diff --git a/Dockerfile.dashboard b/Dockerfile.dashboard
deleted file mode 100644
index e69de29..0000000
diff --git a/Dockerfile.queue b/Dockerfile.queue
deleted file mode 100644
index e69de29..0000000
diff --git a/LITELLM-MIGRATION-PLAN.md b/LITELLM-MIGRATION-PLAN.md
index 3c0d05e..6108ce1 100644
--- a/LITELLM-MIGRATION-PLAN.md
+++ b/LITELLM-MIGRATION-PLAN.md
@@ -49,7 +49,7 @@
           
                                                    
       
-   qwen3.6-35B     qwen3.6-27B      gemma-4-12b      
+   qwen3.6-35B     qwen3.6-27B      gpu-vision      
    MoE/Strix       Dense/RTX3090    VLM/RTX 5070     
    :8080 (llama)   :8080 (llama)    :8080 (llama)    
    :8090 (side)    :8090 (side)     :8090 (sidecar)  
@@ -84,7 +84,7 @@
 |-----|------|-----------|---------|------|---------|
 | qwen3.6-35B-A3B (MoE) | 192.168.68.15 | :8080 | :8090 | Strix Halo | 262K |
 | qwen3.6-27B-code (Dense) | 192.168.68.8 | :8080 | :8090 | RTX 3090 | 262K |
-| gemma-4-12b (VLM) | 192.168.68.110 | :8080 | :8090 | RTX 5070 | 262K |
+| gpu-vision (VLM) | 192.168.68.110 | :8080 | :8090 | RTX 5070 | 262K |
 
 ### 1.3 Existing LiteLLM POC on CT 116
 
@@ -249,9 +249,9 @@ model_list:
       api_base: http://router:9000/v1
       api_key: os.environ/ROUTER_API_KEY
 
-  - model_name: gemma-4-12b
+  - model_name: gpu-vision
     litellm_params:
-      model: openai/gemma-4-12b
+      model: openai/gpu-vision
       api_base: http://router:9000/v1
       api_key: os.environ/ROUTER_API_KEY
 
@@ -298,9 +298,9 @@ router_settings:
   # Fallback chains: LiteLLM retries down the chain when router returns saturated
   # This gives accurate per-model metrics because router no longer silently reroutes
   fallbacks:
-    - qwen3.6-35B-A3B: ["qwen3.6-27B-code", "gemma-4-12b"]
-    - qwen3.6-27B-code: ["qwen3.6-35B-A3B", "gemma-4-12b"]
-    - gemma-4-12b: ["qwen3.6-27B-code", "qwen3.6-35B-A3B"]
+    - qwen3.6-35B-A3B: ["qwen3.6-27B-code", "gpu-vision"]
+    - qwen3.6-27B-code: ["qwen3.6-35B-A3B", "gpu-vision"]
+    - gpu-vision: ["qwen3.6-27B-code", "qwen3.6-35B-A3B"]
 
 # Cost tracking: map model names to per-token pricing for spend tracking
 litellm_settings:
@@ -311,7 +311,7 @@ litellm_settings:
     qwen3.6-27B-code:
       input_cost_per_token: 0.0
       output_cost_per_token: 0.0
-    gemma-4-12b:
+    gpu-vision:
       input_cost_per_token: 0.0
       output_cost_per_token: 0.0
     # For internal cost allocation, set symbolic rates:
@@ -705,9 +705,9 @@ if req != "auto":
 router_settings:
   allowed_fails: 100
   fallbacks:
-    - qwen3.6-35B-A3B: ["qwen3.6-27B-code", "gemma-4-12b"]
-    - qwen3.6-27B-code: ["qwen3.6-35B-A3B", "gemma-4-12b"]
-    - gemma-4-12b: ["qwen3.6-27B-code", "qwen3.6-35B-A3B"]
+    - qwen3.6-35B-A3B: ["qwen3.6-27B-code", "gpu-vision"]
+    - qwen3.6-27B-code: ["qwen3.6-35B-A3B", "gpu-vision"]
+    - gpu-vision: ["qwen3.6-27B-code", "qwen3.6-35B-A3B"]
 ```
 
 ### Result
diff --git a/README.md b/README.md
index c5f42d9..5e48169 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ CT 116 Docker stack for routing local GPU models through a unified OpenAI-compat
 nginx :80 → router :9000 → GPU backends
                 ├─ qwen3.6-35B-A3B (MoE) @ 192.168.68.15:8080  [2 slots, 262K ctx]
                 ├─ qwen3.6-27B-code (Dense) @ 192.168.68.8:8080  [2 slots, 262K ctx]
-                └─ gemma-4-12b (VLM) @ 192.168.68.110:8080    [2 slots, 262K ctx]
+                └─ gpu-vision (VLM) @ 192.168.68.110:8080    [2 slots, 262K ctx]
                                      Total: 6 concurrent slots
 
 LiteLLM :8081 (fallback) | Dashboard :3000 | Redis :6379 (local)
@@ -63,7 +63,7 @@ When all GPUs are saturated, requests enter a polling queue (500ms intervals) in
 |-----|-------|------|-------|
 | Strix Halo | qwen3.6-35B-A3B (MoE) | 65GB | 2 | 262K | General quality |
 | RTX 3090 | qwen3.6-27B-code (Dense) | 24GB | 2 | 262K | Code, reasoning |
-| RTX 5070 | gemma-4-12b (VLM) | 12GB | 2 | 262K | Speed, vision |
+| RTX 5070 | gpu-vision (VLM) | 12GB | 2 | 262K | Speed, vision |
 
 ## Maintenance
 
diff --git a/dashboard/dashboard.html b/dashboard/dashboard.html
index f743140..fdee4c7 100644
--- a/dashboard/dashboard.html
+++ b/dashboard/dashboard.html
@@ -70,7 +70,7 @@ body{background:var(--bg);color:var(--text);font-family:-apple-system,BlinkMacSy
 </div>
 
 <script>
-const COLORS={'qwen3.6-35B-A3B':'#10b981','qwen3.6-27B-code':'#8b5cf6','gemma-4-12b':'#3b82f6'};
+const COLORS={'qwen3.6-35B-A3B':'#10b981','qwen3.6-27B-code':'#8b5cf6','gpu-vision':'#3b82f6'};
 const HISTORY=[]; // rolling 60 sample history for chart
 function Q(id){return document.getElementById(id)}
 
diff --git a/dashboard/dashboard.py b/dashboard/dashboard.py
index aa0511a..71590fa 100644
--- a/dashboard/dashboard.py
+++ b/dashboard/dashboard.py
@@ -119,7 +119,7 @@ body { background: #0b0f17; color: #bcc3cd; font-family: -apple-system, BlinkMac
     <div class="d-flex gap-2">
       <select id="scatter-model" onchange="loadScatter()" style="font-size:10px;background:#1e293b;color:#94a3b8;border:1px solid #334155;border-radius:4px;padding:2px 6px">
         <option value="all">All Models</option>
-        <option value="gemma-4-12b">12B VLM</option>
+        <option value="gpu-vision">12B VLM</option>
         <option value="qwen3.6-27B-code">27B Dense</option>
         <option value="qwen3.6-35B-A3B">35B MoE</option>
       </select>
@@ -136,9 +136,9 @@ body { background: #0b0f17; color: #bcc3cd; font-family: -apple-system, BlinkMac
 </div>
 
 <script>
-var MC={'gemma-4-12b':'#22c55e','qwen3.6-27B-code':'#f59e0b','qwen3.6-35B-A3B':'#a78bfa'};
-var ML={'gemma-4-12b':'Gemma 4 12B','qwen3.6-27B-code':'Qwen Code','qwen3.6-35B-A3B':'Qwen MoE'};
-var GL={'qwen3.6-35B-A3B':'MoE - Strix Halo','qwen3.6-27B-code':'Dense - RTX 3090','gemma-4-12b':'VLM - RTX 5070'};
+var MC={'gpu-vision':'#22c55e','qwen3.6-27B-code':'#f59e0b','qwen3.6-35B-A3B':'#a78bfa'};
+var ML={'gpu-vision':'Gemma 4 12B','qwen3.6-27B-code':'Qwen Code','qwen3.6-35B-A3B':'Qwen MoE'};
+var GL={'qwen3.6-35B-A3B':'MoE - Strix Halo','qwen3.6-27B-code':'Dense - RTX 3090','gpu-vision':'VLM - RTX 5070'};
 function $(id){return document.getElementById(id);}
 
 function render(data){
@@ -147,7 +147,7 @@ var t=Object.values(data.route_counts||{}).reduce((a,b)=>a+b,0);
 var ta=0,tm=0;data.gpus.forEach(function(g){ta+=(g.active_requests||0);tm+=(g.max_concurrent||1)});
 $('kpi-total').textContent=t;$('kpi-active').textContent=ta+'/'+tm;$('kpi-agents').textContent=Object.keys(data.agent_counts||{}).length;
 $('update-time').textContent=new Date().toLocaleTimeString();
-var ids={'qwen3.6-35B-A3B':'gpu-moe','qwen3.6-27B-code':'gpu-dense','gemma-4-12b':'gpu-light'};
+var ids={'qwen3.6-35B-A3B':'gpu-moe','qwen3.6-27B-code':'gpu-dense','gpu-vision':'gpu-light'};
 data.gpus.forEach(function(g){
 var el=$(ids[g.id]);if(!el)return;
 var a=g.active_requests||0,mx=g.max_concurrent||1;
@@ -179,14 +179,14 @@ var sc=pct>=100?'#ef4444':pct>=50?'#f59e0b':'#22c55e';
 var circ=188.5,dash=(pct/100)*circ;
 var h='<div class=\"d-inline-block position-relative mb-2\"><svg width=\"72\" height=\"72\"><circle cx=\"36\" cy=\"36\" r=\"30\" fill=\"none\" stroke=\"#1e293b\" stroke-width=\"6\"/><circle cx=\"36\" cy=\"36\" r=\"30\" fill=\"none\" stroke=\"'+sc+'\" stroke-width=\"6\" stroke-dasharray=\"'+dash+' '+(circ-dash)+'\" stroke-linecap=\"round\" transform=\"rotate(-90 36 36)\"/></svg><div style=\"position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);text-align:center\"><div class=\"ring-label\" style=\"color:'+sc+'\">'+ta+'</div><div class=\"ring-sublabel\">/ '+tm+' slots</div></div></div>';
 h+='<div class=\"fw-bold mb-2 small\" style=\"color:'+sc+'\">'+st+'</div>';
-var lb={'qwen3.6-35B-A3B':'MoE','qwen3.6-27B-code':'Dense','gemma-4-12b':'VLM'};
+var lb={'qwen3.6-35B-A3B':'MoE','qwen3.6-27B-code':'Dense','gpu-vision':'VLM'};
 data.gpus.forEach(function(g){var a=g.active_requests||0,mx=g.max_concurrent||1,gp=mx>0?Math.round(a/mx*100):0;h+='<div class=\"d-flex align-items-center gap-2 mb-1 justify-content-center\"><span class=\"small\" style=\"min-width:32px;text-align:right;font-size:10px\">'+(lb[g.id]||g.id)+'</span><div style=\"flex:1;max-width:70px;height:3px;background:#1e293b;border-radius:2px;overflow:hidden\"><div style=\"height:100%;width:'+gp+'%;background:'+sc+';border-radius:2px\"></div></div><span class=\"small\" style=\"min-width:22px;font-size:10px\">'+a+'/'+mx+'</span></div>'});
 el.innerHTML=h;
 }
 
 function renderGPUMetrics(data){
 var el=$('gpu-metrics-card');if(!el)return;
-var lb={'qwen3.6-35B-A3B':'MoE','qwen3.6-27B-code':'Dense','gemma-4-12b':'VLM'};
+var lb={'qwen3.6-35B-A3B':'MoE','qwen3.6-27B-code':'Dense','gpu-vision':'VLM'};
 var h='';data.gpus.forEach(function(g){
 var nm=lb[g.id]||g.id,tp=g.temp_c||0,ut=g.gpu_util_pct||0,pw=g.power_w||0,pl=g.power_limit_w||0;
 var tc=tp>85?'#ef4444':tp>70?'#f59e0b':'#22c55e',uc=ut>90?'#ef4444':ut>70?'#f59e0b':'#22c55e';
@@ -219,8 +219,8 @@ function loadPerf(){fetch('/api/performance?window='+perfWindow).then(function(r
 function renderPerf(d){
 var models=d.models||[],reasons=d.reasons||[],agents=d.agents||[],sum=d.summary||{};
 // Latency bars: p50/p95/p99 per model
-var mlab={'qwen3.6-35B-A3B':'35B MoE','qwen3.6-27B-code':'27B Dense','gemma-4-12b':'12B VLM'};
-var mcol={'qwen3.6-35B-A3B':'#a78bfa','qwen3.6-27B-code':'#f59e0b','gemma-4-12b':'#22c55e'};
+var mlab={'qwen3.6-35B-A3B':'35B MoE','qwen3.6-27B-code':'27B Dense','gpu-vision':'12B VLM'};
+var mcol={'qwen3.6-35B-A3B':'#a78bfa','qwen3.6-27B-code':'#f59e0b','gpu-vision':'#22c55e'};
 if(!models.length){$('perf-latency').innerHTML='<div class="text-secondary small text-center py-4">Accumulating data...</div>';return;}
 var maxLat=Math.max(...models.map(function(m){return m.latency.p99||0}),1);
 var latHTML=models.map(function(m){
@@ -270,8 +270,8 @@ fetch('/api/scatter?window=24&model='+m).then(function(r){return r.json()}).then
 function renderScatter(d){
 var pts=d.points||[],el=$('scatter-plot'),lg=$('scatter-legend');
 if(!pts.length){el.innerHTML='<div class="text-secondary small text-center py-5">No data yet</div>';return;}
-var mcol={'qwen3.6-35B-A3B':'#a78bfa','qwen3.6-27B-code':'#f59e0b','gemma-4-12b':'#22c55e','unknown':'#38bdf8'};
-var mlab={'qwen3.6-35B-A3B':'35B MoE','qwen3.6-27B-code':'27B Dense','gemma-4-12b':'12B VLM'};
+var mcol={'qwen3.6-35B-A3B':'#a78bfa','qwen3.6-27B-code':'#f59e0b','gpu-vision':'#22c55e','unknown':'#38bdf8'};
+var mlab={'qwen3.6-35B-A3B':'35B MoE','qwen3.6-27B-code':'27B Dense','gpu-vision':'12B VLM'};
 var maxX=Math.max.apply(null,pts.map(function(p){return p.prompt_tokens||0}))||1000;
 var maxY=Math.max.apply(null,pts.map(function(p){return p.inference_ms||0}))||5000;
 // Log scale for X axis (prompt tokens vary widely)
diff --git a/dashboard/harness.html b/dashboard/harness.html
index eeb9df3..78637d8 100644
--- a/dashboard/harness.html
+++ b/dashboard/harness.html
@@ -362,7 +362,7 @@ function dashboard() {
             try {
                 const metrics = await fetch('/metrics/circuit-breaker').then(r => r.json());
                 this.gpuHealth = [
-                    { id: 'gemma3-70b', name: 'Gemma 3 70B', model: 'gemma3-70b', health_score: metrics.gemma3_70b?.gpu_health_score || 39.4, vram_pct: 45, temp: 78, load: 65, is_preferred: true },
+                    { id: 'gpu-vision', name: 'Qwen3.5-9B Vision', model: 'gpu-vision', health_score: metrics.gpu_vision?.gpu_health_score || 39.4, vram_pct: 45, temp: 78, load: 65, is_preferred: true },
                     { id: 'deepseek-v3', name: 'DeepSeek V3', model: 'deepseek-v3', health_score: metrics.deepseek_v3?.gpu_health_score || 45.9, vram_pct: 60, temp: 82, load: 50, is_preferred: false },
                     { id: 'mistral-small', name: 'Mistral Small', model: 'mistral-small', health_score: metrics.mistral_small?.gpu_health_score || 35.0, vram_pct: 30, temp: 65, load: 40, is_preferred: false }
                 ];
@@ -388,7 +388,7 @@ function dashboard() {
         async fetchSessionAnalytics() {
             try {
                 this.sessionData = {
-                    distribution: { 'gemma3-70b': 45, 'deepseek-v3': 30, 'mistral-small': 25 },
+                    distribution: { 'gpu-vision': 45, 'deepseek-v3': 30, 'mistral-small': 25 },
                     trend: Array.from({ length: 24 }, (_, i) => ({ time: `${i}:00`, sessions: Math.floor(Math.random() * 20) + 10 })),
                     peaks: { '09:00': 25, '14:00': 30, '18:00': 20 }
                 };
@@ -400,7 +400,7 @@ function dashboard() {
             try {
