Statuses and badges

Every status word and badge Cloud Score shows, what each one means, and the page it appears on.

On this page

Reading these tables

Provider status words describe different evidence

Connection, background checks, and routing signals describe different things. Connected, Error, and Disconnected are the connection badge on Providers, written from the last credential check. The health-history dots on each provider card record individual checks. up, degraded, down, and unknown are the router's own health signal, shown on Optimization settings › Routing signals and inside the Measured tooltip on Models. Gateway health under Observability shows observed request outcomes and latency over time.

Two reading rules hold for every table on this page.

A dash is not a zero. — means the value was never recorded, and the product usually attaches a tooltip saying why. A recorded zero prints as 0 or $0.
Estimates are identified.Savings on Overview and the request's savings receipt carry an Estimate chip. Other pages use (est.) where applicable. See Costs, savings, and estimates.

Badge tones

Badges carry one of four tones: green for good, amber for a warning, red for an error, and grey for neutral or unknown states.

Request status

Request status, written once per request at the Record stage.
Value	Meaning	Where
`completed`	The request finished with no error. A cache hit and a dedup follower are both completed.	The `Gateway status` column in Observability and its `Status` filter chip; the `Record` station; `Request outcomes` on Gateway health; the `Requests` tile on Usage & cost
`failed`	An upstream or pipeline error that was not a block. Gateway health counts failed requests in the selected period.	Same places as `completed`
`blocked`	Stopped before or without execution by a policy, a budget, or AI Security. Blocked rows are never counted as failed.	Same places as `completed`

A blocked request stores less

An AI Security block suppresses the intent and both previews whatever the key's Store bodies setting says, so the request and response previews in the Request drawer read Not stored: blocked by AI Security even on a retaining key. Classification, trace, usage, and cost are still recorded. See Observability.

Provider connection, health, and signals

Provider connection badge, on a Providers card.
Value	Meaning	Where
`Connected`	The last credential check passed.	Providers, the second badge on a provider card
`Error`	The last check failed. The card also prints the backend's last error message.	Same card
`Disconnected`	Credentials are saved but no check has run yet. A freshly saved provider shows this until you re-test or the 60 second loop reaches it.	Same card
`Not set up`	No connection of this type exists. The bay says what it needs, for example `needs API key`.	An empty bay card on the same page

Health history is on Providers

Each history dot has its check result, latency and time in a tooltip. Green marks ok; red marks a failed check. A provider with no checks has no history dots.

Router health signal. Penalties only, never bonuses.
Value	Meaning	Where
`up`	`Last health check passed. No penalty.`	`Optimization settings` › `Routing signals`, the `Health` column; and the `Measured` tooltip on Models
`degraded`	`A failed check, or p95 above 3× the window median. Small penalty.`	Same places
`down`	`Two consecutive failed checks. Penalised until one clean check.`	Same places
`unknown`	`No checks yet, or the last check is stale (older than 3× the loop interval). Never penalised.`	Same places

Per-model routing signal status, on Optimization settings › Routing signals and on Models.
Value	Meaning	Where
`−0.045`	The model has reached the sample floor, so its measured deltas apply to the score. The signed total sits over its `health` · `reliability` · `latency` parts.	The `Penalty` column of the signals table
`Not penalised`	Fewer observations than the sample floor, default 20, so `Samples` reads `12 of 20`. A learning model is never penalised.	The same column
`learning (12/20)`	The same learning state, as a badge.	The `Measured` cell on Models
`cooling`	A circuit breaker is open. The badge carries the scope and the time it lifts.	The `Cooldown` column

Learning is not unhealthy

A model still learning (Not penalised on Routing signals, the learning badge on Models) has too little evidence for Cloud Score to judge it, so it is exempt from penalties. Measured adjustments only ever subtract from a score, are never money, and never change a tier. See Models, tiers, and scoring.

