40 lines
1.9 KiB
Markdown
40 lines
1.9 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: Planner proxy enforces effective Host token budgets before provider invocation
|
|
The Cloud planner-decision endpoint SHALL atomically reserve a conservative
|
|
bounded token amount before invoking its provider for an authenticated Host
|
|
using Cloud planner transport with an effective token budget, and SHALL reject
|
|
the request without invoking the provider when the reservation would exceed
|
|
the remaining budget.
|
|
|
|
#### Scenario: Budget permits a planner decision
|
|
- **WHEN** the Host has sufficient budget after used and reserved tokens are
|
|
considered
|
|
- **THEN** the endpoint creates a reservation and invokes the configured
|
|
provider exactly once
|
|
|
|
#### Scenario: Budget is exhausted
|
|
- **WHEN** a next planner decision would exceed the Host's effective budget
|
|
- **THEN** the endpoint returns a structured failure without invoking the
|
|
configured provider
|
|
|
|
### Requirement: Planner proxy settles provider-reported token usage without duplicating planner decision content
|
|
The Cloud planner-decision endpoint SHALL settle its reservation to the
|
|
provider-reported token usage when available and SHALL retain only non-secret
|
|
metering metadata in its usage event, never raw prompt text, screenshot bytes,
|
|
provider credentials, or session/lease secrets. This does not constrain the
|
|
separate bounded planner-decision history defined by `cloud-planner-proxy`.
|
|
|
|
#### Scenario: Provider response includes usage
|
|
- **WHEN** the configured provider returns a valid tool-call decision and
|
|
token-usage metadata
|
|
- **THEN** the endpoint records and returns the decision, settles the Host's
|
|
reservation to the reported usage, and records a usage event without request
|
|
text or screenshot bytes
|
|
|
|
#### Scenario: Usage is indeterminate after failure
|
|
- **WHEN** a reservation exists but the endpoint cannot determine provider
|
|
usage after a transport failure
|
|
- **THEN** the reservation remains until bounded expiry cleanup rather than
|
|
being released as unused
|