                 this.systemPerf = {
                     latency: { p50: Math.floor(Math.random() * 50) + 100, p95: Math.floor(Math.random() * 200) + 250, p99: Math.floor(Math.random() * 500) + 400 },
-                    errorRates: { 'gemma3-70b': Math.random() * 0.01, 'deepseek-v3': Math.random() * 0.02, 'mistral-small': Math.random() * 0.015 }
+                    errorRates: { 'gpu-vision': Math.random() * 0.01, 'deepseek-v3': Math.random() * 0.02, 'mistral-small': Math.random() * 0.015 }
                 };
                 console.log('System performance loaded');
             } catch (error) { console.error('Failed to load system performance:', error); }
@@ -434,7 +434,7 @@ function dashboard() {
         },
 
         getGPUColor(name) {
-            const colors = { 'gemma3-70b': '#3b82f6', 'deepseek-v3': '#8b5cf6', 'mistral-small': '#10b981' };
+            const colors = { 'gpu-vision': '#3b82f6', 'deepseek-v3': '#8b5cf6', 'mistral-small': '#10b981' };
             return colors[name] || '#9ca3af';
         }
     };
diff --git a/docker-compose.yml b/docker-compose.yml
index 2add58e..ea81ed2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,4 +1,4 @@
-version: '3.8'
+version: "3.8"
 
 services:
   redis:
@@ -16,46 +16,70 @@ services:
       timeout: 3s
       retries: 5
 
-  router:
-    build: ./router
-    container_name: harness-router
+  postgres:
+    image: postgres:16-alpine
+    container_name: harness-postgres
     restart: unless-stopped
-    network_mode: host
+    ports:
+      - "127.0.0.1:5432:5432"
     environment:
-      - REDIS_URL=redis://127.0.0.1:6379
-      - GPU_MOE_URL=http://192.168.68.15:8080/v1
-      - GPU_DENSE_URL=http://192.168.68.8:8080/v1
-      - GPU_LIGHT_URL=http://192.168.68.110:8080/v1
-      - API_KEYS={"sk-sys...-key":{"tier":"enterprise","agent":"admin","deprecated":true},"sk-9e6...cb64":{"tier":"enterprise","agent":"admin"},"***":{"tier":"enterprise","agent":"Abiba","deprecated":true},"sk-856...a889":{"tier":"enterprise","agent":"Abiba"},"***":{"tier":"enterprise","agent":"Mumuni","deprecated":true},"sk-b57...807e":{"tier":"enterprise","agent":"Mumuni"},"***":{"tier":"enterprise","agent":"Tanko","deprecated":true},"sk-620...eaa7":{"tier":"enterprise","agent":"Tanko"},"***":{"tier":"enterprise","agent":"Koby","deprecated":true},"sk-eb3...fdee":{"tier":"enterprise","agent":"Koby"},"***":{"tier":"enterprise","agent":"Kagenz0","deprecated":true},"sk-12b...ed9b":{"tier":"enterprise","agent":"Kagenz0"},"***":{"tier":"enterprise","agent":"Koonimo","deprecated":true},"sk-680...4dfe":{"tier":"enterprise","agent":"Koonimo"},"***":{"tier":"starter","agent":"test-starter","deprecated":true},"sk-55d...7860":{"tier":"starter","agent":"test-starter"},"sk-pro...z789":{"tier":"professional","agent":"test-pro","deprecated":true},"sk-b51...e676":{"tier":"professional","agent":"test-pro"}}
-      - ADMIN_KEY=sk-adm...8814
+      - POSTGRES_DB=litellm
+      - POSTGRES_USER=litellm
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+    volumes:
+      - pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9000/health')"]
-      interval: 30s
-      timeout: 15s
-      retries: 3
-    depends_on:
-      redis:
-        condition: service_healthy
+      test: ["CMD-SHELL", "pg_isready -U litellm"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
 
   litellm:
-    image: ghcr.io/berriai/litellm:main-stable
+    image: ghcr.io/docker.litellm.ai/berriai/litellm:1.99.1
     command: ["--config", "/app/config.yaml", "--port", "4000"]
     container_name: harness-litellm
     restart: unless-stopped
     ports:
-      - "127.0.0.1:8081:4000"
+      - "4000:4000"
     volumes:
       - ./litellm_config.yaml:/app/config.yaml
+      - /opt/combined-ca-bundle.pem:/etc/ssl/certs/ca-certificates.crt:ro
     environment:
-      - LITELLM_MASTER_KEY=sk-sys...-key
+      - PROMETHEUS_EXPORTER=true
+      - ENFORCE_PRISMA_MIGRATION_CHECK=true
+      - LITELLM_MASTER_KEY=${LITELLM_MASTER_KEY}
+      - DATABASE_URL=postgresql://litellm:${POSTGRES_PASSWORD}@postgres:5432/litellm
+      - STORE_MODEL_IN_DB=True
+      - LITELLM_UI_USERNAME=admin
+      - LITELLM_UI_PASSWORD=${LITELLM_UI_PASSWORD}
+      - UI_USERNAME=admin
+      - UI_PASSWORD=${UI_PASSWORD}
+      - OPENAI_API_KEY=${OPENAI_API_KEY}
+      - PROXY_BASE_URL=https://litellm.sysloggh.net
+      - DOCS_URL=/docs
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+      - GENERIC_CLIENT_ID=FHd7bs9dP5gHad2Ki23iUL5kQvFa0GRaj3nlLnNU
+      - GENERIC_CLIENT_SECRET=${GENERIC_CLIENT_SECRET}
+      - GENERIC_AUTHORIZATION_ENDPOINT=https://auth.sysloggh.net/application/o/authorize/
+      - GENERIC_TOKEN_ENDPOINT=http://harness-nginx/application/o/token/
+      - GENERIC_USERINFO_ENDPOINT=http://harness-nginx/application/o/userinfo/
+      - GENERIC_SCOPE=openid email profile
+      - MCP_SERVER_RAHOS_URL=http://192.168.68.65:3100/mcp
+      - MCP_SERVER_RAHOS_TRANSPORT=http
+      - GENERIC_ROLE_MAPPINGS_DEFAULT_ROLE=proxy_admin
+      - SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
     extra_hosts:
       - "host.docker.internal:host-gateway"
+      - "auth.sysloggh.net:192.168.68.11"
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/health/liveliness')"]
       interval: 15s
       timeout: 5s
       retries: 3
+      start_period: 120s
     depends_on:
+      postgres:
+        condition: service_healthy
       redis:
         condition: service_healthy
 
@@ -69,7 +93,7 @@ services:
       - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       - ./dashboard:/opt/inference-harness/dashboard:ro
     extra_hosts:
-        - "host.docker.internal:host-gateway"
+      - "auth.sysloggh.net:192.168.68.11"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1/health"]
       interval: 30s
@@ -86,7 +110,7 @@ services:
     ports:
       - "127.0.0.1:3000:3000"
     environment:
-      - REDIS_URL=redis://127.0.0.1:6379
+      - REDIS_URL=redis://redis:6379
       - GPU_SIDECARS=192.168.68.15:8090,192.168.68.8:8090,192.168.68.110:8090
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:3000/health')"]
@@ -96,8 +120,7 @@ services:
     depends_on:
       - redis
 
+
 volumes:
   redis-data:
-
-# LiteLLM command override to load config
-# (appended to fix config loading issue)
+  pgdata:
diff --git a/docker-compose.yml.bak b/docker-compose.yml.bak
index ceb2bbb..9f97e54 100644
--- a/docker-compose.yml.bak
+++ b/docker-compose.yml.bak
@@ -1,4 +1,4 @@
-version: '3.8'
+version: "3.8"
 
 services:
   redis:
@@ -16,43 +16,89 @@ services:
       timeout: 3s
       retries: 5
 
+  postgres:
+    image: postgres:16-alpine
+    container_name: harness-postgres
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:5432:5432"
+    environment:
+      - POSTGRES_DB=litellm
+      - POSTGRES_USER=litellm
+      - POSTGRES_PASSWORD=d9fc143e3dc1a7a8e672c359fea95c5e
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U litellm"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+
   router:
     build: ./router
     container_name: harness-router
     restart: unless-stopped
     ports:
-      - "9000:9000"
+      - "127.0.0.1:9000:9000"
     environment:
       - REDIS_URL=redis://redis:6379
-      - GPU_MOE_URL=http://192.168.68.15:8080/v1
       - GPU_DENSE_URL=http://192.168.68.8:8080/v1
+      - GPU_MOE_URL=http://192.168.68.15:8080/v1
       - GPU_LIGHT_URL=http://192.168.68.110:8080/v1
+      - API_KEYS={"sk-syslog-local-master-key":{"tier":"enterprise","agent":"admin","deprecated":true},"sk-9e65b69a67-e54af421c1b09fb8bd4f75dacb38cb64":{"tier":"enterprise","agent":"admin"},"sk-syslog-abiba":{"tier":"enterprise","agent":"Abiba","deprecated":true},"sk-856ffb0bbb-e5aaf78b10054eca608f8fbcbd73a889":{"tier":"enterprise","agent":"Abiba"},"sk-syslog-mumuni":{"tier":"enterprise","agent":"Mumuni","deprecated":true},"sk-b57e6e042e-47573660114f3138c852c47f62da807e":{"tier":"enterprise","agent":"Mumuni"},"sk-syslog-tanko":{"tier":"enterprise","agent":"Tanko","deprecated":true},"sk-620a05e95a-e93d875476b650a4d1137249ead8eaa7":{"tier":"enterprise","agent":"Tanko"},"sk-syslog-koby":{"tier":"enterprise","agent":"Koby","deprecated":true},"sk-eb3e6fc1c0-de1bf2edf35a53cb3749a2400483fdee":{"tier":"enterprise","agent":"Koby"},"sk-syslog-kagenz0":{"tier":"enterprise","agent":"Kagenz0","deprecated":true},"sk-12b66b3392-b548aed9138aeb6f698e8e521650ed9b":{"tier":"enterprise","agent":"Kagenz0"},"sk-syslog-koonimo":{"tier":"enterprise","agent":"Koonimo","deprecated":true},"sk-680d06686c-00ee8bf9dc3c93b276af122d49a14dfe":{"tier":"enterprise","agent":"Koonimo"},"sk-starter-abc123":{"tier":"starter","agent":"test-starter","deprecated":true},"sk-55da55907a-1bd7ff344e26feda50e9ac2219697860":{"tier":"starter","agent":"test-starter"},"sk-professional-xyz789":{"tier":"professional","agent":"test-pro","deprecated":true},"sk-b5159863e6-8df3ae52fb958cfe76cc2888c8c8e676":{"tier":"professional","agent":"test-pro"}}
+      - ADMIN_KEY=sk-admin-ee09fffd04978b61a1569ac670c68814
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9000/health')"]
-      interval: 15s
-      timeout: 5s
+      interval: 30s
+      timeout: 15s
       retries: 3
     depends_on:
       redis:
         condition: service_healthy
 
   litellm:
-    image: ghcr.io/berriai/litellm:main-stable
+    image: ghcr.io/docker.litellm.ai/berriai/litellm:1.90.0-rc.1
     command: ["--config", "/app/config.yaml", "--port", "4000"]
     container_name: harness-litellm
     restart: unless-stopped
     ports:
-      - "8081:4000"
+      - "4000:4000"
     volumes:
       - ./litellm_config.yaml:/app/config.yaml
+      - /opt/combined-ca-bundle.pem:/etc/ssl/certs/ca-certificates.crt:ro
     environment:
-      - LITELLM_MASTER_KEY=sk-syslog-local-master-key
+      - PROMETHEUS_EXPORTER=true
+      - LITELLM_MASTER_KEY=sk-litellm-7f96080dd99b15c36bd4b333b58a6796
+      - ROUTER_API_KEY=sk-9e65b69a67-e54af421c1b09fb8bd4f75dacb38cb64
+      - DATABASE_URL=postgresql://litellm:d9fc143e3dc1a7a8e672c359fea95c5e@postgres:5432/litellm
+      - STORE_MODEL_IN_DB=True
+      - LITELLM_UI_USERNAME=admin
+      - LITELLM_UI_PASSWORD=syslog-admin-2026
+      - UI_USERNAME=admin
+      - UI_PASSWORD=syslog-admin-2026
+      - OPENAI_API_KEY=not-used
+      - PROXY_BASE_URL=https://litellm.sysloggh.net
+      - DOCS_URL=/docs
+      - ANTHROPIC_API_KEY=not-used
+      - GENERIC_CLIENT_ID=FHd7bs9dP5gHad2Ki23iUL5kQvFa0GRaj3nlLnNU
+      - GENERIC_CLIENT_SECRET=aDkXQx82duqpxc98xxqp0quzzUf1mawsnOTqj7sx1acaS7rWSt02N5ksBCi92n8ZilRavigoYME6fLakP20Ixc9H2pxnSZFiOqQLb7BPi8UtsvfxmzXklD0HJIdbKFxe
+      - GENERIC_AUTHORIZATION_ENDPOINT=https://auth.sysloggh.net/application/o/authorize/
+      - GENERIC_TOKEN_ENDPOINT=http://harness-nginx/application/o/token/
+      - GENERIC_USERINFO_ENDPOINT=http://harness-nginx/application/o/userinfo/
+      - GENERIC_SCOPE=openid email profile
+      - GENERIC_ROLE_MAPPINGS_DEFAULT_ROLE=proxy_admin
+      - SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+      - "auth.sysloggh.net:192.168.68.11"
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:4000/health/liveliness')"]
       interval: 15s
       timeout: 5s
       retries: 3
     depends_on:
+      postgres:
+        condition: service_healthy
       redis:
         condition: service_healthy
 
@@ -64,10 +110,13 @@ services:
       - "80:80"
     volumes:
       - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+      - ./dashboard:/opt/inference-harness/dashboard:ro
+    extra_hosts:
+      - "auth.sysloggh.net:192.168.68.11"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://127.0.0.1/health"]
-      interval: 15s
-      timeout: 5s
+      interval: 30s
+      timeout: 15s
       retries: 3
     depends_on:
       - litellm
@@ -78,7 +127,7 @@ services:
     container_name: harness-dashboard
     restart: unless-stopped
     ports:
-      - "3000:3000"
+      - "127.0.0.1:3000:3000"
     environment:
       - REDIS_URL=redis://redis:6379
       - GPU_SIDECARS=192.168.68.15:8090,192.168.68.8:8090,192.168.68.110:8090
@@ -90,8 +139,7 @@ services:
     depends_on:
       - redis
 
+
 volumes:
   redis-data:
-
-# LiteLLM command override to load config
-# (appended to fix config loading issue)
+  pgdata:
diff --git a/gpu-router-docker.conf b/gpu-router-docker.conf
deleted file mode 100644
index c17c2f5..0000000
--- a/gpu-router-docker.conf
+++ /dev/null
@@ -1,106 +0,0 @@
-## Syslog GPU Router — Nginx Configuration (Docker-internal)
-## Routes incoming agent requests to the appropriate GPU backend
-## based on the X-Syslog-Model header.
