[P1] [SPX-AI-014] Enforce nonrefundable live-model budgets, deadlines and cancellation at every attempt

SPX-AI-014 — Enforce nonrefundable live-model budgets, deadlines and cancellation at every attempt

Priority: P1 | Workstream: agent-runtime | Import action: New implementation issue
Planning baseline: wavect/semaprax@ae25c6a49dc09ec4613c7a6f52a27daa69dcd3f3 (11 September 2026).
Implementation prerequisites: SPX-AI-013
Important: prerequisites mean the required implementation/evidence is accepted, not merely that its GitHub issue exists.

Outcome

Bound live execution across valid responses, invalid proposals, retries, cancellation and uncertain provider outcomes. Extend existing accounting rather than resetting usage on recovery or hiding failed-call cost.

Current evidence and distinction from existing work

Runtime v1 includes request/response, attempt, time, token and cost-related limits. Typed Runtime v2 already meters stages and effect bytes. Joining these routes requires a single explicit policy for actual versus reserved versus unknown usage; a provider timeout does not prove zero billing.

Read these owners first

Directory pointers are navigation roots. Resolve current files with rg --files; proposed new files must follow the current module ownership. The referenced snapshot may be older than the implementing branch.

Bounded scope and non-goals

Define bounded per-attempt and cumulative ceilings for provider work, context bytes, response bytes, stage fuel and effects. Monetary limits are conservative reservations using operator-supplied pricing, not a promise of exact live billing. Do not weaken existing effect or stage budgets to accommodate provider behavior.

Implementation steps

Reuse current budget types where their semantics match. Otherwise introduce an explicitly versioned accounting extension distinguishing reserved, observed and unknown provider usage, and document the reconciliation rule.
Reserve allowed request/response work before dispatch. Reject a request whose maximum admitted work cannot fit the remaining budget. Count malformed-response repair attempts, provider failures and canceled in-flight calls as attempts.
Use one monotonic deadline budget for the invocation and preserve consumed duration/reservations through suspension and recovery. An external wall clock may expire a deadline sooner; it must not refund prior elapsed work.
Check cancellation before each model call, stage, authorization and effect dispatch. If the transport cannot forcibly interrupt in-flight work, report that limitation and wait for controlled settlement without publishing its late result.
Implement bounded retry policy by error class. Do not automatically replay an uncertain non-idempotent effect. A model retry is separately identified and conservatively charged, even if no token counter is returned.
Keep live price lookup outside the compiler. Validate operator-provided units and arithmetic with checked integers; disclose estimates and unknown billing rather than reporting false exact savings.
Add table-driven boundary tests at zero, exact-limit and limit-plus-one for every counter. Ensure terminal evidence retains usage consumed before failure and cannot be replaced by a clean zero-usage outcome.

Required tests and failure cases

Invalid proposals consume attempts and retained input/output work; they cannot loop for free.
Timeout with unknown billing conservatively retains reservation and never appears as zero usage.
Cancellation before dispatch makes zero calls; cancellation in flight blocks subsequent effects and result publication.
Resume and migration preserve cumulative ceilings and cannot reset the provider deadline.
Counter overflow, negative configuration and unit mismatch refuse before dispatch.

Test discovery and integration

Use rg --files src tests scripts and the owning harness command cargo test --locked -p semaprax --test <existing-harness> -- --list or its existing library selector. Replace <existing-harness> with the owner established from the references. Register new focused tests in that harness, prove they execute, then run the documented full profile. Do not copy a guessed selector into CI and accept a zero-test success.

Definition of done

All live paths enforce one cumulative accounting policy with explicit uncertainty.
No retry, malformed response, suspension or migration refunds spent work.
Evidence distinguishes observed counters from reservation and price estimates.