Mechanism modes and decision states

Mechanism mode, set per mechanism on Optimization settings › Settings.
Value	Meaning	Where
`off`	Nothing runs, and the plan records the decision `skip` with the reason `not_available`.	Optimization settings mode selects; the `Mode` column of `By mechanism` on Optimizations; the mechanism rows of the `Optimization decision` card
`observe`	The full decision runs and is recorded, and nothing is applied. The caller sees no change.	Same places
`auto`	Applied when the decision's confidence reaches that mechanism's `Min confidence`. Below the bar the request behaves as observe and records the reason `low_confidence`.	Same places
`—`	The row has no mode setting of its own: `Routing vs reference model` and `Provider prompt cache`.	The `Mode` column of `By mechanism` on Optimizations

Per-request mechanism decision state, in the Optimization decision card.
Value	Meaning	Where
`applied`	The mechanism ran and changed this request.	The `Optimization decision` card in the Observability `Request` drawer and under a Playground result
`skipped`	The outcome writer ran and the mechanism did not apply, with no reason recorded.	The same card
`skipped · low confidence`	The same, with the recorded reason after the separator. Hover the badge for the full sentence.	The same card
`—`	Unrecorded, not skipped. The tooltip reads `Unrecorded, not skipped: this row was written before the outcome writer (outcomes_version = 0), so nothing is known about what the mechanism did.`	The same card

Wiring badges beside a control on Optimization settings › Settings.
Value	Meaning	Where
No badge	The control is live: the backend reads it and acts on it.	Optimization settings
`Observe only`	Recorded in the plan and reported by the aggregates, but nothing acts on it yet. The control stays editable and keeps the value you set. On the current backend the only mechanism expected to wear this badge is Context caching.	Beside the mechanism label on the same page
`Not wired`	No backend code reads the field at all. The control is disabled but keeps its value legible. Hover the badge for the backend line that proves it.	Beside the affected advanced field on the same page

Two more mechanism readings

The Optimize station summarises a whole plan as counts, for example 3 auto · 2 observe. A request recorded before the engine landed has no plan at all, and the card reads No plan recorded for this request (pre-engine row).

Cache verdicts and reasons

Cache verdict. One per request, and the split the hit rate is measured on.
Value	Meaning	Where
`hit`	The answer came from Cloud Score's response cache. Counts toward the hit rate.	The request's `Cache` section in Observability; the `Resolve` station; the `Exact response cache` and `Semantic response cache` rows of By mechanism
`miss`	The request was eligible but no usable entry existed. This is the tunable population and the rest of the hit-rate denominator.	The request's `Cache` section
`ineligible`	A reason other than a miss, such as tools or a no-retention key. Excluded from the hit rate.	The request's `Cache` section
`coalesced`	A follower served by in-flight dedup. Never counted as a hit or a miss.	The `Dedup` station reads `follower`
`off`	Caching was switched off for this request, by the workspace default, by a policy, or by the response cache's own mode in Optimization settings. Excluded from the hit rate.	The request's own reason is in its `Cache` section
`observe`	The cache ran in observe mode: a match was measured and nothing was served. Excluded from the hit rate.	As for `off`
`blocked`	A cached answer existed and AI Security refused it. Excluded from the hit rate.	As for `off`

Cache source, shown on a hit.
Value	Meaning	Where
`exact`	Same request fingerprint. The section reads `Served from cache (exact match)`.	The request's `Cache` section in Observability; the `Resolve` station
`semantic`	Nearest embedding above the policy's similarity bar. The section reads `Served from cache (semantic match)`, and the station carries the similarity percentage.	The same places

A request that was not a hit carries a reason code. It renders as the sentence below in the request's Cache section. See Caching and deduplication.

Cache reason codes and the sentence each renders as.
Value	Meaning	Where
`miss_absent`	`No cached entry yet`	Cache section
`miss`	`No cached entry yet`	Cache section
`miss_expired`	`Entry had expired`	Cache section
`miss_model_disabled`	`Producing model disabled`	Cache section
`miss_below_similarity`	`Closest match below similarity bar`	Cache section
`miss_provider_denied`	`Cached answer's provider or model is not allowed by this request's routing policy`	Cache section
`miss_embed_unavailable`	`No connected provider can embed for semantic matching`	Cache section
`policy_off`	`Caching not enabled by any matching policy`	Cache section only
`default_off`	`Caching off by workspace default (no policy set a cache mode)`	Cache section only
`mode_off`	`Response cache switched off in Optimization settings`	Cache section only
`mode_observe`	`Observe mode: a match was measured but not served`	Cache section only
`store_bodies_off`	`API key is no-retention`	Cache section only
`security_redacted`	`Not cached — the request was redacted by AI Security`	Cache section only
`security_blocked`	`Not served — the cached response was blocked by AI Security`	Cache section only
`tools`	`Request uses tools`	Cache section only
`sampling`	`Non-zero temperature`	Cache section only
`bypass_no_cache`	`Caller asked for a fresh answer (cache: no-cache); the answer was still stored`	Cache section only
`bypass_no_store`	`Caller opted out (cache: no-store); nothing served, nothing stored`	Cache section only
`ttl_zero`	`Policy TTL is 0 — never written back`	Cache section only
`not_evaluated`	`Never reached the cache stage`	Cache section only
`error:`	A lookup that failed open. The code carries the error type after the colon, and renders as `Cache error (failed open):` plus that type.	Cache section only

An unmatched code shows itself

A reason code with no sentence of its own is printed raw, so a new code never disappears.

