External Model Workers

Nishi vs the field — every Nishi cell is measured against real organ source at emit time; each gap names the watch contract that will close it.

Nishi classified-egress worker lane (free inference as a U-cleared sink, byte-exact judge, egress ledger, terms as data) vs LiteLLM gateway and the OpenRouter router and LLM Guard egress scanning and openai-evals model grading -- Aug-2026 field

Layer 1 · Executive

Where we are. MEASURED 2026-08-24 against the catalogue and the mirrored terms: the sovereign TLS 1.3 client and a JSON POST over it are LIVE (yt_post, nx_https_req_complete), the vault and its lease rotation are BUILT (vlt_derive, rot_due), the clearance resolver and the public U index are LIVE (ag_uid_to_level, dss_search_off_div), the evidence register and its pin gate are LIVE (rf_provenance, crg_pin_ok), the byte-exact judge and the forge prompt and fence machinery are LIVE (fg_run, fg_bank, fm_compose_prompt, fm_strip_fences, fc_emit), the plane ledger verb is LIVE (nsp_hist_append) and the SWE-bench Verified grader is BUILT (sg_verdicts). CORRECTED 2026-08-25, MEASURED: XL1 and XL2 ARE NOW LIVE. nx_extllm (nx_catalog VERDICT LIVE -- source, built, promoted, registered, authorised, invoked, with_gaps=0) reads the 13-provider terms ledger and the release manifest, both of which existed as DATA since 2026-08-24 with ZERO readers in the whole 23,235-file corpus. Its gate is 27/27 GREEN on the live NAS binary and BITE-PROVEN twice: mutating the cumulative bound to a per-call check killed the aggregation tooth (RED 24/25) while its fixture-reached-the-condition partner stayed PASS, and mutating the classifier fail-open killed exactly the undeclared-source and empty-manifest neg-controls while the stale-hash tooth stayed PASS. Promote rulers agreed: nx_contentdiff lost_from_live=0 over 136 runs, nx_behaveprobe first_diff_off=-1 IDENTICAL STRONG. An UNPINNED terms row now ADMITS NOTHING, so a provider posture we have not pinned to a mirrored contract cannot be asserted. The Claude tier is in the ledger keyed on ACCOUNT TIER, not vendor name, because Free/Pro/Max and API/Team/Enterprise publish OPPOSITE defaults; all four rows are pinned to mirrors fetched 2026-08-25, and the UNDECLARED row REFUSES until the operator declares which tier this estate runs under. DISTILL is refused for anthropic on every tier -- both contracts forbid using outputs to train a competing model and our no-float LM is exactly that -- so the sovereign corpus can never be grown from Claude output. STILL ABSENT: NO external call organ, NO pool scheduler, NO external forge backend, NO best-of-N, NO LLM judge, NO egress ledger PLANE (the odometer arithmetic ships and is gate-proven, but nothing writes a row per call yet) and NO publish guard. The subject provider census (27 pages mirrored, 179 fetches by the research lane) is summarised in the Market row below.

Where we need to go. OPERATOR ASK (2026-08-24): stand up the OpenRouter stealth key as a capability, publish a /compare on it, and research the August-2026 opportunities to farm training and other work off free resources where the material is already public -- with a classification system like the estate's top-secret-down model applied to every such use, and with the free models working the open code-emitting rungs toward the /compare/coding and /compare/lang bars while the gates rule and the assistant only judges. Deliverable: the classified call lane (terms ledger, egress classifier, call plus scheduler plus ledger), the external forge tier (public pack, backend, best-of-N), the judge panel, the rung worker, the publish guard and the terms-gated distillation harvest.

The unit. 1 u = one measured session-leg (organ plus gate plus live flip), the standing calibration.

Cost to a classified call lane: 4 u. XL1 the terms ledger read from the pinned mirrors [stealtheula] [ortos], XL2 the egress classifier and the release manifest, XL3 the call over the sovereign TLS client with the scheduler and the egress ledger. Version 0.1.

Cost to a free worker on the forge: 2.5 u more. XL4 the public-only pack and the external backend behind fm_compose_prompt, XL5 best-of-N against the byte-exact judge [llmonkeys]. 6.5 u cumulative = version 1.0.

Cost to an independent referee and a safe page: 2 u more. XL6 the judge panel over U artifacts [openaievals], XL8 the publish guard the Stealth AUP requires [stealtheula]. 8.5 u cumulative.

Cost to rung workers and a lawful distillation harvest: 3.5 u more. XL7 the rung worker loop over open plan rungs, XL9 the harvest gated per provider on the output-rights row [groqsa] [deepseektos] [cfterms]. 12 u cumulative = version 2.0.

Research bar. Stealth Program EULA, the contract that binds a free stealth model is measured on OpenRouter, updated 2026-07-06. Theirs: models are offered free of charge for purposes of collecting User Content for use in Stealth Model training and improvement; an irrevocable perpetual licence to the provider; a ban on publicly disseminating confidential technical information regarding the performance of the models [@stealtheula]. Ours: XL1 carries these as rows and XL8 enforces the publish ban; the model page banner that says the opposite [@oxalpha] is recorded beside it as the marketing statement it is.

Research bar. Large Language Monkeys, sampling against a verifier is measured on arXiv 2407.21787. Theirs: coverage climbs with the number of samples when a verifier exists [@llmonkeys]. Ours: XL5 -- the estate's verifier is a byte-exact equality and a free sampler makes N affordable.

Research bar. Groq Services Agreement, the free tier that does not train and leaves outputs yours is measured on Groq, effective 2026-06-22. Theirs: Groq is not permitted to use Inputs or Outputs for training or fine-tuning any models unless explicitly granted permission; the customer retains all rights in Inputs and Outputs [@groqsa]; free tier limits published per model [@groqlimits]. Ours: XL9 -- the first provider whose outputs may lawfully grow the forge ledger; XL3 schedules to its published caps.