Guardrails for the implementing agent

Read the current AGENTS.md, affected RFC/specification, completion rows and architecture owners before implementation. This pack is pinned planning input, not permission to ignore newer code or decisions.
Use a private worktree and a private CARGO_TARGET_DIR inside it. Do not use git stash, overwrite sibling worktrees, or share compiler/test scratch output. Add tests to the existing owning harness, not a new compiler-linking top-level test binary unless repository rules require it.
Preserve source/graph/schema compatibility where contracted, left-to-right evaluation, lazy operands, ownership transfer, canonical cleanup order and sticky failure. Do not weaken tests, diagnostics, range checks or authority checks to get green.
A proposed new shape/API below is a design target, not a claim that syntax or a command already exists. Run --help and discover exact test selectors. Zero selected tests, unavailable tools and skipped required rows are not execution evidence.
Keep model output as untrusted data; compiler facts and evidence never mint capabilities. Human support/publication decisions, paid model calls and real registry/Git writes require their own explicit authority.
Reuse implemented Agent v2, migrations, iterators, closures, semantic candidates, persistent HIR cache and hosted PG grammar/metadata work. If the requested slice already landed, verify its gate and close only the residual gap rather than building a competitor implementation inside this repo.

Evidence to attach before closing

For the implementation handoff, include: exact starting and finishing commit; changed files and their owning invariants; the pre-fix failure or negative-control result; exact commands, exit status and nonzero selected test counts; target/toolchain/provider identity; artifact/log locations; and remaining limitations. Run the repository's complete required quality profile (scripts/quality.sh full on supported Unix, or the documented platform equivalent) before merge. A local focused pass is not hosted evidence and a green framework is not a completed model experiment. For architecture/ABI/ownership changes, obtain independent semantic review before promotion. Do not mark an execution issue complete using authored tests or documentation alone.

feat(live-invocation): enforce nonrefundable budgets, deadlines and c…

feat(live-invocation): migrate a suspended invocation with history an…

feat(model-budget-policy): admit model calls, retries and failover ag…

Integrated a tested residual slice from 84e91e01c48ca76dd98c506940c765c23aa73311 to bd5a19d6b607c232681872d2f98f460e86d6e40c on main. This issue remains OPEN.

OpenCodeProposalSource now requires an explicit wrapper around the existing InvocationBudgetHook: fixed positive operator reservation, bounded attempt receipts, reservation before dispatch, and nonrefundable usage through malformed retries and uncertain failures. Provider token counters remain optional observations, not pricing authority.
Shared check_deadline uses the existing ledger clock/absolute deadline without another ledger or wire format. Late settled model responses fail before decoding; the kernel also checks effect/publication boundaries. Already selected provider/cancellation/effect failures and real EffectObserved entries remain intact. Failed usage retains bounded known attempted bytes.
Source receipts remain host-only/in-memory. A late settled response records failed usage and the closed accounting refusal before withholding bytes from the canonical decoder.

Validation (all exit0): cargo test --locked -p semaprax --lib live_invocation:: 103 passed; cargo test --locked -p semaprax-toolchain --lib opencode_host -- --test-threads=1 39 passed; bundle pin 1, module-size 1, source-contract coverage 1; updated example built and returned offline status=Complete; formatting/diff checks passed. Exact-deadline/just-before cases use injected clocks advanced inside the actual fake handler, assert dispatch/decoder/effect counts, and validate causal journals plus terminal replay. No new provider call or full/hosted profile rerun for this slice, following the operator's speed preference. Local logs are .agent-logs/0913-accounting-{kernel-tests,source-tests,bundle-pin,module-size,source-contracts,example-build,offline-example}.log in the integration worktree.

Remaining acceptance: durable source reservation/receipt journal and recovery/migration binding; persistent source deadline across restart and checks around all source stages/effects/publication; explicit monetary pricing/unit binding rather than the example's one operation unit. Existing generic-kernel recovery is not evidence that the source path has these capabilities. Independent review accepted the bounded source/kernel ordering and identified these residuals. See the updated OpenCode host and live-invocation contracts for the boundary.

Progress pushed to main: bd5a19d6b607c232681872d2f98f460e86d6e40c → 1d2a3e09cf1c027c5a784bf1d53619743f3aa653.

The existing source driver now checks its source's shared ledger deadline before/after stage callbacks, before proposal decode, around effect dispatch, before reduction, and around non-Fail result publication. Cancellation uses the post-callback guards too. An actual OpenCode source forwards to the same accounting ledger; no second driver or reservation counter was introduced. Checked reducer Fail remains sticky.

