A3S GATEWAYAI NATIVE TRAFFIC LAYERAI NATIVE 流量层
Enforce model policy, stream lifecycles, backend recovery, and safe configuration changes in one local Rust data plane.
在一个本地 Rust 数据平面中统一执行模型策略、流生命周期、后端恢复和安全配置变更。
healthy 2 / 3
A3S brings model, stream, backend, and configuration decisions into one validated local request path.
A3S 将模型、流、后端和配置决策收敛到一条经过校验的本地请求路径。
NGINX is a mature general-purpose proxy. A3S makes AI workload semantics part of the gateway contract.
NGINX 是成熟的通用代理。A3S 则把 AI 工作负载语义纳入网关契约。
Strong for web serving, general reverse proxying, transport routing, and module-based deployments.
适合 Web 服务、通用反向代理、传输层路由和模块化部署。
Strong when model policy, stream lifecycle, provider recovery, and desired state must act as one runtime.
适合需要将模型策略、流生命周期、提供方恢复和期望状态统一为一个运行时的场景。
Routes HTTP and transport traffic through URI, header, upstream, and proxy directives. Model identity remains application data by default.
通过 URI、header、upstream 和代理指令路由流量。默认情况下，模型身份仍属于应用数据。
Model grants, rewriting, RPM, burst, concurrency, and request identities are first-class runtime policy.
模型授权、重写、RPM、突发、并发和请求身份都是运行时一等策略。
Generic buffering plus connect, read, and send timeouts control proxied connections and responses.
通过通用缓冲，以及连接、读取和发送超时控制代理连接与响应。
First-response, idle-stream, and total-operation bounds model distinct stream failure modes.
首响应、流空闲和总操作边界分别对应不同的流故障模式。
Reload validates configuration, starts new workers, and gracefully retires old workers. Failure keeps the old configuration.
reload 校验配置、启动新 worker 并平滑退出旧 worker。失败时保留旧配置。
Domain references, listeners, policy, and health compile as one snapshot and stay pinned per request.
领域引用、监听器、策略和健康规则被编译为一个快照，并固定到每个请求。
Passive health is built in. Active health and live upstream reconfiguration are NGINX Plus capabilities.
开源版内置被动健康检查。主动健康和 upstream 在线重配置属于 NGINX Plus 能力。
Active and passive health, circuit state, balancing, failover, mirroring, and pre-response fallback share one selection model.
主动与被动健康、熔断、均衡、故障转移、镜像和响应前 fallback 共用一套选择模型。
Modules, authorization subrequests, and njs scripting compose deployment-specific behavior.
通过模块、鉴权子请求和 njs 脚本组合部署所需行为。
Fifteen built-in policies cover common controls, with typed Rust middleware registered by stable names.
15 种内置策略覆盖常见控制，并可按稳定名称注册类型化 Rust 中间件。
The current delivery spans protocol handling, model policy, backend recovery, desired state, middleware, and operations.
当前交付覆盖协议处理、模型策略、后端恢复、期望状态、中间件和运维能力。
Full-duplex bodies, trailers, backpressure, verified upstreams, independent stream bounds, and bounded drain.
支持全双工 body、trailer、背压、上游校验、独立流式边界和有界排空。
Models, chat, completions, embeddings, grants, admission, rewriting, identities, and ordered healthy targets.
模型列表、Chat、Completions、Embeddings、授权、准入、重写、身份和有序健康目标。
Host, path, method, header, and SNI rules with priority, four balancing strategies, circuits, failover, and mirroring.
Host、路径、方法、header 和 SNI 规则，配合优先级、四种均衡策略、熔断、故障转移和镜像。
Standalone ACL or Cloud snapshots, fail-closed validation, serialized listener reconciliation, atomic activation, and durable recovery.
支持 standalone ACL 或 Cloud 快照、失败关闭校验、串行监听器协调、原子激活和持久恢复。
Ordered policy composition stays visible in ACL. Embedded deployments can register typed Rust middleware under stable names.
