Combo models are model containers
Combo models are model containers.
Before container shipping, loading a ship was bespoke. Every crate, barrel, and machine had to be handled as its own weird object. The standard container made the unit boring, which made the system fast. Ports, trucks, cranes, ships, warehouses, insurance, finance, and customs could all speak the same shape.
There is a circuit analogy too. A useful circuit diagram is not one giant blob called "computer." It is made out of blocks with names and contracts: gates, adders, registers, clocks, buses, memory. You can reason about each piece, test it, reuse it, and then wire it into something larger. Combo models should work like that. Advisor, Synth, selector, and mapreduce are the blocks. Socrates, Plato, Prometheus, and Zeus are named circuit modules built from those blocks. Bigger combo models are the diagram that wires them together.
The same thing is starting to happen with model orchestration. The token API made one model callable. Combo models make a whole structure callable. A panel, a judge, an advisor, a selector, a mapreduce graph, or a chain of those pieces can sit behind one model id.
That is what we just launched on TrustedRouter.
We are experimenting with a new way to make models. We call them Combo models, or combination models. You compose them from simple building blocks into much larger systems, then expose the result through the same standardized token API as any other model. The important part is that the composition becomes a named model published on TrustedRouter, with visible sub-models, public evals, and privacy routing that can include end-to-end encrypted execution.
That changes the marketplace. A stranger can publish a useful composition without asking you to trust their server or their prompt logger. You can inspect the structure, inspect the evals, and have an agent verify the attested gateway before sending traffic. The prompts and the composition can come from people you do not know, while the data path stays verifiable. This is the hosted ClaudeVM marketplace: executable model systems, packaged as normal model ids, sold and evaluated like software, but called like tokens.
We are already seeing open combo models push past closed, restricted baselines in the dimensions developers care about: correctness, speed, price, reliability, transparency, and freedom. The point is not another hidden benchmark claim. The point is that the model page can show the wiring, the provider routes, the privacy class, and the scorecard in public.
The API call still looks normal:
model = "trustedrouter/advisor"Inside the attested gateway, that one model id can run a fast worker and give it a private advisor tool. You can call the generic primitive directly with trustedrouter/advisor and send the advisor parameters yourself, the same way trustedrouter/synth accepts a panel, judge list, and final model list. Or you can call a named preset like trustedrouter/socrates-1.0 and let the catalog pick the sub-model stack.
A different id can run a fusion panel. Another can split work into parallel parts and reduce the result. Another can select the best answer from several candidates. The caller does not need to wire all of that together on every request.
This is already in the product. The catalog now includes the Synth family, advisor orchestration, selector, and mapreduce models.
| primitive | how you call it | what you configure |
|---|---|---|
| Advisor | trustedrouter/advisor with tool trustedrouter:advisor | advisor_models, max advice calls, depth, advisor token budget, timeout |
| Synth | trustedrouter/synth with tool trustedrouter:synth | analysis_models, judge_models, final_models, fallback final models, selection strategy |
| Selector | trustedrouter/selector | candidate models and selection policy |
| MapReduce | trustedrouter/mapreduce | shard models, reduce model, fallback policy |
The named models are presets, not a different abstraction. Socrates, Plato, Aristotle, Iris, Prometheus, and Zeus are the branded containers. The sub-models define what is inside them.
| preset | primitive | sub-model stack |
|---|---|---|
| Socrates | advisor | cerebras/gpt-oss-120b worker, then cerebras/zai-glm-4.7, xiaomi/mimo-v2.5-pro-ultraspeed, trustedrouter/zeus-1.0 |
| Aristotle | advisor | deepseek/deepseek-v4-flash worker, then frontier advisors: claude-opus-4.8, gpt-5.5, claude-sonnet-4.6, gemini-3.1-pro-preview, kimi-k2.6 |
| Plato | advisor | deepseek/deepseek-v4-flash worker, then open advisors: glm-5.2, minimax-m3, kimi-k2.6, gemma-4-31b-it, deepseek-v4-pro |
| Prometheus | synth | open model panel with MiniMax M3, Kimi K2.6, GLM 5.2, Gemma 4, and DeepSeek V4 Pro |
| Zeus | synth | frontier panel with open-model judge and synthesizer, built for max answer quality |
| Iris | synth | budget panel with MiniMax M3, Kimi K2.6, and DeepSeek V4 Pro |
A combo model can contain advisors which are themselves combo models. A Synth can ask several advisors. A selector can choose between Synth outputs. MapReduce can run a cheap model over many shards and reserve a smarter model for the final reduce. Once the unit is a model id, the graph becomes reusable.
This matters most when it becomes an artifact other people can use. Today you can call our shipped combo models and inspect the model pages. The next step is a public builder: define a combo model, run evals, publish the scorecard, set a price, and offer it on TrustedRouter. The marketplace should care about measured quality per dollar, latency, privacy class, and reliability, not vibes.
There is prior art here. DSPy got the important abstraction right: programs made of model calls should be typed, optimized, and evaluated. TrustedRouter is taking that idea to the hosted token API boundary. You should be able to put a serious orchestration graph behind an OpenAI-compatible model id, make it private, test it, and let another developer call it without copying your prompt graph into their app.
The privacy part is not decoration. Combo models can create many subcalls. If those subcalls spray prompts across random systems, nobody should use this for legal, medical, financial, or proprietary work. TrustedRouter runs prompt traffic through the attested gateway, and the trust page lets an agent verify what code is running. For the highest privacy classes we expose routes like trustedrouter/zdr and trustedrouter/e2e. The goal is simple: powerful orchestration without making users give up control of their data.
The model id is becoming the package boundary. That is the launch.
Use it from the API, or start with trustedrouter/socrates-1.0, trustedrouter/prometheus, and trustedrouter/selector. If you want to design a combo model and sell it, that is where this is going next.