Business case

Axis	Position	Figures	Decision
Investment	Zero token cost on every free tier in the census; the whole investment is organ work (12 u to version 2.0) and the operator's release decision for the manifest; no hardware and no credit card on the Groq, OpenRouter free, Cloudflare and Z.ai paths [groqlimits] [orlimits] [cfpricing] [zaitos], a card on Cerebras [cerebrastos]	12 u; the return is rungs climbed on other boards by workers that cost nothing per token	fund XL1 to XL3 now -- the terms ledger and the classifier are reused by every external call the estate will ever make
Market	The August-2026 free-inference field from the mirrored record: OpenRouter routes one stealth model and a free collection where some providers train on prompts and OpenRouter itself does not [orfree] [orprivacy], with a per-request data_collection deny switch [orrouting] and published free-tier caps [orlimits]; Google's unpaid Gemini tier uses submissions to improve its products and forbids developing competing models [geminiterms] [geminipricing]; Groq's free tier does not train and leaves outputs yours [groqsa]; Cerebras replaced its free tier with a card-gated trial and forbids benchmarking [cerebrastos]; SambaNova's free tier does not train but forbids publishing performance results [sambanovaeula]; Mistral trains by default on preview models and on opt-in-by-default products [mistraltos]; Cloudflare gives a daily neuron allowance and does not train on customer content [cfterms] [cfpricing]; NVIDIA's API catalogue is trial-only, collects content to improve its models and forbids production use [nvidiatrial]; Z.ai's Flash models are free, not trained on, and their outputs may not train a competing model [zaitos]; DeepSeek is paid, stores data in the PRC and explicitly permits distillation [deepseektos]; Alibaba Model Studio gives a per-model free quota and states it never trains on customer data [alibabaquota] [alibabaprivacy]; GitHub Models was retired on 2026-07-30 [ghmodels]	three classes fall out and the ledger encodes them: WORKER (any provider, U material only), JUDGE (any provider, U artifacts), DISTILL (Groq, Cloudflare, DeepSeek only)	no provider is trusted from its model card; every row is read from the pinned contract
Opportunity cost	The forge today samples from a local 0.5B and 1.5B tier that pattern-copies; a free frontier-class sampler behind the same byte-exact judge converts the coding domain's best-of-N rung from a throughput problem into a scheduling problem	the ruler stays ours, the samples become free	charge XL1, XL2, XL3 and XL8 to the platform; XL4 to XL7 to the coding domain; XL9 to the modelwright domain
Competitive position	The gateway field owns routing and spend [litellm]; the DLP field owns pattern scanning [llmguard]; the evaluation field owns model-graded evals [openaievals]; none of them owns a clearance model, a terms ledger read from pinned contracts, or a byte-exact judge on the worker's output	our position is the guard and the ruler, not the model	use their inference, keep our classification, publish only what the contract permits
Buy vs build	Inference: TAKE FREE where the terms row permits the use, BUY DeepSeek for distillation if volume is wanted [deepseektos]. Transport, vault, classification, judge, ledger: already BUILT. Terms ledger, classifier, scheduler, backend, panel, worker, guard, harvest: BUILD -- none exist to buy in the clearance-aware form	the only build is the guard and the loop; the model is never ours to own on this lane	guard first, worker second, harvest last

Market-entry ladder

Level	Best in class (Aug 2026)	What we have	What must grow	Verdict
Hobbyist	Paste a prompt into a free model's page or a router's playground [oxalpha]; no clearance, no ledger, the prompt is the payment [stealtheula]	the classification rule as a written instruction: only what the public site already serves may be pasted	nothing structural -- the discipline of the operator and the assistant	ENTER NOW by hand on U material only; it is how the 21-call probe of 2026-08-24 was run, and it is where the manifest's first rows come from
Small business	A gateway with key management, retries and spend logs [litellm], a router with per-request data-collection routing [orrouting] and published caps [orlimits]	the sovereign transport, the vault and rotation, the plane ledger verb, the pin gate	XL1 the terms ledger, XL2 the classifier, XL3 the call with the scheduler and the ledger	GROW-FIRST -- enter when M0 is green; until then every external call is a hand-run probe on U material and nothing else
Market leader	Enterprise gateways with DLP scanning of prompts [llmguard], zero-data-retention contracts with the inference vendors [groqsa] [cfterms], model-graded evaluation suites [openaievals]	a clearance model the field does not have (ag_uid_to_level, the public U index with a consent bit) and a byte-exact judge the field cannot have	XL2 at the door, XL6 the panel, XL8 the guard	HOLD until M2 -- and the position is stronger than the leader's once XL2 ships, because a level is a rule where a pattern list is a floor
Innovation leader	Nobody in the field combines clearance-by-construction egress, provider terms as pinned data consumed at the call, and a deterministic verifier judging the worker's output; the closest published result is sampling against a verifier [llmonkeys]	the verifier and the classification are measured present; the wiring is the whole gap	XL4 and XL5 published on the coding board with the external tier as the sampler	THIS IS THE WEDGE -- reachable at M1 without any model of our own, which is why the entry order is guard, then worker, then harvest
Research leader	Distillation from frontier outputs where the licence permits it [deepseektos] [groqsa], repository-level agents graded on SWE-bench [swebench], contamination-aware evaluation	the SWE-bench Verified grader owning its denominator (sg_verdicts) and the compile-verified forge ledger	XL7 rung workers feeding the ledger and XL9 the harvest, then the modelwright domain's training arc over it	AFTER M3 -- the ledger is the research asset and it accrues from the first worker run, so the research rung is a by-product of the worker rung, not a separate investment

21 of 31 capabilities measured|7 of them measured exceeds|10 open|coverage 677/1000|adoption 14 full / 7 partial

Layer 2 · Roadmap

Do this next — computed by the ranker, never chosen by a seat

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: the cheapest closures on this board, listed before any new work. Stamp: # asof=1787883580 domain=extllm target_version=1.0 rungs=9 done=3 open=6 finish=0 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
#1	1.0	Public pack and external forge backend (XL4) fm_post_ext	1000	v=5 m=3 c=15
#2	1.0	Best-of-N against the free verifier (XL5) fg_best_of_n	200	v=2 m=1 c=10
#3	later	Publish guard (XL8) xl_publish_guard	2000	v=1 m=2 c=1
#4	later	Terms-gated distillation harvest (XL9) xl_distill_corpus	600	v=1 m=3 c=5
#5	later	External judge panel (XL6) lj_grade	266	v=2 m=2 c=15
#6	later	Rung worker loop (XL7) xl_rung_worker	166	v=1 m=1 c=6

