Block a user
cortex: EntitlementProvider trait + local/static provider
Draft trait sketch (starting point)
Lives in cortex-gateway (cortex is the only authenticator; neuron just trusts the stamped principal header). Principal could move to cortex-core later…
helexa-upstream: accounts, allocations, key distribution, real-time authorization, operator compensation
cortex: operator served-usage ledger + scheduled reconciliation + no-limit infra key
cortex: EntitlementProvider — helexa-upstream client (authorize/reserve/settle, fail-closed)
cortex: client-aware guidance — prompt pre-validation, User-Agent hints, advertised limits
cortex: load-aware routing across replicas + backpressure propagation
neuron: per-principal in-flight cap (fair-share)
neuron: admission control — bounded queue + backpressure, expose load in /health
cortex: budget enforcement — hard per-key caps, reserve→settle, 429/402 + Retry-After
cortex: per-request token metering + per-key/account spend ledger
cortex: EntitlementProvider trait + local/static provider
cortex: API-key authentication + principal resolution