feat(free): free hosted Gemini Flash model, no signup

docs/docs/configure/providers.md

@@ -35,9 +35,9 @@ Managed LLM access with dynamic routing across Sonnet 4.6, Opus 4.6, GPT-5.4, GP
 ```json
 {
   "provider": {
-    "altimate": {}
+    "altimate-backend": {}
   },
-  "model": "altimate/auto"
+  "model": "altimate-backend/altimate-default"
 }
 ```
 
@@ -46,6 +46,27 @@ For pricing, security, and data handling details, see the [Altimate LLM Gateway
 !!! tip "Automatic model selection"
     When Altimate credentials are configured and no model is explicitly chosen, the Altimate LLM Gateway is selected automatically. You can override this by setting `model` in your config or by restricting the `provider` section to specific providers only.
 
+## Gemini Flash (Free)
+
+A hosted Gemini Flash model we pay for. No signup, no API key: pick **Gemini Flash (Free)** in the model picker, accept the disclosure, and the CLI registers itself with our gateway and stores a short-lived key. The key rotates silently when it expires.
+
+```json
+{
+  "model": "altimate-free/gemini-flash-free"
+}
+```
+
+!!! warning "What you agree to"
+    Free model — requests and responses are logged and may be used to improve Altimate's products and services. Don't send secrets or confidential code. No signup required.
+
+Nothing is sent to the gateway until you accept that disclosure: the install identifier is created in the same step that registers it, so an install that never opts in never contacts the free-tier gateway at all. Usage is subject to per-install daily limits; when a limit is hit, requests are rejected until it resets.
+
+Point the CLI at a different gateway (for local development against your own deployment) with `ALTIMATE_FREE_GATEWAY_URL`:
+
+```bash
+ALTIMATE_FREE_GATEWAY_URL=http://localhost:4000 altimate-code
+```
+
 ## Anthropic
 
 ```json

docs/docs/reference/telemetry.md

@@ -53,8 +53,10 @@ We collect the following categories of events:
 | `validator_retries_exhausted` | A session terminated with unresolved validator failures after exhausting the synthetic-retry budget — names of the failing validators (no failure body content). |
 | `onboarding_started` | The first-run setup gate opened (fresh launch with no usable model). |
 | `model_picker_shown` | The provider picker was displayed. `trigger` distinguishes the first run from `/connect`, from declining Big Pickle, and from the prompt gate. |
-| `provider_selected` | A provider row was chosen — `altimate_gateway`, `anthropic`, `openai`, `google`, `big_pickle`, `search_all`, or `other` for anything outside the curated five. `provider_id` carries the raw id only for publicly-known providers, so a provider you named yourself in config is reported as `other` with no name attached. `via_search` marks a pick made inside the full catalogue after choosing "Search all providers…". **Choosing search emits this event twice for one user** — once as `search_all`, then again with the provider actually chosen — so count distinct users or filter on `via_search`, not raw event count. Recorded at the moment of choice, so a sign-in that is then cancelled still counts. |
+| `provider_selected` | A provider row was chosen — `altimate_gateway`, `altimate_free`, `anthropic`, `openai`, `google`, `big_pickle`, `search_all`, or `other` for anything outside the curated set. `provider_id` carries the raw id only for publicly-known providers, so a provider you named yourself in config is reported as `other` with no name attached. `via_search` marks a pick made inside the full catalogue after choosing "Search all providers…". **Choosing search emits this event twice for one user** — once as `search_all`, then again with the provider actually chosen — so count distinct users or filter on `via_search`, not raw event count. Recorded at the moment of choice, so a sign-in that is then cancelled still counts. |
 | `big_pickle_confirm_shown` / `big_pickle_choice` | The Big Pickle interstitial was shown, and what the user decided (`accept`/`cancel`). |
+| `free_gemini_confirm_shown` / `free_gemini_choice` | The Gemini Flash (Free) disclosure interstitial was shown, and what the user decided (`accept`/`cancel`). Every dismissal that is not an explicit accept — Escape, click-away, picking another row — is recorded as `cancel`. |
+| `free_gemini_register_result` | The outcome of the free-tier registration that runs after an `accept`: `success`, `rate_limited` (gateway velocity limit), `unavailable` (gateway maintenance or kill switch), `network` (gateway unreachable), or `error`. Never carries error text. |
 | `gateway_device_code_issued` | The Altimate Gateway authorize URL was built and the browser open attempted. **Name note:** the flow is a browser loopback OAuth — there is no device code. The name follows the original event spec. |
 | `gateway_auth_completed` / `gateway_auth_failed` | Gateway sign-in outcome. `reason` is `timeout`, `denied`, or `error` — never the underlying message, which can contain the instance name. An unrecognised callback state does not reject the pending attempt, so a CSRF mismatch surfaces as `timeout`. |