-
-upstream amdpve_pool {
-    ## Strix Halo 395 — qwen3.6-35B-A3B (MoE) — Default workhorse
-    server 192.168.68.15:8080;
-}
-
-upstream llmgpu_pool {
-    ## RTX 3090 — qwen3.5-27B (Dense) — Heavy reasoning
-    server 192.168.68.8:8080;
-}
-
-upstream ocu_llm_pool {
-    ## New Backend — gemma-4-12b (VLM) — Vision + light tasks
-    server 192.168.68.110:8080;
-}
-
-upstream queue_service {
-    ## Agent queue with circuit breaker (Docker container)
-    server queue-service:8091;
-}
-
-upstream dashboard_service {
-    ## Harness dashboard (Docker container)
-    server dashboard:3001;
-}
-
-## ------------------------------------------------------------------
-## Mapping: X-Syslog-Model header → upstream backend
-## ------------------------------------------------------------------
-map $http_x_syslog_model $gpu_upstream {
-    default          amdpve_pool;
-    "standard"       amdpve_pool;
-    "heavy"          llmgpu_pool;
-    "qwen3.5-27B"    llmgpu_pool;
-    "light"          ocu_llm_pool;
-    "gemma-4-12b"        ocu_llm_pool;
-}
-
-## Rate limit zone — 10 req/s per IP, burst of 20
-limit_req_zone $binary_remote_addr zone=perip:10m rate=10r/s;
-
-server {
-    listen 80;
-    server_name _;
-
-    ## ------------------------------------------------------------------
-    ## Dashboard — observability UI (MUST be before / catch-all)
-    ## ------------------------------------------------------------------
-    location /dashboard {
-        proxy_pass http://dashboard_service/;
-        proxy_set_header Host              $host;
-        proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-    }
-
-    ## ------------------------------------------------------------------
-    ## Main location — proxy to selected upstream
-    ## ------------------------------------------------------------------
-    location / {
-        limit_req zone=perip burst=20 nodelay;
-        limit_req_status 503;
-        proxy_pass http://$gpu_upstream;
-
-        ## Preserve original host and headers
-        proxy_set_header Host              $host;
-        proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        ## Pass through the model header so backends can log it
-        proxy_pass_header X-Syslog-Model;
-
-        ## Streaming support (SSE for LLM responses)
-        proxy_buffering off;
-        proxy_cache     off;
-        proxy_read_timeout  300s;
-        proxy_send_timeout  300s;
-
-        ## Basic failover — retry on error or timeout
-        proxy_next_upstream error timeout http_502 http_503;
-        proxy_next_upstream_tries 2;
-
-        ## Add a response header for observability
-        add_header X-Routed-To $gpu_upstream always;
-
-        ## Fallback to queue when all GPU upstreams are down
-        error_page 502 503 504 = @queue_fallback;
-    }
-
-    ## ------------------------------------------------------------------
-    ## Queue fallback — enqueue when GPUs are unavailable
-    ## ------------------------------------------------------------------
-    location @queue_fallback {
-        rewrite ^ /enqueue break;
-        proxy_pass http://queue_service;
-        proxy_set_header Host              $host;
-        proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Content-Type      $content_type;
-        proxy_pass_request_body            on;
-    }
-}
diff --git a/gpu-router.conf b/gpu-router.conf
deleted file mode 100644
index d0e9712..0000000
--- a/gpu-router.conf
+++ /dev/null
@@ -1,106 +0,0 @@
-## Syslog GPU Router — Nginx Configuration
-## Routes incoming agent requests to the appropriate GPU backend
-## based on the X-Syslog-Model header.
-
-upstream amdpve_pool {
-    ## Strix Halo 395 — qwen3.6-35B-A3B (MoE) — Default workhorse
-    server 192.168.68.15:8080;
-}
-
-upstream llmgpu_pool {
-    ## RTX 3090 — qwen3.5-27B (Dense) — Heavy reasoning
-    server 192.168.68.8:8080;
-}
-
-upstream ocu_llm_pool {
-    ## New Backend — gemma-4-12b (VLM) — Vision + light tasks
-    server 192.168.68.110:8080;
-}
-
-upstream queue_service {
-    ## Agent queue with circuit breaker (Docker container)
-    server 127.0.0.1:8091;
-}
-
-upstream dashboard_service {
-    ## Harness dashboard (Docker container)
-    server 127.0.0.1:3001;
-}
-
-## ------------------------------------------------------------------
-## Mapping: X-Syslog-Model header → upstream backend
-## ------------------------------------------------------------------
-map $http_x_syslog_model $gpu_upstream {
-    default          amdpve_pool;   # missing header → default workhorse
-    "standard"       amdpve_pool;
-    "heavy"          llmgpu_pool;
-    "qwen3.5-27B"    llmgpu_pool;
-    "light"          ocu_llm_pool;
-    "gemma-4-12b"        ocu_llm_pool;
-}
-
-server {
-    listen 8080;
-    server_name _;
-
-    # Rate limit zone — 10 req/s per IP, burst of 20
-    limit_req_zone $binary_remote_addr zone=perip:10m rate=10r/s;
-
-    ## ------------------------------------------------------------------
-    ## Dashboard — observability UI (MUST be before / catch-all)
-    ## ------------------------------------------------------------------
-    location /dashboard {
-        proxy_pass http://dashboard_service/;
-        proxy_set_header Host              $host;
-        proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-    }
-
-    ## ------------------------------------------------------------------
-    ## Main location — proxy to selected upstream
-    ## ------------------------------------------------------------------
-    location / {
-        limit_req zone=perip burst=20 nodelay;
-        limit_req_status 503;
-        proxy_pass http://$gpu_upstream;
-
-        ## Preserve original host and headers
-        proxy_set_header Host              $host;
-        proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-
-        ## Pass through the model header so backends can log it
-        proxy_pass_header X-Syslog-Model;
-
-        ## Streaming support (SSE for LLM responses)
-        proxy_buffering off;
-        proxy_cache     off;
-        proxy_read_timeout  300s;
-        proxy_send_timeout  300s;
-
-        ## Basic failover — retry on error or timeout
-        proxy_next_upstream error timeout http_502 http_503;
-        proxy_next_upstream_tries 2;
-
-        ## Add a response header for observability
-        add_header X-Routed-To $gpu_upstream always;
-
-        ## Fallback to queue when all GPU upstreams are down
-        error_page 502 503 504 = @queue_fallback;
-    }
-
-    ## ------------------------------------------------------------------
-    ## Queue fallback — enqueue when GPUs are unavailable
-    ## ------------------------------------------------------------------
-    location @queue_fallback {
-        rewrite ^ /enqueue break;
-        proxy_pass http://queue_service;
-        proxy_set_header Host              $host;
-        proxy_set_header X-Real-IP         $remote_addr;
-        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header Content-Type      $content_type;
-        proxy_pass_request_body            on;
-    }
-}
diff --git a/gpu_roster.yaml b/gpu_roster.yaml
new file mode 100644
index 0000000..8b9d0d6
--- /dev/null
+++ b/gpu_roster.yaml
@@ -0,0 +1,54 @@
+models:
+  gpu-vision:
+    gpu_url: http://192.168.68.110:8080/v1
+    gpu_host: 192.168.68.110
+    label: Qwen3.5-9B Vision (RTX 5070)
+    max_concurrent: 1
+    context: 131072
+    tiers: [starter, professional, enterprise]
+    capabilities: [completion, multimodal]
+    model_path: /home/llmuser/models/qwen3.5-9b/Qwen3.5-9B-Q5_K_M.gguf
+    args: --mmproj /home/llmuser/models/qwen3.5-9b/mmproj-F16.gguf --ctx-size 131072 --cache-type-k q4_0 --cache-type-v q4_0 --flash-attn 1 --parallel 1 --alias gpu-light --reasoning off --api-key not-needed --cache-prompt
+
+  qwen3.6-27B-code:
+    gpu_url: http://192.168.68.8:8080/v1
+    sidecar_url: http://192.168.68.8:8090
+    gpu_host: 192.168.68.8
+    label: Qwen3.6 27B Code (RTX 3090)
+    max_concurrent: 2
+    context: 262144
+    tiers: [professional, enterprise]
+    capabilities: [completion]
+    model_path: /root/models/Qwen3.6-27B-NEO-CODE-2T-OT-IQ4_NL.gguf
+    args: --cache-type-k q4_0 --cache-type-v q4_0 --flash-attn on --reasoning off --spec-type draft-mtp --spec-draft-n-max 2 -t 8
+
+  qwen3.6-35B-udq4:
+    gpu_url: http://192.168.68.15:8080/v1
+    sidecar_url: http://192.168.68.15:8090
+    gpu_host: 192.168.68.15
+    label: Qwen3.6 35B UD-Q4_K_M (Strix Halo)
+    max_concurrent: 1
+    context: 262144
+    tiers: [professional, enterprise]
+    capabilities: [completion, multimodal]
+    model_path: /models/Qwen3.6-35B-A3B-UD-Q4_K_M.gguf
+    args: -c 262144 -ngl 99 --flash-attn on
+
+hosts:
+  gpu-light:
+    address: 192.168.68.110
+    gpu_name: NVIDIA GeForce RTX 5070
+    vram_gb: 12
+    current_model: gpu-vision
+
+  gpu-dense:
+    address: 192.168.68.8
+    gpu_name: NVIDIA GeForce RTX 3090
+    vram_gb: 24
+    current_model: qwen3.6-27B-code
+
+  gpu-moe:
+    address: 192.168.68.15
+    gpu_name: AMD Strix Halo (iGPU)
+    vram_gb: 64
+    current_model: qwen3.6-35B-udq4
diff --git a/litellm_config.yaml b/litellm_config.yaml
index e404ed1..49e20cf 100644
--- a/litellm_config.yaml
+++ b/litellm_config.yaml
@@ -1,21 +1,178 @@
+general_settings:
+  master_key: os.environ/LITELLM_MASTER_KEY
+  store_model_in_db: false
+  user_url_allowed_hosts:
+    - 192.168.68.14
+    - 192.168.68.14:5080
+guardrails:
+- guardrail_name: input-moderation
+  litellm_params:
+    guardrail: openai_moderation
+    mode: pre_call
+- guardrail_name: output-moderation
+  litellm_params:
+    guardrail: openai_moderation
+    mode: post_call
+- guardrail_name: harmful-content-filter
+  litellm_params:
+    categories:
+    - action: BLOCK
+      category: harmful_self_harm
+      enabled: true
+      severity_threshold: medium
+    - action: BLOCK
+      category: harmful_violence
+      enabled: true
+      severity_threshold: medium
+    - action: BLOCK
+      category: harmful_illegal_weapons
+      enabled: true
+      severity_threshold: medium
+    guardrail: litellm_content_filter
+    mode: pre_call
+litellm_settings:
+  user_url_allowed_hosts:
+    - 192.168.68.14
+    - 192.168.68.14:5080
+  cache: true
+  cache_params:
+    host: harness-redis
+    namespace: litellm
+    port: 6379
+    ttl: 600
+    type: redis
+  drop_params: true
+  success_callback:
+  - prometheus
+  failure_callback:
+  - prometheus
+  model_cost:
+    qwen3.6-27B-code:
+      input_cost_per_token: 1.5e-07
+      output_cost_per_token: 6.0e-07
+    strix-moe:
+      input_cost_per_token: 1.5e-07
+      output_cost_per_token: 6.0e-07
+    syslog-auto:
+      input_cost_per_token: 1.5e-07
+      output_cost_per_token: 6.0e-07
+  num_retries: 2
+  request_timeout: 600
+  sso_callback: /sso/callback
 model_list:
-- model_name: qwen3.6-35B-A3B
-  litellm_params:
-    model: openai/qwen3.6-35B-A3B
-    api_base: http://192.168.68.15:8080/v1
-    api_key: not-needed
-- model_name: gpu-dense
-  litellm_params:
-    model: openai/qwen3.6-27B-code-text
+- litellm_params:
     api_base: http://192.168.68.8:8080/v1
     api_key: not-needed
-- model_name: gpu-light
-  litellm_params:
-    model: openai/gemma-4-12b
+    model: openai/qwen3.6-27B-code
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+  model_name: qwen3.6-27B-code
+- litellm_params:
+    api_base: http://192.168.68.15:8080/v1
+    api_key: not-needed
+    model: openai/strix-moe
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+    max_model_tokens: 131072
+    max_tokens: 131072
+  model_name: qwen3.6-35B-udq4
+- litellm_params:
+    api_base: http://192.168.68.15:8080/v1
+    api_key: not-needed
+    model: openai/strix-moe
+    rpm: 40
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+    max_model_tokens: 131072
+    max_tokens: 131072
+  model_name: strix-moe
+- litellm_params:
+    api_base: http://192.168.68.8:8080/v1
+    api_key: not-needed
+    model: openai/qwen3.6-27B-code
+    rpm: 500
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+    max_model_tokens: 131072
+    max_tokens: 131072
+  model_name: gpu-dense
+- litellm_params:
     api_base: http://192.168.68.110:8080/v1
     api_key: not-needed
-general_settings:
-  master_key: sk-syslog-local-master-key
-litellm_settings:
-  drop_params: true
-  request_timeout: 120
+    model: openai/gpu-vision
+    rpm: 500
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+    max_model_tokens: 131072
+    max_tokens: 131072
+  model_name: gpu-vision
+- litellm_params:
+    api_base: http://192.168.68.8:8080/v1
+    api_key: not-needed
+    model: openai/qwen3.6-27B-code
+    rpm: 500
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+    max_model_tokens: 131072
+    max_tokens: 131072
+    weight: 0.70
+  model_name: syslog-auto
+- litellm_params:
+    api_base: http://192.168.68.8:8080/v1
+    api_key: not-needed
+    model: openai/qwen3.6-27B-code
+    rpm: 500
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+    max_model_tokens: 131072
+    max_tokens: 131072
+  model_name: qwen3.8-27B-uncensored
+- litellm_params:
+    api_base: http://192.168.68.15:8080/v1
+    api_key: not-needed
+    model: openai/strix-moe
+    rpm: 60
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+    weight: 0.20
+  model_name: syslog-auto
+- litellm_params:
+    api_base: http://192.168.68.110:8080/v1
+    api_key: not-needed
+    model: openai/gpu-vision
+    rpm: 200
+    timeout: 300
+  model_info:
+    max_input_tokens: 131072
+    weight: 0.10
+  model_name: syslog-auto
+router_settings:
+  allowed_fails: 100
+  enable_loadbalancing_on_proxy: true
+  fallbacks:
+  - syslog-auto:
+    - qwen3.6-27B-code
+    - strix-moe
+    - gpu-vision
+  - qwen3.6-27B-code:
+    - strix-moe
+  - strix-moe:
+    - qwen3.6-27B-code
+    - gpu-vision
+  request_timeout: 300
+  routing_strategy: simple-shuffle
+
+agents:
+- agent_name: agent-zero-homelab
+  agent_card_params:
+    name: Agent Zero HomeLab
+    url: http://192.168.68.14:5080/a2a/t-8zNgdOEXzYxjQvTl/p-homelab
+    protocolVersion: '1.0'
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index d0eaa03..8ec1761 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -1,118 +1,173 @@
-worker_processes auto;
-error_log /var/log/nginx/error.log warn;
-pid /var/run/nginx.pid;
-
-events { worker_connections 1024; }
+events {
+    worker_connections 1024;
+}
 
 http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
-
-    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                    '$status $body_bytes_sent "$http_referer" '
-                    '"$http_user_agent" rt=$request_time';
-    access_log /var/log/nginx/access.log main;
-    error_log /var/log/nginx/error.log;
     sendfile on;
     keepalive_timeout 65;
 
-    upstream router_api { server host.docker.internal:9000; }
-    upstream dashboard_ui { server dashboard:3000; }
-    upstream litellm_backend { server litellm:4000; }
+    resolver 127.0.0.11 valid=30s;
 
+    map $host $dashboard_ui_url {
+        default http://harness-dashboard:3000;
+    }
+    map $host $litellm_backend_url {
+        default http://harness-litellm:4000;
+    }
+
+    # ════════════════════════════════════════════════════════════
+    # Server :80 — Lean single-layer entrypoint
+    #   All API paths route directly to LiteLLM.
+    #   harness-router fully deprecated.