Critical path — contract, done-rule, executor, cost

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Provider terms ledger (XL1)	xl_terms_ledger	one row per provider read from the PINNED mirror, never the live site: trains_on_input, outputs_train_ours, benchmark_publish_restricted, retention, card_required, rate caps; UNKNOWN is a value and REFUSES every gated use; neg-control: a provider with no mirror row must never read ALLOW [@ortos] [@orprivacy] [@orlimits]	Organ	1 u
Egress classifier and release manifest (XL2)	xl_egress_class	every prompt byte resolves to a public-index cid or to a row of the operator-declared release manifest, else the call REFUSES naming the offending source; the manifest is data the operator writes, never a default; neg-control: a prompt assembled from an unreleased runtime .nx must never leave; positive control: a prompt built only from public compare pages must pass	Organ	1.5 u
Call, scheduler and egress ledger (XL3) after XL1,XL2	xl_call	request built from a conf row (provider, model, effort, max tokens) and sent through nx_https_req_complete with the key read from the vault; the 429 attributed to its source (shared pool versus this key) and the body state named; one lane per free pool with backoff derived from the measured refusal rate and concurrency pinned to the measured admission (2 of 6, 2026-08-24) [@orlimits] [@orrouting]; one ledger row per call (provider, model, prompt hash, bytes, class, terms pin, verdict) through nsp_hist_append; neg-control: a call whose terms row reads UNKNOWN is refused before the socket opens	Organ	1.5 u
Public pack and external forge backend (XL4) after XL2,XL3	fm_post_ext	fc_emit_public emits the rules corpus plus RELEASED stdlib signatures only and fails closed on any unreleased source exactly as fc_emit fails closed on an UNVERIFIED rule; fm_post_ext produces a candidate into the same file fg_run judges; gate: a candidate from the external tier passes the byte-exact judge on the L4 mini-pack task; neg-control: a pack carrying an unreleased signature is refused by name	Organ	1.5 u
Best-of-N against the free verifier (XL5) after XL4	fg_best_of_n	N candidates per task through fg_run, first GREEN kept, pass-at-N monotone in N on the mini-pack, NONE reported when no candidate is GREEN rather than the best-scoring wrong answer [@llmonkeys]; the same contract /compare/coding names as CD2, so both pages flip on one organ	Organ	1 u
External judge panel (XL6) after XL3	lj_grade	free external models grade a U artifact under a pre-declared rubric and the grade travels with the claim as the independent referee the estate's progress law requires; the same contract the referee domain names [@openaievals]; neg-control: a panel requested over a C artifact is refused at the door by XL2, never graded	Organ	1.5 u
Rung worker loop (XL7) after XL4,XL5	xl_rung_worker	reads a /compare plan rung whose spec and KAT resolve entirely to U sources, runs sampler then judge then bank, files the GREEN candidate on the pm intake plane for review by the assistant; a rung citing unreleased source is SKIPPED by name; the loop reports rungs attempted, GREEN, RED and SKIPPED with the partition summing	Organ	2 u
Publish guard (XL8) after XL1	xl_publish_guard	the compare emit may carry capability rows about an external provider and may NOT carry per-model performance numbers while the provider's terms row says benchmark_publish_restricted [@stealtheula] [@cerebrastos] [@sambanovaeula]; measured numbers stay on the internal plane at class C; neg-control: an emit carrying a per-model score for a restricted provider is refused	Gate	0.5 u
Terms-gated distillation harvest (XL9) after XL1,XL3	xl_distill_corpus	SOVEREIGNTY IS THE ACCEPT RULE, NOT THE PERMISSION. The corpus must never DEPEND on a provider: with every external sampler disabled the verified ledger must still STRICTLY GROW over a run, and deleting every externally-provenanced row must leave it passing its quality bar unchanged. Both are measurable and a harvest that cannot show them is not wired. External output is then a SUPPLEMENT that can only ever enter as a CANDIDATE judged by our own byte-exact verifier, with its provenance recorded per row so the deletion test above stays possible. Only then does the terms gate apply: worker outputs are harvested into the forge's compile-verified ledger only where the terms row reads outputs_train_ours YES -- Groq [@groqsa], Cloudflare Workers AI [@cfterms], DeepSeek which permits distillation by name [@deepseektos]; providers whose terms forbid training a competing model -- Gemini unpaid [@geminiterms], NVIDIA trial [@nvidiatrial], Z.ai [@zaitos] -- are refused for this use and stay worker or judge only; UNKNOWN refuses	Organ	1.5 u

Milestones

Milestone	Rungs	Cumulative
M0 · Classified call lane	XL1,XL2,XL3	4 u
M1 · Free worker on the forge	XL4,XL5	6.5 u
M2 · Independent referee and a safe page	XL6,XL8	8.5 u
M3 · Rung workers and lawful distillation	XL7,XL9	12 u

Layer 3 · Engineering

How this is scored. Every Nishi mark is measured: the generator reads the real organ source on disk and requires the implementing symbol to exist (no self-grading). A watching tag names the organ and symbol contracted to close a gap — the mark flips itself on the next compare beat when that workstream ships, and the comparewatch- plane row flips with it. The flip is necessary, not sufficient: it proves the symbol exists, never that the capability is good. The bar is the rung's pre-declared done-rule, proven by its gate — a symbol shipped without the behaviour behind it is a defect, and the flip is exactly what makes that defect visible instead of quiet. Competitor marks record documented capability presence — presence, not depth or scale. Adoption is measured too: every measured row carries where its organ stands on the estate's ladder (source → built → promoted → registered → invoked; libraries by importer reach minus validation importers; gates by the execution surfaces that run them). A row is fully adopted only at the top of its ladder; anything short is tagged partial with the exact remedy, so a build nobody promoted can no longer read as shipped. Census stamps: importers asof 1787849099, gate census asof 1787855507 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ leads / measured exceed● present◐ partial○ absent · click any capability for its evidence

