Tollgate v0.1.1

Beta, pre-1.0. Recommended over v0.1.0 for evaluation.

Changes since v0.1.0:

• Budget exhaustion now returns 402 Payment Required (was 429); an unroutable or unpriced model returns 400 Bad Request (was 402). Each carries an x-tollgate-reason header. 429 is reserved for real rate limiting, and 402 is not auto-retried by provider SDKs, so a monthly cap no longer invites retry storms.
• Startup reconcile never lowers a live budget counter (max of cache and ledger).
• The .env.example placeholder pepper is rejected at startup and key issuance.
• Usage ledger now also rejects TRUNCATE (append-only hardening).
• Docs: honest Limitations section (no streaming yet; prompt-caching cost is approximate; flat observe authz; minimal metrics), architecture diagrams, and status codes matched to behaviour.
• CI: cargo audit advisory gate (h2 bumped to 0.4.19 for RUSTSEC-2026-0258) plus Dependabot.

MIT. Anthropic and Vertex (config-gated) plus a built-in mock. Interfaces and schema may change before 1.0.

Tollgate v0.1.0

Beta, pre-1.0.

Since v0.0.1:

• Read-only web console in production and demo: live budget meters, spend, tokens-to-cost, and per-request gateway latency (median + p95 sparkline). Endpoints: /console, /console/budgets, /console/usage.
• Per-request gateway-overhead latency, exposed via the x-tollgate-overhead-us header and the console.
• Config hot-reload: budget and price changes apply without a restart (TOLLGATE_RELOAD__INTERVAL).
• Usage-ledger retention by monthly partitioning, with automatic create-ahead and old-partition drops (TOLLGATE_RETENTION__WINDOW).
• Append-only ledger hardened to also reject TRUNCATE.
• Enforcement hardening: startup reconcile never lowers a live budget counter; startup and key issuance refuse the example placeholder pepper.
• Docs: architecture diagrams, use cases, operations runbook; CI gains cargo-audit and Dependabot.

Providers: Anthropic and Google Vertex (config-gated) plus a built-in mock. MIT-licensed. Interfaces and schema may still change before 1.0.

Tollgate v0.0.1

First public release of Tollgate, an open-source LLM spend-control proxy in Rust. Early foundation, not production-ready.

Highlights:

• Per-key and global token budgets with a hard-stop before overspend
• Tokens-to-cost accounting per model, currency-agnostic integer money
• Native pass-through adapters for Anthropic and Google Vertex / Gemini
• HMAC-SHA256 API keys under a server-side pepper
• Zero-infra demo (cargo run -- demo) and a production path on Postgres + Valkey
• Cloud Run + Terraform, with secrets sealed in Secret Manager
• Reserve-then-settle enforcement that reconciles from the ledger on restart

See the README and docs/OPERATIONS.md for details. MIT licensed.