Local offline evidence (macOS arm64, rustc 1.98.0; private target, serial compiler):

cargo test --locked -p semaprax --lib agent_lifecycle::iterative::driver::tests: 8 passed. Includes callback-expired Complete refusal and simultaneous callback cancellation/deadline preserving checked Fail.
cargo test --locked -p semaprax-toolchain --lib opencode_host:: -- --test-threads=1: 41 passed. Includes expiry before initialization with zero calls/charge and expiry inside an actual adapter read with one retained model charge and no result publication.
Bundle pin: 1 passed; module-size: 1 passed (regenerator ignored); source-locked contract: 1 passed. Formatting/diff checks passed.

Logs: integration worktree .agent-logs/0913-source-boundaries-*. No provider call or full profile was repeated for this bounded batch, following the operator's explicit speed instruction. Tests initially exposed new test-only expect_err Debug bounds; fixed without changing the production result type.

Still OPEN: durable source attempt/effect journal, recovery/migration accounting and restart-stable deadline binding, declared monetary units/pricing, and complete terminal failure evidence. The public source route still returns diagnostics without its partial run on deadline error. docs/SOURCE-LIVE-JOURNAL-V1.md is an explicitly UNIMPLEMENTED draft defining that next integration contract. #114 remains closed for its accepted generic-kernel persistence scope; this does not replace or reopen it.

Main 5e869a29 adds bounded source checkpoint primitives: strict typed causal ordering, canonical recovery, charged uncertain intents, poisoned cursors after store acknowledgement failures, and restoration through the existing cumulative budget/deadline ledger. Recovery requires the latest authoritative generation and a restart-stable host clock.

Validation: 116 live-invocation tests, the bundle pin, module-size and source-locked contract checks (119 passed total), plus root all-target Clippy with warnings denied. No full-suite, hosted or live-provider durability claim.

This is a foundation for #113, not completion: source-driver/adapter wiring, checked stage and effect replay, terminal failure evidence, provider receipts and migration remain pending. #113 stays open; accepted generic-kernel persistence in #114 remains unchanged. The next increment is the explicit OpenCode attempt checkpoint boundary.

Checkpoint explicit OpenCode source proposal attempts

Main 4b91e7d7 adds an explicit OpenCodeProposalSource::propose_checkpointed attempt boundary over the existing source journal and accounting ledger. Bound context, reservation units, response cap, clock domain and journal phase are checked before charging. The intent must be acknowledged before transport; cancellation/deadline are checked again after store callbacks. A late-arriving response is a charged failure; expiry during settlement acknowledgement retains the already committed raw response but refuses exposing it. Previously selected settlement failures stay selected.

Focused validation: 50 OpenCode host tests, 118 live-invocation tests, four CI planner tests, module-size/source-locked checks, and the regenerated bundle pin: 175 passed, plus root/toolchain all-target Clippy with warnings denied. Fixtures cover both store failure outcomes, no redispatch after acknowledgement loss, wrong binding/policy, clock rollback, and distinct arrival-versus-acknowledgement deadlines. No live provider was called and no full quality suite was rerun.

This is attempt checkpointing only. Ordinary run_live remains unchanged and nondurable. Full checked source-driver wiring, replay, terminal failure evidence, provider receipt persistence and migration remain pending; #113 stays open. The same push also fixes CI example-target routing (817f8e92) without omitting example coverage or accepting unknown kinds.

Execute and recover source runs through one checkpoint ledger

Progress pushed to main in eb943c0: the durable source route now executes through the existing checked iterative driver with one cumulative model-budget ledger and a source journal v2. Replay reserves fresh evaluation fuel, matches causal stage/request/effect identity before new work, retains optional usage and terminal evidence, and refuses uncertain redispatch. The OpenCode wrapper borrows the same ledger. Failed acknowledgements preserve the last acknowledged checkpoint and poison further writes.

