Skip to main content

YABANIN gateway introduction

This documentation covers the gateway product. For the wider YABANIN platform, Raider agent workflows, and enterprise implementation, start with the platform overview or enterprise deployment.

Yabanin — Your Agnostic Bridge Across Numerous Inference Networks (the Y·A·B·A·N·I·N backronym; package github.com/reireirei/yabanin, CLI codename yabanin) is an OpenAI-compatible AI gateway that does three things in one control plane:

  1. Evaluate costs — a local spend audit separates usage-based estimates and cache/routing simulations. Savings depend on workload and acceptable output quality.
  2. Control request handling — provider routing, retries and fallback can improve resilience within the configured deployment and failure limits.
  3. Inspect request evidence — optional signed lineage records model, region evidence and log jurisdiction. A signature verifies the recorded claim, not independently the physical processing location.

Yabanin includes a self-hosted gateway and supporting services. Assess the entire request path, including external providers, storage and local model endpoints, for your deployment requirements. Self-hosting the gateway alone does not keep external inference local.

Architecture​

The solution architecture explains component ownership, request processing, evidence storage, MCP paths and deployment with Mermaid diagrams.

Client ──► Gateway (:8082) ──► Upstream provider (OpenAI / Anthropic / sovereign / open-weights)
           │        ├─ Postgres 16 (sessions, rules, models, lineage ledger, audit logs)
           │        ├─ Redis 7   (semantic cache, event stream, rate limiting)
           │        └─ Embedder  (sentence-transformers / bge for semantic caching)
           │
           ├─ Loggerd (:8085) ←── Redis stream consumer → Postgres persistence
           ├─ Admin (:8086)     — Control plane API, dashboard, policy management
           └─ MCP (:8787/SSE)   — Partner bridge (stdio + HTTP-SSE)

One binary, four components. The unified yabanin binary runs every component in-process (yabanin [gateway|admin|loggerd|mcp]; with no compose stack, yabanin dev starts the whole stack in a single process). Legacy per-component binaries (yabanin-gateway, yabanin-loggerd, yabanin-admin, yabanin-migrate) are still built for the Docker images but are not the main path. The gateway reads rules from Postgres and publishes events to Redis; loggerd is a Redis stream consumer that writes request logs; admin is the control plane for policy, residency, lineage verification, and compliance reporting; mcp bridges partner and agent integrations over the Model Context Protocol.

What is already built​

The repository includes the following implementation areas. “Implementation exists” is not an enterprise readiness certification; deployment and failure scenarios require environment-specific verification.

LayerStatus
OpenAI-compatible proxy + SSE streamingImplementation exists
Multi-provider + fallback + circuit breaker + retryImplementation exists
Semantic cache (pgvector + Redis)Implementation exists
Task classifier (rule V0 + ML V1)Implementation exists
Cost / FinOps dashboard (React + Vite)Implementation exists (cost/credits/cache/classifier pages)
Prepaid-credits billing, team budgets, spend alertsImplementation exists
Org caps & beta credits (fail-closed RPM/TPM per org, 402 on exhausted credits, starter grant, org-scoped credits view)Implementation exists — see Organization setup
Jurisdictional lineage attestation (Ed25519)Implementation exists
Multi-region active-active (RLS + failover)Implementation exists
Air-gap / on-prem single-tenant + license/PKIImplementation exists
Sovereign-model registry + Asia policy-packs (SG/IN/ID/JP)Implementation exists (OpenAI-compat adapters, not partnerships)
SOC 2 / ISO 27001📝 Control-draft worksheets, not certified — do not present as certification
Audit hash-chainImplementation exists — the admin write path writes tamper-evident rows (ENT-03: row_hash = sha256(prev_hash | serialized row), chain contiguous under concurrency, verified end-to-end by the DR drill and integration tests)
JIT access📝 pkg/jitaccess package and tests exist; admin wiring is coming soon — do not present as shipped
KMS (AWS)📝 Fail-closed stub — only local / file providers are wired and tested; AWS KMS is coming soon
MCP serverImplementation exists
Policy pipeline (YPP) — declarative YAML policies over gateway traffic: 20 built-in detector/mutator steps, external HTTP callouts (SSRF-guarded), LLM judges, conditional branching, shadow→enforce rollout, git-as-code reconciliation, decision logImplementation exists — see Policy Pipeline
Prompt studio (backend) — versioned org prompts, label bindings, partials, render-on-requestImplementation exists (API; the console UI is in progress)
Enterprise identity — SCIM 2.0 provisioning (/scim/v2), SAML 2.0 admin SSO, JWT→gateway-key auth (JWKS)Implementation exists — see SSO (OIDC), SSO (SAML)
Observability export — request logs via OTLP/HTTP with GenAI semantic-convention attributes; S3/GCS log export; spend-reconcile invoice captureImplementation exists
Agent lifecycle (agent keys yag_, delegation with TTL & grant ceilings, role profiles, per-agent/task budgets, MCP tool grants, task-tag cost analytics, evals-as-PR-gate)Implementation exists — see Agent Governance and Agentic Development
BYOK — org provider keys (per-org upstream credentials, enc: encrypted at rest, masked in API/UI, org-isolated RLS)Implementation exists — see BYOK
Member invitations & welcome onboarding (invite tokens, 3-step first-login flow: provider key → gateway key → client config)Implementation exists — see Organization setup
Owner feedback & beta telemetry (feedback page, beta metrics views, Grafana dashboards, status page, Telegram alerts)Implementation exists — see Ops and the public stand runbook
SDKs (Go / Node / Python)📝 Beta — thin wrappers, Python/Node match the documented API
Vertical packs (finance, health, legal, …)📝 Typed residency-rule presets + lineage hooks, not certified Halal/HIPAA/ITAR modules

Run the quality gates in the repository AGENTS.md against your checkout. Historical test results do not certify a new deployment.

Where to go next​