 | `instance_connected` | Credentials received and saved. `time_to_connect_ms` runs from the start of the authorize call, so it includes the browser launch. No instance or tenant name is sent. |
@@ -65,7 +67,7 @@ We collect the following categories of events:
 | `activation_menu_shown` | The activation menu was (very likely) rendered. `variant` is `warehouse` or `no_data`. **Derived** — see the note below. |
 | `activation_job_selected` / `first_job_completed` | Which activation job the user started and, where observable, finished. Completion is reported only for the job that was actually selected, so the two form a coherent pair. **Derived** — see the note below. |
 | `first_prompt_sent` | The user's first typed message in an onboarding session. Slash commands are excluded, so the hidden `/onboard-connect` submission does not count. |
-| `onboarding_abandoned` | The CLI exited during a first run without connecting. `last_stage` is the furthest point reached: `started`, `model_picker`, `provider_setup`, `big_pickle_confirm`, or `gateway_auth`. (`connected` is a funnel position but never a `last_stage` — reaching it means the run completed, which is not an abandonment.) Only emitted for a genuine first run — opening `/connect` as an existing user does not enter the funnel, and abandonment after setup completes is out of scope by definition. Emitted on the exit path under a bounded flush, so the measured rate is a lower bound — see [Delivery & Reliability](#delivery--reliability). |
+| `onboarding_abandoned` | The CLI exited during a first run without connecting. `last_stage` is the furthest point reached: `started`, `model_picker`, `provider_setup`, `big_pickle_confirm`, `free_gemini_confirm`, or `gateway_auth`. (`connected` is a funnel position but never a `last_stage` — reaching it means the run completed, which is not an abandonment.) Only emitted for a genuine first run — opening `/connect` as an existing user does not enter the funnel, and abandonment after setup completes is out of scope by definition. Emitted on the exit path under a bounded flush, so the measured rate is a lower bound — see [Delivery & Reliability](#delivery--reliability). |
 | `review_run` | A dbt/SQL review completed or failed — `invocation` (`cli` for `altimate-code review`, `tool` for the `dbt_pr_review` tool), status, duration, and on success the verdict, the pre-gating verdict, mode, risk tier, and finding counts by severity and by category. No file paths, model or column names, finding titles or bodies, SQL, diff content, or repository/branch/PR names. |
 | `review_post_outcome` | Whether a review was published to GitHub — `not_requested`, `not_attempted`, `target_unresolved`, `full`, `partial`, or `summary_failed`, plus duration. Emitted on the **CLI path only** — the `dbt_pr_review` tool completes reviews but never publishes, so a `review_run` with `invocation: tool` has no post event and that is not a failure. Within the CLI path there is exactly one per **completed** review: a review that failed emits `review_run: failed` and no post event, so absence there means the review failed rather than that an event was lost. `not_attempted` is publication requested but never reached (a bad `--output` path, a stdout write error). No repository, PR, or comment content. |
 
@@ -171,6 +173,8 @@ Altimate Code uses two types of anonymous identifiers for analytics, depending o
 
 Both identifiers are only sent when telemetry is enabled. Disable telemetry entirely with `ALTIMATE_TELEMETRY_DISABLED=true` or the config option above.
 
+The [Gemini Flash (Free)](../configure/providers.md#gemini-flash-free) tier uses a **separate** identifier, deliberately not the machine ID above: a random secret minted only when you accept its disclosure, stored with your other credentials, and sent to the free-tier gateway only as a SHA-256 hash. It exists to hold that install's usage budget, and it is never used for telemetry — the two datasets are not joined. Declining the free model, or never opening it, means the identifier is never created.
+
 ### CLI Authentication Flow
 
 When you sign in using the CLI browser auth flow (`altimate auth login`), the anonymous machine ID (a random UUID persisted at `~/.altimate/machine-id` — a device/installation identifier, reused across sessions) is included in the authorization URL and associated with your account in product analytics. This is used solely to correlate CLI install events with authenticated accounts in aggregate funnel analytics — it is not used for advertising or cross-site tracking. Your telemetry opt-out suppresses this: when you disable telemetry — via `ALTIMATE_TELEMETRY_DISABLED=true` **or** the `telemetry.disabled` config option — the machine ID is omitted from the authorization URL entirely. The machine ID is associated with your account in PostHog for this funnel analysis, separate from the Azure Application Insights pipeline used for other CLI telemetry events.