Capability	Nishi	LiteLLM gateway	OpenRouter router	LLM Guard (egress DLP)	openai-evals (model grading)
TRANSPORT
HTTPS JSON POST over the sovereign TLS 1.3 client (own stack, Mozilla trust store) Measured exceed: `yt_post` in `runtime/_hdl_build/nx_yt_innertube.nx`, verified at emit. The gateway and the guard ride a Python HTTP client over a system TLS library [litellm] [llmguard]; ours is the estate's own TLS 1.3 client, proven on the InnerTube POST path -- no third-party TLS sits between the estate and the provider Adoption: `LIB-UNIMPORTED` — PARTIAL: nothing imports it: wire it into a consumer or retire it. adoption LIB-UNIMPORTED	◉	●	●	●	○
Prebuilt request sent over an established TLS session (the primitive a chat-completions call composes) Measured: `nx_https_req_complete` exists in `runtime/nx_https_get_complete.nx`, verified at emit. Fourteen call sites in the tree already compose it; the external call is a request builder plus this one function, not a new transport Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. adoption SOURCE-ONLY	●	●	●	○	○
Body-completeness state named on every response (COMPLETE, TRUNCATED, UNJUDGEABLE, UNOBSERVED) Measured exceed: `nx_https_body_state` in `runtime/nx_https_get_complete.nx`, verified at emit. A reply cut at the wire reads as a short answer in every client; ours names the state. Measured on the subject 2026-08-24: the shared free pool answered 429 on roughly half of first attempts and admitted 2 of 6 concurrent calls [oxalpha] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. adoption SOURCE-ONLY	◉	○	○	○	○
SECRETS
Provider key sealed at rest (AES-128-GCM, KDF-stretched passphrase) Measured: `vlt_derive` exists in `runtime/_hdl_build/nx_vault.nx`, verified at emit. The gateway keeps provider keys in environment and config [litellm]; ours is the vault -- a key never touches argv, source, a memory file or a page Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, no MCP invocation on record (a direct fork logs the runner, so this is not proof it never ran); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_vault_v3_gate -- a mention, not a run. adoption REGISTERED-DARK	●	◐	○	○	○
Lease-driven key rotation with a grace overlap Measured: `rot_due` exists in `runtime/_hdl_build/nx_vault_rotation.nx`, verified at emit. A key pasted into a chat is exposed the moment it is pasted; rotation here is a lease that falls due, not a reminder Adoption: `LIB-GATE-ONLY importers=2` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. adoption LIB-GATE-ONLY importers=2	●	●	○	○	○
CLASSIFY
Reader clearance resolved from the session uid (U, C, S, TS) Measured exceed: `ag_uid_to_level` in `runtime/_hdl_build/nx_access_lib.nx`, verified at emit. The estate's Bell-LaPadula model gives every reader a level; an external provider is a sink with clearance U. The egress DLP field scans for secret and PII patterns [llmguard] and has no notion of a clearance -- a pattern list is a floor, a level is a rule Adoption: `LIB-WIRED importers=4 nonval=3` — fully adopted (top of its ladder).	◉	○	○	◐	○
The public U index served with a per-document consent bit (the only material a U sink may receive) Measured exceed: `dss_search_off_div` in `runtime/_hdl_build/nx_docportal_search_seg.nx`, verified at emit. No-write-down by construction: what the anonymous public search already serves is, by definition, already public. Anything else is C by default and never leaves Adoption: `LIB-WIRED importers=19 nonval=12` — fully adopted (top of its ladder).	◉	○	○	○	○
EVIDENCE
Provider terms mirrored with provenance (url, sha256, bytes) on every fetch Measured: `rf_provenance` exists in `runtime/nx_research_fetch.nx`, verified at emit. The Stealth EULA [stealtheula], the OpenRouter terms [ortos] and the model page [oxalpha] are mirrored and pinned, not remembered Adoption: `LIVE` — fully adopted (top of its ladder).	●	○	○	○	○
Citations register gate, pin must equal the live hash Measured: `crg_pin_ok` exists in `runtime/nx_compare_refs_gate.nx`, verified at emit. A terms page that changes under you re-pins RED on the next emit; the terms ledger contract below reads the pinned mirror, never the live site Adoption: `GATE:LIVE trial=-` — fully adopted (top of its ladder).	●	○	○	○	○
JUDGE
Byte-exact deterministic build plus judge of a candidate Measured exceed: `fg_run` in `runtime/nx_forge.nx`, verified at emit. The worker's output is judged by an equality, never by a model grading a model; model-graded evals [openaievals] are the field's shape and the referee domain records that gap honestly Adoption: `LIB-WIRED importers=8 nonval=5` — fully adopted (top of its ladder).	◉	○	○	○	◐
Bounded repair loop feeding verbatim compiler stderr back to the worker Measured: `fg_bank` exists in `runtime/nx_forge.nx`, verified at emit. The loop the local Coder tier already runs; the external tier plugs into the same bank Adoption: `LIB-WIRED importers=8 nonval=5` — fully adopted (top of its ladder).	●	○	○	○	○
WORKER
Prompt composed from the context pack plus the task plus repair feedback Measured: `fm_compose_prompt` exists in `runtime/nx_forge_model.nx`, verified at emit. The prompt is assembled from named files, which is what makes the egress classifier below decidable: every byte has a source path Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder).	●	●	○	○	●
Fence stripping and text extraction on a model reply Measured: `fm_strip_fences` exists in `runtime/nx_forge_model.nx`, verified at emit. Measured on the subject 2026-08-24: at max effort ox-alpha wrapped its code in fences despite an explicit no-fences instruction; this organ exists for exactly that Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder).	●	●	○	○	○
Context pack emitted from sources (rules corpus plus stdlib signatures plus exemplar) Measured: `fc_emit` exists in `runtime/nx_forge_ctx.nx`, verified at emit. Today's pack extracts signatures from estate source, which is C by default under classify-at-the-door; the public-only pack is a contract below and an operator decision Adoption: `LIB-WIRED importers=7 nonval=4` — fully adopted (top of its ladder).	●	○	○	○	○
LEDGER
Provenanced additive plane write with a history row per change Measured: `nsp_hist_append` exists in `runtime/_hdl_build/nx_store_put.nx`, verified at emit. The gateway logs spend per key [litellm]; the router shows activity per key [oxalpha]; ours writes every egress as a plane row with actor, hash and class -- the ledger contract below is one consumer of this verb Adoption: `LIVE` — fully adopted (top of its ladder).	●	◐	◐	○	○
BENCH
SWE-bench Verified grader owning the denominator (python is the oracle, never the scorer) Measured: `sg_verdicts` exists in `runtime/_hdl_build/nx_swebv_grade.nx`, verified at emit. The repository-level bar [swebench] is graded by an estate organ; an external worker's patches are graded by the same organ, so a free model's SWE-bench standing is a number we compute, not one we read Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, no MCP invocation on record (a direct fork logs the runner, so this is not proof it never ran); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption REGISTERED-DARK	●	○	○	○	●
GATE