Focused local evidence: 43 iterative-driver tests (including 18 source-route tests), 22 source-journal tests, and 55 OpenCode adapter tests passed. Adversarial cases cover replay charging, uncertain model/effect intent, clock regression, deadline/cancellation at acknowledgement boundaries, and terminal recovery. Bundle, documentation metadata, module-size, and source-locked ownership checks passed. Independent semantic review found no blocking issue in this tranche.

No live provider was called. Latest exclusive-writer storage and clock-epoch guarantees remain host responsibilities. Source migration (#115) and the supported durable CLI (#116) remain pending; this issue stays open for its remaining integration scope. Hosted CI is handled separately.

Clarify historical source journal gates against implemented v2 route

Add private durable source CLI and catalog batch gates (Refs #113, #116…

Pushed to main in ea330594: private semaprax-full source-live run/resume/migrate now joins the existing durable source driver and OpenCode adapter. The host retains an exclusive checkpoint-directory lock, publishes each acknowledged generation through held-directory file descriptors, binds source/task/read snapshot/policy, preserves clock floors on migration, and refuses uncertain replay or a second migration destination. Public compiler CLI capability remains unchanged.

Local focused evidence: 9 actual CLI module tests, 22 existing source adapter tests, 10 help tests, installed public/private help checks, and a final private CLI build passed. The recorded-transport migration test uses epoch time, terminal recovery makes zero dispatches, and changed inputs fail closed. Checkpoint regressions cover held-directory rename, writer exclusion, publication failure poisoning, symlink/FIFO refusal, and empty incomplete checkpoints. No live model was called; hosted CI is owned separately.

This closes the missing durable host wiring, not all of #113. Operator-priced monetary accounting and the complete zero/exact/plus-one counter matrix remain outstanding. Reservation units are not a claim of exact billing. #116 also remains open for the actual failed-check → reviewed semantic candidate → repair/publication workflow.

Pin durable model reservation boundary accounting (Refs #113)

Additional focused integration evidence pushed in f3d206f5: reservation=2 work units with cumulative ceilings 0,2,3 produces 0,1,1 actual model/effect dispatches. The fixture proves the source requests the next attempt and receives BudgetExhausted before it dispatches; terminal evidence retains 0,2,2 committed units and 0,1,1 attempts. Recovery makes zero proposal/model/effect calls and preserves generation and terminal evidence bytes.

Actual root library selector agent_lifecycle::iterative::source_live::tests::budget_boundaries selected 1 table-driven test and passed all three rows plus recovery cases. Final formatting, module size and bundle pin pass. No live calls or product semantics changed. These are opaque reservation/work units, not monetary billing. #113 remains open for priced accounting and the rest of the counter boundary matrix.

Add durable priced source accounting and bound uncached graph peaks

Pushed f2070b15734c71b7d7a3c38f8ec3ef936c9cdb50 → fbef4a8cab7bdc9ef79fb744a5f6e697b7011910 to main. This issue remains OPEN.

The explicit priced source route now binds an integer operator quote (work unit, currency, decimal scale, rate and ceiling) into a separate source-journal v4 identity. Its acknowledged attempt intent reserves work and money before dispatch. Replay reconstructs reservations, explicit Unknown/Observed charge evidence and overage without refunds; malformed repair attempts remain charged. Historical ordinal and turn/attempt checks reject relabeled evidence, and changed quotes cannot recover an existing run.

The private CLI selects this route with exact config v2 and emits receipt v2 monetary counters. Failures retain acknowledged monetary counters too. The OpenCode adapter reports monetary charge as Unknown because its untyped cost has no currency/scale authority. Existing v1/v2/v3 profiles and unpriced CLI behavior are preserved. Priced migration currently refuses explicitly, before claim/dispatch; its checked monetary carry remains unfinished.

Local validation (serial compiler/private target, no provider call): 152 live-invocation tests, 21 source-route tests, 13 CLI tests, 55 OpenCode tests, plus bundle pin, module-size and source-boundary checks passed. Monetary fixtures cover zero/exact/one-over ceilings, malformed retry exhaustion, overflow/unit/currency refusal, retained unknown exposure, quote drift and terminal recovery without redispatch. Two initially misplaced exact-boundary fixture assertions were corrected before the final pass. Independent bounded review found no concrete monetary/replay defect. Logs are .agent-logs/0913-priced-{live,source,cli,bundle}-final.log and .agent-logs/0913-opencode-priced-regressions.log in the private integration worktree.

