Routing inference without an account

The router is four components behind one endpoint. Nothing about the request shape is novel — that is deliberate, because the migration cost of a router that requires a new dialect exceeds what it saves.

  client / agent
        │  POST /v1/chat/completions        (no key, no account)
        ▼
  ┌───────────────┐
  │   INGRESS     │  validate · normalize to the common dialect
  └──────┬────────┘
         ▼
  ┌───────────────┐   catalog: model × provider matrix
  │   RESOLVER    │   alias → concrete model (pinned or live)
  └──────┬────────┘
         ▼
  ┌───────────────┐   policy: cost | latency | quality
  │    ROUTER     │   health: observed error rate + TTFT band
  └──────┬────────┘
         │  402 Payment Required  ──────────►  wallet signs EIP-3009
         │  ◄────────────────────────────────  signed authorization
         ▼
  ┌───────────────┐   facilitator verifies off-chain (1 round trip)
  │  SETTLEMENT   │   facilitator submits transfer, returns tx hash
  └──────┬────────┘
         ▼
  ┌───────────────┐   Dolphin · Surplus · AntSeed
  │   UPSTREAMS   │   fallback walks the ordered candidate list
  └──────┬────────┘
         ▼
     SSE stream  +  { routing, settlement }

2.1 · Resolver

The catalog is a model-by-provider matrix: for each model, every upstream that can serve it, with context window, price, observed latency band and current health. The resolver maps the requested identifier — a vendor SKU or an alias in the wuraw/ namespace — to a concrete model and a candidate list. Aliases may be pinned to a date, freezing resolution so that outputs remain reproducible at the cost of following the catalog forward.

2.2 · Router

Selection is a policy applied to the candidate list, filtered by health. Health is measured, not declared: a rolling error rate and TTFT distribution per provider and region, de-weighting a degraded upstream within seconds and probing it back gradually. Only idempotent failures walk the fallback list; a client-side 4xx is returned unchanged rather than replayed at the payer’s expense.

2.3 · Tiers

Dolphin serves open-weight models free and rate-limited, and never touches the settlement path — which makes it the degraded-mode surface when settlement is unavailable. Surplus and AntSeed serve the metered catalog over independent capacity, so failover between them is failover between distinct operational failure domains rather than between two regions of one provider.

2.4 · What the router does not hold

No balances, no keys belonging to the payer, and no conversation history. Prompt and completion bodies transit the router and are not retained beyond the request, and nothing about their content is written onchain. The router’s durable state is the catalog, the health table and the settlement references — none of which describe what anyone asked a model.

Payment is carried inside the request cycle rather than beside it. A metered route answers an unpaid request with 402 and a machine-readable quote: scheme, network, asset, exact amount, payee and a validity window [2]. The client signs an EIP-3009 transferWithAuthorization message committing to that exact amount [4] and repeats the request with the signed payload in the payment header.

We do not name that header anywhere in our documentation. The community specification and current vendor documentation disagree on it, and the divergence appears to be a version boundary rather than an error [2]. Clients should read the header name from the challenge and code against the authorization payload, which is stable across both.

3.1 · Facilitator

A facilitator verifies the signature off-chain and submits the transfer, paying gas itself and returning a transaction hash [2]. The payer therefore never holds gas, never manages a nonce and never broadcasts anything. We treat facilitators as a redundant set rather than a fixed integration and record which one handled each transfer, because facilitator liveness sits directly in the critical path (§6.2).

3.2 · Asset and chain

USDG, the Global Dollar, is issued by Paxos and redeemable one for one against US dollars, with the issuing entity supervised as a Major Payments Institution in Singapore and separately regulated in the EU [7]. It is the first natively issued stablecoin on Robinhood Chain and that chain’s primary settlement asset [6][8].

Robinhood Chain is an Arbitrum Orbit rollup operating as an Ethereum L2 that settles directly to Ethereum, with blob data availability [5], chain ID 4663, a base fee near 0.05 gwei, and configurable block times with preconfirmations giving roughly 100 ms on the payment path [6]. Gas is paid in ETH and there is no native chain token, so a payer funds one asset and monitors one balance.

3.3 · Post-settlement failure

If an upstream fails after settlement has landed, the transfer cannot be reversed. The router issues a credit note against the payer address, redeemable on a subsequent request. This is a real asymmetry and we state it rather than describing it as a refund.