AI control center
One owner-controlled place for provider connections, app access, usage, spend and diagnostics. P1 preserves every existing production route.
30-day AI spend
Existing request ledger + current model pricing metadata.
Connections
Only services actually configured are shown.
Providers & connections
Connected services only. Search the catalog when you need another provider; unconfigured services do not occupy the dashboard.
Registered · disabled
Guarded provider shells created by P4.2. They are not selectable routes.
Core credentials
Owner re-entry only. Credentials are written through the existing core provider secret writer while providers remain disabled.
Applications
Owner-controlled application permissions, quotas, tokens and P5 policy visibility.
AI dispatcher
Live capability policies, health-aware auto routing, app admission state and decision audit trail from the central ai.youpilot.me dispatcher.
Capability policies
Configured preference order. Capabilities without a policy use model priority plus runtime health.
Application admission
Current-month request/token guardrails from ai_apps. USD budget policies remain separate.
App / feature scoped policies
Prepared routes for one application and optional feature. P5.2 evaluates matching AUTO requests in shadow; activation is still locked.
Scoped canaries
Qualified Text/Coding policies may send at most 5% of matching AUTO requests to one exact target. Provider/model global enablement stays unchanged.
| App / feature | Capability | Traffic | Target | Posture | Runtime | Activated |
|---|
Canary safety & ramp
P5.5 circuit breaker watches only selected canary executions. One selected failure or same-request fallback blocks future canary selection back to P3. Ramps are explicit 1% → 2% → 5% only.
| App / feature | Capability | Traffic | Selected | Clean success | Fallback | Failure | Safety | Ramp |
|---|
Recent canary decisions
Request-level bucket decisions and the route that ultimately executed. P3.8 safe retry remains available for Text/Coding.
| Time | App / feature | Capability | Bucket | Target | Executed | Outcome |
|---|
Scoped qualification gates
Read-only gates over P5.2 shadow evidence. Passing means eligible for a later guarded canary, not production activation.
| App / feature | Capability | Samples | Coverage | Dominant target | Stability | Exceptions | Gates | State |
|---|
Scoped shadow decisions
What a matching app / feature policy would select versus the route actually executed by P3.
| Time | App / feature | Capability | Shadow target | Executed | Outcome | Delta |
|---|
Recent dispatcher decisions
Why a provider/model was selected. No prompts, credentials or raw user identity are exposed.
| Time | App | Capability | Feature / operation | Selected route | Reason | Quota | Fallback | Outcome |
|---|
Eligible model pool
Enabled models/providers ordered by the existing priority field. Dispatcher policy and health may choose among these routes.
| Capability | Provider | Model | Priority | Model | Provider |
|---|
Usage & spend
Operational accounting with optional user, feature and channel attribution. Existing calls remain valid when attribution headers are absent.
Attribution filters
Filter the same ledger by app, opaque user/owner reference, feature, channel, provider, model or capability.
Daily accounted spend
Provider-reported + estimated cost. Unpriced requests are not silently treated as $0.
Spend by app
| Application | Requests | Provider reported | Estimated | Unpriced | Accounted |
|---|
Spend by provider
Coverage shows how many cost-relevant calls have a known or estimated price.
Models
| Model | Requests | Accounted | Coverage | Unpriced |
|---|
Capabilities
| Capability | Requests | Accounted | Coverage | Unpriced |
|---|
Users / owners
Opaque references only; YouPilot AI does not infer names or emails.
| User / owner ref | Requests | Accounted | Coverage |
|---|
Features
| Feature | Requests | Accounted | Coverage |
|---|
Channels
Channel attribution appears when callers begin sending X-YouPilot-Channel-Ref.
| Channel ref | Requests | Accounted | Coverage |
|---|
Used-model pricing coverage
Only models actually used in the selected period. Price age is based on the last verified source date.
| Provider | Model | Requests | Price basis | Checked | Status |
|---|
Budgets & limits
Owner-defined daily and monthly spend guardrails using the same accounting engine as Usage. P2.2 is observe-only: it warns, but does not block production requests.
Budget policies
Global, app, provider or capability thresholds.
| Scope | Today | Daily limit | Month | Monthly limit | Warn at | Status |
|---|
Add / update guardrail
Saving the same scope updates its threshold.
Requests
Request-level accounting plus optional user, feature, channel and operation attribution. Prompt bodies, credentials and raw user identities are not exposed.
Request filters
Unattributed is a real filter value, so missing caller context stays visible.
| Time | App | User / owner | Feature | Channel | Operation | Capability | Provider | Model | Routing | Usage | Cost | Accounting | Latency | Status |
|---|
Health
AI service, database and staged connection checks without SSH.
System
Safety boundaries for the first production Control Center release.
Attribution capture
OPTIONALApp calls may send X-YouPilot-User-Ref, X-YouPilot-Feature, X-YouPilot-Channel-Ref and X-YouPilot-Operation. Existing calls remain valid without them.
USD budget policies
OBSERVE ONLYP2.2 USD spend thresholds remain monitoring-only. App monthly request/token limits are separate hard guardrails and are visible in Dispatcher admission.
Central dispatcher
ACTIVEAutomatic selection can use capability policies, runtime health avoidance and app admission context. Explicit model requests remain unchanged and safe same-request fallback is enabled only for AUTO Text + Coding on provider rejection; media and Story remain excluded.
Provider lifecycle
P4 FROZEN · P5.5 SAFETYP4 provider/model enablement remains locked. P5.5 adds a fail-safe circuit breaker and evidence-gated 1% → 2% → 5% ramp over the existing P5.4 Text/Coding canary.
New connections
TEST ONLYExternal credentials are stored in a separate encrypted table and cannot become production routes.
Secrets
ENCRYPTEDNew credentials use an isolated AES-256-GCM envelope derived from the existing AI master key.
Canonical UI
ROOTThe Control Center lives directly on ai.youpilot.me with refresh-safe deep URLs. /admin remains only as a compatibility redirect.