Glossary — TokenTriage Docs

The vocabulary that recurs across these docs.

Trust ladder — the safety model: ledger → shadow → route. You climb one rung at a time, and enforcement is earned on evidence, never assumed.
Ledger mode — observe and cost every request; zero request mutation.
Shadow mode — also compute the would-route decision and its counterfactual cost, touching no response.
Route mode — enforce decisions: rewrite the model, pick the cheaper upstream.
Decision ledger — the append-only JSONL log; one row per proxied request. “One ledger, one truth”: every surface derives from it and two may never disagree.
Provenance — the lineage stamped on every dollar: its pricing_snapshot, estimated flag, and source.
UNPRICED — a model with no price: a null cost that propagates as an exclusion count, never $0.00. Distinct from a declared-free explicit $0.
EST — the flag on an estimated (rather than provider-reported) figure.
Savings verdicts — PROVEN (measured post-change), ESTIMATED (a repricing model), UNPROVABLE (insufficient evidence). A recommendation can never be PROVEN.
Honesty verdict — the routing-skill verdict from eval, one of four wire-exact states: BEAT, NOT_BEAT (counterfactual ran, enough labels, delta ≤ threshold), ON_FRONTIER, or CANNOT_MEASURE (insufficient labels). Values are underscored and rendered verbatim from the API. Served-model labels can only place routing on the frontier; only judged shadow duplication can show a beat.
Shadow duplication — grading both tiers on the same query — the only data that can show the router beating a blind model mix.
Zero-router baseline — the best achievable by probabilistically mixing the individual models; the bar eval measures against.
Calibration — fitting routing thresholds from your own decision log (RouteLLM’s quantile method); writes a versioned candidate artifact that only routes once activated.
Row == wire — a governance refusal stamps the HTTP response and the decision-log row from the same value before any byte is sent; the two can never disagree.
Fail-open with disclosure — a dead accountant suspends a limit (traffic flows) and discloses suspended:[<limit_id>], rather than a fabricated 429.
Virtual key — a ttv_-prefixed bearer token bound to a tenancy node, stored as a SHA-256 hash, shown once at mint.
Tenancy node — a position in the org / team / user / key hierarchy that limits and keys attach to.
The six limit types — budget_usd, quota_tokens, quota_requests, rpm, tpm, concurrency.
Wire dialect — a protocol the binary speaks in code: openai, anthropic, bedrock, gemini.
Provider descriptor — the data (auth, pricing prefix, endpoints) that defines a provider; adding an OpenAI-compatible one is N+1-by-config (no new Go code).
Cross-dialect translation — opt-in openai ↔ anthropic translation that discloses every dropped parameter (default off).
x-tt-* headers — the explicit trace-identity contract (x-tt-trace-id, x-tt-step-id, x-tt-parent-id, x-tt-agent, x-tt-step-class, x-tt-tier); identity is never guessed.
Step-class — a step’s kind: user_turn, tool_loop, or provider_state.
Business dimensions — dim.user / dim.tenant / dim.feature / dim.tag.<key>, from x-tt-* headers.
Rollup tuple — the eight-dimension hourly pre-aggregation key behind the cost-analytics views (tenant, team, key, feature, model_served, tier, provider, endpoint).
BubbleUp — the per-dimension divergence attribution that ranks what drove an anomaly or a spend change.
robust-seasonal-v1 — the shipped, method-named cost anomaly detector.
Metacost — what the measurement itself cost (the cache’s own embedding spend, etc.).
Coverage merge — the read-time, coverage-typed merge over per-replica ledgers that produces a fleet view without a shared ledger.
FOCUS / chargeback / showback — the FinOps cost-export column standard; and per-scope allocation with (chargeback) or without (showback) an accounting transfer.
Reconciliation residual — the leftover of an invoice-vs-ledger match, shown as “unexplained,” never zeroed.