Eltheon AIGateway

Redeon.SuperSiteEngineCore.Web.Eltheon.Core.Features.AIGateway provides the provider-neutral Eltheon AI gateway, provider/model/usage profiles, protected credentials, routing, quotas, administration APIs and Razor pages.

Register the feature and its database context:

builder.Services.AddEltheonAiGateway(options =>
{
    options.EnableGateway = true;
    options.EnableApplicationApi = false;
});
builder.Services.AddEltheonAiGatewayDataStore(
    db => db.UseSqlite(connectionString));

builder.Services
    .AddRazorPages()
    .AddEltheonAiGatewayApplicationPart();

Applications consume IAiGateway with a logical usage-profile key. They never select provider credentials or remote model identifiers directly. Tool calls are returned to the application and are not executed by this package.

The remote /api/ai/v1 application API is disabled by default. Credentials are protected with ASP.NET Core Data Protection and are never returned by a read API, written to telemetry, or persisted as plaintext.

The feature-owned Admin RCL uses the same Assan/Bootstrap controls, page-header actions, navigation tabs, responsive cards, tables, validation summaries, and localized empty states as the other Eltheon administration features. Its live cockpit visualizes request volume, token usage, outcomes, profile latency, and recent secret-safe invocation activity with the ApexCharts bundle already provided by the Admin shell. Provider, model, usage-profile, route, quota, structured-output, and tool definitions are edited through typed fields and visual builders; JSON remains an internal wire format. The provider workspace exposes a dedicated credential form: administrators select a provider, enter its API key or token, and use the explicit save or replace action. The current concurrency token is refreshed immediately before the credential mutation; successful writes clear the input and update the credential status without ever returning the protected value. Model discovery opens a selectable Assan/Bootstrap table instead of a passive result list. Administrators can adjust logical keys and display names, select all or individual discoveries, and import up to 100 enabled model profiles in one action. Already imported remote models are marked and cannot be selected again. Imported profiles are loaded into the model registry immediately and therefore appear in the visual route selector when a usage profile is created or edited. The UI uses the EltheonJS Core bundle and adds only a narrow typed SSE decoder for the streaming test console.

Runtime provider, credential, model, route, static quota, and pricing configuration is materialized as an immutable frozen snapshot. The gateway hot path reads this snapshot and performs no EF configuration queries after warm-up. A singleton database revision, transactional revision bumps, and a jittered 15-second watcher invalidate changes from other hosts. Defaults are five minutes fresh and two minutes maximum stale. The Admin overview exposes secret-safe cache metadata and a separately confirmed refresh action guarded by System.AIGateway.Runtime.Manage.

Pricing is append-only and effective-dated. Each schedule has an ISO-4217 currency and explicit input, cached-read, cached-write, and output components; unknown prices remain different from explicit zero prices. Usage retains uncached input, cache reads, cache writes, output, and reasoning counts. Cost details keep gateway estimate, provider-reported amount, and effective amount with separate currencies and never perform FX conversion. Manual schedules are never silently replaced by discovery imports.

Built-in adapters are openai-compatible and ollama-native. Outbound endpoints are checked against the configured network policy and resolved addresses are pinned for the connection. Redirects are disabled unless the provider profile explicitly enables them; every enabled redirect is revalidated and the chain is limited to three hops. Provider calls use a per-host circuit breaker and no automatic generative retry. Native Ollama profiles use the server root such as http://127.0.0.1:11434, no authentication, and the loopback network policy. The former Admin value ollama remains a read-compatible alias and is canonicalized to ollama-native whenever a provider profile is saved.

AIGateway owns its MSSQL, MySQL, and SQLite migration registry, contexts, design-time factories, and generated migrations. The DataProvider-v3 lifecycle contributor verifies legacy template baselines, backfills legacy model prices between the add and drop migrations, and restores a compatible legacy projection during rollback.

The package deliberately does not execute tools, manage agents, run RAG, expose an OpenAI-compatible public API, or retain prompt and response bodies. See docs/Eltheon_AIGateway_v1_Operations.md and docs/Eltheon_AIGateway_v1_Security.md in the Eltheon repository for the operational and security runbooks.

Adviser contributors

AddEltheonAiGateway() contributes two read-only checks through the neutral Core.Abstractions Adviser contract:

• eltheon.aigateway.routing-readiness validates enabled usage-profile routes, models, providers, capabilities, and local adapter resolution without contacting a provider.
• eltheon.aigateway.quota-pressure aggregates only current quota windows per policy and reports soft-threshold pressure or unknown usage under a fail-closed hard budget.

Subjects contain logical usage-profile or quota-policy keys. Evidence never contains provider endpoints, remote model IDs, credentials, quota dimensions, consumer keys, subject keys, absolute token counts, or cost values.