Ship a policy in five minutes.

Three steps to your first routed call.

No app rewrite, no server config. Install the SDK, repoint the client, build a policy in your backend, and attach it to a single create() call. The host admits the term, resolves it over the live catalog, and traces the decision.

$ npm i openai

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.unhardcoded.com/v1",
  apiKey: process.env.UNHARDCODED_KEY,
});

// built in your backend, at request time — a plain JSON term
const policy_ir = [
  "policy",
  ["and", ["meets_req"], ["not", ["is", "disabled"]], ["is", "cap_tools"],
         ["cmp", "bench_intelligence", "ge", 0.9]],  // filter
  ["neg", ["normalize", ["field", "price_out"]]],          // cheapest survivor
  ["argmax"], ["id"],
  ["always", { action: "next_candidate" }],
];

const res = await client.chat.completions.create({
  model: "policy:support",  // free-form trace label, not a route
  policy_ir,
  messages,
});

{
  "selected": "gemini-3.5-flash",
  "reason":   "cheapest passing candidate",
  "policy":   "ir_8f41",
  "cost":     "$0.018",
  "trace":    "req_8f41"
}

One OpenAI-compatible surface.

An OpenAI-compatible completions endpoint, dry-run helpers, a field-schema lookup, and one header. Carry a policy_ir or flow_ir in the request body; inference runs over the provider keys you configured on the host.

POST /v1/chat/completions

OpenAI-compatible completions. Carry policy_ir or flow_ir in the body; everything else is the standard request shape. The router resolves the model over the live catalog and writes the decision to the trace.

POST /x/rank

dry-runReturns the candidate ranking and per-model verdicts without running inference. Use it to preview which models clear the floor and why before a single token is spent.

POST /x/policy/normalize

dry-runAdmits a policy_ir and returns its canonical form, content fingerprint, and grammar version — identify and cache a term without running it.

POST /x/flow/normalize

dry-runAdmits and identifies a flow_ir — the bounded DAG and each node's policy — before use, so a malformed workflow fails fast instead of mid-run.

GET /x/fields

Returns the live field vocabulary — the core fields plus this host's registered extensions — that policies gate on with cmp/is and score on with field. The source of truth for valid field names (e.g. price_out, context, bench_intelligence).

Authorization: Bearer <key>

Authenticate every request with your unhardcoded key. The key identifies your workspace and its trace history — never a provider account.

Note: BYO provider keys are configured on the host. unhardcoded routes through your own OpenAI, Anthropic, Gemini, and other accounts — it does not resell tokens or mark up inference, and it never bills the model spend.

The raw policy_ir term.

The real interface is the term itself: a plain JSON array you inspect, hash, log, and replay. A policy is a six-element array — ["policy", filter, rank, select, mutate, fallback]. You author the filter, rank, and select; keep mutate (["id"]) and fallback (["always", {"action":"next_candidate"}]) as-is. Hover a verb to see where it lives in the term.

[ "policy",
  // filter — the gate; narrows the host floor, never widens it
  ["and", ["meets_req"], ["not",["is","disabled"]],
        ["is","cap_tools"],
        ["cmp","bench_intelligence","ge",0.5],
        ["cmp","price_out","le",5]],
  // rank — score the survivors, cheapest wins
  ["neg",["normalize",["field","price_out"]]],
  // select — take the single top of the ranked list
  ["argmax"],
  // mutate — pass the request through unchanged
  ["id"],
  // fallback — on any failure, next candidate
  ["always",{"action":"next_candidate"}] ]

The full sigma-pol/v2 operator vocabulary, grouped by position. These are the only ops — there is no filter/rank/select/fallback wrapper.

filter — predicates

and / or / not — boolean combinators · is <flag> — a model capability flag (e.g. cap_tools) · cmp <field> <op> <value> — a numeric bound (ge, le, …) · meets_req — the request's own implied requirements. Returns the surviving candidates.

rank — scorers

field <name> — a raw catalog field · normalize — scale a sub-score to 0–1 · neg — invert (cheapest, lowest-latency) · scale <w> — weight a sub-score · add — sum weighted sub-scores. Produces one score per survivor.

select — selectors

argmax — the single highest-scoring model · top_k <n> <sel> — keep the top n as an ordered cascade · sample <t> — a reproducible stochastic pick.

mutate — request mutators

id — pass the request through unchanged (the default). Request-mutators such as clamp_param also exist for shaping parameters on the chosen call.

fallback

always {"action":"next_candidate"} — on a provider failure, advance to the next survivor in the cascade.