Verdict base class, the exit code carries the verdict Measured: `gv_verdict` exists in `runtime/nx_gate_verdict.nx`, verified at emit. Every contract below ships with a gate on this class, including a neg-control that a C-classified prompt is REFUSED Adoption: `LIB-WIRED importers=1506 nonval=108` — fully adopted (top of its ladder).	●	○	○	○	●
EVIDENCE
Sovereign mirrored and pinned reference register for this field Measured: `knowledge/fetched/cmp_extllm` exists in `knowledge/compare/extllm.refs`, verified at emit. Every rival claim on this page resolves to a mirror in the estate evidence store, content-pinned by hash and re-measured on every emit Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. adoption ABSENT	●	○	○	○	○
CALL
Chat-completions call to an external provider over the sovereign TLS client Measured: `xl_call` exists in `runtime/nx_extllm_call.nx`, verified at emit. The gateway [litellm] and the router [oxalpha] are the field; contract = request built from a conf row (provider, model, effort, max tokens), sent through nx_https_req_complete, the 429 attributed by source (upstream shared pool versus this key), the body state named Adoption: `LIVE` — fully adopted (top of its ladder).	●	◉	◉	○	●
CLASSIFY
Egress classifier at the door -- every prompt byte must resolve to a U source (a public-index cid or a public-release manifest row) or the call REFUSES by name Measured exceed: `xl_egress_class` in `runtime/nx_extllm.nx`, verified at emit. The DLP field redacts patterns it recognises [llmguard]; ours refuses anything it cannot prove public. Neg-control: a prompt assembled from a runtime .nx not on the manifest must never leave Adoption: `LIVE` — fully adopted (top of its ladder).	◉	○	○	◐	○
Public-release manifest for source and doctrine (which files are U//public-release, declared by the operator as data) Open — watching `runtime/nx_extllm.nx` : `xl_release_manifest`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The estate has a public-release flag on media vault items and a consent bit on documents, and NO marking on source; the manifest is that marking, and it is an operator decision row, never a default watching xl_release_manifest	○	○	○	○	○
TERMS
Provider terms ledger as data (retains, trains, output rights, benchmark-publish restriction, rate caps) read from the pinned mirrors and consumed by the guard Measured exceed: `xl_terms_ledger` in `runtime/nx_extllm.nx`, verified at emit. The router publishes a data-policy field per model [oxalpha]; the contract binds to the EULA [stealtheula] and the terms [ortos] as rows, so a provider whose terms forbid a use refuses that use at the call, not in a reader's memory. The Claude escalation sink is in the ledger keyed on ACCOUNT TIER rather than vendor name, because the commercial contract [anthropic_comm_terms] and the consumer contract [anthropic_cons_terms] publish OPPOSITE training defaults, Claude Code inherits whichever account it runs under [anthropic_cc_datausage], and zero data retention is a per-organization grant that no plan name implies [anthropic_zdr] Adoption: `LIVE` — fully adopted (top of its ladder).	◉	○	◐	○	○
POOL
429-aware scheduler -- single lane per free pool, backoff from the measured refusal rate, concurrency pinned to what was admitted Open — watching `runtime/nx_extllm.nx` : `xl_pool_sched`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The gateway retries and falls back across providers [litellm]; ours schedules to the measured pool (2 of 6 admitted, ~50 permil-per-call refusal on first attempt, 2026-08-24) and never bypasses a limit, which the AUP forbids [stealtheula] watching xl_pool_sched	○	◉	◉	○	○
WORKER
Public-only context pack (rules corpus plus RELEASED signatures only, refusing any unreleased source) Open — watching `runtime/nx_forge_ctx.nx` : `fc_emit_public`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The variant of the pack an external worker may see; it composes the manifest and fails closed exactly as the existing pack fails closed on an UNVERIFIED rule watching fc_emit_public	○	○	○	○	○
External model backend for the forge with the same candidate contract as the local serve Open — watching `runtime/nx_forge_model.nx` : `fm_post_ext`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. One more backend behind fm_compose_prompt and fm_strip_fences: the candidate lands in the same file the byte-exact judge reads, so nothing downstream changes watching fm_post_ext	○	●	●	○	●
Best-of-N sampling against the free verifier with the external tier as a sampler Open — watching `runtime/nx_forge.nx` : `fg_best_of_n`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Coverage climbs with samples given a verifier [llmonkeys]; ours is perfect and free, and a free external sampler makes N affordable -- the same contract /compare/coding names as CD2, so this cell and that one flip together watching fg_best_of_n	○	○	○	○	●
JUDGE
External LLM-as-judge panel over U content, the independent referee grade recorded beside every claim it grades Open — watching `runtime/nx_llm_judge.nx` : `lj_grade`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Model-graded evals are the field [openaievals]; the estate's law demands an independent referee grade with every progress claim -- free external judges over public artifacts are that referee, and this is the same contract the referee domain names watching lj_grade	○	○	○	○	◉
PUBLISH
Publication guard -- external-model performance numbers stay C, capability rows stay U Open — watching `runtime/nx_extllm.nx` : `xl_publish_guard`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The Stealth AUP forbids publicly disseminating confidential technical information regarding the performance of the models [stealtheula]; the guard keeps the measured numbers on the internal plane and lets only the capability rows onto this page watching xl_publish_guard	○	○	○	○	○
LEDGER
Egress ledger row per call (provider, model, prompt hash, bytes, classification, terms pin, verdict) Open — watching `runtime/nx_extllm.nx` : `xl_egress_ledger`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Spend logs record cost [litellm]; ours records WHAT LEFT and under WHICH TERMS, so an audit of the lane is a plane read, and a terms change re-pins every row it governs watching xl_egress_ledger	○	◐	◐	○	○
WORKER
Rung worker loop -- reads a /compare plan rung whose spec and KAT are public, runs sampler then judge then bank, files the candidate for review Open — watching `runtime/nx_extllm.nx` : `xl_rung_worker`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The operator ask of 2026-08-24: free workers climb the open rungs, the gates rule, the assistant judges. Neg-control: a rung whose spec cites unreleased source must be SKIPPED by name, never prompted watching xl_rung_worker	○	○	○	○	○
DISTILL
Synthetic corpus harvest for the no-float LM, gated per provider on the output-rights row of the terms ledger Open — watching `runtime/nx_extllm.nx` : `xl_distill_corpus`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. The forge's compile-verified ledger is the training set the coding domain names; an external worker can grow it only where the provider's terms permit outputs to train a model [ortos] -- the ledger row decides, and UNKNOWN refuses watching xl_distill_corpus	○	○	○	○	○

