# Kendr public product claims and evidence

**Review date:** 2026-08-27

This register is the approval gate for public claims about routing, pricing,
billing, security, and reliability. A claim may be published only when the
wording below is still supported by the linked code, configuration, migration,
test, or operational artifact. Repository evidence proves an implemented or
configured control; it does not, by itself, prove that every production
environment is healthy or correctly deployed.

## Approved claims

| Area | Approved public wording | Evidence in this repository | Boundary |
|---|---|---|---|
| API compatibility | Kendr exposes OpenAI-compatible model listing, Responses, and Chat Completions routes, plus Anthropic-compatible Messages and token counting. | `cloud/services/model-api/src/main.rs` route declarations; `cloud/crates/kendr-contracts/src/lib.rs` OpenAPI annotations and schemas; model-service tests. | Do not imply support for unrelated OpenAI or Anthropic APIs. Compatibility is endpoint- and field-specific. |
| Public model discovery | `GET /api/public/models` is an unauthenticated, versioned, sanitized catalog of enabled models, public capabilities, availability, and credit rates. | `cloud/services/model-api/src/main.rs` public route and serializer; public-catalog tests; edge routing configuration. | The public payload omits provider routes, credentials, configuration, retention data, and account-specific routing profiles. Authenticated callers should still use `/v1/models` for account availability. |
| Provider-neutral video generation | `kendr-video` creates durable asynchronous text-to-video jobs, copies completed output into Kendr-controlled private storage, supports authenticated byte-range playback, and settles exact provider-reported completion-token usage against a pinned route and rate card. | `backend/kendrweb/video_generation.py`; video handlers and settlement in `backend/early_access_api.py`; `cloud/crates/kendr-providers/src/lib.rs`; `cloud/services/connector-api/src/main.rs`; `cloud/migrations/202608270004_provider_neutral_video_generation.sql`; focused runtime, adapter, migration, and browser tests. | V1 is text-to-video only. The first executable route is TokenRa ArtSDance 2.5; Seedance 2.0 remains runtime-gated. Do not claim that submitted jobs can be cancelled upstream, that provider URLs are permanent, or that reference image/video/audio inputs are accepted. |
| Managed routing products | Kendr Intelligent, Kendr Intelligent Direct, Kendr Coder, and Kendr Coder Direct select one primary answer model deterministically and can use an immutable, bounded fallback plan for eligible transient failures before response delivery. Selection makes no extra model call. The plan prefers same-alias recovery before an approved alternate logical model. The successful model remains sticky for the task epoch, and responses return a sanitized routing receipt. The optimized products use embedded Kendr Optimizer; Direct products preserve original context. | `cloud/INTELLIGENT_ROUTING.md`; `cloud/services/router-api/src/main.rs`; `cloud/services/model-api/src/main.rs`; `cloud/crates/kendr-contracts/src/lib.rs`; router fallback and sticky-write tests. | Managed routing does **not** invoke a second model to select, fact-check, or verify a completed answer. Runtime can remove a planned fallback after current Admin/policy revalidation but cannot add a candidate; failure-specific provider-diversity prioritization stays within the planned set. MCP requests cannot cross logical models; exact continuations and provider-native `previous_response_id` requests receive no physical-route fallback. |
| Admin routing controls | Administrators control managed-product pool membership, logical-model strategy, physical-provider strategy, absolute primary/fallback upstream-cost ceilings, task-specific output limits and reasoning defaults/ceilings, supported response verbosity, and optional exact-response caching. New plans snapshot the effective settings so later edits do not change in-flight requests. | `cloud/services/router-api/src/cost_controls.rs`; Admin cost-control handlers and immutable-plan construction in `cloud/services/router-api/src/main.rs`; enforcement in `cloud/services/model-api/src/main.rs`; `cloud/migrations/202608270003_routing_cost_controls.sql`; Admin UI in `web/src/pages/AdminPages.tsx`; service and migration tests. | An Admin pool switch does not override live provider health, entitlement, rate cards, policy, or the physical capability contract. Configured generation controls apply when callers omit them, cap explicit values, and fail closed when unsupported, so they can reduce the routable pool. Exact-response caching is disabled by default and applies only to eligible exact-fingerprint, search-free, tool-free, image-free, non-continuation requests for the same user and billing account. Only primary-route completions become sources, and every hit is revalidated against live Admin/policy controls before it is returned. |
| Task-outcome routing evidence | For a new task epoch, Kendr may blend a signed seven-day task-outcome-efficiency signal across six routing domains after benchmark/profile quality gating. It uses terminal direct-model execution outcomes and charged upstream cost, with maturity, distinct-user, and per-model confidence floors. | Task-outcome loader and scorer in `cloud/services/router-api/src/main.rs`; `RoutingPolicy` in `cloud/crates/kendr-routing/src/lib.rs`; `cloud/evaluation/export_policy.py`; `cloud/migrations/202608270001_task_performance_and_cross_model_policy.sql`; policy, routing, and migration tests. | This is not exact OpenRouter Auto parity. Managed, unsettled, and mock traffic are excluded. The score is reliability-weighted accepted outcomes per upstream dollar, so rejected terminal outcomes reduce it; it is not popularity, correctness, or answer quality. Aggregates cache for 120 seconds and preserve base ranking when unavailable. A changed ranking alone does not evict a compatible sticky task epoch. |