Filter first. Rank survivors. No silent downgrade.

Routing is deterministic and ordered. Spend ceilings and quality minimums live in the filter, not the score — a cheap model can never win on points against your rules. If it does not clear the floor, it is not a candidate at all.

Change the rule. Watch the winner move.

Toggle the rules below. The router filters the live catalog, then ranks the survivors cheapest-first — the cheapest model that clears every rule wins. Tighten the floor past what any model can meet and the call fails loudly rather than downgrading.

Illustrative catalog and figures. Against the live catalog, POST /x/rank returns the same per-model verdicts without running inference. See the worked example →

The trace object.

Every completion carries a trace: a structured record of how the model was chosen. The trace is what makes every routing decision replayable and auditable — the same term, the same catalog snapshot, the same verdicts.

trace

The replayable identifier/fingerprint for the run — e.g. "req_8f41c2".

policy.fingerprint

Content hash of the normalized policy_ir. Identical terms share a fingerprint.

policy.version

The grammar version — "sigma-pol/v2".

selected

The chosen model id.

candidates[]

One entry per considered model: { model, status: "winner" | "passed" | "rejected", dropped_by: "<rule that eliminated it>" | null }. A rejected model carries the exact rule that dropped it; a passing model carries null.

reason

Human-readable why-this-model.

fallback[]

Ordered hops taken on failure: { from, to, cause }. An empty array if the first pick succeeded.

latency_ms

Total routing + inference latency.

cost

USD billed for the run.

usage

{ prompt_tokens, completion_tokens } — informational only; billing is per run, not per token.

created

ISO timestamp.

{
  "selected": "gemini-3.5-flash",
  "candidates": [
    { "model": "gemini-3.5-flash",      "passed": true,  "status": "winner", "price_out": 0.30, "dropped_by": null,
      "note": "meets floor · cheapest survivor" },
    { "model": "mistral-small-4",       "passed": true,  "status": "passed", "price_out": 0.35, "dropped_by": null,
      "note": "meets floor" },
    { "model": "claude-sonnet-4-6",     "passed": true,  "status": "passed", "price_out": 3.00, "dropped_by": null,
      "note": "meets floor · not cheapest" },
    { "model": "gemini-3.1-flash-lite", "passed": false, "status": "rejected", "dropped_by": "is cap_tools",
      "note": "no tool support" },
    { "model": "tiny-draft-1",          "passed": false, "status": "rejected", "dropped_by": "cmp bench_intelligence ge 0.5",
      "note": "below quality floor" }
  ]
}

Filter first, then rank survivors. Each rejected model names the exact rule that eliminated it in dropped_by — no silent substitution, no hidden downgrade.

Compose policies into a flow.

Not every task is one call. A flow is a bounded, acyclic graph of LLM steps — ["flow", { id: node, … }] — with exactly one input node and one output node. Each llm node carries its own system prompt and a full policy_ir term, so every step routes independently at request time over the live catalog. You send the whole graph as flow_ir on a single call, and it writes one stitched, replayable trace.

Edges are pull-model: a node's inputs list names the nodes it consumes, so "b": { inputs: ["a"] } means a → b — a node with two or more inputs is a fusion step, and there are no loops or conditionals. Switch the examples below; each box is an llm node with its own policy and model, and the dashed ends are the input / output nodes.

