-Reason":"only when a request was refused — the machine-readable reason it was declined","X-Rodeo-Refusal-Explains":"only when a request was refused — the same reason in one plain sentence","X-Rodeo-Content-Left-Ranch":"only when a request was refused — reads 'false', signed proof nothing was sent anywhere","X-Rodeo-Privacy-Declared":"only when a request was refused — the privacy it was carrying when declined","X-Rodeo-Privacy-Held":"only when a request was refused — 'true' if a privacy fence refused it rather than capacity","X-Rodeo-Fee-Capped":"only when your own fee ceiling stopped the charge — absent means the fee shown is the whole fee, not a capped one","X-Rodeo-Absorbed":"only when a source was tried and died BEFORE your first word, and we went to another one — absent means the first source answered. It counts legs we swallowed for you, so it is the header that says the failover you never saw actually happened. Rehearsed deaths (X-Rodeo-Drill) are excluded; streaming does not hedge, so X-Rodeo-Hedges can never carry this and never did","X-Rodeo-Hedges":"only when more than one candidate was actually raced. Absent means one was enough — the ordinary case — and it is set by the SAME condition as X-Rodeo-Hedge-Wins below, which was already declared conditional here while this one was listed as unconditional. The live journey scenario caught the mismatch on 2026-08-30: an advertised header that is correctly absent is the phantom-bug hunt this map exists to prevent","X-Rodeo-Hedge-Wins":"only when more than one candidate was run at once. Absent means one was enough, which is the ordinary case","X-Rodeo-TTFT-Ms":"only when the answer was STREAMED, where it rides the signed terminal frame. A buffered answer has no first-token moment distinct from its last, so the number does not exist rather than being withheld — X-Rodeo-Total-Ms is the buffered equivalent","X-Rodeo-Model-Pin":"only when your key pins a model AND that pin displaced the model the request itself asked for","X-Rodeo-Patience":"only when the request said, in its own words, how much time this one was worth. It is read per request and never stored, so it is absent on every turn that did not say","X-Rodeo-Patience-Why":"only when X-Rodeo-Patience is present — the phrase we read it from","X-Rodeo-Auto-Objective-Inferred-Why":"only when the kind of work was inferred from the request rather than stated by you or pinned on your key","X-Rodeo-Signature":"only when receipt signing is configured on the gateway serving you (it is on api.host.rodeo). A self-hosted install with no signing key emits an unsigned receipt rather than a fabricated seal","X-Rodeo-Signature-Ed25519":"only when receipt signing is configured on the gateway serving you, the same condition as X-Rodeo-Signature","X-Rodeo-Key-Id":"only when receipt signing is configured on the gateway serving you — there is no key to name when nothing signed","X-Rodeo-Node-Id":"only when one of your own machines served this answer and signed for it","X-Rodeo-Node-Proof":"only when one of your own machines served this answer and signed for it","X-Rodeo-Node-Signature":"only when one of your own machines served this answer and signed for it","X-Rodeo-Node-Answer-Sha":"only when one of your own machines served this answer and signed for it","X-Rodeo-Node-At":"only when one of your own machines served this answer and signed for it","X-Rodeo-Dry-Run":"only when you called POST /v1/route, the preview that spends nothing — never on a served answer","X-Rodeo-Alignment-Profile":"only when your key carries your own guardrail (the whole X-Rodeo-Alignment-* block is absent when you have set none, which is the default)","X-Rodeo-Alignment-Mode":"only when your key carries your own guardrail","X-Rodeo-Alignment-Verdict":"only when your key carries your own guardrail","X-Rodeo-Alignment-Enforced":"only when your key carries your own guardrail","X-Rodeo-Alignment-Version":"only when your key carries your own guardrail AND you have versioned it — absent means the rules are unversioned, not unheld","X-Rodeo-Alignment-Rule":"only when one of YOUR OWN rules is what decided this answer: the rule's id, never its text — a person's own sentence is not something to push through a transport field. Your shelf resolves the id to the words","X-Rodeo-Strategy":"only when the answer came from the multi-step agentic loop rather than a single model. The whole X-Rodeo-Agentic-* block travels with it","X-Rodeo-Agentic-Steps":"only when the answer was worked out over several steps","X-Rodeo-Agentic-Tools":"only when the answer was worked out over several steps","X-Rodeo-Agentic-Stop":"only when the answer was worked out over several steps","X-Rodeo-Agentic-Budget-USD":"only when the answer was worked out over several steps","X-Rodeo-Stream":"only when you asked for