| Web-search preference | Web chat defaults to Auto search. A user can choose Always or Off, and explicit Off is not overridden by routing. | Web preference migration and composer controls in `web/src/pages/UserPages.tsx`; `web/src/lib/search.ts`; model routing/search tests. | Auto may answer offline when search is unnecessary. Search has separate pricing and any search-enabled request is excluded from exact-response caching. |
| Routing receipt | Successful managed-route responses identify the requested product alias and selected public model alias, decision category/reason/confidence, required task domains, minimum qualification, web-evidence requirement, policy/catalog/pricing versions, attempt/fallback outcome, latency, settled usage, and cost. | `IntelligentRoutingMetadata` in `cloud/crates/kendr-contracts/src/lib.rs`; public sanitization and compatibility response builders in `cloud/services/model-api/src/main.rs`; receipt tests. | Provider keys, provider model IDs, internal ranking telemetry, raw candidate eligibility snapshots, and raw provider errors remain private. Failed requests have outcome metadata but no settled usage/cost claim. |
| Model markup | Exact model aliases and all four managed-route products use one fixed 5% markup on configured provider cost. | Markup constants and pricing helpers in `cloud/crates/kendr-routing/src/lib.rs`; billing public-pricing response in `cloud/services/billing-api/src/main.rs`; pricing tests. | Use the settled microcredit receipt as the authoritative customer charge. Non-model surfaces can have independent unit prices. |
| Optimizer | Kendr Intelligent and Kendr Coder invoke the embedded, pinned Kendr Optimizer core before each provider attempt and emit a sanitized optimization receipt. Direct variants never optimize. | `cloud/vendor/kendr-optimizer/PROVENANCE.md`; `cloud/crates/kendr-optimization`; router execution tests. | Optimizer estimates are not verified savings until paired with provider observations. Unsupported or structurally unsafe transformations fail open to the original request. |
| Purchased credit expiry | Credits from a completed paid package purchase never expire. Promotional credits may carry a grant-specific expiry. | Purchased-lot settlement and public pricing policy in `cloud/services/billing-api/src/main.rs`; `cloud/migrations/202608120001_fixed_markup_and_nonexpiring_purchases.sql`; billing and migration tests. | Do not describe every wallet lot as non-expiring. Starter, referral, weekly, and administrative grants can expire under their own policy. |
| Billing settlement | Model calls reserve wallet microcredits before chargeable execution and settle or release the reservation from the terminal outcome. Reusing an idempotency key for the same settled logical request replays the result. | Reserve/settle/release routes and transactions in `cloud/services/billing-api/src/main.rs`; model orchestration in `cloud/services/model-api/src/main.rs`; idempotency and settlement tests. | Do not promise that Kendr never incurs upstream cost on a failed attempt. Customer settlement and Kendr's provider expense are different ledgers. |
| Kendr API keys | Raw Kendr API keys are shown at creation; persistent lookup uses a SHA-256 token hash and a display prefix. | `hash_token` and `create_api_key_for_user` in `backend/early_access_api.py`; API-key authentication queries and tests. | SHA-256 hashing is not encryption. Do not say a raw key can be recovered or displayed later. |
| Connected credentials | Stored app-connector, MCP, and vector-database secrets use AES-GCM with random nonces and a deployment-owned encryption secret. | Credential encryption/decryption helpers in `backend/early_access_api.py`; `KENDR_CREDENTIAL_ENCRYPTION_KEY` production checks; connector/MCP credential tests. | This supports “encrypted at rest in the application database,” not end-to-end encryption. Runtime services decrypt credentials when an authorized operation needs them. |
| Rate limiting | Model requests have a configurable per-user, per-minute limit; the code default is 60 when Redis-backed rate-limit state is available. | `enforce_rate_limit` in `cloud/services/model-api/src/main.rs`; `KENDR_USER_REQUESTS_PER_MINUTE` configuration. | Do not market 60 requests/minute as a contractual quota or SLA. The implementation currently permits requests when Redis is absent. |
| Operational telemetry | The repository defines RED metrics, stream terminal outcomes, provider-call telemetry, dashboards, and provisional internal SLOs. | `docs/observability/README.md`, `docs/observability/SLO.md`, and `k8s/observability` manifests. | Internal SLO values are not customer SLAs. In-cluster blackbox probes are not independent external availability evidence. |
| Kendr Voice | Signed-in users can preview an allowlisted Amazon Nova 2 Sonic voice, save that choice across devices, and use it in a live interruptible speech conversation with bounded read-only server tools. | `cloud/services/voice-api`; voice preference migration and account routes; `web/src/lib/realtimeVoice.ts`; voice picker/settings components; WebSocket and browser tests. | Do not describe browser-to-AWS access, arbitrary tool execution, unlimited sessions, or settled voice credit charging. The browser connects only to Kendr, sessions renew before the provider limit, and this release records provider usage while automated voice settlement remains a separate verified-rate-card step. |
| Log minimization | Reviewed observability paths use bounded labels and hashed request correlation; documented logging guidance excludes authorization headers and customer prompts from metrics and reviewed access-event fields. | `docs/observability/README.md`; observability helpers and tests. | Do not claim “Kendr never logs customer content” across every component. Coverage is intentionally incomplete and source-level review remains required. |

