tokenronin, and its scars.
twelve providers, one key, and the defects we have not fixed yet.
TokenRonin is the gateway every model request in this fleet passes through. It is not a thin proxy: it holds organizations, workspaces, keys, budgets, usage, requests, responses, and an audit trail — and it is the reason a provider going down does not take the fleet down. This page describes what it does and, more usefully, the three defects that are still open.
each with its own key, model list and failover order
organizations through audit events, in one SQLite file
a cache hit can look exactly like a broken model. See the first defect.
built on a branch, never pushed, never deployed, default off
what it holds
| table | what it is for |
|---|---|
| organizations | the tenant boundary. Everything else hangs off this. |
| workspaces | an organization can have several, with separate keys and budgets |
| api_keys | per-workspace credentials, each with its own spend cap |
| budgets | hard ceilings, so a runaway loop cannot become a bill |
| usage_records | aggregated spend per key, per window |
| requests | every call that went out, with the provider and model |
| responses | the reply, so a complaint can be answered without a re-run |
| audit_events | who changed what, when — including key creation and rotation |
| cache_entries | the 3600-second response cache |
the model stack behind it
The gateway routes to a decider stack, not a single endpoint. Each role is a separate process, so a failure in one does not take the others with it.
the three defects that are still open
Responses are cached for 3600 seconds. If a provider starts returning garbage, or if a bad prompt is cached, the gateway keeps serving the cached answer — and the caller cannot tell the difference between "the model is broken" and "this is a cache hit". The fix is a cache-busting prompt or a versioned cache key. The lesson is broader: a cache is a second source of truth, and it needs its own health check.
The gateway marks a streaming request as succeeded as soon as the response headers arrive, without reading one body byte. If the connection then dies mid-stream, the request is recorded as complete and the partial response is stored as if it were whole. The audit trail says yes when the answer was no. This is the same class of failure as the mask vault defect on the security page: a success that is recorded before it is earned.
Model ids beginning claude- are aliased to a different provider. The lane answers correctly and the responses are good, but it is not Anthropic's model and should never be presented as one. This is deliberate — it is how the fleet keeps a single point of routing — but it has to be stated, because an alias is not a capability.
the operational traps
the thinking-model token floor
max_tokensmust be at least ~64 for a reasoning model.- Below that you get
finish_reason=lengthwith empty content — which looks exactly like a dead model. - Debugging it costs an hour because the symptom is indistinguishable from an outage.
the key you must not rotate
- One provider key is live and load-bearing: every agent turn in the fleet depends on it through this gateway.
- Rotating it unilaterally takes chat down fleet-wide.
- Its rotation is deferred on purpose. Do not "fix" this.
There is also a leaked credential in the git history of the TokenRonin repository, in a commit that predates the current workflow. It is known, it is tracked, and it is one of the reasons the secret-scanning hook in the security kit exists — that hook would have caught it. A leak in history is not fixed by deleting the line; it is fixed by rotating the key and accepting that the old one is burned.
documented 2026-10-16 · defects listed are open as of this date