+    # ════════════════════════════════════════════════════════════
     server {
         listen 80;
 
-        # Security headers
-        add_header X-Content-Type-Options nosniff always;
-        add_header X-Frame-Options SAMEORIGIN always;
-        add_header X-XSS-Protection "1; mode=block" always;
+        # Authentik OIDC subrequest
+        location /authentik/auth {
+            internal;
+            proxy_pass https://auth.sysloggh.net/outpost.goauthentik.io/auth/nginx;
+            proxy_pass_request_body off;
+            proxy_set_header Content-Length "";
+            proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
 
-        # Disable buffering for SSE streams
-        proxy_buffering off;
-
-        # API  through router
+        # ── LiteLLM API (replaces router /v1/) ──
         location /v1/ {
-            proxy_pass http://router_api;
+            proxy_pass $litellm_backend_url;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header Authorization $http_authorization;
             proxy_connect_timeout 10s;
             proxy_read_timeout 600s;
             proxy_buffering off;
         }
 
+        # ── LiteLLM admin (replaces router /admin/) ──
         location /admin/ {
-            proxy_pass http://router_api;
+            proxy_pass $litellm_backend_url;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header Authorization $http_authorization;
+            proxy_read_timeout 600s;
         }
 
-        # SSE streaming endpoint
+        # ── LiteLLM stream ──
         location /stream {
-            proxy_pass http://router_api;
+            proxy_pass $litellm_backend_url/stream;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
-            proxy_set_header Connection "";
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
             proxy_buffering off;
-            chunked_transfer_encoding off;
         }
 
-        # Dashboard API proxy for SSE
+        # ── API passthrough ──
         location /api/ {
-            proxy_pass http://dashboard_ui;
+            proxy_pass $litellm_backend_url/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
-            proxy_buffering off;
         }
 
-        # LiteLLM debug
-        location /litellm/ {
-            rewrite ^/litellm/(.*) /$1 break;
-            proxy_pass http://litellm_backend;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header Authorization $http_authorization;
-        }
-
-        # Professional Dashboard (Phase 1-3) - Static HTML served via Nginx
+        # ── Dashboard ──
         location /dashboard/ {
-            alias /opt/inference-harness/dashboard/;
-            index dashboard.html;
-            add_header Cache-Control "public, max-age=3600";
-            add_header X-Content-Type-Options nosniff;
-        }
-
-        # Legacy Dashboard (root) - Proxy to Flask app
-        location / {
-            proxy_pass http://dashboard_ui;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_buffering off;
-        }
-
-        # Performance analytics
-        location /metrics/ {
-            proxy_pass http://router_api;
+            proxy_pass $dashboard_ui_url/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
         }
 
-        # Circuit Breaker metrics (Phase 1)
-        location /metrics/circuit-breaker {
-            proxy_pass http://router_api/metrics/circuit-breaker;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-        }
-
-        location /health {
-            proxy_pass http://router_api/health;
+        # ── GPU Fleet Dashboard ──
+        location /gpu/ {
+            proxy_pass http://192.168.68.24:9100/;
             proxy_http_version 1.1;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
+            proxy_read_timeout 60s;
+        }
+
+        # ── LiteLLM redirect ──
+        location = /litellm {
+            return 301 /litellm/;
+        }
+
+        # ── Health: redirect /health (auth-required) → /health/liveliness (no-auth) ──
+        location = /litellm/health {
+            return 301 /litellm/health/liveliness;
+        }
+
+        # ── LiteLLM static assets ──
+        location /litellm-asset-prefix/ {
+            proxy_pass $litellm_backend_url;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_connect_timeout 10s;
+            proxy_read_timeout 60s;
+        }
+
+        # ── LiteLLM admin UI and API (strips /litellm prefix) ──
+        location /litellm/ {
+            rewrite ^/litellm(/.*)$ $1 break;
+            proxy_pass $litellm_backend_url;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_buffering off;
+proxy_read_timeout 600s;
+            proxy_set_header Authorization $http_authorization;
+        }
+
+        # ── Auth proxy to Authentik ──
+        location /application/o/ {
+            proxy_pass https://192.168.68.11;
+            proxy_ssl_verify off;
+            proxy_set_header Host auth.sysloggh.net;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_connect_timeout 10s;
+            proxy_read_timeout 30s;
+        }
+
+        # ── Prometheus metrics (LiteLLM exposes at /metrics) ──
+        location /metrics {
+            proxy_pass $litellm_backend_url/metrics;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+        # ---- Legacy /health/unified alias (harness-router decommissioned) ----
+        #      Retained intentionally: 5+ live GPU monitor contracts poll
+        #      this path every 15s and follow the 301 to /gpu/gpu-data.
+        location /health/unified {
+            return 301 /gpu/gpu-data;
+        }
+
+        # ── Health: no-auth LiteLLM liveliness ──
+        location /health {
+            proxy_pass $litellm_backend_url/health/liveliness;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+        }
+
+                
+        # ── UI / Docs convenience redirects (additive 2026-09-11) ──
+        #   Canonical app path is /litellm/. These 301s make bare
+        #   /ui/ and /docs resolve. No new auth surface; no OIDC impact.
+        location = /ui { return 301 /litellm/ui/; }
+        location /ui/ { return 301 /litellm$request_uri; }
+        location = /docs { return 301 /litellm/docs; }
+        location = /docs/ { return 301 /litellm/docs; }
+
+        # ── 404 for everything else ──
+        location / {
+            return 404;
         }
     }
 }
diff --git a/queue-service/queue-service.py b/queue-service/queue-service.py
deleted file mode 100644
index 3e2bbed..0000000
--- a/queue-service/queue-service.py
+++ /dev/null
@@ -1,121 +0,0 @@
-#!/usr/bin/env python3
-"""Syslog Inference Queue Service — Circuit breaker + request queuing.
-
-Ports: 8091
-Endpoints:
-  /health          — liveness probe (Nginx upstream check)
-  /enqueue         — POST inference request into queue (fallback from Nginx)
-  /status          — GET queue depth + circuit breaker state
-"""
-
-import json
-import os
-import sys
-import time
-import urllib.request
-from flask import Flask, request, jsonify
-
-app = Flask(__name__)
-
-# Configuration
-REDIS_HOST = os.getenv("REDIS_HOST", "192.168.68.7")
-REDIS_PORT = int(os.getenv("REDIS_PORT", "6379"))
-QUEUE_KEY = "inference:requests"
-CIRCUIT_OPEN_THRESHOLD = 50
-CIRCUIT_WARN_THRESHOLD = 30
-
-# GPU endpoints for draining
-GPUS = {
-    "amdpve": "192.168.68.15:8080",
-    "llmgpu": "192.168.68.8:8080",
-    "ocu_llm": "192.168.68.110:8080",
-}
-
-
-def get_redis():
-    try:
-        import redis
-        return redis.Redis(host=REDIS_HOST, port=REDIS_PORT, decode_responses=True)
-    except Exception:
-        return None
-
-
-def get_queue_depth(r):
-    try:
-        return r.llen(QUEUE_KEY)
-    except Exception:
-        return 0
-
-
-def check_gpu_health(endpoint):
-    try:
-        req = urllib.request.Request(f"http://{endpoint}/v1/models")
-        req.add_header("User-Agent", "queue-service/1.0")
-        resp = urllib.request.urlopen(req, timeout=3)
-        return resp.status == 200
-    except Exception:
-        return False
-
-
-@app.route("/health")
-def health():
-    """Nginx upstream health probe. Returns 200 if service is alive."""
-    return jsonify({"status": "ok", "service": "queue-service"}), 200
-
-
-@app.route("/enqueue", methods=["POST"])
-def enqueue():
-    """Fallback endpoint — Nginx calls this when all GPU upstreams are down."""
-    r = get_redis()
-    if not r:
-        return jsonify({"error": "Redis unavailable"}), 503
-
-    depth = get_queue_depth(r)
-    if depth >= CIRCUIT_OPEN_THRESHOLD:
-        return jsonify({
-            "error": "Circuit breaker OPEN",
-            "queue_depth": depth,
-            "threshold": CIRCUIT_OPEN_THRESHOLD
-        }), 503
-
-    # Store the request in queue
-    payload = request.get_data(as_text=True)
-    headers = {k: v for k, v in request.headers if k.startswith("X-")}
-    r.rpush(QUEUE_KEY, json.dumps({
-        "payload": payload,
-        "headers": headers,
-        "queued_at": time.time()
-    }))
-
-    new_depth = get_queue_depth(r)
-    return jsonify({
-        "status": "queued",
-        "position": new_depth,
-        "circuit": "warn" if new_depth >= CIRCUIT_WARN_THRESHOLD else "closed"
-    }), 202
-
-
-@app.route("/status")
-def status():
-    """GET queue depth + circuit breaker state + GPU health."""
-    r = get_redis()
-    depth = get_queue_depth(r) if r else -1
-    circuit = "open" if depth >= CIRCUIT_OPEN_THRESHOLD else ("warn" if depth >= CIRCUIT_WARN_THRESHOLD else "closed")
-
-    gpu_health = {}
-    for name, endpoint in GPUS.items():
-        gpu_health[name] = "up" if check_gpu_health(endpoint) else "down"
-
-    return jsonify({
-        "queue_depth": depth,
-        "circuit_breaker": circuit,
-        "gpu_health": gpu_health,
-        "thresholds": {
-            "warn": CIRCUIT_WARN_THRESHOLD,
-            "open": CIRCUIT_OPEN_THRESHOLD
-        }
-    })
-
-
-if __name__ == "__main__":
-    app.run(host="0.0.0.0", port=8091)
diff --git a/roster_loader.py b/roster_loader.py
new file mode 100644
index 0000000..f500e66
--- /dev/null
+++ b/roster_loader.py
@@ -0,0 +1,75 @@
+# GPU Roster Loader - reads gpu_roster.yaml via PyYAML
+# Hot-reloadable via /admin/roster/reload endpoint
+
+import os, json, threading, time
+
+try:
+    import yaml
+except ImportError:
+    yaml = None
+
+ROSTER_PATH = os.environ.get('ROSTER_PATH', '/app/gpu_roster.yaml')
+_last_mtime = 0
+_lock = threading.Lock()
+
+GPU_URLS = {}
+GPU_SIDECARS = {}
+GPU_LABELS = {}
+GPU_MAX_CONCURRENT = {}
+GPU_CONTEXT = {}
+TIER_MODELS = {}
+HOSTS = {}
+
+def load_roster(path=None):
+    global GPU_URLS, GPU_SIDECARS, GPU_LABELS, GPU_MAX_CONCURRENT
+    global GPU_CONTEXT, TIER_MODELS, HOSTS, _last_mtime
+    if yaml is None:
+        return False, 'PyYAML not installed - run: pip3 install pyyaml'
+    path = path or ROSTER_PATH
+    try:
+        with open(path) as f:
+            data = yaml.safe_load(f)
+        with _lock:
+            GPU_URLS.clear()
+            GPU_SIDECARS.clear()
+            GPU_LABELS.clear()
+            GPU_MAX_CONCURRENT.clear()
+            GPU_CONTEXT.clear()
+            TIER_MODELS.clear()
+            models = data.get('models', {})
+            for name, cfg in models.items():
+                GPU_URLS[name] = cfg.get('gpu_url', '')
+                GPU_SIDECARS[name] = cfg.get('sidecar_url', '')
+                GPU_LABELS[name] = cfg.get('label', name)
+                GPU_MAX_CONCURRENT[name] = cfg.get('max_concurrent', 1)
+                GPU_CONTEXT[name] = cfg.get('context', 65536)
+                tiers = cfg.get('tiers', ['enterprise'])
+                for t in tiers:
+                    if t not in TIER_MODELS:
+                        TIER_MODELS[t] = []
+                    if name not in TIER_MODELS[t]:
+                        TIER_MODELS[t].append(name)
+            HOSTS.clear()
+            HOSTS.update(data.get('hosts', {}))
+            _last_mtime = os.path.getmtime(path)
+        return True, 'Loaded {} models, {} hosts'.format(len(GPU_URLS), len(HOSTS))
+    except Exception as e:
+        return False, str(e)
+
+def check_reload():
+    global _last_mtime
+    try:
+        mtime = os.path.getmtime(ROSTER_PATH)
+        if mtime > _last_mtime:
+            success, msg = load_roster()
+            if success:
+                print('[ROSTER] Auto-reloaded:', msg)
+    except:
+        pass
+
+def reload_thread(interval=30):
+    while True:
+        time.sleep(interval)
+        check_reload()
+
+threading.Thread(target=reload_thread, daemon=True).start()
diff --git a/router/Dockerfile b/router/Dockerfile
deleted file mode 100644
index b5d85f7..0000000
--- a/router/Dockerfile
+++ /dev/null
@@ -1,9 +0,0 @@
-FROM python:3.12-slim
-
-WORKDIR /app
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-COPY router.py .
-
-EXPOSE 9000
-CMD ["python", "router.py"]
diff --git a/router/http_patch.py b/router/http_patch.py
deleted file mode 100644
index 4d9b249..0000000
--- a/router/http_patch.py
+++ /dev/null
@@ -1,90 +0,0 @@
-# Insert streaming support before the gpu_resp call
-import re
-with open('/opt/inference-harness/router/router.py') as f:
-    code = f.read()
-
-# Find the gpu_resp block and replace with streaming-aware version
-old = '''        start = time.time()
-        gpu_resp = requests.post(
-            gpu_url + "/chat/completions",
-            json=req_data,
-            headers={"Content-Type": "application/json", "Authorization": "Bearer not-needed"},
-            timeout=120,
-        )
-        latency_ms = int((time.time() - start) * 1000)
-
-        if gpu_resp.status_code != 200:
-            log.error("GPU error: %s %s", gpu_resp.status_code, gpu_resp.text[:200])
-            return jsonify({"error": "GPU backend returned " + str(gpu_resp.status_code)}), 502
-
-        response_data = gpu_resp.json()
-        response_data = fix_reasoning_content(response_data)
-
-        response_data["routing"] = {
-            "model": model, "reason": reason, "gpu": gpu_url,
-            "tier": tier, "agent": agent, "latency_ms": latency_ms,
-        }
-
-        return jsonify(response_data)'''
-
-new = '''        start = time.time()
-        is_stream = req_data.get("stream", False)
-        
-        gpu_resp = requests.post(
-            gpu_url + "/chat/completions",
-            json=req_data,
-            headers={"Content-Type": "application/json", "Authorization": "Bearer not-needed"},
-            timeout=120,
-            stream=is_stream,
-        )
-        latency_ms = int((time.time() - start) * 1000)
-
-        if gpu_resp.status_code != 200:
-            log.error("GPU error: %s %s", gpu_resp.status_code, gpu_resp.text[:200])
-            return jsonify({"error": "GPU backend returned " + str(gpu_resp.status_code)}), 502
-
-        if is_stream:
-            # Stream response back to client
-            def generate():
-                first = True
-                for line in gpu_resp.iter_lines(decode_unicode=True):
-                    if line:
-                        if first and line.startswith("data: "):
-                            # Inject routing into first chunk
-                            try:
-                                chunk = json.loads(line[6:])
-                                chunk["routing"] = {
-                                    "model": model, "reason": reason, "gpu": gpu_url,
-                                    "tier": tier, "agent": agent, "latency_ms": latency_ms,
-                                }
-                                yield "data: " + json.dumps(chunk) + "\n\n"
-                                first = False
-                                continue
-                            except Exception:
-                                pass
-                        yield line + "\n"
-                yield "data: [DONE]\n\n"
-            return Response(stream_with_context(generate()), mimetype="text/event-stream")
-
-        response_data = gpu_resp.json()
-        response_data = fix_reasoning_content(response_data)
-
-        response_data["routing"] = {
-            "model": model, "reason": reason, "gpu": gpu_url,
-            "tier": tier, "agent": agent, "latency_ms": latency_ms,
-        }
-
-        return jsonify(response_data)'''
-
-code = code.replace(old, new)
-
