One controlled boundary between SALC and model providers
Every component that touches a model goes through here. One way in, one way out — if any component could reach a provider directly, the budget cap would be fiction and the audit record incomplete.
Budget healthy — 16% consumed. The cap is enforced before a call is made, never reconciled after it.
1 retry recorded — one provider returned a malformed structured response. The router retried within its bound and charged it to the same budget.
Everything narrows here
Any direct provider import outside this boundary is treated as critical drift, not a shortcut.
- Product Knowledge
- Test Intelligence
- Automation Generation
- Change Impact
- Model Router
Selects a model per task class. Swapping a model never touches calling code.
- Prompt Registry
Versioned prompts. Every call records the version it ran — currently prompt:v7.
- Budget Control
Server-side cap per user and per workspace. An uncapped call is treated as a defect.
- Response Cache
Identical prompt plus identical artifact version returns the recorded response.
- Retry Policy
Bounded retries with backoff. Retries are counted against the same budget.
- Audit Writer
User, component, model, prompt version, artifact version, cost and duration — every call.
- Provider AHealthy
- Provider BDegraded — routed away
- Provider CHealthy
Provider-neutral by design. No partnership is claimed or implied, and no provider is contacted by this demonstrator.
Gateway usage
- Router
- Model Router
- Prompt registry
- prompt:v7
- Structured output
- Enforced per call
- Privacy
- Tenant-scoped · org-demo-001
Cost is a correctness property
Budget is enforced server-side, per user and per workspace. An uncapped AI call is classified as a defect in the same category as a data leak — not as a cost overrun.
What the boundary buys
Swapping a model does not touch calling code
because components request a task class, not a provider
The budget cap is real
because there is exactly one place spend can be counted
The audit record is complete
because no call can bypass the writer
Prompt changes are versioned and reversible
because every call records the prompt version it ran
- A direct provider import anywhere else in the codebase is classified as CRITICAL drift and fails the governance check.