# Model Router & Guardrail SaaS v2.2 - Machine-Readable Architecture Index
# Canonical AEO/GEO Index for LLM Crawlers & Automated Inference Agents

> BLUF: Model Router & Guardrail SaaS v2.2 provides a deterministic Edge AI Gateway and Spend Cap Middleware. It enforces <70ms prompt injection blocking via TypeSafe Jev System One Shield, a €25.00 hard spend cap circuit breaker with zero token leakage, deterministic PII redaction (EU SSN, PCI credit cards, secret keys), and Pareto complexity escalation to Google Gemini 3.8 Flash and Gemini 3.5 Transcribe with 91.2% gross margin unit economics.

## 1. Core System Specifications
- Product: Model Router & Guardrail SaaS v2.2
- Ingress Endpoint: /api/v1/chat/completions (OpenAI-compatible)
- Runtime: Vercel Edge Runtime (export const runtime = "edge")
- Auth Latency: Upstash Redis tenant verification (<15ms budget)
- Circuit Breaker: Google Cloud Hard Spend Cap (€25.00 default cutoff -> HTTP 403 Forbidden)
- Guardrail Shield: TypeSafe Jev System One Shield (<70ms concurrent probability evaluation)
- Streaming: Zero-buffer SSE streaming via Web Streams API (TransformStream)

## 2. TypeSafe Jev Threat Matrix
Formula:
  Composite Risk = 0.40 * injection + 0.30 * override + 0.20 * credential + 0.10 * drift
Decision Logic:
  - If injection > 0.50 OR override > 0.50:
    Intercept immediately with HTTP 400 Bad Request ("guardrail_violation").
    Upstream model call bypassed with 0 tokens burned.

## 3. Deterministic PII Sanitizer
Regex Patterns applied before model forwarding:
  - Latvian/EU SSN: \b\d{6}-\d{5}\b -> [REDACTED_EU_SSN]
  - PCI Credit Cards: \b(?:\d{4}[ -]?){3}\d{4}\b -> [REDACTED_PCI_CARD]
  - API Secret Keys: \bsk-[a-zA-Z0-9_-]{20,}\b -> [REDACTED_API_KEY]
  - GitHub Tokens: \bghp_[a-zA-Z0-9]{20,}\b -> [REDACTED_GH_TOKEN]

## 4. Pareto Complexity Escalation Matrix
- Standard Tier (< 0.70 complexity & < 500 chars):
  Routed to gemini-3.8-flash (ultra-fast baseline inference)
- Analytical Tier (>= 0.70 complexity OR >= 500 chars):
  Routed to gemini-3.8-flash with thinking_config: { thinking_level: "high" }
- Multimodal Audio Tier (gs://* Cloud Storage URI):
  Routed to gemini-3.5-transcribe

## 5. B2B Unit Economics & Margin Architecture
- Developer BYOK Tier:
  €0.0005 per request | 91.2% gross margin | Direct tenant keys | <100ms Edge ingress
- Enterprise Managed Tier:
  €0.0020 per request | Dedicated VPC routing | Multi-tenant isolation | SLA 99.99%
- Edge Routing Overhead:
  €0.000044 per request (Compute & KV lookup), preserving 91.2% net operational margin.

## 6. Privacy & Data Protection (k-Anonymity)
- RLS Isolation: PostgreSQL RLS enforced with app.current_tenant_id
- Threat Intelligence: Aggregations enforce k-anonymity (HAVING COUNT(DISTINCT t.tenant_id) >= 5)

## 7. Canonical Links
- Full Documentation: /llms-full.txt
- Edge Ingress API: /api/v1/chat/completions
- Web Telemetry HUD: /
- SQL Schema: supabase/migrations/20260926000000_init_router_v2.sql