arbstr node 1.0

arbstr is the cheapest route to any model, metered in sats. It has three parts:

  • arbstr, the routing engine: an OpenAI-compatible proxy that picks the cheapest qualified provider for each request.
  • arbstr-vault, the treasury: agent accounts, spending policy, per-request billing, and Lightning and Cashu payment rails.
  • arbstr-node, the full stack (core, vault, LND, and a Cashu mint) as one docker compose up.

On October 24 I released arbstr 2.1.0, arbstr-vault 1.2.0, and arbstr-node 1.0.0, the first node release that runs released images instead of whatever was on a branch.

How a Request Gets Paid For

Every request is billed to an agent account in vault. Core asks vault to reserve the estimated cost, after checking the agent's per-request and daily limits. It routes to the cheapest qualified provider, streams the response back, and then vault settles the actual cost and refunds the rest. If the provider fails, core releases the reservation. If core never settles (say it crashed mid-request), vault releases it on its own after 15 minutes.

New agents start with a deny-all policy, so nothing is spent until you set limits on purpose.

What Changed in arbstr 2.1.0

  • Analytics now sit behind a separate operator token. The request log and stats cover every agent's traffic, so an agent token no longer opens them, and until you set the operator token they refuse every request.
  • Bad agent tokens get a clean 401, and a request the vault's policy refuses gets a 403 with vault's reason, such as exceeds_max_transaction or exceeds_daily_limit.
  • Reserve 401s are classified by error code, not by matching message text.
  • The reserve estimate now covers prompt framing, and core warns when a settle is capped.
  • Dependency bumps for security alerts in openssl, rustls-webpki, rand, and rustls.

What Changed in arbstr-vault 1.2.0

  • Webhook deliveries that fail every attempt are now written to the audit log instead of disappearing.
  • Operators can query the audit log with GET /operator/audit.
  • Core can verify an agent token without reserving funds.
  • Every PR and push to main is type-checked and tested.

Releases You Can Verify

All three repos now release from tags. The arbstr and arbstr-vault images are multi-arch (amd64 and arm64) and carry signed build provenance you can check with gh attestation verify. arbstr-node pins every service to an exact image version in one file, and each node release lists the set it ships. Dependabot proposes new versions as weekly PRs, and nothing upgrades on its own.

The 1.0 node also dropped the vault git submodule and runs the published vault image, and the quick start now works end to end.

A Day Later: arbstr-node 1.1

The next morning I shipped a hardening round: arbstr 2.2.0, arbstr-vault 1.3.0 and 1.3.1, and arbstr-node 1.1.0.

  • Only core, the client-facing API, listens on the network now. Vault's admin API, LND, and the mint bind to localhost, so administering a remote node means an SSH tunnel, not an open port.
  • The node refuses to start without a MINT_PRIVATE_KEY.
  • Core only sends tokenstats API keys to allowed HTTPS hosts, and it bounds the quote prices it accepts.
  • Vault validates BOLT11 destinations and requires the exact invoice amount, refuses non-invoice destinations on real payment rails, and warns when webhooks are unsigned.
  • Approved payments and withdrawals now go through the configured wallet.

By the afternoon the node was at 1.1.3, pinning arbstr 2.3.1 and arbstr-vault 1.3.2:

  • Billing fixes: a request whose provider reports no usage now settles at the reserved amount, and a completed stream is settled instead of released.
  • An opt-in per-client rate limit, plus usage warnings.
  • Less leakage: provider error bodies, key prefixes, and token lengths no longer show up in responses or logs, and server tokens are redacted.
  • Vault now issues 256-bit agent tokens and logs through a shared structured logger.

That evening, arbstr 2.4.0 and arbstr-node 1.2.0 tightened the tokenstats integration: core now uses the market feed's quality signals and fetches only sources it can actually route to. The node's config docs also cover the OrcaRouter allowed hosts and key for the feed.

On October 27, arbstr 2.5.0 and arbstr-node 1.3.0 added an opt-in require_healthy setting. When it's on, arbstr skips any quote whose endpoint tokenstats marks unhealthy (a failed catalog fetch, under 90% reliability over 24 hours, a failing info probe, or a stale quote), and the skipped endpoints show up in GET /providers with a reason. It's off by default because that bar is stricter than arbstr's own default reliability floor, so normal routing doesn't change.

Please Read the Warning

This is experimental and not audited. Don't run it as a production Lightning node or with real bitcoin. The stack defaults to a simulated wallet, where vault tracks balances in its ledger but no real funds move. For anything beyond that, use testnet, signet, or regtest. Paying providers out of collected funds isn't built yet.