2.5 KiB
ADDED Requirements
Requirement: Cloud-proxied planner calls produce durable non-secret usage events
After the Cloud planner proxy resolves a provider call, the system SHALL record a durable usage event with Host, provider/model, provider-reported token counts, request outcome, and known task-attempt context, while excluding raw prompts, screenshots, provider credentials, cookies, and lease secrets.
Scenario: Provider returns token usage
- WHEN a Cloud-proxied planner call completes with provider-reported token counts
- THEN the system stores those counts against the authenticated Host and returns the planner decision without exposing secret request content
Scenario: Assignment context is available
- WHEN the Host makes a proxied planner call while executing a claimed assignment
- THEN the recorded event includes that task id and attempt identifier
Requirement: Host token budgets use atomic reservation and settlement
The Cloud planner proxy SHALL atomically reserve a conservative per-call token amount before a provider invocation for every Host with an effective AI token budget using Cloud planner transport, SHALL reject over-budget calls before invoking the provider, and SHALL settle the reservation to provider-reported usage when available.
Scenario: Remaining budget permits a call
- WHEN used tokens plus active reservations and the next conservative reservation are within the Host's UTC-day budget
- THEN the proxy reserves budget, invokes the provider, and settles the reservation after the provider response
Scenario: Remaining budget is insufficient
- WHEN the next reservation would exceed the Host's effective budget
- THEN the proxy rejects the planner call without invoking the provider
Scenario: Provider outcome has unknown usage
- WHEN a transport failure prevents the proxy from determining actual provider usage after reservation
- THEN the reservation remains active until bounded expiry cleanup rather than being released optimistically
Requirement: Direct planner transport is explicitly unmetered
The system SHALL represent a Host using direct-to-provider planner transport as unmetered for Cloud token accounting and SHALL not report it as complying with a Cloud-enforced token budget.
Scenario: Console inspects a direct-transport Host
- WHEN an authorized operator views AI usage for a Host not using Cloud planner transport
- THEN the system reports the Host as unmetered rather than zero usage or hard-budget-enforced