a streamed answer","X-Rodeo-Receipt":"only when the answer streams token by token, where the receipt cannot be complete in the HTTP headers because the cost is not known until the last word","X-Rodeo-Restarted-From":"only when a streamed answer's model dropped mid-sentence and another finished it. Absent is the ordinary case and means nothing restarted","X-Rodeo-Discarded-Chars":"only when X-Rodeo-Restarted-From is present — how much to throw away","X-Rodeo-Search-Path":"only when you called POST /v1/search","X-Rodeo-Enrichment-Path":"only when you called POST /v1/search or POST /v1/research","X-Rodeo-External-Fallback":"only when you called POST /v1/search or POST /v1/research","X-Rodeo-Citation-Status":"only when you called POST /v1/research","X-Rodeo-Citation-Path":"only when you called POST /v1/research","X-Rodeo-Synthesis-Path":"only when you called POST /v1/research","X-Rodeo-Synthesis-Status":"only when you called POST /v1/research and the answer was written sources — a research route that found no sources reports the citation fields and stops there, with nothing to say about writing","X-Rodeo-Answer-Path":"only when you called POST /v1/research and the answer was written here from the sources"},"floor":{"certifiable_classes":["chitchat","code","creative","factual_lookup","judgment","reasoning","tool_trajectory","translation"],"classes":{"chitchat":{"matrix":"v9-2026-08-29","default_shape":"plain","shapes":{"plain":{"bar":0.8095,"basis":"provisional","n":68,"pool_depth":2,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":11,"live":7,"departed":["google/gemma-4-31b-it","gpt-oss:120b","mistral-medium-2505","qwen/qwen3.6-27b"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}}}},"code":{"matrix":"v9-2026-08-29","default_shape":"plain","shapes":{"plain":{"bar":1.0,"basis":"provisional","n":43,"pool_depth":2,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":15,"live":10,"departed":["gemini-2.5-flash","google/gemma-4-31b-it","gpt-oss:120b","mistral-medium-2505","qwen/qwen3.6-27b"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}}}},"creative":{"matrix":"v9-2026-08-29","default_shape":"plain","shapes":{"plain":{"bar":1.0,"basis":"provisional","n":20,"pool_depth":1,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":11,"live":7,"departed":["google/gemma-4-31b-it","gpt-oss:120b","mistral-medium-2505","qwen/qwen3.6-27b"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}}}},"factual_lookup":{"matrix":"v9-2026-08-29","default_shape":"plain","shapes":{"plain":{"bar":0.963,"basis":"provisional","n":121,"pool_depth":2,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":15,"live":10,"departed":["gemini-2.5-flash","google/gemma-4-31b-it","gpt-oss:120b","mistral-medium-2505","qwen/qwen3.6-27b"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}}}},"judgment":{"matrix":"v9-2026-08-29","default_shape":"plain","shapes":{"plain":{"bar":0.9091,"basis":"provisional","n":85,"pool_depth":4,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":10,"live":6,"departed":["google/gemma-4-31b-it","gpt-oss:120b","mistral-medium-2505","qwen/qwen3.6-27b"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}},"json_object":{"bar":0.9048,"basis":"provisional","n":105,"pool_depth":3,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":8,"live":6,"departed":["gpt-oss:120b","mistral-medium-2505"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}}}},"reasoning":{"matrix":"v9-2026-08-29","default_shape":"plain","shapes":{"plain":{"bar":1.0,"basis":"provisional","n":47,"pool_depth":2,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":14,"live":10,"departed":["google/gemma-4-31b-it","gpt-oss:120b","mistral-medium-2505","qwen/qwen3.6-27b"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}}}},"tool_trajectory":{"matrix":"v9-2026-08-29","default_shape":"plain","shapes":{"plain":{"bar":0.9667,"basis":"certified","n":115,"pool_depth":3,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":9,"live":6,"departed":["google/gemma-4-31b-it","gpt-oss:120b","mistral-medium-2505"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}}}},"translation":{"matrix":"v9-2026-08-29","default_shape":"plain","shapes":{"plain":{"bar":0.9655,"basis":"provisional","n":124,"pool_depth":2,"pool_unmeasurable":4,"corpus":null,"as_of":null,"trials":null,"interval":null,"pass_basis":"unstated","roster":{"measured":15,"live":10,"departed":["gemini-2.5-flash","google/gemma-4-31b-it","gpt-oss:120b","mistral-medium-2505","qwen/qwen3.6-27b"]},"local":{"nodes":0,"clearing":[],"below":[],"unmeasured":[],"earns_the_bar":false,"measured_elsewhere":[],"measured_on_a_node":[]}}}}},"measurement":{"measured":true,"yardstick":"v9-2026-08-29","roster_fingerprint":"292582489c7c","artifact_built_at":1788308289,"aged_by":"version_pin","retired":{},"classes":{"chitchat":{"bar":0