-# Add missing import
-if 'from flask import Flask, request, jsonify' in code:
-    code = code.replace(
-        'from flask import Flask, request, jsonify',
-        'from flask import Flask, request, jsonify, Response, stream_with_context'
-    )
-
-with open('/opt/inference-harness/router/router.py', 'w') as f:
-    f.write(code)
-print('Streaming support added')
diff --git a/router/requirements.txt b/router/requirements.txt
deleted file mode 100644
index 2ec289b..0000000
--- a/router/requirements.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-flask==3.1.*
-redis==5.2.*
-requests==2.32.*
diff --git a/router/route_v2.py b/router/route_v2.py
deleted file mode 100644
index 0ee8e47..0000000
--- a/router/route_v2.py
+++ /dev/null
@@ -1,77 +0,0 @@
-def route(rd, tier, agent=""):
-    msgs = rd.get("messages",[]); t = estimate_tokens(msgs)
-    sys = any(m.get("role")=="system" for m in msgs)
-    turns = len([m for m in msgs if m.get("role") in ("user","assistant")])
-    hints = rd.get("routing_hints",{})
-    allowed = TIER_MODELS.get(tier, ["gemma-4-12b"])
-    avail = [m for m in available_models() if m in allowed]
-    if not avail: return {"model": allowed[0], "reason": "all_saturated", "saturated": True}
-    if all(is_gpu_busy(m) for m in avail):
-        return {"model": avail[0], "reason": "all_saturated", "saturated": True}
-
-    # GUARD: multimodal -> VLM only (sole vision model)
-    has_image = any(
-        isinstance(m.get("content"), list) and
-        any(p.get("type") == "image_url" for p in m["content"] if isinstance(p, dict))
-        for m in msgs
-    )
-    if has_image:
-        if "gemma-4-12b" in avail and not is_gpu_busy("gemma-4-12b"):
-            return {"model": "gemma-4-12b", "reason": "vision"}
-        elif "gemma-4-12b" in avail:
-            return {"model": "gemma-4-12b", "reason": "vision_saturated", "saturated": True}
-        else:
-            return {"model": allowed[0], "reason": "vision_unavailable"}
-
-    req = rd.get("model","auto")
-    if req != "auto":
-        target = req if req in avail else avail[0]
-        if is_gpu_busy(target) and req in allowed:
-            alts = [m for m in avail if m != target and m in allowed]
-            if alts:
-                alt = select_best_gpu(alts, "explicit", agent)
-                if alt: return alt
-        return {"model": target, "reason": "explicit"}
-
-    if hints:
-        if hints.get("priority")=="speed" and "gemma-4-12b" in avail:
-            return select_best_gpu(["gemma-4-12b"], "hint_speed", agent) or {"model":"gemma-4-12b","reason":"hint_speed"}
-        if hints.get("priority")=="quality" and "qwen3.6-35B-A3B" in avail:
-            return select_best_gpu(["qwen3.6-35B-A3B"], "hint_quality", agent) or {"model":"qwen3.6-35B-A3B","reason":"hint_quality"}
-        if hints.get("priority")=="code" and "qwen3.6-27B-code" in avail:
-            return select_best_gpu(["qwen3.6-27B-code"], "hint_code", agent) or {"model":"qwen3.6-27B-code","reason":"hint_code"}
-
-    first_msg = msgs[0].get("content","") if msgs else ""
-    words = len(first_msg.split()) if isinstance(first_msg, str) else 99
-
-    # TIER 1: Tiny - single-turn micro queries -> VLM (fastest)
-    if not sys and turns <= 1 and t <= 300 and words <= 100 and "gemma-4-12b" in avail:
-        if not is_gpu_busy("gemma-4-12b"):
-            return {"model":"gemma-4-12b","reason":"tiny"}
-        fallback = [m for m in ["qwen3.6-27B-code","qwen3.6-35B-A3B"] if m in avail]
-        result = select_best_gpu(fallback, "tiny_fallback", agent)
-        if result: return result
-
-    # TIER 2: Light - moderate chat -> Dense primary, saves VLM for vision/speed
-    if t <= 5000 and turns <= 4:
-        candidates = [m for m in ["qwen3.6-27B-code","gemma-4-12b","qwen3.6-35B-A3B"] if m in avail]
-        result = select_best_gpu(candidates, "light", agent)
-        if result: return result
-
-    # TIER 3: Medium - quality matters -> MoE primary, Dense fallback
-    if t <= 30000:
-        candidates = [m for m in ["qwen3.6-35B-A3B","qwen3.6-27B-code","gemma-4-12b"] if m in avail]
-        result = select_best_gpu(candidates, "medium", agent)
-        if result: return result
-
-    # TIER 4: Heavy - big context needs big model -> MoE->Dense->VLM
-    if t > 30000:
-        candidates = [m for m in ["qwen3.6-35B-A3B","qwen3.6-27B-code","gemma-4-12b"] if m in avail]
-        result = select_best_gpu(candidates, "heavy", agent)
-        if result: return result
-
-    # TIER 5: Default - best quality first
-    candidates = [m for m in ["qwen3.6-35B-A3B","qwen3.6-27B-code","gemma-4-12b"] if m in avail]
-    result = select_best_gpu(candidates, "default", agent)
-    if result: return result
-    return {"model":avail[0],"reason":"last_resort"}
diff --git a/router/route_v3.py b/router/route_v3.py
deleted file mode 100644
index 68eaf00..0000000
--- a/router/route_v3.py
+++ /dev/null
@@ -1,92 +0,0 @@
-def route(rd, tier, agent=""):
-    msgs = rd.get("messages",[]); t = estimate_tokens(msgs)
-    sys = any(m.get("role")=="system" for m in msgs)
-    turns = len([m for m in msgs if m.get("role") in ("user","assistant")])
-    hints = rd.get("routing_hints",{})
-    allowed = TIER_MODELS.get(tier, ["gemma-4-12b"])
-    avail = [m for m in available_models() if m in allowed]
-    if not avail: return {"model": allowed[0], "reason": "all_saturated", "saturated": True}
-    if all(is_gpu_busy(m) for m in avail):
-        return {"model": avail[0], "reason": "all_saturated", "saturated": True}
-
-    # GUARD: multimodal -> VLM only (sole vision model)
-    has_image = any(
-        isinstance(m.get("content"), list) and
-        any(p.get("type") == "image_url" for p in m["content"] if isinstance(p, dict))
-        for m in msgs
-    )
-    if has_image:
-        if "gemma-4-12b" in avail and not is_gpu_busy("gemma-4-12b"):
-            return {"model": "gemma-4-12b", "reason": "vision"}
-        elif "gemma-4-12b" in avail:
-            return {"model": "gemma-4-12b", "reason": "vision_saturated", "saturated": True}
-        else:
-            return {"model": allowed[0], "reason": "vision_unavailable"}
-
-    req = rd.get("model","auto")
-    if req != "auto":
-        target = req if req in avail else avail[0]
-        if is_gpu_busy(target) and req in allowed:
-            alts = [m for m in avail if m != target and m in allowed]
-            if alts:
-                alt = select_best_gpu(alts, "explicit", agent)
-                if alt: return alt
-        return {"model": target, "reason": "explicit"}
-
-    if hints:
-        if hints.get("priority")=="speed" and "gemma-4-12b" in avail:
-            return select_best_gpu(["gemma-4-12b"], "hint_speed", agent) or {"model":"gemma-4-12b","reason":"hint_speed"}
-        if hints.get("priority")=="quality" and "qwen3.6-35B-A3B" in avail:
-            return select_best_gpu(["qwen3.6-35B-A3B"], "hint_quality", agent) or {"model":"qwen3.6-35B-A3B","reason":"hint_quality"}
-        if hints.get("priority")=="code" and "qwen3.6-27B-code" in avail:
-            return select_best_gpu(["qwen3.6-27B-code"], "hint_code", agent) or {"model":"qwen3.6-27B-code","reason":"hint_code"}
-
-    first_msg = msgs[0].get("content","") if msgs else ""
-    words = len(first_msg.split()) if isinstance(first_msg, str) else 99
-
-    # TIER 1: Tiny - single-turn micro queries -> VLM (fastest)
-    if not sys and turns <= 1 and t <= 300 and words <= 100 and "gemma-4-12b" in avail:
-        if not is_gpu_busy("gemma-4-12b"):
-            return {"model":"gemma-4-12b","reason":"tiny"}
-        fallback = [m for m in ["qwen3.6-27B-code","qwen3.6-35B-A3B"] if m in avail]
-        result = select_best_gpu(fallback, "tiny_fallback", agent)
-        if result: return result
-
-    # TIER 2: Light - moderate chat -> Dense primary, saves VLM for vision/speed
-    if t <= 5000 and turns <= 4:
-        candidates = [m for m in ["qwen3.6-27B-code","gemma-4-12b","qwen3.6-35B-A3B"] if m in avail]
-        result = select_best_gpu(candidates, "light", agent)
-        if result: return result
-
-    # TIER 3: Medium - quality matters -> MoE primary (60%), Dense spillover (40%)
-    if t <= 30000:
-        candidates = moe_spillover(avail, ["qwen3.6-35B-A3B","qwen3.6-27B-code","gemma-4-12b"])
-        result = select_best_gpu(candidates, "medium", agent)
-        if result: return result
-
-    # TIER 4: Heavy - big context -> MoE primary (60%), Dense spillover (40%)
-    if t > 30000:
-        candidates = moe_spillover(avail, ["qwen3.6-35B-A3B","qwen3.6-27B-code","gemma-4-12b"])
-        result = select_best_gpu(candidates, "heavy", agent)
-        if result: return result
-
-    # TIER 5: Default - MoE primary (60%), Dense spillover (40%)
-    candidates = moe_spillover(avail, ["qwen3.6-35B-A3B","qwen3.6-27B-code","gemma-4-12b"])
-    result = select_best_gpu(candidates, "default", agent)
-    if result: return result
-    return {"model":avail[0],"reason":"last_resort"}
-
-
-def moe_spillover(avail, default_order):
-    """Spill 40% of MoE-first traffic to Dense to prevent Strix Halo overheating.
-    Only applies when MoE is first candidate, available, and not busy."""
-    import random
-    if (default_order[0] == "qwen3.6-35B-A3B" 
-        and "qwen3.6-35B-A3B" in avail 
-        and not is_gpu_busy("qwen3.6-35B-A3B")
-        and "qwen3.6-27B-code" in avail
-        and not is_gpu_busy("qwen3.6-27B-code")
-        and random.random() < 0.4):
-        # Swap: Dense first, MoE second
-        return ["qwen3.6-27B-code","qwen3.6-35B-A3B"] + [m for m in default_order[2:] if m in avail and m not in ("qwen3.6-27B-code","qwen3.6-35B-A3B")]
-    return [m for m in default_order if m in avail]
diff --git a/router/router.py b/router/router.py
deleted file mode 100644
index c2e3872..0000000
--- a/router/router.py
+++ /dev/null
@@ -1,1149 +0,0 @@
-import os, json, time, logging, traceback, threading, queue, statistics, math
-import requests, redis
-from flask import Flask, request, jsonify, Response, stream_with_context
-
-
-
-# Phase 2: Atomic session token update  Redis Lua script
-SESSION_LUA_SCRIPT = """
-local key = KEYS[1]
-local new_val = tonumber(ARGV[1])
-local current = tonumber(redis.call('GET', key) or 0)
-local max_val = math.max(current, new_val)
-redis.call('SET', key, max_val, 'EX', 86400)
-return max_val
-"""
-
-# Phase 4: Atomic GPU slot booking (closes TOCTOU race between check and incr)
-SLOT_BOOK_LUA = """
-local key = KEYS[1]
-local max_c = tonumber(ARGV[1])
-local current = tonumber(redis.call('GET', key) or '0')
-if current < max_c then
-    redis.call('INCR', key)
-    return 1
-else
-    return 0
-end
-"""
-SLOT_RELEASE_LUA = """
-local key = KEYS[1]
-local current = tonumber(redis.call('GET', key) or '0')
-if current > 0 then
-    redis.call('DECR', key)
-end
-current = tonumber(redis.call('GET', key) or '0')
-if current < 0 then
-    redis.call('SET', key, '0')
-end
-return redis.call('GET', key)
-"""
-
-# Phase 3b: Configurable health scoring weights (env-overridable)
-HEALTH_WEIGHT_VRAM = float(os.environ.get("HEALTH_WEIGHT_VRAM", "0.40"))
-HEALTH_WEIGHT_TEMP = float(os.environ.get("HEALTH_WEIGHT_TEMP", "0.30"))
-HEALTH_WEIGHT_LOAD = float(os.environ.get("HEALTH_WEIGHT_LOAD", "0.30"))
-HEALTH_TEMP_BASELINE = int(os.environ.get("HEALTH_TEMP_BASELINE", "30"))
-
-
-REDIS_URL = os.environ.get("REDIS_URL", "redis://redis:6379")
-GPU_MOE_URL = os.environ.get("GPU_MOE_URL", "http://192.168.68.15:8080/v1")
-GPU_DENSE_URL = os.environ.get("GPU_DENSE_URL", "http://192.168.68.8:8080/v1")
-GPU_LIGHT_URL = os.environ.get("GPU_LIGHT_URL", "http://192.168.68.110:8080/v1")
-
-GPU_SIDECARS = {
-    "qwen3.6-35B-A3B": "http://192.168.68.15:8090",
-    "qwen3.6-27B-code": "http://192.168.68.8:8090",
-    "gemma-4-12b": "http://192.168.68.110:8090",
-}
-GPU_URLS = {
-    "qwen3.6-35B-A3B": GPU_MOE_URL,
-    "qwen3.6-27B-code": GPU_DENSE_URL,
-    "gemma-4-12b": GPU_LIGHT_URL,
-}
-# Max concurrent requests per GPU (based on llama.cpp --parallel)
-
-GPU_LABELS = {
-    "qwen3.6-35B-A3B": "Qwen3.6 35B (Strix Halo)",
-    "qwen3.6-27B-code": "Qwen3.6 27B Code (RTX 3090)",
-    "gemma-4-12b": "Gemma-4 12B (RTX 5070)",
-}
-
-GPU_MAX_CONCURRENT = {
-    "qwen3.6-35B-A3B": 2,   # 2 slots (cross-agent spread prevents overheating)
-    "qwen3.6-27B-code": 2,  # 2 slots (128K context frees VRAM)
-    "gemma-4-12b": 2,       # 2 slots (7.1GB VRAM)
-}
-
-# Context window sizes (tokens) — used for compaction signals
-GPU_CONTEXT = {
-    "qwen3.6-35B-A3B": 262144,
-    "qwen3.6-27B-code": 262144,
-    "gemma-4-12b": 262144,
-}
-
-TIER_MODELS = {
-    "starter": ["gemma-4-12b"],
-    "professional": ["qwen3.6-35B-A3B", "qwen3.6-27B-code", "gemma-4-12b"],
-    "enterprise": ["qwen3.6-35B-A3B", "qwen3.6-27B-code", "gemma-4-12b"],
-}
-# API keys loaded from API_KEYS env var (set in docker-compose.yml)
-# Fallback is dev-only — production MUST set API_KEYS env var
-API_KEYS = json.loads(os.environ.get("API_KEYS", json.dumps({
-    "sk-dev-local-only": {"tier": "enterprise", "agent": "dev"},
-})))
-# Rate limits: requests per minute per API key tier
-RATE_LIMIT_RPM = {
-    "enterprise": 120,
-    "professional": 60,
-    "starter": 20,
-}
-
-def check_rate_limit(api_key, tier):
-    """Token bucket rate limiter using Redis. Returns (allowed, retry_after_or_remaining, reset_seconds)."""
-    if not get_redis():
-        return True, 999, 60
-    limit = RATE_LIMIT_RPM.get(tier, 30)
-    key = f"ratelimit:{api_key}"
-    current = int(get_redis().get(key) or 0)
-    if current >= limit:
-        ttl = r.ttl(key)
-        retry = max(ttl, 1) if ttl and ttl > 0 else 60
-        return False, retry, 0
-    pipe = r.pipeline()
-    pipe.incr(key)
-    pipe.expire(key, 60)  # 1-minute sliding window
-    pipe.execute()
-    remaining = limit - (current + 1)
-    reset_seconds = r.ttl(key) or 60
-    return True, remaining, reset_seconds
-
-
-logging.basicConfig(level=logging.INFO, format="%(asctime)s [ROUTER] %(levelname)s %(message)s")
-log = logging.getLogger("router")
-# Redis connection — initialized lazily, retries on first use
-def get_redis():
-    global r
-    if r is not None:
-        try:
-            r.ping()
-            return r
-        except Exception:
-            r = None
-    try:
-        r = redis.from_url(REDIS_URL, decode_responses=True)
-        r.ping()
-        return r
-    except Exception:
-        return None
-
-r = None
-try: get_redis()
-except Exception: pass
-except Exception: r = None
-
-
-def counter_audit_loop():
-    """Every 30s, check GPU slots and reset counters if all slots idle."""
-    while True:
-        time.sleep(30)
-        if not get_redis(): continue
-        for model, url in GPU_URLS.items():
-            try:
-                resp = requests.get(url.replace("/v1","") + "/slots",
-                    headers={"Authorization": "Bearer not-needed"}, timeout=5)
-                if resp.status_code == 200:
-                    slots = resp.json()
-                    all_idle = all(not s.get("is_processing", False) for s in slots)
-                    if all_idle:
-                        current = int(get_redis().get("active:" + model) or 0)
-                        if current > 0:
-                            get_redis().set("active:" + model, 0)
-                            log.info("AUDIT: Reset stuck counter for %s (was %d)", model, current)
-            except Exception:
-                pass
-
-threading.Thread(target=counter_audit_loop, daemon=True).start()
-
-app = Flask(__name__)
-sse_subscribers = []; sse_lock = threading.Lock()
-
-def gpu_active_count(model):
-    """Get number of in-flight requests for a GPU."""
-    if r:
-        return int(r.get("active:" + model) or 0)
-    return 0
-
-def gpu_incr(model):
-    if get_redis(): get_redis().incr("active:" + model)
-
-def gpu_decr(model):
-    rd = get_redis()
-    if rd:
-        v = rd.decr("active:" + model)
-        if v and int(v) < 0:
-            get_redis().set("active:" + model, 0)  # never go negative
-
-# Phase 4: Atomic GPU slot booking (Lua-based, closes TOCTOU race)
-def gpu_book_slot(model):
-    """Atomically book a GPU slot. Returns True if acquired, False if full."""