Cost status

Cost status, per request. A link that carries it shows a Cost status chip on Usage & cost.
Value	Meaning	Where
`computed`	Measured tokens priced at the versioned price card. This is the normal state.	The `Status · basis` line of the request's evidence in Observability
`estimated`	A streamed attempt returned no usage, so tokens were estimated.	The same line
`pending`	The cost math failed and the row awaits reconciliation. The evidence warns `Cost not yet computed — awaiting reconciliation.`	The same line
`reconciled`	The cost was recomputed later and the row is settled.	The same line

A dash in a money column is not free

In Observability, $0 in the List cost estimate column is a known zero: a cache hit, a dedup follower, or a request blocked before execution. — means the cost is unknown, either pending reconciliation or every billed attempt failed.

Budgets, alerts, and deliveries

Budget hard action, At the limit in the limits editor on Budgets.
Value	Meaning	Where
`Warn`	The breach is reported and the request is still served.	Budgets, `At the limit` in the editor that `Manage organization limits` or `Edit limits` opens
`Block`	The request is refused once the period's spend plus in-flight estimates pass the limit. Choosing block asks first, through the dialog `Block requests at the limit?`	The same editor

Alert delivery status, on Budgets › Alerts.
Value	Meaning	Where
`pending`	Queued or retrying. The next attempt is in the Next / sent column.	Alerts, the `Deliveries` table and its `Status` filter
`sent`	Delivered. The Next / sent column shows when.	The same table
`failed`	The attempt failed and will be retried at the time shown. The reason is in the Last error column.	The same table
`dead`	Retries are exhausted, and the Next / sent column reads `—`.	The same table

Channel and rule state, on the same tab.
Value	Meaning	Where
`enabled`	The channel or rule is live. A channel that is enabled but failing also shows a consecutive-failure count in amber.	The `Status` column of `Alert channels` and `Threshold rules`
`disabled`	Turned off by you, or auto-disabled after consecutive delivery failures, in which case the row says after how many and when.	The same columns

AI Security actions and categories

AI Security action, set per category and per direction in a profile. The editor's selects show them as Off, Log, Redact, Block.
Value	Meaning	Where
`off`	The category is not scanned. Setting both directions to off disables the category.	The `Input` and `Output` selects in the AI Security profile editor; the `Guard in` and `Guard out` stations
`log`	Record a security event only. Nothing is changed, and streaming keeps working.	The same selects, and the request's guardrail verdicts in Observability
`redact`	Replace matched spans in place. Redaction is irreversible, and a redacted request is cache-ineligible.	The same selects, and the request's guardrail verdicts in Observability
`block`	Refuse the request or the response with 403.	The same selects, and the request's guardrail verdicts in Observability
`— input only`	Not an action. It is the fixed text in the Output cell of Jailbreak, which is input-only in V1.	The profile editor rules table

The six security categories, in catalog order.
Value	Meaning	Where
`Jailbreak`	`Input only. Scans the latest user turn; system and developer messages are never scanned.`	The profile editor rules table, and Scan rules findings
`PII`	Personal identifiers. The only category that reads the `Locales` section.	The same places
`Secrets`	Credentials and keys. The built-in Observe profile blocks this category on input.	The same places
`PHI (identifier-based)`	`Requires a healthcare identifier plus health context. Narrative clinical text is not detected in V1.`	The same places
`PCI`	Payment card data.	The same places
`Confidential`	`Literal keyword and phrase matching: case-insensitive, whole words, any spacing between words. Custom regular expressions are not supported.`	The same places

The decisive per-request verdict.
Value	Meaning	Where
`blocked`	Whichever direction blocked, output first.	The `Pipeline stations and guardrail verdicts` section of the request in Observability
`redacted`	Whichever direction redacted, output first.	The same section
`logged`	Findings were recorded and nothing was changed.	The same section
`not scanned`	A detector failed open or the scan was truncated, so the request was not fully scanned.	The same section