Debt register

Id	Sev	What it is	Unblock
extllm-no-source-markingnot in this scope	5	The estate marks media vault items with a public-release flag and documents with a consent bit; runtime source carries no classification at all, so today a prompt built from a .nx file has no level to check.	XL2's release manifest is the marking for source; until it lands no external call may include any .nx content and the classifier does not exist to enforce that -- it is a written rule and nothing more.
extllm-key-exposed-not-vaultednot in this scope	4	The OpenRouter key was pasted into a chat on 2026-08-24, so it is exposed; it is not yet sealed in the vault and rotation is not armed.	Rotate the key at the provider, seal the replacement with the vault (vlt_derive), arm rot_due; XL3 reads only from the vault.
extllm-probe-numbers-internalnot in this scope	3	The 21-call probe of stealth/ox-alpha produced per-model performance numbers that the Stealth AUP forbids publishing [@stealtheula].	They stay on the internal plane at class C; XL8 is the mechanical guard; this page carries capability facts only.

Risk register

Risk	Likelihood x impact	Mitigation
A stub carrying a contract symbol flips a watch cell green with no capability behind it	possible x high	the flip is the receipt, the rung gate is the proof; every XL rung names its neg-control
The EULA and the model page disagree on training and a reader trusts the page	probable x high	XL1 reads the contract mirror, not the model card; the ledger row for ox-alpha carries trains_on_input YES with the EULA pin [@stealtheula]
A provider's terms change under a pinned mirror	probable x medium	the refs gate re-pins RED on the next emit; XL1 refuses a row whose pin no longer matches until the mirror is re-fetched and re-read
Classification creep -- a C file is added to the release manifest to get work done	possible x high	manifest rows are operator-declared data, every call's ledger row carries the manifest pin, and the classifier's positive control is the public compare page, never a source file
The shared free pool starves the worker and a partial run reads as a failed one	probable x medium	XL3 attributes every 429 to its source and the worker loop appends each rung's result as it is decided, so an interrupted run keeps what it finished
Outputs harvested from a provider whose terms forbid training a competing model	possible x high	XL9 reads outputs_train_ours from the ledger and UNKNOWN refuses; Gemini unpaid, NVIDIA trial and Z.ai are worker or judge only by their own contracts [@geminiterms] [@nvidiatrial] [@zaitos]

