nightly (86d4d77f6b23ad5fa5e86d23609dcaa2721b8f00)

Rolling build of main — unstable, rebuilt on every commit.
Install: curl -sSf https://stokegate.com/install | sh -s -- --version nightly

Stoke v0.2.2

Stoke v0.2.2

Maintenance and trust-boundary fixes since v0.2.1.

Changes

• Streamed OpenAI Responses disclose the selected node; subscription streams disclose billing mode without inventing a dollar cost before final usage.
• Durable budget admission is atomic across concurrent requests while preserving the established budget-refusal response.
• Built-in privacy filters handle nested content and multiline private keys; audit logging uses metadata-only defaults and owner-only files.
• HTTP webhook credential and destination boundaries are hardened.
• Optional JavaScript plugin chains compose their results correctly and have feature-gated regression coverage.
• Installer replacement failures restore the previous binaries; rollback and uninstall commands are available.
• Documentation, routing/federation proof harnesses, and Actions storage retention have been updated.

Distribution and limits

The release matrix is macOS ARM64/x64 and Linux ARM64/x64, with stoke and stoke-cli in each archive. Default prebuilt binaries do not include the optional V8/JavaScript feature; build with --features js-plugins to enable it. The optional Headroom companion is included only in the macOS ARM64 package and requires its separately pinned Python environment.

Platform compilation and deterministic CI are not a claim of real-provider or native runtime testing on every platform. macOS binaries are not Developer ID-signed or notarized. Provider credentials, local models, and subscription entitlements are not supplied by this release. No general savings or quality-equivalence claim is made.

Install and rollback

After publication, install the exact version:

curl -sSf https://stokegate.com/install | sh -s -- --version v0.2.2

The GitHub release contains SHA-256 sidecars and a manifest identifying the exact source commit. Verify the checksum before deploying. Existing configuration is retained. The installer preserves the previous binary pair; restore it with:

curl -sSf https://stokegate.com/install | sh -s -- --rollback

For a clean downgrade, pin --version v0.2.1. Do not delete or reconcile the durable ledger merely to downgrade.

Release gates

The current .github/workflows/ci.yml defines core build/unit/smoke checks, optional macOS ARM64 Headroom packaging checks, and cargo test --locked --features js-plugins. The release workflow builds all four archives. Stable publication requires all checks to pass and the exact archive inventory, manifest source identity, and checksums to be verified. Source preparation alone is not publication.

Webhook contract migration

Webhook JSON no longer includes the raw gateway api_key; it supplies a stable opaque key_id instead. Update consumers that relied on api_key. The identifier is not an authentication credential. See the updated webhook guide.

Verified release provenance

• Source: c16c955eb68a15b469eebb91b7ad2c62b898568d.
• CI: core, Headroom, and JS-plugin checks passed.
• Release builds: all four targets passed.
• Stable promotion: exact nightly source, inventory and checksums verified.
• All nine versioned assets and four latest-download archives were downloaded independently and matched the verified CI bytes.

Stoke v0.2.1

What's Changed

• Update landing page for v0.2.0 by @pozga in #3
• ci: promote verified nightly releases by @pozga in #4
• fix: authenticate nightly promotion workflow by @pozga in #5

Full Changelog: v0.2.0...v0.2.1

Stoke v0.2.0

Stoke v0.2.0

This release adds reusable gateway infrastructure for native Codex Responses and Ollama clients.

Highlights

• Native Codex gateway-owned authentication using Stoke’s existing local Codex credential store.
• Ollama-compatible routing with discovered model IDs and preserved client protocol separation.
• Bounded exact caching/coalescing for eligible named non-streaming routes.
• Validated client-facing retry hints and decision-feed visibility for coalesced followers.
• Optional, default-off local Headroom processing for eligible Responses tool outputs.
• Headroom preserves JSON semantics and native Responses reasoning, tools, metadata, opaque items and SSE behavior; failures fail open to the original request.
• Authenticated loopback worker boundaries, bounded payloads, pinned optional dependencies and packaging evidence.

Verification

• 363 Rust tests and 15 Python tests passed locally during release preparation.
• Public Ubuntu build/test/smoke CI passed.
• Public macOS arm64 Headroom worker, launcher and extracted-package integration passed.
• Cloudflare Pages preview passed.

Headroom remains opt-in and targets the verified macOS arm64 / CPython 3.11 packaging path. Payload-byte reduction is not a billing-savings claim.

What's Changed

• release: Stoke v0.2.0 by @pozga in #2

New Contributors

• @pozga made their first contribution in #2

Full Changelog: v0.1.2...v0.2.0

v0.1.2 — streamed responses accrue spend

budget_usd now sees streaming traffic. Most agent harnesses stream by default, so until this release the dollar cap was blind to nearly all real traffic — auth, rate limits and the loop breaker covered streams, but spend did not.

No config change is required. This is not a breaking release.