That graph is just data. Below is a flow written out as flow_ir — the same input / llm / output nodes, the same inputs edges, each llm node carrying its own policy:

[
  "flow",
  {
    "u":        { "kind": "input" },

    "draft":    { "kind": "llm",
      "system": "Draft an answer.",
      "policy": [ "policy", … ],                // a full policy_ir term — cheapest survivor
      "inputs": [ "u" ] },

    "critique": { "kind": "llm",
      "system": "List the concrete flaws in the draft.",
      "policy": [ "policy", … ],                // strongest model, no cost ceiling
      "inputs": [ "draft" ] },

    "revise":   { "kind": "llm",
      "system": "Rewrite the answer, fixing every point.",
      "policy": [ "policy", … ],                // strongest model
      "inputs": [ "u", "draft", "critique" ],    // fan-in: three predecessors
      "template": "Q:\n$1\n\nDraft:\n$2\n\nCritique:\n$3" },

    "out":      { "kind": "output", "inputs": [ "revise" ] }
  }
]

Each policy is a full policy_ir term — the same six-element array from The SDK above, elided here as …. Copyable end-to-end flows are in Presets below.

A flow has three node kinds. Author the llm nodes; input and output are the single entry and exit.

input

The single entry node — { "kind": "input" }. The call's messages enter the graph here. Exactly one per flow.

llm

A routed step. system — its prompt · policy — a full policy_ir term, resolved over the live catalog at runtime · inputs — the node ids it consumes · template (optional) — joins multiple inputs with $1, $2, … placeholders in input order. Each node routes — and fails over — on its own.

output

The single exit node — { "kind": "output", "inputs": ["…"] }. Its inputs name the node whose result is returned to the caller. Exactly one per flow.

edges & shape

Pull-model: inputs defines the DAG ("b": { inputs: ["a"] } is a → b). Fan-out is one node feeding several; fan-in is several feeding one fusion node. Acyclic, bounded, no loops or conditionals — every node runs once, so cost and latency are knowable up front.

Send a flow as flow_ir on any completion; dry-run with POST /x/flow/normalize to admit the DAG and each node's policy before a single token is spent. Limits: ≤ 256 nodes, in-degree ≤ 32. Billing counts a flow as one run up to 5 nodes, and the whole graph writes one stitched trace — see the trace object. For the picture, the workflow diagrams on the product page show three flow shapes end to end.

Copy a term, send it.

Ready-to-send policies and workflows. Each is a piece of data — drop a policy into policy_ir or a flow into flow_ir on any OpenAI-compatible call, and the host admits it, hashes it, and interprets it deterministically over the live catalog. Dry-run first with POST /x/rank for policies or POST /x/flow/normalize for flows.

Explore the interactive policy playground →

Common failures.

What each one means and what to change. Dry-run with POST /x/rank to see the decision before it costs anything.

No model passes the floor

Your filter excluded every candidate, so the request fails loudly instead of silently downgrading. Loosen a cmp bound or a hard ["is", …], and run /x/rank to see which rule dropped each model.

Unknown field or operator

Admission rejects a term that names a field the host doesn't serve or an op the interpreter doesn't know (invalid_policy). Use a real field from GET /x/fields — e.g. price_out, not price.

Provider key missing

The chosen model's provider isn't configured on your workspace, so the upstream call can't authenticate. Add the provider key during onboarding — inference always runs over your own accounts.

Provider timeout or error

The selected model errored or timed out; the router fails over to the next passing candidate and writes the hop to the trace. If every candidate fails, the request errors — widen the cascade with ["top_k", N, ["argmax"]].

Flow exceeds the limits

A flow is admitted only within bounds (≤ 256 nodes, in-degree ≤ 32); past that it's rejected before running — split the workflow. (Billing counts a flow as one billable run up to 5 nodes; the structural cap is separate.)

Dry run passes, live call fails

/x/rank and /x/*/normalize admit and evaluate the term but run no inference — a live failure is a provider/runtime issue (rate limit, timeout, auth), not a policy error. Read the trace's decision path for the failing hop.