What's published, what's shipped, and how it's verified. The versions below are the current registry releases; click through to confirm them live. Full per-version notes live in the changelog.
The core library — algorithms, stores, adapters, the two engines.
The gRPC service door + ThrottleKit Lens — reach the same limiter from any language.
The two engines
- GALE: window-coupled leasing, a fleet-size-independent overshoot bound (TLA⁺-checked)
- TALE, a streaming LLM token-budget escrow with overshoot bounded by debit granularity
- Weighted-fair escrow (work-conserving multi-tenant budget split)
- Unified admission: rate × concurrency × cost in one decision
Distribution & the fleet
- Federation, one global per-window limit across regions
- Tier-1 fleet over existing RPCs: federated / fleetBudget / distributedConcurrency / federatedFairEscrow
- Tier-2 Fleet lease door (lease a slice of a global budget, spend it locally)
- Six exact backends: Memory · Redis · Postgres · DynamoDB · Deno KV · Cloudflare
Observability: Lens
- ThrottleKit Lens, built-in terminal dashboard with eight tabbed views
- Binding-axis attribution: which of rate / concurrency / cost bound each denial
- Monitor door (gRPC) + Prometheus /metrics + standard gRPC health
- OpenTelemetry export (denies_by_axis{lane} into Grafana)
Tooling & surfaces
- Policy Plans: a terraform plan for limits, gate-able in CI
- What-If Replay + opt-in encrypted decision capture
- 13 framework / transport adapters + a transport-agnostic createEnforcer
- gRPC server + Python client, every axis, bit-for-bit; frozen wire + golden vectors
The 1.x core (algorithms, stores, adapters, federation, the unified-admission core) is frozen under SemVer and mechanically enforced: type-surface tests pin the shapes and publint / attw lock the package resolution matrix on every push. It only grows additively.
The newer, fast-moving surface, covering decision capture, What-If Replay, Policy Plans, the Tier-2 fleet lease, and the Lens telemetry taps, is marked @experimental and sits outside that SemVer guarantee, so it can sharpen in a minor without breaking the frozen promise. The boundary is written down in STABILITY.md.
- Machine-checked specs, re-run on every push. The leasing and concurrency bounds are TLA⁺/TLC specs plus a dependency-free BFS twin that re-derives the same reachable-state invariants in CI. spec/ · the bound holds, not just the tests
- One algorithm, proven bit-identical across backends. A dual-path conformance suite drives Memory and the Lua/store path over the same timeline and asserts identical decisions. Memory ≡ Redis ≡ Postgres ≡ …
- The frozen surface can't silently rot. Type-level freeze tests + publint/attw fail the build on any drift to the public API or the ESM/CJS resolution matrix. the v1 promise is enforced, not documented
- The wire is golden-vectored. Every polyglot client (Python today) replays language-neutral golden vectors, so a remote decision is byte-for-byte the embedded one. wire/vectors · including the new lease vectors
The honest scoreboard (including the benchmarks where an incumbent wins) lives in SCOREBOARD.md and the reproducible benchmarks.
The Tier-2 Fleet lease ships for the rate axis today; the Fleet proto already reserves the concurrency and token-budget axes for the same lease shape. And because the wire is frozen and golden-vectored, additional language clients can reach the same verified core the way throttlekit-py does: one oracle, any language. These are the natural next steps, not dated commitments.