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The Aug-2026 field, from the mirrored record: a free stealth model on OpenRouter is paid for with the prompts -- the Stealth Program EULA says the models are offered free of charge for purposes of collecting User Content for use in Stealth Model training and improvement and grants the anonymous provider an irrevocable, perpetual licence to that content [@stealtheula], while the same model's page banner says prompts are retained and not used for training [@oxalpha]; the contract binds, the banner does not. The gateway field (LiteLLM) solves routing, key management and spend logging across providers [@litellm]; the egress field (LLM Guard) scans prompts for secrets and PII patterns [@llmguard]; the grading field (openai-evals) grades model output with another model [@openaievals]; the sampling result that makes a free worker worth having is that coverage climbs with samples when a verifier exists [@llmonkeys], and the repository-level bar is SWE-bench [@swebench]. What none of them has is a CLEARANCE: the estate already classifies every document U, C, S or TS with no-read-up and no-write-down, and already serves a public U index with a per-document consent bit, so the whole question of what may leave the estate is answered by construction -- a provider is a sink cleared to U, and the only bytes that may flow are bytes the anonymous public search already returns. The measured position: the sovereign TLS 1.3 transport, a JSON POST over it, the sealed vault with lease rotation, the clearance resolver, the public index, the provenance-pinned evidence register, the byte-exact judge and the forge's prompt and fence machinery are all present; the call organ, the egress classifier at the door, the terms ledger, the 429-aware scheduler, the public-only context pack, the external forge backend, best-of-N, the judge panel and the egress ledger are the named contracts. Subject measured 2026-08-24 on generic material only: stealth/ox-alpha answered tools, streaming and a 155k-token needle correctly, wrote wrong code at low effort and correct code at high, ignored JSON-schema enforcement, and refused about half of first attempts from its shared free pool -- so the worker is real and the scheduler is not optional.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/extllm.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain extllm, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[stealtheula] OpenRouter. Stealth Program End User License Agreement (updated 2026-07-06). The contract governing every stealth model: offered free of charge for purposes of collecting User Content for use in Stealth Model training and improvement; an irrevocable, perpetual, transferable licence to the provider; Exhibit A forbids publicly disseminating confidential technical information regarding the performance of the models and bypassing rate limits. publisher · read in our library knowledge/fetched/cmp_extllm_stealtheula.html · pin hfed941390d8fbcb7b06d92337a4b367997e6de39452edec152dfee899f2f6a31 · accessed 2026-08-24 · vendor-docGrounds: The TERMS ledger row, the PUBLISH guard row, the POOL scheduler row and the classification verdict: the prompt is the payment.
[oxalpha] OpenRouter. Ox Alpha model page (stealth/ox-alpha, released 2026-08-20). Free, 1,048,576-token context, 131,072 max completion, text plus image plus video in; the page banner states prompts and completions are retained by the provider and are not used for training, and defers all other use to the Stealth Model Terms. publisher · read in our library knowledge/fetched/cmp_extllm_oxalpha.html · pin h108b8c85dfed1a9b5726af14f6ca955c1a7f5d56c3d6161f70009d88a42586e2 · accessed 2026-08-24 · vendor-docGrounds: The OpenRouter router column and the subject of the 2026-08-24 probe; the banner-versus-contract conflict recorded in the verdict.
[ortos] OpenRouter. Terms of Service (last updated 2026-07-29). Input rights stay with the user; ownership of Output is set by each model's Model Terms; some models may store or train on Inputs; prompt logging is an opt-in; reselling API access or developing a competing service is forbidden. publisher · read in our library knowledge/fetched/cmp_extllm_ortos.html · pin ha502c47af66c96dc766085b59cf24e21ef8483a5446358ef09983b9b9e499780 · accessed 2026-08-24 · vendor-docGrounds: The TERMS ledger row and the DISTILL row: output rights are per model, never assumed.
[orprivacy] OpenRouter. Privacy Policy (2026-07-06). OpenRouter does not use Inputs or Outputs for model training; image, audio and video are not persisted beyond routing; some Model Providers may use Inputs and Outputs for training or improvement. publisher · read in our library knowledge/fetched/cmp_extllm_orprivacy.html · pin hc942b94888cc44af49f36d437b8f4f62788c278d6e47b4f591b4d175080e36db · accessed 2026-08-24 · vendor-docGrounds: The Market row: the router's own retention posture as distinct from each provider's.
[orlimits] OpenRouter. API reference, rate and daily limits. Free-model requests are capped per minute and per day, the daily cap rising with lifetime credits purchased; a negative balance returns 402 even on free models; capacity is governed globally. publisher · read in our library knowledge/fetched/cmp_extllm_orlimits.html · pin h60a0f809632fe66a8d88bb207b831c0ade77a6c4bb4af6ace9d75163c89b584b · accessed 2026-08-24 · vendor-docGrounds: Rung XL3 the scheduler and the Investment row: the caps the lane schedules to.
[orrouting] OpenRouter. Provider routing documentation. The per-request provider object accepts a data_collection allow or deny switch and a zero-data-retention flag, plus provider order, only and ignore lists; account settings can refuse routing to providers that train, with separate settings for paid and free models. publisher · read in our library knowledge/fetched/cmp_extllm_orrouting.html · pin had7d4b328a141ad2aa64fc92039b489ca5144df9e30f2ae3410db8c2b0057197 · accessed 2026-08-24 · vendor-docGrounds: Rung XL3 and the small-business ladder rung: the router-side switch the call sets on every request.
[orfree] OpenRouter. Free models collection page. Lists the current free-suffixed models with their context lengths and carries provider data notices, including providers that state they may use free-tier inputs and outputs to train their models. publisher · read in our library knowledge/fetched/cmp_extllm_orfree.html · pin h3cd5a178fdc63d69be9d84706e00fc7cb1540726a7720a87262d565803363953 · accessed 2026-08-24 · mirrored-indexGrounds: The Market row: the free collection is provider-by-provider, never one policy.
[geminiterms] Google. Gemini API Additional Terms of Service (modified 2026-04-28). For Unpaid Services Google uses submitted content and generated responses to provide, improve and develop its products and machine-learning technologies; sensitive or confidential information must not be submitted; the Services may not be used to develop models that compete with them. publisher · read in our library knowledge/fetched/cmp_extllm_geminiterms.html · pin haf43b249eb59b519b7d7c8756b7f1e6a3c342d005354029222dff77c3c662858 · accessed 2026-08-24 · vendor-docGrounds: Rung XL9: a provider whose contract forbids training a competing model stays worker or judge only.
[geminipricing] Google. Gemini API pricing page. The free tier rows are marked as used to improve Google products while paid rows are marked as not used; the free tier needs an active project, the first paid tier a linked billing account. publisher · read in our library knowledge/fetched/cmp_extllm_geminipricing.html · pin h61e9a62971ad8b0dc74f8775c0f12d70d0408e94249186153c11655d64f80335 · accessed 2026-08-24 · vendor-docGrounds: The Market row: the trains-on-data flag as the vendor itself publishes it.
[groqsa] Groq. Services Agreement (effective 2026-06-22). Groq does not access, use, store or retain Inputs or Outputs except as necessary to provide the service and is not permitted to use them for training or fine-tuning any models unless explicitly granted permission; the customer retains all intellectual-property rights in Inputs and Outputs. publisher · read in our library knowledge/fetched/cmp_extllm_groqsa.html · pin h9fdcc9ed0cb4e7ae538233d4de66dfc43a247aefa0e24232ac05bf95963e8e2f · accessed 2026-08-24 · vendor-docGrounds: Rung XL9 and the research ladder rung: the first provider whose outputs may lawfully grow the forge ledger.
[groqlimits] Groq. Rate limits documentation. Per-model requests-per-minute, requests-per-day and tokens-per-minute rows for the free plan, published on the console. publisher · read in our library knowledge/fetched/cmp_extllm_groqlimits.html · pin hb7499bf7162bd9282e43fcb600a733b6d41f913831b525913d27c62e96340da8 · accessed 2026-08-24 · vendor-docGrounds: Rung XL3 and the Investment row: published caps the scheduler reads as data.
[cerebrastos] Cerebras. Terms of Service. Service content is not licensed to Cerebras for training or fine-tuning; Cerebras claims no ownership over Outputs; using the service for benchmarking or competitive analysis is prohibited; per the 2026-07-16 change the free tier became a card-gated trial. publisher · read in our library knowledge/fetched/cmp_extllm_cerebrastos.html · pin h3bd7dfc787e80ef53e2b41dd3db852ba83967d6fec7885e8e4e12253fdb69a4d · accessed 2026-08-24 · vendor-docGrounds: Rung XL8 the publish guard and the Investment row: a benchmark-publish restriction as a ledger flag.
[sambanovaeula] SambaNova. Cloud End User License Agreement. Customer Content is excluded from the usage data collected; publishing or disclosing results relating to capabilities, performance or benchmarking without written consent is prohibited; the free tier applies when no payment method is linked. publisher · read in our library knowledge/fetched/cmp_extllm_sambanovaeula.html · pin h9b6e8ccb70362e9194ae5f9b2521c193d0391259a9b2dc1f5c0fac7e0fd8ad92 · accessed 2026-08-24 · vendor-docGrounds: Rung XL8: a second provider whose contract makes the publish guard mandatory.