.8095,"basis":"provisional","cases":68,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null},"code":{"bar":1.0,"basis":"provisional","cases":43,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null},"creative":{"bar":1.0,"basis":"provisional","cases":20,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null},"factual_lookup":{"bar":0.963,"basis":"provisional","cases":121,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null},"judgment":{"bar":0.9091,"basis":"provisional","cases":85,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null},"judgment@json_object":{"bar":0.9048,"basis":"provisional","cases":105,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null},"reasoning":{"bar":1.0,"basis":"provisional","cases":47,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null},"tool_trajectory":{"bar":0.9667,"basis":"certified","cases":115,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null},"translation":{"bar":0.9655,"basis":"provisional","cases":124,"trials":null,"interval":null,"pass_basis":null,"corpus":null,"as_of":null}},"note":"every score states the cases it was measured on (`corpus`), when (`as_of`), and over how many trials — a bar is a statement about a corpus at a moment"}},"depth":{"standard_backups":3,"measured_at":1789487227,"shapes":{"chat":{"independent":2,"backups":1,"meets_standard":false,"ready":true,"plain":"Two ways to answer this — one backup, not the three we aim for."},"chat+tools":{"independent":2,"backups":1,"meets_standard":false,"ready":true,"plain":"Two ways to answer this — one backup, not the three we aim for."},"chat+json_object":{"independent":2,"backups":1,"meets_standard":false,"ready":true,"plain":"Two ways to answer this — one backup, not the three we aim for."},"chat+tools+json_object":{"independent":2,"backups":1,"meets_standard":false,"ready":null,"plain":"Two ways to answer this — one backup, not the three we aim for."},"chat+vision":{"independent":2,"backups":1,"meets_standard":false,"ready":true,"plain":"Two ways to answer this — one backup, not the three we aim for."},"audio_speech":{"independent":4,"backups":3,"meets_standard":true,"ready":false,"plain":"Four ways to answer this, on four different suppliers."},"audio_transcription":{"independent":4,"backups":3,"meets_standard":true,"ready":true,"plain":"Four ways to answer this, on four different suppliers."},"embedding":{"independent":5,"backups":4,"meets_standard":true,"ready":true,"plain":"Five ways to answer this, on five different suppliers."},"image":{"independent":3,"backups":2,"meets_standard":false,"ready":true,"plain":"Three ways to answer this — two backups, not the three we aim for."},"moderation":{"independent":2,"backups":1,"meets_standard":false,"ready":true,"plain":"Two ways to answer this — one backup, not the three we aim for."},"rerank":{"independent":1,"backups":0,"meets_standard":false,"ready":false,"plain":"Only one way to answer this right now — no backup behind it."},"video":{"independent":0,"backups":0,"meets_standard":false,"ready":false,"plain":"Nothing can answer this right now."},"chat@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"chat+tools@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"chat+json_object@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"chat+tools+json_object@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"chat+vision@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"audio_speech@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"audio_transcription@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"embedding@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"image@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"moderation@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"rerank@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."},"video@private":{"independent":0,"backups":0,"meets_standard":false,"ready":null,"plain":"Nothing of yours is enrolled to answer this privately yet."}},"below_standard":["audio_speech@private","audio_transcription@private","chat","chat+json_object","chat+json_object@private","chat+tools","chat+tools+json_object","chat+tools+json_object@private","chat+tools@private","chat+vision","chat+vision@private","chat@private","embedding@private","image","image@private","moderation","moderation@private","rerank","rerank@private","video","video@private"],"unknown":[],"note":"independent counts suppliers that fail separately (front, vendor, account); ready means a recent real call in that shape succeeded; null means unmeasured","survivability":{"worst_domain":"aggregator-fabric","ceiling":{"shapes_meeting_standard_after_loss":1,"of":24,"shapes_unanswerable":["audio_speech@private","audio_transcription@private","chat+json_object@private","chat+tools+json_object@private","chat+tools@private","chat+vision@private","chat@private","embedding@private","image@private","moderation@private","rerank","rerank@private","video","video@private"],"shapes_with_no_backup":["chat","chat+json_object","chat+tools","chat+tools+json_object","chat+vision","moderation"]},"note":"recomputed