53 lines
2.5 KiB
Markdown
53 lines
2.5 KiB
Markdown
## ADDED Requirements
|
|
|
|
### Requirement: Cloud-proxied planner calls produce durable non-secret usage events
|
|
After the Cloud planner proxy resolves a provider call, the system SHALL record
|
|
a durable usage event with Host, provider/model, provider-reported token
|
|
counts, request outcome, and known task-attempt context, while excluding raw
|
|
prompts, screenshots, provider credentials, cookies, and lease secrets.
|
|
|
|
#### Scenario: Provider returns token usage
|
|
- **WHEN** a Cloud-proxied planner call completes with provider-reported token
|
|
counts
|
|
- **THEN** the system stores those counts against the authenticated Host and
|
|
returns the planner decision without exposing secret request content
|
|
|
|
#### Scenario: Assignment context is available
|
|
- **WHEN** the Host makes a proxied planner call while executing a claimed
|
|
assignment
|
|
- **THEN** the recorded event includes that task id and attempt identifier
|
|
|
|
### Requirement: Host token budgets use atomic reservation and settlement
|
|
The Cloud planner proxy SHALL atomically reserve a conservative per-call token
|
|
amount before a provider invocation for every Host with an effective AI token
|
|
budget using Cloud planner transport, SHALL reject over-budget calls before
|
|
invoking the provider, and SHALL settle the reservation to provider-reported
|
|
usage when available.
|
|
|
|
#### Scenario: Remaining budget permits a call
|
|
- **WHEN** used tokens plus active reservations and the next conservative
|
|
reservation are within the Host's UTC-day budget
|
|
- **THEN** the proxy reserves budget, invokes the provider, and settles the
|
|
reservation after the provider response
|
|
|
|
#### Scenario: Remaining budget is insufficient
|
|
- **WHEN** the next reservation would exceed the Host's effective budget
|
|
- **THEN** the proxy rejects the planner call without invoking the provider
|
|
|
|
#### Scenario: Provider outcome has unknown usage
|
|
- **WHEN** a transport failure prevents the proxy from determining actual
|
|
provider usage after reservation
|
|
- **THEN** the reservation remains active until bounded expiry cleanup rather
|
|
than being released optimistically
|
|
|
|
### Requirement: Direct planner transport is explicitly unmetered
|
|
The system SHALL represent a Host using direct-to-provider planner transport as
|
|
unmetered for Cloud token accounting and SHALL not report it as complying with
|
|
a Cloud-enforced token budget.
|
|
|
|
#### Scenario: Console inspects a direct-transport Host
|
|
- **WHEN** an authorized operator views AI usage for a Host not using Cloud
|
|
planner transport
|
|
- **THEN** the system reports the Host as unmetered rather than zero usage or
|
|
hard-budget-enforced
|