Scan rules verdicts. A dry run that stores nothing.
Value	Meaning	Where
`Would block`	The unsaved rules would refuse this text.	The `Scan rules` card in the profile editor
`Would redact`	The rules would rewrite it, and a `Redaction diff` shows `Before` and `After`.	The same card
`Detected, not enforced`	Findings would be recorded and the text passed through.	The same card
`No findings`	No detector matched under these rules.	The same card

Playground guardrail verdicts, one chip per direction that acted, followed by the categories, for example Blocked before sending: PCI.
Value	Meaning	Where
`Blocked before sending`	The key's profile refused the prompt; no model was called. It replaces the error line the gateway's message would otherwise show.	The Playground `Result` pane, beside the `Change in Guardrails` link
`Redacted before sending`	Matches in the prompt were replaced before it was sent.	The same pane
`Detected, not enforced`	Matches in the prompt were only recorded. The pane adds `This profile only records matches. Set the category to Redact or Block to enforce it.`	The same pane
`Response blocked`	The answer was withheld.	The same pane
`Redacted in the response`	Matches in the answer were replaced before delivery.	The same pane
`Detected in the response, not enforced`	Matches in the answer were only recorded.	The same pane
`Scan incomplete`	Some content was not scanned: `Part of the text was too long to scan.` or `A detector failed, so some content was not scanned.`	The same pane

Two profile badges

Built-in marks the workspace's immutable Observe profile, which cannot be edited or deleted. Disabledmarks a profile that scans nothing, whatever its rules say. A profile's Behavior cell summarises it as block: … · redact: … · log only (not enforced): …, all off when no category is enabled, or Disabled, not enforced on a disabled profile.

API key badges

API key badges, in the Status column on Admin › API keys.
Value	Meaning	Where
`Enabled`	The key authenticates gateway calls.	API keys, the `Status` column
`Disabled`	Calls with this key fail. Disabling is the supported way to retire a key that has served requests, because revoking one with history is refused.	The same column
`Sandbox`	The Playground may hand-pick which enabled policies apply per request on this key. It is a testing affordance, never a bypass, and it can never skip the budget gate.	The same column, beside Enabled or Disabled
`No guardrails`	Not a status badge. It is the warning the Security column shows when no security profile is bound to the key, so its requests are not scanned.	The `Security` column of the same table

Embeddings and cache-index badges

Provider embeddings capability, on every Providers card and bay.
Value	Meaning	Where
`Supports embeddings (1536)`	This provider can produce the 1536-dimension vectors the semantic cache index compares.	Providers, the first badge on a card. Hover it for the full reason sentence.
`No embeddings API`	The vendor exposes no embeddings endpoint at all.	The same badge
`No 1536-dim embeddings`	The vendor embeds only at other dimensions, or no adapter is pinned to a 1536-dimension model.	The same badge

Embedder status, on the Settings tab of Optimization settings.
Value	Meaning	Where
`Semantic matching available`	An embedder is connected, so the semantic cache can match paraphrases. Hover it for the provider and model it embeds with, for example `openai · text-embedding-3-small`, and the reason.	The `Response cache` row under `Workspace defaults` on Optimization settings. `Embeddings` under `Diagnostics` in the Response cache section shows the same provider and model.
`Semantic matching unavailable`	No connected provider can embed, so semantic requests fall back to exact matching. On the settings row the reason is the badge's tooltip; under `Diagnostics`, `Embeddings` prints it after the label.	The same two places
`—`	No embedding status was reported. The tooltip reads `The settings envelope did not report an embedding status.`	`Embeddings` under `Diagnostics`

Entry, index and embedder badges in the Response cache section of Optimization settings › Settings.
Value	Meaning	Where
`embedded`	The entry has a vector, so it can be matched semantically.	The `Semantic` column of `Top entries by hits`
`exact only`	`Exact-match only until the embedder reaches it (or forever, for structured output).`	The same column
`Vector index valid`	The vector index is present and valid, so semantic lookups use it.	The section header
`Vector index missing`	There is no vector index, so every semantic lookup scans the table sequentially.	The same header
`Vector index invalid`	A concurrent build failed or was interrupted. Lookups still succeed, just slowly, until the index is rebuilt.	The same header
`Embedder running`	The inline embed queue is running. Hover it for the queue, for example `Inline embed queue: 3 / 256.`	The same header
`Embedder stopped`	`The inline embed queue is stopped. Dropped or failed jobs are picked up by the 5-minute backfill.`	The same header

Where these matter

All three tables answer one question: can this workspace serve a semantic cache hit. Set the workspace default under Optimization settings, then read the outcome per request in the Cache section of Observability.