Node.js healthtech review: recording served vendor per request for quality comparison

A healthtech access reviewer needs a record of which model vendor handled each request, along with evidence of what a single credential can reach. Grouping metrics by the configured default does not establish actual attribution, and retaining every prompt would make the evidence store itself a sensitive-access risk. The proposed approach reads routing configuration at service startup, records the vendor reported in each response's metadata, and refreshes the configuration snapshot after changes. Missing vendor values are flagged as attribution gaps rather than replaced with the default, and bearer secrets are kept out of events, metric labels, and sign-off documents. Quality comparisons are kept in a separate, sampled dataset and joined to attribution events through correlation references held outside metric labels.