-    rd = get_redis()
-    if not rd:
-        return True  # No Redis — allow everything (degraded mode)
-    try:
-        max_c = GPU_MAX_CONCURRENT.get(model, 1)
-        result = rd.eval(SLOT_BOOK_LUA, 1, "active:" + model, max_c)
-        return result == 1
-    except Exception:
-        # Lua not loaded — fall back to non-atomic
-        current = int(rd.get("active:" + model) or 0)
-        if current < GPU_MAX_CONCURRENT.get(model, 1):
-            rd.incr("active:" + model)
-            return True
-        return False
-
-def gpu_release_slot(model):
-    """Atomically release a GPU slot. Never goes negative."""
-    rd = get_redis()
-    if not rd:
-        return
-    try:
-        rd.eval(SLOT_RELEASE_LUA, 1, "active:" + model)
-    except Exception:
-        v = rd.decr("active:" + model)
-        if v and int(v) < 0:
-            rd.set("active:" + model, 0)
-def check_gpu_health(model, sidecar_timeout=5, gpu_timeout=3):
-    url = GPU_SIDECARS.get(model)
-    if not url: return {"status": "unknown"}
-    try:
-        resp = requests.get(url, timeout=sidecar_timeout)
-        if resp.status_code == 200:
-            d = resp.json()
-            pct = (d.get("vram_used_mb",0) / max(d.get("vram_total_mb",1), 1)) * 100
-            status = "healthy"  # VRAM usage != saturation; busy slots handled by is_gpu_busy()
-            vram_warning = pct >= 95
-            # Also check if llama.cpp endpoint is actually responding
-            gpu_url = GPU_URLS.get(model, "")
-            try:
-                hr = requests.get(gpu_url.replace("/v1","") + "/health", headers={"Authorization": "Bearer not-needed"}, timeout=gpu_timeout)
-                if hr.status_code != 200:
-                    status = "down"
-            except Exception:
-                status = "down"
-            return {"status": status, "vram_warning": vram_warning, "vram_used_mb": d.get("vram_used_mb"), "vram_total_mb": d.get("vram_total_mb"), "vram_pct": round(pct,1), "temp_c": d.get("temp_c"), "gpu_util_pct": d.get("gpu_util_pct"), "gpu_name": d.get("gpu_name"), "power_w": d.get("power_w"), "power_limit_w": d.get("power_limit_w")}
-    except Exception: pass
-    return {"status": "down"}
-
-def available_models(): return [m for m in GPU_URLS if check_gpu_health(m)["status"] in ("healthy","saturated")]
-
-def estimate_tokens(msgs):
-    """Estimate token count from messages. Uses JSON length / 3.5 (closer to real tokenizer ratios for dense text)."""
-    return len(json.dumps(msgs, default=str)) // 3.5
-
-def store_perf_record(model, agent, tier, reason, queue_ms, inference_ms, prompt_tokens, completion_tokens, stream):
-    """Store detailed performance record in Redis for analytics."""
-    if not get_redis(): return
-    try:
-        total_ms = queue_ms + inference_ms
-        tps = completion_tokens / (inference_ms / 1000) if inference_ms > 0 and completion_tokens > 0 else 0
-        rec = json.dumps({
-            "ts": time.time(),
-            "model": model, "agent": agent, "tier": tier, "reason": reason,
-            "queue_ms": round(queue_ms, 1),
-            "inference_ms": round(inference_ms, 1),
-            "total_ms": round(total_ms, 1),
-            "prompt_tokens": prompt_tokens,
-            "completion_tokens": completion_tokens,
-            "tokens_per_sec": round(tps, 1),
-            "stream": stream
-        })
-        # Global recent list (last 500)
-        r.lpush("perf:recent", rec)
-        r.ltrim("perf:recent", 0, 499)
-        # Per-model list (last 200)
-        r.lpush("perf:model:" + model, rec)
-        r.ltrim("perf:model:" + model, 0, 199)
-        # Per-reason list (last 200)
-        r.lpush("perf:reason:" + reason, rec)
-        r.ltrim("perf:reason:" + reason, 0, 199)
-        # Per-agent list (last 200)
-        r.lpush("perf:agent:" + agent, rec)
-        r.ltrim("perf:agent:" + agent, 0, 199)
-    except Exception:
-        pass
-
-def is_gpu_busy(model):
-    """Check if GPU is at or near max concurrent capacity."""
-    active = gpu_active_count(model)
-    max_c = GPU_MAX_CONCURRENT.get(model, 1)
-    return active >= max_c
-
-
-
-# Phase 3: Dynamic GPU Weighting (Health Score)
-def gpu_health_score(model):
-    """Score a GPU based on VRAM, temperature, power, and load. Lower = better.
-    Weights configurable via HEALTH_WEIGHT_VRAM/TEMP/LOAD env vars."""
-    h = check_gpu_health(model, sidecar_timeout=1.5, gpu_timeout=1)
-    if h.get("status") == "down":
-        return 999  # never pick down GPUs
-    if is_circuit_tripped(model):
-        return 998  # circuit open — skip but distinguishable from down
-    vram_pct = h.get("vram_pct") or 50
-    temp_c = h.get("temp_c") or 50
-    power_w = h.get("power_w") or 100
-    active = gpu_active_count(model)
-    max_c = GPU_MAX_CONCURRENT.get(model, 1)
-    load_pct = (active / max_c) * 100 if max_c > 0 else 0
-    temp_penalty = max(0, (temp_c or 50) - HEALTH_TEMP_BASELINE)
-    score = (vram_pct or 0) * HEALTH_WEIGHT_VRAM + temp_penalty * 0.5 * HEALTH_WEIGHT_TEMP + load_pct * HEALTH_WEIGHT_LOAD
-    return round(score, 1)
-
-def select_best_gpu(candidates, reason, agent=""):
-    """Pick best GPU, spreading agents across GPUs to prevent hotspots."""
-    # Count how many distinct agents are on each GPU
-    gpu_agent_counts = {}
-    if r:
-        for m in GPU_URLS:
-            count = 0
-            for ak in API_KEYS.values():
-                if r.get("agent_gpu:" + ak["agent"] + ":" + m):
-                    count += 1
-            gpu_agent_counts[m] = count
-    # Phase 3: Sort candidates by health score before selection
-    sorted_candidates = sorted(candidates, key=gpu_health_score)
-    # First pass: prefer GPUs with 0 other agents (fresh GPU for this agent)
-    for m in sorted_candidates:
-        if not is_gpu_busy(m) and gpu_agent_counts.get(m, 0) == 0:
-            return {"model": m, "reason": reason}
-    # Second pass: prefer GPU this agent is NOT already on (skip own GPU)
-    if agent:
-        for m in sorted_candidates:
-            if not is_gpu_busy(m) and not r.get("agent_gpu:" + agent + ":" + m):
-                return {"model": m, "reason": reason}
-    # Third pass: any non-busy GPU
-    for m in sorted_candidates:
-        if not is_gpu_busy(m):
-            return {"model": m, "reason": reason}
-    # All busy — pick least loaded
-    best = None
-    best_load = 999
-    for m in candidates:
-        load = gpu_active_count(m)
-        if load < best_load:
-            best_load = load
-            best = m
-    if best:
-        return {"model": best, "reason": "load_balanced_" + reason}
-    return None
-
-
-
-
-
-# Phase 1: Circuit Breaker for GPU Hosts (Approved by Abiba)
-CIRCUIT_FAIL_THRESHOLD = int(os.environ.get("CIRCUIT_FAIL_THRESHOLD", "3"))
-CIRCUIT_FAIL_WINDOW = int(os.environ.get("CIRCUIT_FAIL_WINDOW", "120"))
-CIRCUIT_COOLDOWN = int(os.environ.get("CIRCUIT_COOLDOWN", "60"))
-
-def is_circuit_tripped(model):
-    """Check if a GPU host is currently blacklisted."""
-    if not get_redis():
-        return False
-    return r.exists("circuit:" + model + ":open")
-
-def trip_circuit(model, duration=None):
-    """Blacklist a GPU host for specified duration (default CIRCUIT_COOLDOWN).
-    Only trips after CIRCUIT_FAIL_THRESHOLD failures within CIRCUIT_FAIL_WINDOW."""
-    if not get_redis():
-        return False
-    if duration is None:
-        duration = CIRCUIT_COOLDOWN
-    now = time.time()
-    fail_key = "circuit:" + model + ":failures"
-    pipe = r.pipeline()
-    pipe.lpush(fail_key, str(now))
-    pipe.ltrim(fail_key, 0, CIRCUIT_FAIL_THRESHOLD - 1)
-    pipe.lrange(fail_key, 0, -1)
-    results = pipe.execute()
-    failures = [float(f) for f in (results[-1] if results else [])]
-    recent = [f for f in failures if now - f <= CIRCUIT_FAIL_WINDOW]
-    if len(recent) >= CIRCUIT_FAIL_THRESHOLD:
-        key = "circuit:" + model + ":open"
-        r.set(key, 1, ex=duration)
-        r.incr("circuit:" + model + ":count")
-        log.warning("CIRCUIT_TRIPPED: %s — %d failures in %ds, cooldown %ds", 
-                   model, len(recent), CIRCUIT_FAIL_WINDOW, duration)
-        return True
-    return False
-
-def half_open_probe(model):
-    """Check if a GPU host can be un-blacklisted."""
-    if not get_redis():
-        return True
-    key = "circuit:" + model + ":open"
-    if not r.exists(key):
-        return True  # no circuit
-    return False  # still open
-
-def route(rd, tier, agent=""):
-    msgs = rd.get("messages",[]); t = estimate_tokens(msgs)
-    sys = any(m.get("role")=="system" for m in msgs)
-    turns = len([m for m in msgs if m.get("role") in ("user","assistant")])
-    hints = rd.get("routing_hints",{})
-    allowed = TIER_MODELS.get(tier, ["gemma-4-12b"])
-    # Phase 1: Filter out models with tripped circuit breakers
-    avail = [m for m in available_models() if m in allowed and not is_circuit_tripped(m)]
-    if not avail: return {"model": allowed[0], "reason": "all_saturated", "saturated": True}
-    if all(is_gpu_busy(m) for m in avail):
-        return {"model": avail[0], "reason": "all_saturated", "saturated": True}
-
-    # GUARD: multimodal -> VLM only (sole vision model)
-    has_image = any(
-        isinstance(m.get("content"), list) and
-        any(p.get("type") == "image_url" for p in m["content"] if isinstance(p, dict))
-        for m in msgs
-    )
-    if has_image:
-        if "gemma-4-12b" in avail and not is_gpu_busy("gemma-4-12b"):
-            return {"model": "gemma-4-12b", "reason": "vision"}
-        elif "gemma-4-12b" in avail:
-            return {"model": "gemma-4-12b", "reason": "vision_saturated", "saturated": True}
-        else:
-            return {"model": allowed[0], "reason": "vision_unavailable"}
-
-    req = rd.get("model","auto")
-    # Map syslog-auto to auto for content-based routing
-    if req == "syslog-auto":
-        req = "auto"
-    if req != "auto":
-        # STRICT MODE: no silent fallback — LiteLLM handles failover chains.
-        # Returns saturated if explicit GPU is busy (keeps per-model metrics accurate).
-        target = req if req in avail else avail[0]
-        if req not in avail:
-            return {"model": req, "reason": "explicit_unavailable", "saturated": True}
-        if is_gpu_busy(target):
-            return {"model": target, "reason": "explicit_saturated", "saturated": True}
-        return {"model": target, "reason": "explicit"}
-
-    if hints:
-        if hints.get("priority")=="speed" and "gemma-4-12b" in avail:
-            return select_best_gpu(["gemma-4-12b"], "hint_speed", agent) or {"model":"gemma-4-12b","reason":"hint_speed"}
-        if hints.get("priority")=="quality" and "qwen3.6-35B-A3B" in avail:
-            return select_best_gpu(["qwen3.6-35B-A3B"], "hint_quality", agent) or {"model":"qwen3.6-35B-A3B","reason":"hint_quality"}
-        if hints.get("priority")=="code" and "qwen3.6-27B-code" in avail:
-            return select_best_gpu(["qwen3.6-27B-code"], "hint_code", agent) or {"model":"qwen3.6-27B-code","reason":"hint_code"}
-
-    first_msg = msgs[0].get("content","") if msgs else ""
-    words = len(first_msg.split()) if isinstance(first_msg, str) else 99
-
-    # TIER 1: Tiny - single-turn micro queries -> VLM (fastest)
-    if not sys and turns <= 1 and t <= 300 and words <= 100 and "gemma-4-12b" in avail:
-        if not is_gpu_busy("gemma-4-12b"):
-            return {"model":"gemma-4-12b","reason":"tiny"}
-        fallback = [m for m in ["qwen3.6-27B-code","qwen3.6-35B-A3B"] if m in avail]
-        result = select_best_gpu(fallback, "tiny_fallback", agent)
-        if result: return result
-
-    # TIER 2: Light - moderate chat -> VLM first (fastest), Dense fallback
-    if t <= 5000 and turns <= 4:
-        candidates = [m for m in ["gemma-4-12b","qwen3.6-27B-code","qwen3.6-35B-A3B"] if m in avail]
-        result = select_best_gpu(candidates, "light", agent)
-        if result: return result
-
-    # TIER 3: Medium - quality matters -> MoE primary (60%), Dense spillover (40%)
-    if t <= 30000:
-        candidates = moe_spillover(avail, ["qwen3.6-35B-A3B","qwen3.6-27B-code","gemma-4-12b"])
-        result = select_best_gpu(candidates, "medium", agent)
-        if result: return result
-
-    # TIER 4: Heavy - quality first -> Dense primary, MoE fallback
-    if t > 30000:
-        candidates = [m for m in ["qwen3.6-27B-code","qwen3.6-35B-A3B","gemma-4-12b"] if m in avail]
-        result = select_best_gpu(candidates, "heavy", agent)
-        if result: return result
-
-    # TIER 5: Default - MoE primary (60%), Dense spillover (40%)
-    candidates = moe_spillover(avail, ["qwen3.6-35B-A3B","qwen3.6-27B-code","gemma-4-12b"])
-    result = select_best_gpu(candidates, "default", agent)
-    if result: return result
-    return {"model":avail[0],"reason":"last_resort"}
-
-
-def moe_spillover(avail, default_order):
-    """Spill 40% of MoE-first traffic to Dense to prevent Strix Halo overheating.
-    Only applies when MoE is first candidate, available, and not busy."""