What changed

A streamed response is forwarded byte-for-byte, so the only chance to learn what it cost is to watch it go past. Stoke now reads the provider's own usage report out of the live stream and charges the key when the stream ends — or when the client disconnects mid-answer, which cost the same. Both wire formats are supported: OpenAI reports on a final frame, Anthropic reports input tokens up front and a running output count.

• Metered providers are asked to report usage (stream_options.include_usage), which adds one final frame to their SSE stream. That is standard OpenAI behaviour, and clients that follow the spec ignore it.
• Your own hardware is not asked. Providers on local and remote tiers cost electricity, not tokens. Their requests and their streams are byte-for-byte what they always were.
• A provider that reports nothing is billed from an estimate, not from $0, and the estimate is surfaced separately as estimated_usd in /v1/budget. A provider that hides its usage must not thereby switch the cap off. Treat that number as a guess.

Also fixed

• A streamed vote race priced the winner against the model the caller asked for rather than the one that actually served — an undercharge, and a silent $0 when the requested model was unpriced.
• stream_race_models raced every candidate in parallel even on a metered provider, paying for N answers to use one while metering only the winner. Metered providers are now tried in order, which is what its sibling already did and documented.
• Anthropic reveals input tokens in message_start, before any output exists, so a stream cut short produced a usage object that looked measured. Only the frame carrying the final tally counts as a measurement now; anything else is an estimate and says so.

Known limits

• The cap is a ceiling you can cross once, not a hard stop. It is checked when a request is admitted and charged when the stream completes. A single very long response overshoots it, and concurrent requests on one key are each admitted against a spend figure that does not yet include the others still in flight. There is no reservation against in-flight spend. Bound it with rate_limit_rpm, or give each agent its own key.
• Prices are yours to keep current; nothing warns you when a provider changes its rates. stoke-cli pricing shows what the gateway believes.
• Spend is in-memory and resets on restart.

Install

curl -sSf https://stokegate.com/install | sh

v0.1.1 — the budget cap now enforces

Breaking: you must declare prices and tiers

Stoke ships no model names and no prices, and it no longer guesses.

• Every provider needs a tier. "local" and "remote" are your own hardware and are not billed per token. Anything else is metered. A provider with no tier now fails at startup rather than being silently treated as local.
• Every model a metered provider serves needs a price. Otherwise the request is refused with 403 and an actionable message.

[[providers]]
name = "anthropic"
type = "anthropic"
base_url = "https://api.anthropic.com"
api_key_env = "ANTHROPIC_API_KEY"
tier = "cloud"

[pricing.models."claude-haiku-4"]
input_per_1m = 0.80
output_per_1m = 4.00

If you would rather serve a model unmetered, say so explicitly with [pricing] unpriced = "free" — and accept that budget_usd cannot see that traffic.

Why

In v0.1.0 the price table was a dozen hardcoded model names plus one heuristic: if the name contained "cloud", guess $0.50/$2.00; otherwise the model was free. Almost nothing a real user calls was in that table, so budget_usd never moved and the cap never tripped. Ten requests to a real model against a $0.00001 cap all returned 200 with spend_usd = 0.0.

A spend firewall that cannot measure a call cannot cap it. So it now refuses that call instead.

Also fixed

• The streaming path bypassed the pricing gate. stream: true reached models the gateway could not meter. stream_race also classified providers as free by matching their names against known vendors, so a provider called my-gpu-box pointing at a paid API was raced as if it were free.
• Callers could multiply their own budget. routing, n_samples and vote_models arrive in the request body, and n_samples drove an unclamped loop: one HTTP request with n_samples: 20 produced 20 upstream calls and recorded one call's cost. [limits] now bounds all three. Enforcement runs on the resolved routing — auto is not itself a fan-out, but it resolves into one when the caller supplies test_code.
• Fusion patterns under-billed. A pattern that issued N provider calls returned the winner's cost, not the sum. Every call is now billed, and spend is recorded before the response hooks, since a plugin that blocks a response cannot un-bill the call that produced it.
• The response cache was shared across API keys. It hashed only (model, prompt, max_tokens), so one key was served another key's response — and with semantic matching enabled, for a merely similar prompt. Cache entries are now scoped to (api_key, route).
• stoke --version and --help started a gateway on :8787 instead of answering.

Known limits

• Streamed responses still accrue no spend. SSE usage parsing is not implemented, so budget_usd does not see streaming traffic. Auth, rate limits and the loop breaker do. Most agent harnesses stream by default — treat the dollar cap as a backstop for the non-streaming portion.
• Prices are yours to keep current; nothing warns you when a provider changes its rates. stoke-cli pricing shows what the gateway believes.
• Spend is in-memory and resets on restart.

Install

curl -sSf https://stokegate.com/install | sh

Full Changelog: v0.1.0...v0.1.1

v0.1.0

Full Changelog: https://github.com/Ozperium/stoke/commits/v0.1.0

Full Changelog: https://github.com/Ozperium/stoke/commits/v0.1.0