有序策略组合在 ACL 中保持可见。嵌入式部署可以按稳定名称注册类型化 Rust 中间件。
Prometheus metrics, traces, JSON logs, machine APIs, discovery providers, signed installers, Docker, Helm, and Cargo.
Prometheus 指标、trace、JSON 日志、机器 API、发现提供方、校验安装器、Docker、Helm 和 Cargo。
The core data plane is ready for controlled production. Managed recovery, long-duration reliability, security review, and adoption evidence remain promotion gates.
核心数据平面可用于受控生产环境；受管恢复、长期可靠性、安全审查和真实采用证据仍是晋级 GA 的门槛。
The full matrix covers ten traffic profiles. These three show throughput, tail latency, and the cost of A3S-specific policy.
完整矩阵覆盖十类流量。以下三个场景分别呈现吞吐、尾延迟和 A3S 专属策略的功能成本。
TLS termination / 4 connections / 16 streams each
TLS 终止 / 4 个连接 / 每连接 16 条流
83% higher throughput / 11% lower P99吞吐高 83% / P99 低 11%
64 persistent connections / 32-byte binary echo
64 个持久连接 / 32 字节二进制回显
17% lower throughput / 47% lower P99吞吐低 17% / P99 低 47%
Bounded JSON validation / stream detection / SSE relay
有界 JSON 校验 / 流检测 / SSE 转发
A3S validation: 22% lower throughput / 10% higher P99A3S 校验成本：吞吐低 22% / P99 高 10%
Commit fbb8ae0e / shared infrastructure / regression evidence, not a capacity forecast.提交 fbb8ae0e / 共享基础设施 / 用于回归判断，不代表容量预测。
This complete ACL binds a listener, matches a route, applies admission, and selects a health-checked backend.
这份完整 ACL 绑定监听器、匹配路由、执行准入，并选择经过健康检查的后端。
gateway.aclVALID ACLmode { kind = "standalone" }
entrypoints "web" {
address = "127.0.0.1:8080"
}
routers "models" {
rule = "PathPrefix(`/v1`)"
service = "models"
entrypoints = ["web"]
middlewares = ["rate-limit"]
}
middlewares "rate-limit" {
type = "rate-limit"
rate = 60
burst = 10
}
services "models" {
load_balancer {
strategy = "least-connections"
request_timeout = "30s"
stream_idle_timeout = "5m"
stream_total_timeout = "60m"
servers = [{ url = "http://127.0.0.1:8000" }]
health_check {
path = "/health"; interval = "10s"; timeout = "5s"
unhealthy_threshold = 3; healthy_threshold = 1
}
}
}standalone reads local ACL. cloud-managed accepts complete snapshots from A3S Cloud.
standalone 读取本地 ACL，cloud-managed 接收 A3S Cloud 的完整快照。
address opens the local socket. Routers opt into the named entrypoint.
address 打开本地 socket，路由通过名称选择入口。
The route references one service, listener, and ordered middleware chain. Missing references fail validation.
路由引用服务、监听器和有序中间件链。引用缺失会导致校验失败。
rate permits 60 requests per second. burst allows a short queue of 10 tokens.
rate 允许每秒 60 个请求，burst 允许 10 个令牌的短时突发。
The service defines balancing, request and stream bounds, upstream URLs, and health thresholds.
服务定义负载均衡、请求与流式边界、上游 URL 和健康阈值。
A3S Cloud distributes complete desired state. Gateway validates, activates, and serves from the local snapshot.
A3S Cloud 下发完整期望状态，Gateway 在本地校验、激活并基于快照处理流量。
Verified installers select the platform archive, check its SHA-256 and binary version, then install for the current user.
校验安装器会选择对应平台归档，检查 SHA-256 和二进制版本，再安装到当前用户目录。
curl --proto '=https' --tlsv1.2 -LsSf https://a3s-lab.github.io/Gateway/install.sh | sh