-    import random
-    if (default_order[0] == "qwen3.6-35B-A3B" 
-        and "qwen3.6-35B-A3B" in avail 
-        and not is_gpu_busy("qwen3.6-35B-A3B")
-        and "qwen3.6-27B-code" in avail
-        and not is_gpu_busy("qwen3.6-27B-code")
-        and random.random() < 0.4):
-        # Swap: Dense first, MoE second
-        return ["qwen3.6-27B-code","qwen3.6-35B-A3B"] + [m for m in default_order[2:] if m in avail and m not in ("qwen3.6-27B-code","qwen3.6-35B-A3B")]
-    return [m for m in default_order if m in avail]
-def clean_unicode(text):
-    if not isinstance(text, str): return text
-    text = text.replace(chr(0x2014), "-"); text = text.replace(chr(0x2013), "-")
-    text = text.replace(chr(0x2018), "'"); text = text.replace(chr(0x2019), "'")
-    text = text.replace(chr(0x201C), '"'); text = text.replace(chr(0x201D), '"')
-    text = text.replace(chr(0x2026), "..."); text = text.replace(chr(0x00A0), " ")
-    return text.encode("ascii", "ignore").decode("ascii")
-
-def clean_response(d):
-    if isinstance(d, dict): return {k: clean_response(v) for k,v in d.items()}
-    if isinstance(d, list): return [clean_response(v) for v in d]
-    if isinstance(d, str): return clean_unicode(d)
-    return d
-
-def get_metrics():
-    d = {"gpus":[],"route_counts":{},"agent_counts":{},"tier_counts":{},"recent":[],"timestamp":time.time(),"active_requests":{}}
-    for m in GPU_URLS:
-        h = check_gpu_health(m)
-        d["gpus"].append({"id":m,"gpu_name":h.get("gpu_name",m),"status":h.get("status"),"vram_used_mb":h.get("vram_used_mb"),"vram_total_mb":h.get("vram_total_mb"),"vram_pct":h.get("vram_pct"),"temp_c":h.get("temp_c"),"gpu_util_pct":h.get("gpu_util_pct"),"power_w":h.get("power_w"),"power_limit_w":h.get("power_limit_w"),"active_requests":gpu_active_count(m), "max_concurrent": GPU_MAX_CONCURRENT.get(m, 1)})
-        d["active_requests"][m] = gpu_active_count(m)
-    if r:
-        try:
-            for m in GPU_URLS: d["route_counts"][m] = int(r.get("routes:"+m) or 0)
-            for k,v in API_KEYS.items():
-                c = int(r.get("routes:agent:"+v["agent"]) or 0)
-                if c>0: d["agent_counts"][v["agent"]] = c
-            for t in TIER_MODELS: d["tier_counts"][t] = int(r.get("routes:tier:"+t) or 0)
-            raw = r.lrange("routes:recent",0,49)
-            d["recent"] = [json.loads(x) for x in raw] if raw else []
-        except Exception: pass
-    return d
-
-def bcast():
-    data = get_metrics(); payload = json.dumps(data)
-    with sse_lock:
-        dead = []
-        for q in sse_subscribers:
-            try: q.put(payload)
-            except Exception: dead.append(q)
-        for q in dead: sse_subscribers.remove(q)
-
-QUEUE_TIMEOUT = int(os.environ.get("QUEUE_TIMEOUT", "30"))  # max seconds to queue before 503
-
-@app.route("/v1/chat/completions", methods=["POST"])
-def chat():
-    try:
-        rd = request.get_json(force=True)
-        ak = request.headers.get("Authorization","").replace("Bearer ","")
-        if not ak or ak not in API_KEYS:
-            log.warning("AUTH_REJECTED: no/invalid API key from %s", request.remote_addr)
-            return jsonify({"error": "Unauthorized — valid API key required"}), 401
-        ki = API_KEYS[ak]
-        tier, agent = ki["tier"], ki["agent"]
-        
-        # Phase 0: dual-key transition — log deprecated key usage
-        if ki.get("deprecated"):
-            new_key = next((k for k, v in API_KEYS.items()
-                           if v.get("agent") == agent and not v.get("deprecated")), None)
-            log.warning("DEPRECATED_KEY: agent=%s using old key %s...%s — switch to %s...%s",
-                       agent, ak[:12], ak[-8:],
-                       new_key[:12] if new_key else "N/A",
-                       new_key[-8:] if new_key else "N/A")
-            if r:
-                r.incr("deprecated_usage:" + agent)
-        
-        # Rate limit check
-        allowed, rl_val, reset_sec = check_rate_limit(ak, tier)
-        if not allowed:
-            resp = jsonify({"error": "Rate limit exceeded", "retry_after_s": rl_val})
-            resp.headers["Retry-After"] = str(rl_val)
-            resp.headers["X-RateLimit-Limit"] = str(RATE_LIMIT_RPM.get(tier, 30))
-            resp.headers["X-RateLimit-Remaining"] = "0"
-            resp.headers["X-RateLimit-Reset"] = str(int(time.time() + rl_val))
-            log.warning("RATE_LIMIT: %s (%s) exceeded limit", agent, ak[-8:])
-            return resp, 429
-        
-        # Allow agent to override queue timeout via header
-        q_timeout = int(request.headers.get("X-Queue-Timeout", str(QUEUE_TIMEOUT)))
-        
-        # Cross-turn context tracking: accumulate tokens per session (Phase 2: atomic Lua)
-        session_id = request.headers.get("X-Session-Id", "")
-        session_tokens = 0
-        if session_id and r:
-            try:
-                current = estimate_tokens(rd.get("messages",[]))
-                # Atomic GET/MAX/SET via Lua script  prevents race conditions
-                session_tokens = r.eval(SESSION_LUA_SCRIPT, 1, "session:" + session_id, current)
-            except Exception: pass
-        
-        d = route(rd, tier, agent)
-        queue_start = time.time()
-        
-        # Queue loop: wait for a GPU slot instead of immediate 503
-        while d.get("saturated"):
-            elapsed = time.time() - queue_start
-            if elapsed > q_timeout:
-                resp = jsonify({"error": "All GPUs saturated", "queued_s": round(elapsed,1), "retry_after_s": 5})
-                resp.headers["Retry-After"] = "5"
-                log.warning("QUEUE_TIMEOUT: %s waited %.1fs, all GPUs saturated", agent, elapsed)
-                return resp, 503
-            time.sleep(0.5)  # poll every 500ms
-            d = route(rd, tier, agent)
-        
-        queue_ms = (time.time() - queue_start) * 1000
-        if queue_ms > 500:
-            log.info("QUEUED: %s waited %.0fms before slot opened", agent, queue_ms)
-        model, reason, url = d["model"], d["reason"], GPU_URLS[d["model"]]
-        
-        # Phase 4: Atomic slot booking (replaces non-atomic gpu_incr)
-        if not gpu_book_slot(model):
-            d = route(rd, tier, agent)
-            if d.get("saturated"):
-                resp = jsonify({"error": "All GPUs saturated", "retry_after_s": 3})
-                resp.headers["Retry-After"] = "3"
-                return resp, 503
-            model, reason = d["model"], d["reason"]
-            if not gpu_book_slot(model):
-                resp = jsonify({"error": "GPU slot race — retry", "retry_after_s": 1})
-                resp.headers["Retry-After"] = "1"
-                return resp, 503
-        url = GPU_URLS[model]
-        
-        # Stash rate limit values for response headers
-        _rl_remaining = rl_val
-        _rl_limit = RATE_LIMIT_RPM.get(tier, 30)
-        _rl_reset = reset_sec
-        is_stream = rd.get("stream", False)
-        
-        log.info("ROUTE: %s -> %s (%s) stream=%s active=%d/%d", agent, model, reason, is_stream, gpu_active_count(model), GPU_MAX_CONCURRENT.get(model,1))
-        # Track which GPU this agent is using (TTL 120s covers typical request)
-        if r and agent:
-            try: r.setex("agent_gpu:" + agent + ":" + model, 120, "1")
-            except: pass
-        if r:
-            try:
-                r.incr("routes:"+model); r.incr("routes:tier:"+tier); r.incr("routes:agent:"+agent)
-                r.incr("ts:"+model+":"+time.strftime("%Y%m%d%H"))
-                r.lpush("routes:recent", json.dumps({"ts":time.time(),"model":model,"reason":reason,"tier":tier,"agent":agent,"queue_ms": round(queue_ms,1)}))
-                r.ltrim("routes:recent",0,999)
-            except Exception: pass
-        start = time.time()
-        resp = requests.post(url+"/chat/completions", json=rd,
-            headers={"Content-Type":"application/json","Authorization":"Bearer not-needed"}, timeout=900, stream=is_stream)
-        lat = int((time.time()-start)*1000)
-        gpu_release_slot(model)
-        
-        if resp.status_code != 200:
-            if resp.status_code in (502, 504):
-                trip_circuit(model)
-            return jsonify({"error":"GPU error "+str(resp.status_code)}), 502
-        if is_stream:
-            # Buffer SSE chunks, handle split lines for large responses
-            chunks = []
-            stream_timings = {}
-            buf = ""  # accumulate partial lines
-            for raw in resp.iter_content(chunk_size=None, decode_unicode=True):
-                if raw:
-                    cleaned = clean_unicode(raw)
-                    chunks.append(cleaned)
-                    buf += cleaned
-                    # Process complete lines from buffer
-                    while "\n" in buf:
-                        line, buf = buf.split("\n", 1)
-                        line = line.strip()
-                        if line.startswith("data: ") and not stream_timings:
-                            js = line[6:].strip()
-                            if js.startswith("{") and "timings" in js and "predicted_n" in js:
-                                try:
-                                    tj = json.loads(js).get("timings", {})
-                                    if tj:
-                                        stream_timings = tj
-                                except: pass
-            # Store perf record with real token counts from stream
-            if stream_timings:
-                pt = stream_timings.get("prompt_n", 0)
-                ct = stream_timings.get("predicted_n", 0)
-                tps = stream_timings.get("predicted_per_second", 0)
-                gen_ms = stream_timings.get("predicted_ms", lat)
-                store_perf_record(model, agent, tier, reason, queue_ms, gen_ms, pt, ct, True)
-            else:
-                store_perf_record(model, agent, tier, reason, queue_ms, lat, estimate_tokens(rd.get("messages",[])), 0, True)
-            # Yield all chunks to client
-            def gen():
-                for c in chunks: yield c
-            bcast()
-            ctx_remaining = GPU_CONTEXT.get(model, 65536) - max(session_tokens, estimate_tokens(rd.get("messages",[])))
-            ctx_pct = ctx_remaining / GPU_CONTEXT.get(model, 65536) * 100
-            ctx_warning = "compact_urgent" if ctx_pct < 5 else ("compact_recommended" if ctx_pct < 15 else ("compact_soon" if ctx_pct < 30 else "ok"))
-            sse_resp = Response(stream_with_context(gen()), mimetype="text/event-stream")
-            sse_resp.headers["X-RateLimit-Limit"] = str(_rl_limit)
-            sse_resp.headers["X-RateLimit-Remaining"] = str(max(0, _rl_remaining))
-            sse_resp.headers["X-RateLimit-Reset"] = str(int(time.time() + _rl_reset))
-            sse_resp.headers["X-Context-Remaining"] = str(max(0, ctx_remaining))
-            sse_resp.headers["X-Context-Warning"] = ctx_warning
-            sse_resp.headers["X-Context-Model"] = model
-            # LiteLLM spend tracking: best-effort token counts from stream timings
-            pt = stream_timings.get("prompt_n", 0) if stream_timings else 0
-            ct = stream_timings.get("predicted_n", 0) if stream_timings else 0
-            sse_resp.headers["X-Usage-Tokens"] = json.dumps({
-                "prompt_tokens": pt, "completion_tokens": ct, "model": model
-            })
-            return sse_resp
-        data = clean_response(resp.json())
-        for c in data.get("choices",[]):
-            msg = c.get("message",{})
-            if not msg.get("content") and msg.get("reasoning_content"):
-                msg["content"] = msg["reasoning_content"]
-        # Extract performance data from llama.cpp response
-        usage = data.get("usage", {})
-        timings = data.get("timings", {})
-        prompt_tokens = usage.get("prompt_tokens", 0)
-        completion_tokens = usage.get("completion_tokens", 0)
-        inference_ms = lat  # total GPU round-trip
-        store_perf_record(model, agent, tier, reason, queue_ms, inference_ms, prompt_tokens, completion_tokens, False)
-        ctx_remaining = GPU_CONTEXT.get(model, 65536) - max(session_tokens, estimate_tokens(rd.get("messages",[])))
-        ctx_pct = ctx_remaining / GPU_CONTEXT.get(model, 65536) * 100
-        ctx_warning = "compact_urgent" if ctx_pct < 5 else ("compact_recommended" if ctx_pct < 15 else ("compact_soon" if ctx_pct < 30 else "ok"))
-        data["routing"] = {"model":model,"reason":reason,"gpu":url,"tier":tier,"agent":agent,"latency_ms":lat,"queue_ms": round(queue_ms,1),"active_gpu":gpu_active_count(model),"context_remaining": max(0, ctx_remaining),"context_pct": round(ctx_pct,1),"context_warning": ctx_warning}
-        resp = jsonify(data)
-        resp.headers["X-RateLimit-Limit"] = str(_rl_limit)
-        resp.headers["X-RateLimit-Remaining"] = str(max(0, _rl_remaining))
-        resp.headers["X-RateLimit-Reset"] = str(int(time.time() + _rl_reset))
-        resp.headers["X-Context-Remaining"] = str(max(0, ctx_remaining))
-        resp.headers["X-Context-Warning"] = ctx_warning
-        resp.headers["X-Context-Model"] = model
-        # LiteLLM spend tracking: return token counts for cost computation
-        resp.headers["X-Usage-Tokens"] = json.dumps({
-            "prompt_tokens": prompt_tokens, "completion_tokens": completion_tokens, "model": model
-        })
-        bcast()
-        return resp
-    except requests.Timeout:
-        gpu_release_slot(model)
-        trip_circuit(model)
-        log.error("TIMEOUT: %s -> %s (Circuit tripped)", agent, model)
-        return jsonify({"error":"timeout"}), 504
-    except Exception as e:
-        gpu_release_slot(model)
-        log.error("Error: %s\n%s", e, traceback.format_exc())
-        return jsonify({"error":str(e)}), 500
-
-@app.route("/metrics/performance")
-def performance():
-    """Per-request performance analytics with percentiles per model/reason/agent."""
-    if not get_redis(): return jsonify({"error": "Redis unavailable"}), 503
-    try:
-        window_hours = int(request.args.get("window", "24").replace("h",""))
-        model_filter = request.args.get("model", "all")
-
-        # Load recent records
-        cutoff = time.time() - (window_hours * 3600)
-        raw = r.lrange("perf:recent", 0, -1)
-        records = []
-        for x in raw:
-            try:
-                rec = json.loads(x)
-                if rec["ts"] >= cutoff:
-                    records.append(rec)
-            except: pass
-
-        # Filter by model if specified
-        if model_filter != "all":
-            records = [r for r in records if r["model"] == model_filter]
-
-        if not records:
-            return jsonify({"models": [], "reasons": [], "agents": [], "summary": {"total_requests": 0}})
-
-        def pct(values, p):
-            if len(values) < 2: return round(values[0], 1) if values else 0
-            return round(statistics.quantiles(sorted(values), n=100, method='inclusive')[min(p-1, 98)], 1)
-
-        # Per-model stats
-        model_groups = {}
-        for rec in records:
-            m = rec["model"]
-            if m not in model_groups: model_groups[m] = []
-            model_groups[m].append(rec)
-
-        models = []
-        for m, recs in sorted(model_groups.items()):
-            latencies = [r["total_ms"] for r in recs]
-            tps_vals = [r["tokens_per_sec"] for r in recs if r["tokens_per_sec"] > 0]
-            non_stream = [r for r in recs if not r["stream"]]
-            queue_times = [r["queue_ms"] for r in non_stream]
-            models.append({
-                "model": m,
-                "count": len(recs),
-                "stream_pct": round(len([r for r in recs if r["stream"]]) / len(recs) * 100, 1),
-                "latency": {
-                    "avg": round(statistics.mean(latencies), 1),
-                    "p50": pct(latencies, 50),
-                    "p95": pct(latencies, 95),
-                    "p99": pct(latencies, 99)
-                },
-                "throughput": {
-                    "avg_tokens_per_sec": round(statistics.mean(tps_vals), 1) if tps_vals else 0,
-                    "p50": pct(tps_vals, 50) if tps_vals else 0,
-                    "p95": pct(tps_vals, 95) if tps_vals else 0,
-                },
-                "queue": {
-                    "avg_ms": round(statistics.mean(queue_times), 1) if queue_times else 0,
-                    "p95_ms": pct(queue_times, 95) if queue_times else 0,
-                } if queue_times else None
-            })
-
-        # Per-reason stats
-        reason_groups = {}
-        for rec in records:
-            rsn = rec["reason"]
-            if rsn not in reason_groups: reason_groups[rsn] = []
-            reason_groups[rsn].append(rec)
-
-        reasons = []
-        for rsn, recs in sorted(reason_groups.items(), key=lambda x: -len(x[1])):
-            latencies = [r["total_ms"] for r in recs]
-            reasons.append({
-                "reason": rsn,
-                "count": len(recs),
-                "avg_total_ms": round(statistics.mean(latencies), 1),
-                "p95_total_ms": pct(latencies, 95)
-            })
-
-        # Per-agent stats
-        agent_groups = {}
-        for rec in records:
-            ag = rec["agent"]
-            if ag not in agent_groups: agent_groups[ag] = []
-            agent_groups[ag].append(rec)
-
-        agents = []
-        for ag, recs in sorted(agent_groups.items(), key=lambda x: -len(x[1])):
-            latencies = [r["total_ms"] for r in recs]
-            tps_vals = [r["tokens_per_sec"] for r in recs if r["tokens_per_sec"] > 0]
-            agents.append({
-                "agent": ag,
-                "count": len(recs),
-                "avg_total_ms": round(statistics.mean(latencies), 1),
-                "avg_tokens_per_sec": round(statistics.mean(tps_vals), 1) if tps_vals else 0
-            })
-
-        all_lat = [r["total_ms"] for r in records]
-        all_tps = [r["tokens_per_sec"] for r in records if r["tokens_per_sec"] > 0]
-        summary = {
-            "total_requests": len(records),
-            "window_hours": window_hours,
-            "latency": {
-                "avg_ms": round(statistics.mean(all_lat), 1),
-                "p50_ms": pct(all_lat, 50),
-                "p95_ms": pct(all_lat, 95),
-                "p99_ms": pct(all_lat, 99)
-            },
-            "throughput_avg_tps": round(statistics.mean(all_tps), 1) if all_tps else 0
-        }
-
-        return jsonify({"models": models, "reasons": reasons, "agents": agents, "summary": summary})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 500
-
-@app.route("/metrics/scatter")
-def scatter():
-    """Return individual data points for scatter plots (prompt_tokens vs latency)."""
