NautGate

The served model is parsed from the provider's own response and written beside the requested one. Where they differ, the routing-flow view highlights the exact hop where the substitution happened rather than burying it. Cost attribution then uses the model that actually produced the tokens, and quality comparisons group calls by the model that actually answered.

Provider-reported model identity is evidence, not proof. The record can show what NautGate observed and decided; it cannot independently prove which weights produced the tokens, and the receipt is an operational one rather than a signed attestation. That boundary is written into the product documentation on purpose, because a claim that quietly exceeds what the system can demonstrate is the failure mode this whole project exists to avoid. What it can do is let you check it without believing me: token counts and the served model line up against the provider's own billing dashboard, to the token, and a discrepancy stays visible instead of being normalised away.

A request is scored across task and payload dimensions, mapped to a tier, resolved through a routing table, and filtered by provider health — with explicit requests, key overrides and agent preferences applied in a defined order. Requested, selected and observed models are recorded separately, and a substitution flag goes back to the caller. Silent model switching is easy. Accountable switching is the rarer thing.

The decision is written before the upstream call, so it survives whatever happens next. The outcome — status, latency, tokens, cache tokens, cost, truncation, client disconnect — is written after, and if PostgreSQL cannot take it, it falls to a local SQLite WAL spool and is replayed on recovery rather than silently discarded. Many gateways emit logs. Fewer say out loud which parts are guaranteed and which are eventually durable.

Pointing inference at localhost solves the largest data path and silences none of the rest. Provider heartbeats, health probes, catalogue refreshes and credit lookups all run on their own timers, so a 'local model' is not an offline system. Offline mode stands the whole gateway down together. In a 70-second socket sample it went from a connection to Anthropic every 60 seconds to 127.0.0.1 only — because configuration labels are not proof, and sampling the actual sockets is.

PII and secrets are detected before anything is written, and the sensitivity label feeds the routing decision as well as the capture policy. Regex and a second model can both miss context, so this reduces accidental retention rather than guaranteeing against data loss — but scanning after sensitive text is already in the database is the wrong place to put the check.

Copyleft keeps a hosted fork honest. It also means some enterprises cannot adopt it without a conversation, which is a cost I took on purpose rather than discovered late.