Subpool

A self-hosted gateway from the gesta-run GitHub organization that pools a company's AI subscription and API accounts behind one OpenAI-compatible endpoint. Administrators connect accounts (Codex, GitHub Copilot, or any OpenAI-compatible provider), group them into pools, and hand each employee a personal key. The employee points their coding agent at Subpool instead of at the vendor. Go 1.24 service with an embedded React 19 console and PostgreSQL 17, deployed with Docker Compose, Apache-2.0. Repository metadata read from the GitHub API on 2026-10-04: 112 stars, 12 forks, 0 open issues, created 2026-09-02, last push 2026-10-03, releases v0.1.0 (2026-09-04) and v0.2.0 (2026-09-29). subpool is a month old.

What it does (the project's own account, subpool)

• Pooling and fallback. Employee keys are spread across healthy accounts. The stated policy is to prefer subscription capacity and fall back to paid API accounts under the same key. Mixed pools can also fail over requests that one provider cannot serve, such as previous_response_id continuation or provider-hosted web search on Copilot chat-only models.
• Governance. Per-key rate limits, expiry and revocation; key-to-account assignments kept visible; account health, remaining subscription capacity and reset times monitored. Token telemetry is aggregate, per key and per subscription quota, in provider-native units.
• Credential handling. Upstream credentials are encrypted at rest (SUBPOOL_CREDENTIAL_KEY, plus an HMAC key for API keys). Prompts, responses and source code are stated not to be persisted.
• Onboarding. Codex accounts use device-code authorization and Copilot accounts use GitHub Device OAuth, so a headless server needs no localhost callback. Copilot's AI-credit entitlement is read separately for routing and is not presented as billing.
• Surface. /v1/responses (HTTP and WebSocket), /v1/chat/completions, image generation and edit endpoints, /v1/models, plus /healthz, /readyz and /metrics. For harnesses the integration is one block in the user's Codex config.toml (model_provider, base_url, wire_api = "responses", a bearer token). Fast mode is enforced per account by the gateway, so users do not set it.
• Protocol translation. Copilot models limited to /chat/completions get a compatibility translator for text, images, tools, structured output and streaming. Requests go to Copilot's native /responses when the model's supported_endpoints metadata allows it.

Why it is in this spoke

The spoke's agent-governance pages ask what limits an agent. Subpool limits the person-to-vendor edge instead: one organization-owned bundle of seats, divided among employees whose agents all speak the same wire protocol. It sits next to claude-code-model-router and cache-aware-model-routing, which choose a model per request, but chooses an account per request and never looks at the prompt. Compare omniroute and ai-gateway in ../llm-providers-wiki, which are the provider-market view of the same layer.

Caveats

• The tier is T1 for the artifact's own facts (architecture, endpoints, licence, versions, metadata), per QUALITY.md's tier-by-the-claim rule. It is not evidence the gateway works well: there are no benchmarks, no latency or fail-over numbers, and no deployment reports.
• The repository's own terms say to use only accounts you are authorized to manage and to review each upstream provider's terms before sharing access. Whether pooling a per-seat subscription across employees is permitted is a provider-policy question the README states and does not answer.
• The README carries a "Supported by Ubang" banner; nothing else about the sponsor or the gesta-run organization is stated, so neither is paged.

Cross-spoke context

Weaker facet for ../llm-providers-wiki (API access and pricing across Codex, Copilot and OpenAI-compatible providers). It is a gateway tool rather than a provider, so it is recorded here only; nothing was written there.

Related

agent-scope-isolation · agent-permission-model · claude-code-model-router · cache-aware-model-routing · omniroute · ai-gateway · synthesis