Crate firstpass_proxy 

firstpass-proxy

An HTTP proxy that sits as a drop-in base_url in front of Anthropic/OpenAI-compatible providers. In observe mode it forwards each request unchanged and records a tamper-evident audit trace asynchronously (zero added latency). In enforce mode it runs the escalation engine — cheapest model first, gate the output, escalate one rung on failure, serve the first output that passes — with cross-provider failover (SPEC §7.1, §7.1a, §9.1).

• config — ProxyConfig, loaded from the environment.
• store — the background SQLite trace writer.
• calibrate — recalibrate the conformal serving threshold from deferred feedback.
• upstream — BYOK passthrough to the upstream provider (observe mode).
• provider — normalized multi-provider model access (Anthropic, OpenAI).
• gate — runtime verification gates (Batch 3 inline set).
• router — the enforce-mode escalation engine.
• proxy — axum routing, observe passthrough, and enforce dispatch.
• error — structured, no-leak error responses.
• metrics — Prometheus recorder install + GET /metrics.
• cli — firstpass doctor / trace logic (validate a setup, read the store).
• mcp — minimal MCP stdio server so an agent can read its traces and submit feedback.
• run — shared server bootstrap for the firstpass and firstpass-proxy binaries.

Re-exports

pub use config::ProxyConfig;

pub use error::ProxyError;

pub use proxy::AppState;

pub use proxy::app;

pub use store::TraceSender;

pub use store::load_all_traces;

Modules

calibrate

Recalibrate the conformal serving threshold from real deferred feedback (SPEC §10.1, run against live traffic instead of a static benchmark suite) — the “learns your quality bar” loop.

cli

CLI surfaces for the firstpass binary (SPEC §7.3/§7.4): doctor validates a setup before you route real traffic through it, and trace reads recent audit records from the store. Both are kept here (not in the binary) so the judgment is unit-tested.

config

Proxy configuration, loaded from the environment (SPEC §7.4: agent-first, zero-config by default — every knob has a sane local default and can be overridden by env var).

error

Structured, no-leak errors (SPEC §7.4: “errors are structured, never prose an agent must parse”).

gate

The gate framework (SPEC §8 — the moat).

judge

Native LLM-judge gate (SPEC §8.3): a separate model grades the candidate output against a rubric. Three anti-gaming properties are enforced structurally here, not left to the prompt:

mcp

Minimal MCP (Model Context Protocol) stdio server (SPEC §0.2/§7.4): lets an agent inspect and correct its own routing — read the audit traces, and submit feedback — over JSON-RPC 2.0.

metrics

Prometheus metrics: install the global recorder once per process and serve GET /metrics for scraping. Real signals only — latency, escalations, what got served, what dropped.

provider

Normalized model access: a provider-agnostic request/response shape, and the two wire adapters (Anthropic Messages, OpenAI Chat Completions) that speak it. The router (crate::router) only ever talks to Provider; it never knows which wire format is behind a given rung.

proxy

Axum wiring: routes, request/response shapes, and observe-mode trace construction (SPEC §7.1, §7.1a — forward unchanged, record asynchronously, zero added latency).

router

The enforce-mode escalation engine (SPEC §7.1) — the crown jewel.

run

Server bootstrap shared by the firstpass and firstpass-proxy binaries: build state from config, open the trace store, and serve until Ctrl-C. Keeping this in the lib means both the unified CLI (firstpass up) and the bare proxy binary start the server the exact same way.

store

Tamper-evident trace storage: a background SQLite writer fed by a bounded channel.

subprocess

Subprocess gate plugin contract (SPEC §8.1) — the language-agnostic moat mechanism.

upstream

Forwarding to the upstream Anthropic-compatible provider.