Model Router & Cost Governance — multi-model spend control

What are we spending across models, and why did this particular call go where it went? Bills grow quietly, usually because a handful of calls are doing expensive work a cheaper model would handle just as well, plus retries nobody is counting.

Live catalogue, pricing, context-window and benchmark evidence is scored against the requirements of a specific workload profile, not against averages. The resulting route publishes behind a reviewed-model admission gate, so a newly released model never silently starts serving production traffic.

Each refresh writes a complete, immutable generation, and a single atomic pointer selects which generation is live. A partial or failed refresh therefore cannot corrupt the route currently in use, and rollback to the last verified generation is one command. A validate step checks pointer, digest, schema and route profiles together.

A weekly spend envelope with a named enforcement point, wired to the provider-side limit so the ceiling actually binds rather than sitting on a dashboard

Usage receipts recording route, model, token counts and realised cost

Prompts, outputs and user identifiers deliberately excluded, so the cost record can be shared without carrying the content with it

Fallback lanes chosen in advance, so a provider outage has a designed answer instead of an incident