over the same qualified pools with one failure domain removed; worst is the domain whose loss costs most; a pool we could not measure is never credited"},"standard":{"backups":3,"rule":"every shape keeps at least 3 qualified backups beyond the winner, each on a supplier that fails separately; unmeasured suppliers count as one"}},"control_headers":{"X-Rodeo-Sensitivity":"high|standard (high pins eligible self-hosted/customer-owned sources and fails closed rather than leak; legacy: public|sensitive|secret)","X-Rodeo-Prefer":"latency|quality|cost|balanced — latency: interactive lane, routes around slow models + fails over fast (real answer or clean 503, no 50s hang); quality: best proven model; cost: cheapest (default); balanced: weigh quality, cost, and latency together","X-Rodeo-Training":"none — route only to providers that have stated in writing that they do not train on submitted data. Silence is not consent: a provider that has not said counts as a refusal, and the request fails closed (503) rather than quietly reach a trainer","X-Rodeo-Tiers":"comma list of free|local|paid — a HARD fence on which lanes may serve you. 'local' means hardware you own; 'free,local' never reaches a paid provider. Fails closed rather than cross the fence","X-Rodeo-Deadline-S":"how many seconds you can actually wait. We stop trying inside your budget and answer honestly instead of being hung up on by your own client — without it we use our own, which may be longer than yours","X-Rodeo-Session":"your own id for one ongoing conversation. A live session keeps the same model, so replies stay consistent turn to turn; it takes precedence over everything else we would otherwise guess from","X-Rodeo-Byok":"provider=key — spend your OWN account for this one request. Custody is recorded as 'edge': the key is used for the call and never stored. The strongest privacy and cost lever we offer, per request","X-Rodeo-Last-Feedback":"<decision-id>=good|bad — thumb the PREVIOUS answer on the next call you were making anyway, with the id from its X-Rodeo-Decision-Id. No extra round trip, and it steers only YOUR routing: the id is bound to you, so nobody can vote on your behalf and your verdict never moves anyone else","X-Rodeo-Anchor-In":"$/1M input tokens baseline for your avoided-cost receipt","X-Rodeo-Anchor-Out":"$/1M output tokens baseline for your avoided-cost receipt","X-Rodeo-Floor":"a MEASURED quality floor: '<class>' (the class's certified bar) or 'model=<id>[; class=<c>]' (at least as good as that model, measured). Evidence-only — an unmeasured model cannot clear a floor. Chat only for now; the LIVE certifiable-class list rides this manifest's floor.certifiable_classes field (it grows as classes certify — poll it, and the 400 that refuses an uncertifiable class also names it). A miss is a 503 whose error.type is the frozen string 'requirement_unmet' — terminal: waiting does not change a measured score, so do NOT retry or walk a fallback roster past it","X-Rodeo-Floor-Miss":"refuse (default) | serve-best — serve the best measured candidate anyway, disclosed. Refuse where being wrong is expensive; serve-best where no answer is worse than a near-miss","X-Rodeo-Floor-Met":"RESPONSE header (with the same object in the body's x_rodeo.floor and on the receipt): 'met|served-best|refused; class=…; score=…; bar=…; gap=…; matrix=<version>; shape=<population the score and bar were measured on>; pass=<attempts each case was measured over: single_shot | <k>_attempts_per_case | mixed | unstated>; corpus=<fingerprint of the cases this class was measured on, so a re-frozen corpus is visible as a different number>; as_of=<when that measurement was taken>' — grammar, never prose. Two optional tokens appear between `shape` and `pass` when they apply: `shape_requested=` when you sent a shape we hold no evidence for, and `reads_as=` when your stated class differs from what the request reads as to us. The matrix version lets you tell a yardstick change from a routing change; `pass` lets you tell our single-shot certification from your own repeated one","X-Rodeo-Safety-Fence":"RESPONSE header (same object in the body's x_rodeo.safety_fence and on the receipt), present only when the fence changed the candidate set (or always, for the operator): 'applied|armed; scope=constraint|crisis|operator; removed=<n>; kept=<n>; unmeasured=<n>; basis=observed' — grammar, never prose. `constraint` arms on a system prompt, `crisis` on a disclosure of danger; `removed` counts models struck for an OBSERVED failure in our own safety