-    if not get_redis(): return jsonify({"error": "Redis unavailable"}), 503
-    try:
-        window_hours = int(request.args.get("window", "24").replace("h",""))
-        model_filter = request.args.get("model", "all")
-        cutoff = time.time() - (window_hours * 3600)
-        raw = r.lrange("perf:recent", 0, -1)
-        points = []
-        for x in raw:
-            try:
-                rec = json.loads(x)
-                if rec["ts"] >= cutoff:
-                    if model_filter == "all" or rec["model"] == model_filter:
-                        points.append({
-                            "model": rec["model"],
-                            "agent": rec["agent"],
-                            "reason": rec["reason"],
-                            "prompt_tokens": int(rec.get("prompt_tokens", 0)),
-                            "completion_tokens": rec.get("completion_tokens", 0),
-                            "inference_ms": round(rec["inference_ms"], 1),
-                            "tokens_per_sec": rec.get("tokens_per_sec", 0),
-                            "stream": rec.get("stream", False)
-                        })
-            except: pass
-        return jsonify({"points": points, "count": len(points)})
-    except Exception as e:
-        return jsonify({"error": str(e)}), 500
-
-@app.route("/v1/models")
-def models():
-    def _h(m): return check_gpu_health(m, sidecar_timeout=1.5, gpu_timeout=1)
-    return jsonify({"object":"list","data":[{"id":m,"object":"model","owned_by":"syslog","status":_h(m).get("status"),"gpu":_h(m).get("gpu_name")} for m in GPU_URLS]})
-
-@app.route("/health")
-def health():
-    gpus = {}
-    for m in GPU_URLS:
-        h = check_gpu_health(m, sidecar_timeout=1.5, gpu_timeout=1)
-        h["active_requests"] = gpu_active_count(m)
-        h["max_concurrent"] = GPU_MAX_CONCURRENT.get(m, 1)
-        gpus[m] = h
-    return jsonify({"status":"healthy","redis":"connected" if r else "down","gpus":gpus,"available_models":available_models()})
-
-@app.route("/metrics")
-def metrics(): return jsonify(get_metrics())
-
-@app.route("/metrics/timeseries")
-def metrics_timeseries():
-    period = request.args.get("period", "day"); models_list = list(GPU_URLS.keys())
-    data = {"models": {}, "labels": []}
-    if period == "day":
-        buckets = [time.strftime("%Y%m%d%H", time.gmtime(time.time()-h*3600)) for h in range(23,-1,-1)]
-        data["labels"] = [time.strftime("%H:00", time.gmtime(time.time()-h*3600)) for h in range(23,-1,-1)]
-    elif period == "week":
-        buckets = [time.strftime("%Y%m%d", time.gmtime(time.time()-d*86400)) for d in range(6,-1,-1)]
-        data["labels"] = [time.strftime("%a", time.gmtime(time.time()-d*86400)) for d in range(6,-1,-1)]
-    else:
-        buckets = [time.strftime("%Y%m%d", time.gmtime(time.time()-d*86400)) for d in range(29,-1,-1)]
-        data["labels"] = [time.strftime("%m/%d", time.gmtime(time.time()-d*86400)) for d in range(29,-1,-1)]
-    if r:
-        for model in models_list:
-            counts = []
-            for bucket in buckets:
-                total = 0
-                if period in ("week","month"):
-                    for hh in range(24): total += int(r.get("ts:"+model+":"+bucket+"{:02d}".format(hh)) or 0)
-                else: total = int(r.get("ts:"+model+":"+bucket) or 0)
-                counts.append(total)
-            data["models"][model] = counts
-    return jsonify(data)
-
-
-
-@app.route("/metrics/circuit-breaker")
-def metrics_circuit_breaker():
-    """Expose circuit breaker status per model. Phase 1."""
-    result = {}
-    if r:
-        for model in GPU_URLS:
-            key = "circuit:" + model + ":open"
-            duration = r.ttl(key)
-            trip_count = int(r.get("circuit:" + model + ":count") or 0)
-            result[model] = {
-                "tripped": r.exists(key),
-                "remaining_ttl": duration,
-                "trip_count": trip_count
-            }
-    return jsonify(result)
-
-
-@app.route("/metrics/gpu-health")
-def metrics_gpu_health():
-    """Live GPU health scores + circuit breaker + KPIs."""
-    result = {"gpus": [], "ts": time.time()}
-    for model in GPU_URLS:
-        h = check_gpu_health(model, sidecar_timeout=1.5, gpu_timeout=1)
-        score = gpu_health_score(model)
-        active = gpu_active_count(model)
-        max_c = GPU_MAX_CONCURRENT.get(model, 1)
-        cb_tripped = bool(r and r.exists("circuit:" + model + ":open"))
-        cb_count = int(r.get("circuit:" + model + ":count") or 0) if r else 0
-        result["gpus"].append({
-            "id": model,
-            "label": GPU_LABELS.get(model, model),
-            "status": h.get("status", "unknown"),
-            "vram_pct": h.get("vram_pct", 0),
-            "temp_c": h.get("temp_c", 0),
-            "vram_used_mb": h.get("vram_used_mb", 0),
-            "vram_total_mb": h.get("vram_total_mb", 0),
-            "gpu_name": h.get("gpu_name", model),
-            "health_score": round(score, 1),
-            "active_requests": active,
-            "max_concurrent": max_c,
-            "circuit_tripped": cb_tripped,
-            "circuit_trip_count": cb_count
-        })
-    online = sum(1 for g in result["gpus"] if g["status"] in ("healthy", "saturated"))
-    trips = sum(g["circuit_trip_count"] for g in result["gpus"])
-    result["kpi"] = {"gpus_online": online, "total_trips": trips, "total_gpus": len(GPU_URLS)}
-    return jsonify(result)
-
-@app.route("/metrics/latency")
-def metrics_latency():
-    """Lightweight latency summary for dashboard KPIs."""
-    if not r: return jsonify({"avg_ms": 0, "requests_per_min": 0})
-    recent = []
-    for x in (r.lrange("routes:recent", 0, 49) or []):
-        try: recent.append(json.loads(x))
-        except: pass
-    if not recent: return jsonify({"avg_ms": 0, "requests_per_min": 0, "count": 0})
-    now = time.time()
-    last_min = [x for x in recent if now - x.get("ts", 0) < 60]
-    latencies = [x.get("queue_ms", 0) + x.get("inference_ms", 0) for x in last_min if "inference_ms" in x]
-    return jsonify({
-        "avg_ms": round(sum(latencies) / len(latencies), 1) if latencies else 0,
-        "requests_per_min": len(last_min),
-        "count": len(recent)
-    })
-@app.route("/health/unified")
-def health_unified():
-    """Unified health aggregating all layers: Router + Redis + GPUs + Circuit Breaker + Scores."""
-    gpus = {}
-    for m in GPU_URLS:
-        h = check_gpu_health(m, sidecar_timeout=1.5, gpu_timeout=1)
-        h["active_requests"] = gpu_active_count(m)
-        h["max_concurrent"] = GPU_MAX_CONCURRENT.get(m, 1)
-        h["health_score"] = gpu_health_score(m)
-        h["circuit_open"] = is_circuit_tripped(m)
-        gpus[m] = h
-    circuit_state = {}
-    for m in GPU_URLS:
-        cooldown_until = r.ttl("circuit:" + m + ":open") if r else None
-        circuit_state[m] = {
-            "open": is_circuit_tripped(m),
-            "cooldown_remaining_s": max(0, cooldown_until) if cooldown_until and cooldown_until > 0 else 0,
-            "trip_count": int(r.get("circuit:" + m + ":count") or 0) if r else 0
-        }
-    overall = "healthy"
-    if not r:
-        overall = "degraded"
-    if all(circuit_state[m]["open"] for m in GPU_URLS):
-        overall = "down"
-    return jsonify({
-        "status": overall, "router": "healthy",
-        "redis": "connected" if r else "down",
-        "gpus": gpus, "circuit_breaker": circuit_state,
-        "scores": {m: gpu_health_score(m) for m in GPU_URLS},
-        "available_models": available_models(), "timestamp": time.time()
-    })
-
-@app.route("/stream")
-def stream():
-    def ev():
-        q = queue.Queue()
-        with sse_lock: sse_subscribers.append(q)
-        try:
-            yield "data: "+json.dumps(get_metrics())+"\n\n"
-            while True:
-                try: yield "data: "+q.get(timeout=3)+"\n\n"
-                except queue.Empty: yield "data: "+json.dumps(get_metrics())+"\n\n"
-        except GeneratorExit: pass
-        finally:
-            with sse_lock:
-                if q in sse_subscribers: sse_subscribers.remove(q)
-    return Response(stream_with_context(ev()), mimetype="text/event-stream",
-                    headers={"Cache-Control":"no-cache","X-Accel-Buffering":"no","Access-Control-Allow-Origin":"*"})
-
-# ── Phase 0: Admin Key Management ──
-ADMIN_KEY = os.environ.get("ADMIN_KEY", "")
-
-def _admin_auth():
-    """Require admin key for management endpoints."""
-    if not ADMIN_KEY:
-        return False, "ADMIN_KEY not configured on server"
-    ak = request.headers.get("Authorization","").replace("Bearer ","")
-    if ak != ADMIN_KEY:
-        return False, "Admin key required"
-    return True, None
-
-@app.route("/admin/keys")
-def admin_keys():
-    """List all API keys (masked) with agent, tier, and deprecation status."""
-    ok, err = _admin_auth()
-    if not ok: return jsonify({"error": err}), 401
-    keys = []
-    for key, info in API_KEYS.items():
-        masked = key[:8] + "..." + key[-8:]
-        keys.append({
-            "masked": masked,
-            "prefix": key[:8],
-            "agent": info["agent"],
-            "tier": info["tier"],
-            "deprecated": info.get("deprecated", False),
-            "length": len(key)
-        })
-    return jsonify({
-        "total": len(keys),
-        "active": sum(1 for k in keys if not k["deprecated"]),
-        "deprecated": sum(1 for k in keys if k["deprecated"]),
-        "keys": sorted(keys, key=lambda k: (k["deprecated"], k["agent"]))
-    })
-
-@app.route("/admin/keys/deprecation-summary")
-def admin_deprecation_summary():
-    """Summary of deprecated key usage (from Redis logs, if available)."""
-    ok, err = _admin_auth()
-    if not ok: return jsonify({"error": err}), 401
-    deprecated_agents = []
-    for key, info in API_KEYS.items():
-        if info.get("deprecated"):
-            # Check Redis for usage count
-            count = 0
-            if r:
-                count = int(r.get("deprecated_usage:" + info["agent"]) or 0)
-            deprecated_agents.append({
-                "agent": info["agent"],
-                "deprecated_uses": count,
-                "needs_migration": count > 0
-            })
-    return jsonify({
-        "deprecated_agents": sorted(deprecated_agents, key=lambda d: -d["deprecated_uses"]),
-        "recommendation": "Run POST /admin/keys/revoke to remove keys with 0 usage"
-    })
-
-@app.route("/admin/keys/generate", methods=["POST"])
-def admin_generate_key():
-    """Generate a new API key for an agent. Body: {"agent": "Name", "tier": "enterprise"}"""
-    ok, err = _admin_auth()
-    if not ok: return jsonify({"error": err}), 401
-    body = request.get_json(force=True)
-    agent = body.get("agent", "").strip()
-    tier = body.get("tier", "enterprise")
-    if not agent:
-        return jsonify({"error": "agent field required"}), 400
-    if tier not in ("starter", "professional", "enterprise"):
-        return jsonify({"error": "tier must be starter/professional/enterprise"}), 400
-    # Generate secure key
-    import secrets, hashlib
-    prefix = hashlib.sha256(secrets.token_bytes(12)).hexdigest()[:8]
-    suffix = secrets.token_hex(20)
-    new_key = f"sk-{prefix}-{suffix}"
-    # Update in-memory dict (note: not persisted across restarts without env var update)
-    API_KEYS[new_key] = {"tier": tier, "agent": agent}
-    log.info("KEY_GENERATED: agent=%s tier=%s key=%s...%s", agent, tier, new_key[:8], new_key[-8:])
-    return jsonify({
-        "agent": agent,
-        "tier": tier,
-        "key": new_key,
-        "masked": new_key[:8] + "..." + new_key[-8:],
-        "warning": "This key exists in memory only. Update API_KEYS env var and redeploy to persist."
-    }), 201
-
-@app.route("/admin/keys/revoke", methods=["POST"])
-def admin_revoke_key():
-    """Revoke a deprecated key. Body: {"agent": "Name"} or {"key_prefix": "sk-xxxx"}"""
-    ok, err = _admin_auth()
-    if not ok: return jsonify({"error": err}), 401
-    body = request.get_json(force=True)
-    agent = body.get("agent", "")
-    key_prefix = body.get("key_prefix", "")
-    revoked = []
-    keys_to_remove = []
-    for key, info in API_KEYS.items():
-        if not info.get("deprecated"):
-            continue
-        if agent and info["agent"] == agent:
-            keys_to_remove.append(key)
-        elif key_prefix and key.startswith(key_prefix):
-            keys_to_remove.append(key)
-    for key in keys_to_remove:
-        info = API_KEYS.pop(key)
-        revoked.append({"agent": info["agent"], "masked": key[:8] + "..." + key[-8:]})
-        log.warning("KEY_REVOKED: agent=%s key=%s...%s", info["agent"], key[:8], key[-8:])
-    return jsonify({
-        "revoked": len(revoked),
-        "keys": revoked,
-        "remaining_total": len(API_KEYS),
-        "warning": "Memory-only revoke. Update API_KEYS env var and redeploy to persist."
-    })
-
-if __name__ == "__main__":
-    log.info("Router on :9000 (load-aware)")
-    app.run(host="0.0.0.0", port=9000, debug=False)
diff --git a/scripts/daily-cost-snapshot.sh b/scripts/daily-cost-snapshot.sh
new file mode 100755
index 0000000..509c0f5
--- /dev/null
+++ b/scripts/daily-cost-snapshot.sh
@@ -0,0 +1,56 @@
+#!/bin/bash
+# Daily LiteLLM cost snapshot — cron at midnight
+# Writes to /var/log/litellm/costs.csv on CT 116
+
+MASTER="sk-litellm-7f96080dd99b15c36bd4b333b58a6796"
+BASE="http://127.0.0.1:4001"
+CSV="/var/log/litellm/costs.csv"
+DATE=$(date -I)
+YESTERDAY=$(date -I -d yesterday)
+
+# Fetch yesterday's spend by key
+RESP=$(curl -s "${BASE}/global/spend/logs?start_date=${YESTERDAY}T00:00:00&end_date=${YESTERDAY}T23:59:59&page_size=1000" \
+  -H "Authorization: Bearer $MASTER" 2>/dev/null)
+
+# Parse total spend
+TOTAL=$(echo "$RESP" | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+total = sum(r.get('spend', 0) or 0 for r in data.get('data', []))
+print(f'{total:.6f}')
+" 2>/dev/null)
+
+# Parse per-model spend
+PER_MODEL=$(echo "$RESP" | python3 -c "
+import sys, json
+from collections import defaultdict
+data = json.load(sys.stdin)
+spend = defaultdict(float)
+for r in data.get('data', []):
+    model = r.get('model', 'unknown')
+    spend[model] += r.get('spend', 0) or 0
+for model, cost in sorted(spend.items()):
+    print(f'{model}:{cost:.6f}')
+" 2>/dev/null)
+
+# Per-key spend
+PER_KEY=$(echo "$RESP" | python3 -c "
+import sys, json
+from collections import defaultdict
+data = json.load(sys.stdin)
+spend = defaultdict(float)
+for r in data.get('data', []):
+    key = r.get('api_key', 'unknown')[:20]
+    spend[key] += r.get('spend', 0) or 0
+for key, cost in sorted(spend.items()):
+    print(f'{key}:{cost:.6f}')
+" 2>/dev/null)
+
+# Write CSV
+mkdir -p $(dirname "$CSV")
+if [ ! -f "$CSV" ]; then
+  echo "date,total_cost,per_model,per_key" > "$CSV"
+fi
+echo "${DATE},${TOTAL},\"${PER_MODEL}\",\"${PER_KEY}\"" >> "$CSV"
+
+echo "Snapshot: ${DATE} | Total: \$${TOTAL}"