## Claims that are not approved

Do not publish any of these without new implementation and independent evidence:

- “Managed routing verifies every answer,” “independent model verification,”
  or equivalent wording.
- “Kendr implements OpenRouter Auto exactly,” “spend or request volume proves
  answer quality,” or “managed routing reranks every sticky turn to the latest
  dynamic winner.”
- “Zero retention,” “no logging,” or “end-to-end encrypted” as a platform-wide
  statement.
- “99.9% uptime,” “five nines,” “always available,” or any customer SLA derived
  only from repository configuration or in-cluster probes.
- SOC 2, ISO 27001, HIPAA, GDPR certification/compliance, or another third-party
  assurance unless a current, scoped attestation is available to the reviewer.
- “All credits never expire.” Only completed paid package purchases are
  non-expiring; promotional grants can expire.
- A markup other than the fixed 5% model-cost policy, or different percentages
  for exact and Intelligent routing.
- Published npm or PyPI availability for the source-included helper SDKs until
  the registry release is independently verified.

## Release review

Before changing a public security, routing, pricing, billing, or reliability
claim:

1. Link the exact implementation/configuration and a test or operational check.
2. State whether the evidence proves code behavior, deployed configuration, or
   observed production performance.
3. Include the limitation in the public wording when readers could otherwise
   infer a broader guarantee.
4. Re-run the documentation truth tests and the owning service's tests.
5. Remove or narrow the claim immediately when its evidence changes.