Gateways
Gateways are the provider front door: routing surfaces that execute model inference. The gateway surface is the Gateways tab at /ai/gateways, alongside the Models and Providers tabs. The default gateway is resolved from the catalog, not hardcoded.
- The header counts the surface: gateways, the one marked Default, and reachable providers.
- Each gateway row carries its key, auth kind, endpoint, reachable providers, and active state, with a Make default action for switching the default.
- Gateway wiring is platform work, not tenant config. Tenants feel gateways through session behavior and availability, not through keys they hold.

- Model selection per workload stays in the Model registry; the gateway is the route models are reached through, not the choice of model.
- Session trouble that looks gateway-shaped (slow, down, or empty externals) is handled the same way as provider trouble: output stays sane, the session degrades instead of wedging, and the pattern gets reported with examples.
- No password, API key, token, connection string, or private key goes in this wiki. Names of variables where source names them, values never.
Treat the Gateways tab as the source of truth for gateway surfaces. Provider wiring: AI providers. Provisioning-side gateway key: Provisioning and internals.

