The build
What runs today, what lands next, and — for each thing that does not exist yet — where it plugs into the code that does.
This page exists because a roadmap without an integration point is a wish list. Every DESIGNED and PLANNED row below names the function it extends, so the gap between "documented" and "shipped" is an afternoon rather than a rewrite.
Order, not dates. Phases ship when the gate before them clears. Putting quarters on a page a market reads would be a commitment nobody made.
#NOW LIVE
One key, one base URL, the FRONTIER mode, both protocol shapes, streaming, and a gateway that refuses before it spends. All of it is in routing with the line that does it.
frodo-frontier |
maximum intelligence, routed |
| OpenAI and Anthropic wire formats | one credential answers both |
| Streaming with cancel-stops-spend | endpoints |
| Allowlist → quota → clamp → resolve | a refusal costs no quota |
| Modes only, never upstream ids | the model stack |
#P1 — the raw lane DESIGNED
frodo-raw opens. The model as it was trained: no system prompt, no persona, no house style.
Plus the two variants most people actually want alongside it.
| Ships | What it is | Where it plugs in |
|---|---|---|
frodo-raw |
the RAW mode itself | MODE_ENV map — one entry, one env var |
frodo-raw:fast · :code |
a cheaper lane and a coding lane | same map; variants are modes with a suffix |
| Public Backrooms | bounded RAW-to-RAW rooms, public transcripts, branches and search | a room worker, transcript store and public read routes |
x-ratelimit-* headers |
remaining, limit, reset — on every response | checkQuota already computes all three; it returns them instead of discarding them |
GET /v1/limits |
read your own ceilings without burning a request | same counters, no new state |
Why the variants are nearly free. A mode is already a string → model lookup. frodo-raw:fast is
another row in the same table, so the whole variant system is configuration rather than code — which
is the point of having resolved modes at the edge instead of hard-coding a model.
See the RAW shortlist for the candidates being benchmarked.
#P2 — the private lane DESIGNED
frodo-private opens, on rungs L1 and L2 of the privacy ladder.
| Ships | What it is | Where it plugs in |
|---|---|---|
frodo-private |
no prompt logs, zero-retention routing | MODE_ENV, plus a retention flag per mode |
| Private Backrooms | holder-created rooms with restricted access and separate retention | room access records plus the PRIVATE route policy |
| L1 · no-log | routing restricted to zero-retention capacity | a per-mode route filter in resolveModel |
| L2 · dedicated | our own GPUs, no third-party fallback | compute — this is what owned capacity buys |
frodo-private:fast · :code |
the same two variants | MODE_ENV |
| Usage accounting | tokens and what they cost your day, per response | the stream loop tees the upstream usage frame instead of only forwarding it |
| Balance-derived allowance | a bigger holding buys a bigger day | unlockReached already reads chain state per mint; the same read sets a tier on the key record |
The allowance is the part that matters. Today every key gets the same ceiling. It should scale with what you hold — that is the entire thesis of a token that buys compute, and right now the gateway does not express it. The hook already exists: the mint path proves the wallet and reads chain state, so the tier is a field on a record we already write. See the ecosystem.
#P3 — proof and resale PLANNED
| Ships | What it is | Where it plugs in |
|---|---|---|
| L3 · attested | TEE inference with a nonce-bound attestation you verify yourself | a new /v1/attestation route + enclave capacity — how it reads |
| x402 resale | list unused allowance back on the market | settlement layer, not the gateway |
| Partner pools | a protocol draws from a shared budget for its users | a key record with a pooled counter instead of a personal one |
L3 is the only rung that replaces trust with a proof, and it is the only one that needs hardware we do not rent today. It is direction, not a date.
#What we will not do
Stated so the absence reads as a decision rather than an oversight.
- No prompt logging, ever, not even opt-in. Some routers offer a discount for letting them keep your prompts. There is no switch here because the feature does not exist.
- No silent model swaps. A mode resolves to one model at a time, and changing it is a deploy with a changelog entry — not a live A/B against your production traffic.
- No catalogue race. If you want the widest model list, use a catalogue router; that is what they are for. This is a key that pays for itself.
- No dates on this page. See above.
#Next
- The model stack — what each mode changes
- FRODO Backrooms — how two agents become a bounded transcript product
- Endpoint catalog — the surface as it exists today
- Ecosystem — what the key is worth, and who pays for it