Documentation
TDE Pass
Capability lanes, caching, rate limits, resilience and troubleshooting.
On this page
Open-model access for agent routines
TDE Pass gives supported agent CLIs one endpoint and one license-backed access path to a curated open-model catalogue. Public plans remain flat subscriptions with fair-use controls; Pass does not turn a subscription into per-token billing.
The gateway keeps three controls separate:
| Control | Window | Meaning |
|---|---|---|
| RPM | One minute | Request burst protection. |
| TPM | One minute, model-aware | Token-throughput protection for large contexts and parallel agents. |
| Fair use | Monthly | Subscription usage and margin protection. |
RPM or TPM exhaustion returns 429 Too Many Requests with Retry-After, so a
well-behaved agent can slow down and continue. The monthly abuse backstop uses
402; TPM is not a new bill or SKU.
These limits are gateway admission controls, not a throughput SLA. Effective capacity is the lowest limit across the Pass plan, the selected model/provider, the request's token size and current upstream availability. For that reason, public plan selection is described by the agent routine each tier is designed to serve rather than by a universal requests-per-minute promise.
Capability lanes
Every routed model stays in a declared lane:
- Native Exact — official model and official protocol; unavailable while its commercial gate is blocked.
- Protocol Bridge — the same open model through an explicitly translated protocol.
- Enhanced — TDE adds a declared capability such as recovery, vision routing or automatic model selection on top of Bridge.
Pass does not silently promote a Bridge request to Native, claim a proprietary model under an open-model SKU or drop unsupported capabilities without saying so. See the model catalogue in the product UI for the lane attached to each route.
Response cache
Eligible non-streaming requests use an exact response cache with a bounded TTL. The response reports its decision:
x-tde-cache: HIT
x-tde-cache: MISS
x-tde-cache: BYPASSDisable storage and reuse for a request with either header:
x-tde-cache: no-store
Cache-Control: no-storeStreaming requests bypass the response cache. Upstream prompt-cache usage is a separate meter and remains visible in the usage ledger.
Resilience and routing
The gateway combines session/prefix affinity, model-aware limits, circuit breakers and bounded fallback. Affinity keeps related turns on a route where provider-side prompt caches are most useful. A failure before the first streamed byte can move through the declared fallback chain; once bytes have been exposed, Pass will not splice an unrelated response into the stream.
Per-turn cost ceilings and admission controls reject an unsafe request before it can consume an unbounded amount. Operational policy and protocol conformance checks fail closed when the gateway cannot prove that a request stays within its lane.
Verify and troubleshoot
The license verification response includes the plan's rpm and tpm values.
Use TDE Doctor when an agent cannot reach Pass:
tde doctor
tde license statusLocal Doctor reports the desktop and agent environment. Pass also runs a server-side conformance diagnostic that fails closed: an unhealthy route is not reported as usable with a warning hidden inside it. Check the returned HTTP status, selected lane and retry information before changing agent configuration.
Privacy
Pass meters model, token, timing, cache and fallback metadata. Prompts and model answers are not copied into the usage telemetry by default. TDE surfaces one Cloud-backed ledger rather than inventing a second billing record in the desktop.