Relay architecture

Three distinct layers

AnchorShell separates public-site, control-plane, and model-traffic responsibilities.

AnchorShell Platform

Platform owns signup, authentication, organizations, users, product permissions, API-key validation, and the browser application. It resolves organization and user identity, then signs short-lived context for hosted Relay.

AnchorShell Relay — Managed

Hosted Relay verifies that signed context before routing. It adds PostgreSQL-backed organization scoping, user attribution, permissions, and per-user request, token, and spend policies around the public engine.

AnchorShell Relay — Self-Hosted

The self-hosted service owns the model-traffic path: provider and endpoint configuration, the in-memory scheduler, limit resolution, queueing, pacing, ranked lanes, fallback handling, proxying, token and cost accounting, telemetry, and the embedded administration UI.

Request sequence

Receive request
      ↓
Validate trusted caller context (hosted Relay)
      ↓
Estimate tokens and configured cost
      ↓
Select candidate paths
      ↓
Evaluate resource and user policies
      ↓
Queue / wait / dispatch
      ↓
Proxy to the selected endpoint
      ↓
Record status, usage, cost, and route outcome

What Relay is not

Relay does not replace the application, agent framework, or model provider. It does not implement semantic loop detection, content moderation, automatic least-cost routing, or a durable distributed queue. Manual lane ordering is currently authoritative.