probes, `unmeasured` counts kept models nobody has probed (unknown, never clean). A pool the fence empties is refused as `no_capacity` with X-Rodeo-Refusal-Reason: safety_fenced on the signed refusal receipt — we declined; no provider was asked"},"account":{"set":"PUT /v1/account/prefs {\"feeCapUsd\": 10}; read: GET /v1/account/prefs","spendLimit":{"what":"your monthly ceiling on what Host.Rodeo may spend on PAID PROVIDERS on your behalf — the 'never spend more than ___ a month' number","read":"GET /v1/spend","set":"POST /v1/spend {\"limit_usd\": 25}","clear":"POST /v1/spend {\"limit_usd\": null} — turns the paid backup off entirely. Clearing is a first-class operation, as easy as setting","auth":"a signed-in session or an owned API key; you can only ever set your own","whenUnset":"the paid lane is OFF, never uncapped. No limit means we can never spend your money — the safest state, not the most exposed one","belowWhatIsAlreadySpent":"allowed on purpose — it reads as 'reached' and everything keeps working on free services and your own machines. A budget was never a request to be taken offline","notToBeConfusedWith":"feeCapUsd on PUT /v1/account/prefs, which is a different dollar: it caps the fee Host.Rodeo itself may charge, which is $0 today, and it never stops routing"},"unhonored":{"fields":["profile","autoObjective"],"why":"Host.Rodeo picks the route for every request itself. These still parse, so a live integration keeps working, but they no longer change anything. And feeCapUsd is NOT your spend ceiling — it caps the fee Host.Rodeo itself may charge, which is $0 today, and it never stops routing. Your monthly ceiling on paid-provider spend is a separate setting with its own endpoint: read it at GET /v1/spend and set it with POST /v1/spend {\"limit_usd\": 25}. Unset means the paid lane is OFF, not uncapped."},"usage":{"endpoint":"/v1/usage/me","auth":"signed-in member session","recentFields":["model","intent","tier","when","autoObjective","autoObjectiveSource","autoObjectiveReadiness","autoObjectiveWhy","routeExplanation"],"routeHistoryFields":["when","model","intent","tier","autoObjective","autoObjectiveReadiness","routeExplanation"],"routeExplanation":"plain-language per-call receipt summary built from the objective, readiness evidence, selected source lane, custody, latency, failover, degraded, and savings facts"},"patience":"your END USER can state patience in the message itself and it routes that one request: 'take your time'/'no rush'/'get this right' sorts for the stronger model, 'in a hurry'/'as fast as you can' sorts for speed. There is no setting and no parameter, by design. Disclosed back on X-Rodeo-Patience and X-Rodeo-Patience-Why. An explicit typed objective or X-Rodeo-Prefer header you send OUTRANKS it, so your own contract is never overruled by prose.","note":"Host.Rodeo picks the route for every request itself — there is no account-level routing default any more, and a value stored before this changed no longer steers anything. What you send per-request still wins: a model you pin on purpose, or an X-Rodeo-* header stating your own constraint, is honoured as your stated contract. The product routing tiers are free, local, and paid; any named local source is an instance of the local tier, not the product category."},"channels":{"feedback":{"endpoint":"/v1/feedback","method":"POST","auth":"none","send":{"reporter":"<your-id>","observation":"<required>","notes":"...","metrics":{}},"resolve":"GET /v1/feedback/{id}","note":"send a signal; our operator adjudicates it autonomously on our OWN models — evidence, never a command"},"webhooks":{"register":"/v1/webhooks","method":"POST","auth":"your Bearer key (self-service, no admin)","body":{"consumer_id":"<your-id, matches your reporter>","url":"<your https receiver>","events":["signal.resolved","capability.changed"]},"events_available":{"signal.resolved":"the resolution of a feedback signal YOU sent (1:1)","capability.changed":"the platform's capability surface changed (new model/modality/profile) — re-read /v1/contract. Fires only on a MATERIAL change (debounced, coalesced); never on traffic/latency."},"verify":"HMAC-SHA256(secret, raw_body) == X-HostRodeo-Signature; dedupe by event_id; ack 200","note":"self-register to be PUSHED signal resolutions + capability changes — no polling. Storm-safe: rate-limited, bounded retries, deliberate triggers only."}},"contract_version":"59d841ed002bb763","quickstart":"Point any OpenAI client at this base with your Bearer key and model='auto' — it just works. Audio STT: POST /v1/audio/transcriptions (multipart). Everything you need is in THIS manifest.","laws":["this manifest never overstates — a capability is listed only if >=1 available source proves it","caller feedback is evidence, adjudicated by our own probe, never a direct command"]}