[mistraltos] Mistral AI. Commercial Terms of Service (effective 2026-08-05). No training on Customer Data or Outputs except where the customer opted in, has not opted out of an opt-in-by-default product, gives feedback, or uses Labs or Preview models; the customer owns all Output. publisher · read in our library knowledge/fetched/cmp_extllm_mistraltos.html · pin hc33421b30fcdf33a691130a9b922868a3e56d24afb4b0893a3547908de9135eb · accessed 2026-08-24 · vendor-docGrounds: The Market row: a conditional trains-on-data flag the ledger must carry per product, not per vendor.
[cfterms] Cloudflare. Service-Specific Terms, Developer Platform (2026-06-02). Unless otherwise agreed Cloudflare does not use Customer Content to train generative AI tools; the customer retains rights in Inputs and Outputs. publisher · read in our library knowledge/fetched/cmp_extllm_cfterms.html · pin h7b60b139f3cfac0fe326e8f14ee7091a32bbd1b494e39741fb8afd95cf31d3e4 · accessed 2026-08-24 · vendor-docGrounds: Rung XL9 and the market-leader ladder rung: a no-training contract with outputs retained.
[cfpricing] Cloudflare. Workers AI pricing. A daily allowance of neurons at no charge, with some models requiring a paid billing method. publisher · read in our library knowledge/fetched/cmp_extllm_cfpricing.html · pin h8275a38368b69821aa56ca21e5489d1fc319cab1696180b61c270fa39d447c6d · accessed 2026-08-24 · vendor-docGrounds: The Investment row: the free allowance as published.
[nvidiatrial] NVIDIA. API Trial Terms of Service (version 2025-09-19, PDF). Access is for limited trial purposes and not production; NVIDIA collects User Content and Generated Content to improve its products and services including AI models; the API service including Generated Content may not be used to develop or improve competing products. publisher · read in our library knowledge/fetched/cmp_extllm_nvidiatrial.pdf · pin hafd5df0322615ff95736f2f8b59fa952f5f4582dfe05f97213c0ae860f628b30 · accessed 2026-08-24 · vendor-docGrounds: Rung XL9: trial-only and competing-use clauses keep this provider worker or judge only.
[zaitos] Z.ai. Terms of Use (2026-04-14). End User Content is not used for developing or improving the Services without explicit agreement; utilising platform models or exported data to develop, train or enhance competing algorithms or models is prohibited; the Flash models are free. publisher · read in our library knowledge/fetched/cmp_extllm_zaitos.html · pin he14e9cae5a6fb0177687bed9d4a453341ba89c3d8219f43b10851f6ebe88ce21 · accessed 2026-08-24 · vendor-docGrounds: Rung XL9 and the Investment row: free and not trained on, but outputs may not train a competing model.
[deepseektos] DeepSeek. Open Platform Terms of Service (2026-04-29). Inputs and Outputs may be applied to derivative product development and to training other models such as model distillation; rights in Outputs are assigned to the user; the service is prepaid. publisher · read in our library knowledge/fetched/cmp_extllm_deepseektos.html · pin h2b433c53cbac75491959025eba5a27908f9f1886352dce0a05f3d5a936d87790 · accessed 2026-08-24 · vendor-docGrounds: Rung XL9 and the Buy-vs-build row: the one contract that permits distillation by name.
[alibabaquota] Alibaba Cloud. Model Studio new-user free quota. Each model carries an independent free quota, typically one million tokens, valid for ninety days. publisher · read in our library knowledge/fetched/cmp_extllm_alibabaquota.html · pin hb5842e49cf1d0e10422ffa2bbcf87025e6990b18c6c8f2a76aeffd0cc3a6eaa6 · accessed 2026-08-24 · vendor-docGrounds: The Market row: a per-model quota rather than a rate cap.
[alibabaprivacy] Alibaba Cloud. Model Studio privacy notice. States that customer data is never used for model training. publisher · read in our library knowledge/fetched/cmp_extllm_alibabaprivacy.html · pin h70b9453fa2d16ad627fd6d72313c23b5ecaeb2fcef69ce7c2cef7f4303ae446d · accessed 2026-08-24 · vendor-docGrounds: The Market row: the trains-on-input flag for this provider; its output-rights row stays UNKNOWN until the service agreement is mirrored.
[ghmodels] GitHub. GitHub Models documentation. States that as of 2026-07-30 GitHub Models has been fully retired. publisher · read in our library knowledge/fetched/cmp_extllm_ghmodels.html · pin h6decf8c242b2657407e64a04c31220801ac19f6222186ce77d16e58779ff6fcd · accessed 2026-08-24 · vendor-docGrounds: The Market row: a free tier that no longer exists, recorded so nobody re-discovers it.
[anthropic_comm_terms] Anthropic. Commercial Terms of Service effective 2025-06-17. Section B states that Customer retains all rights to its Inputs and owns its Outputs, that Anthropic assigns to Customer its right title and interest in Outputs, and that Anthropic may not train models on Customer Content from Services. Section D.4 forbids using the Services to build a competing product or to train competing AI models. publisher · read in our library knowledge/fetched/cmp_extllm_anthropic_comm_terms.html · pin hb19a3c3a15f3aa5896ba7e2e6eca0c88f7d92c16613dd78ec2b2f659372eec97 · accessed 2026-08-25 · vendor-docGrounds: The TERMS ledger row for the Claude escalation sink and the reason DISTILL is refused on every Anthropic tier.
[anthropic_cons_terms] Anthropic. Consumer Terms of Service effective 2025-10-08. The use-of-Materials clause states that Anthropic may use Materials to improve the Services and to develop other products including training our models unless the user opts out through account settings, and that even after opting out Materials are used for training when the user provides Feedback or when content is flagged for safety review. publisher · read in our library knowledge/fetched/cmp_extllm_anthropic_cons_terms.html · pin h584de77005454c3cbd6dbddf85be507dd32dbfd1c032133dd65b16bc426534de · accessed 2026-08-25 · vendor-docGrounds: The TERMS ledger row proving the consumer default is the OPPOSITE of the commercial default, so the ledger must key on account tier and never on vendor name.
[anthropic_cc_datausage] Anthropic. Claude Code documentation Data usage page. States that new models are trained using data from Free Pro and Max accounts when the model improvement setting is on including when Claude Code is used from those accounts, that commercial users are not trained on unless they opt in through a programme such as the Development Partner Program, and gives retention as five years consumer opted-in, thirty days consumer opted-out and thirty days commercial standard. publisher · read in our library knowledge/fetched/cmp_extllm_anthropic_cc_datausage.html · pin h09ef84d3ee4e3e32516b85efc770d322fba094707a5c57f2a6b50ad1abf350f3 · accessed 2026-08-25 · vendor-docGrounds: The TERMS ledger row for the Claude tier as actually operated: Claude Code has no data posture of its own and inherits the signed-in account tier.
[anthropic_zdr] Anthropic Privacy Center. Zero data retention article dated 2026-06-09. States that zero data retention is granted per organization subject to Anthropic approval, applies to eligible APIs and to Claude Code accessed via a commercial organization API key, that User Safety classifier results are retained regardless, and that it is not included in the standard Enterprise plan. publisher · read in our library knowledge/fetched/cmp_extllm_anthropic_zdr.html · pin h4d6e3b7ccfb410005afdf8e8f2a515f31c4a1aadac77a2921b2bddc8fbe32feb · accessed 2026-08-25 · vendor-docGrounds: The TERMS ledger retention column: the only published posture that reduces retention below the commercial default, and it cannot be assumed from a plan name.
[litellm] BerriAI. LiteLLM documentation. The open-source gateway that routes one OpenAI-shaped call across many providers with key management, retries, fallbacks and spend logging per key. publisher · read in our library knowledge/fetched/cmp_extllm_litellm.html · pin h7907d422518d59baa217e3a41966ae74e67b0fad493e7ee82e3239ef2ec9e987 · accessed 2026-08-24 · vendor-docGrounds: The LiteLLM gateway column: routing, keys and spend as the field's shape.
[llmguard] Protect AI. LLM Guard repository. An open-source input and output scanner for LLM prompts: secrets, PII and injection patterns, redaction and refusal. publisher · read in our library knowledge/fetched/cmp_extllm_llmguard.html · pin h91f889d011d0a925a9d7ecddbddc81ed877648ecdfe6ccc2d0b43a40022fb8f0 · accessed 2026-08-24 · source-readGrounds: The LLM Guard egress DLP column: a pattern list where the estate has a clearance level.
[openaievals] OpenAI. Evals repository. The evaluation framework and registry, including model-graded evals in which a model grades another model's output. publisher · read in our library knowledge/fetched/cmp_extllm_openaievals.html · pin hca1f4b2e7e7d80f566b098eb751c9362bc708fc2757146efbf98d7cb22634ae1 · accessed 2026-08-24 · source-readGrounds: The openai-evals column and rung XL6: model-graded evaluation as the field's judge.
[llmonkeys] Brown, Juravsky, Ehrlich, Clark, Le, Re and Mirhoseini. Large Language Monkeys: Scaling Inference Compute with Repeated Sampling (arXiv 2407.21787, 2024). Coverage climbs with the number of samples when a verifier can pick the correct one. publisher · read in our library knowledge/fetched/cmp_extllm_llmonkeys.html · pin h922be22acaa0999ba5690c50a680d29228db6c0e73aa6c89ffb769acb7cab68c · accessed 2026-08-24 · published-paperGrounds: Rung XL5 best-of-N and the innovation ladder rung: the result that makes a free sampler worth scheduling.
[swebench] SWE-bench. The public leaderboard and task set for repository-level issue resolution. publisher · read in our library knowledge/fetched/cmp_extllm_swebench.html · pin hf70fc6c0c500d07af0e7e3d7d7f3a51c40689a7f1704eebf4702b8cacc114411 · accessed 2026-08-24 · mirrored-indexGrounds: The BENCH row and the research ladder rung: the repository-level bar the estate's own grader scores against.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/extllm.matrix · every Nishi cell verified against organ source at emit time · watch cells re-measured on every compare beat · zero JS, zero trackers