Client Reliability Telemetry
See exactly what TrustedRouter SDKs measure for client-observed reliability, what they never send, how long metadata is retained, and how to opt out.
Measure uptime as your process sees it.
TrustedRouter can measure requests that reach its infrastructure. An SDK can also see DNS, TLS, connection, timeout, and broken-stream failures that never arrive. Client reliability telemetry joins those views without sending prompt or response content.
Exact per-minute counters measure logical requests after retries. Sampled events provide bounded diagnostics. Client-observed availability has its own methodology and is never part of the 99.99 % Router Core SLO.
x-tr-client
A compact header travels with each attempt to a known TrustedRouter inference host. It describes retry state, timing, streaming, and failover.
trustedrouter.com/v1/client-events
A fire-and-forget batch reports exact counters and sampled diagnostics. It runs outside the request retry engine and never blocks your request.
The per-attempt x-tr-client header
Version 1 is at most 160 bytes. Keys are unique; every value comes from a closed vocabulary or bounded integer.
| Key | Meaning | Allowed value |
|---|---|---|
v | Schema version | 1 |
a | Attempt index; zero is the first attempt | Integer 0–99 |
po | Previous attempt outcome | none, http_error, transport_error, timeout, or stream_broken |
pc | Previous error class | A closed error class listed below, or none |
ph | Previous TrustedRouter host path | apex, ally, uptime, us_central1, us_east4, europe_west4, control, custom, or none |
pm | Previous attempt elapsed time | Milliseconds, 0–3,600,000 |
sm | Time since the first attempt started | Milliseconds, 0–3,600,000 |
s | Streaming request | 0 or 1 |
fo | Candidate index advanced during this logical request | 0 or 1 |
The batched beacon field list
One bounded process batch.
schema_version | 1 |
|---|---|
batch_id | 32 lowercase hex characters |
instance_id | 16 lowercase hex characters |
seq | Per-process batch sequence |
sdk.name | tr-py, tr-js, tr-go, tr-rust, tr-java, or tr-swift |
sdk.version | SDK semantic version |
sdk.lang | python, js, go, rust, java, or swift |
sdk.runtime | Bounded runtime family and version |
sdk.os | linux, macos, windows, ios, android, freebsd, or other |
sdk.arch | x64, x32, arm, arm64, wasm, or other |
synthetic | Whether requests carried TrustedRouter synthetic metadata |
dropped_since_last | Locally dropped records since the prior batch |
events | Up to 100 sampled request events |
counters | Up to 200 exact minute counters |
A sampled logical request.
age_ms | Completion-to-flush age, up to 24 hours |
|---|---|
plane | inference or control |
endpoint | Closed endpoint enum |
method | GET, POST, PUT, PATCH, or DELETE |
streaming | Boolean |
provider_pinned | Whether provider candidates were pinned |
model | Catalog-safe model id or null |
attempts | One to 16 attempt objects |
final_outcome | Closed final outcome enum |
final_http_status | HTTP status 100–599 or null |
total_ms | Total logical request duration |
ttft_ms | First event or first body byte, or null |
failover_used | Boolean |
timeout_phase | none, connect, first_byte, idle, or total |
configured_timeout_ms | Configured timeout or null |
sample_rate | Sampling probability in (0, 1] |
sample_reason | failure, retried, slow, or random |
One network attempt.
index | Attempt index 0–99 |
|---|---|
host | Closed host enum |
outcome | Closed attempt outcome enum |
http_status | HTTP status or null |
error_class | Closed error class or null |
error_source | router, provider, unknown, or null |
should_retry | Observed retry hint: true, false, or absent |
retry_after_ms | Observed retry delay or null |
elapsed_ms | Attempt duration |
ttfb_ms | Headers received duration or null |
request_id | TrustedRouter rlog_… response id or null |
moved | Whether the candidate index advanced |
Exact availability inputs.
window_start_age_ms | Minute start as an age before flush |
|---|---|
level | attempt or request |
endpoint | Closed endpoint enum |
streaming | Boolean |
host | Closed host enum |
outcome | Closed final outcome enum |
error_class | Closed error class or null |
http_status_class | none, 2xx, 4xx, 429, or 5xx |
timeout_phase | Closed timeout phase enum |
timeout_floor_met | Whether the disclosed timeout floor was met |
provider_pinned | Boolean |
requests | Exact request count |
attempts | Exact attempt count |
failover_used | Exact failover count |
first_attempt_success | Exact first-attempt success count |
total_ms_hist | Bounded latency histogram |
first_event_ms_hist | Bounded first-event histogram |
Closed endpoint values: chat_completions, messages, responses, embeddings, images, videos, models, fusion, control_other, and inference_other. Error classes: dns, tls, connect_refused, connect_timeout, connect_error, read_timeout, write_timeout, pool_timeout, protocol_error, reset, io_error, proxy_error, stream_stalled, and unknown.
What is never sent
No request or response text.
- Prompts
- Completions
- Message text
- Tool inputs or outputs
No application identity fields.
- Workspace ids
- Key ids
- User ids
- Session ids
- IPs (IP addresses)
No secret routing identifiers.
- Hostnames of custom endpoints
- Idempotency keys
Your API key identifies the batch; it is stored as a salted hash surrogate. Raw workspace and key ids do not enter the analytics store.
Default on for known TrustedRouter hosts. Easy to turn off.
Pass telemetry=False to the SDK, set TRUSTEDROUTER_TELEMETRY=0, or set DO_NOT_TRACK=1. Opting out disables both the x-tr-client header and beacon. Custom inference or control hosts default off.
Set TRUSTEDROUTER_TELEMETRY_DEBUG=1 to echo each batch JSON to stderr before it is sent.
# Disable telemetry
TRUSTEDROUTER_TELEMETRY=0
# Universal opt-out
DO_NOT_TRACK=1
# Inspect each batch before send
TRUSTEDROUTER_TELEMETRY_DEBUG=1Retention
90 days
Raw content-free diagnostic events expire after 90 days.
180 days
Per-minute counters expire after 180 days.
24 months
Aggregated client availability rollups expire after 24 months.
Client-observed availability methodology v1
One unit is one logical SDK call. Retries never count twice, and a request rescued by failover is a success.
TrustedRouter faults
Counted faults include DNS, TLS, connection refused, connection timeout, connection error, reset, I/O, and protocol errors on known hosts; HTTP 5xx unless the request is provider-pinned and the error source is the provider; connect timeouts configured for at least 10 seconds; first-byte timeouts configured for at least 60 seconds; broken streams; stalled streams meeting the 30-second idle floor; and unknown failures conservatively.
Disclosed exclusions
Caller aborts, HTTP 4xx and 429, pool and proxy errors, custom hosts, timeouts below the floor, total-phase timeouts, and provider 5xx responses for provider-pinned requests are counted separately and excluded from the denominator.
Publication gate
Availability is successes ÷ (successes + TrustedRouter faults). Fleet percentages require at least 1,000 requests from at least three distinct tenants and a 14-day clean calibration period. Live figures remain internal by default because they include upstream provider-caused failures; public disclosure can be explicitly enabled after per-provider attribution makes the number fair.
Python 0.6.0 implements the full contract first.
TrustedRouter Python SDK 0.6.0 is the first release with default-on beacons for known TrustedRouter hosts. JavaScript, Go, Rust, Java, and Swift SDKs remain header-only until their release notes explicitly say they implement the beacon contract.