Remaining: priced migration/cumulative carry and the full all-counter/all-live-path acceptance matrix. No hosted CI, live billing, live-provider, or full quality-profile claim; those gates were not rerun under the operator's speed/CI ownership instructions.

Preserve priced accounting across checked source migrations (#113)

Implemented and pushed fbef4a8cab7bdc9ef79fb744a5f6e697b7011910 → 87a3ab721ddeedbf5806a83fa1e30432686204d2.

Priced source migration now derives cumulative reserved/observed/unknown/overage accounting and the global attempt ordinal from the authenticated recovered predecessor. Compatible quotes can narrow ceilings without refunding history. The existing checked migration evaluator and journal prefix are reused; migrated attempt identities bind the handoff. The private CLI supports one priced handoff; the embedding API has an actual retained-Project A→B→C gate. Unpriced/priced conversion is refused.

Focused local evidence on macOS arm64 / Rust 1.98 / recorded OpenCode transport:

cargo test --locked -p semaprax --features unstable-workflow-profiling --lib live_invocation -- --test-threads=1: 156 passed, including ordinal-overflow state preservation and priced carry/replay.
Current library binary, agent_lifecycle::iterative::source_live: 22 passed, including priced malformed retry and cancellation before/after settlement.
Current agent_runtime_v1 binary, source_migration: 8 passed, including priced A→B→C with narrowing ceilings, retained 21→42→63 exposure, ordinals 0–8, zero-dispatch recovery, and old migration regressions.
cargo test --locked -p semaprax-toolchain --features semaprax/unstable-workflow-profiling --lib source_live_cli -- --test-threads=1: 14 passed, including priced migration money boundaries 7/14/15 and terminal recovery.
Bundle pin, module-size, formatting and diff checks passed. Independent static migration review found no further concrete defect after corrections.

Negative runs exposed and corrected the missing carried sink ordinal, overflow mutation ordering, and fixture clock/ceiling errors. Local logs are .agent-logs/0913-migration-{live,source,cli,bundle}-final.log and 0913-source-migration-integration.log in the integration checkout. No paid/live provider experiment, full quality profile, or hosted CI claim; focused checks follow the maintainer's speed override.

Still OPEN: finish the actual adapter prompt/response and malformed-retry accounting assertions, invalid quote predispatch boundary table, priced deadline cross-product, and final criterion mapping. Migration completion alone is not the whole issue.

Exercise priced adapter boundaries and imported byte views (#113, #103)

Pushed 87a3ab72 → 7360e0745d9242853d94a989548a9b7e375486c9.

Added actual priced OpenCode-adapter checks for canonical task/context prompt bytes, malformed-then-valid retry with two separately charged quotes, exact retained request byte counts and settled response bytes (including the malformed response), unchanged terminal recovery, and invalid/lowercase/negative/overflow quotes refused before transport or checkpoint publication. Added real clock advances at RunOpened and AttemptSettled acknowledgements to prove zero versus retained unknown monetary exposure and no subsequent effects. The source test helper now accepts the existing clock trait.

Local macOS arm64 / Rust1.98 / Node24.3 evidence: three new CLI adapter tests passed; full owning source_live_cli selector17 passed; agent_lifecycle::iterative::source_live23 passed; bundle pin and module-size passed; fmt/diff checks passed. Logs .agent-logs/0913-priced-adapter-{first,cli-final}.log, 0913-priced-deadline-final.log, 0913-source-budget-boundaries-final.log. Initial fixtures wrongly assumed expired preflight creates a terminal journal; the final test advances the real clock only after acknowledged journal entries. No production runtime semantics changed in this commit, no paid provider or hosted/full-quality claim.

Still open: functional scope remains. Source policy currently records request/response bytes and has per-attempt caps, but no cumulative context-byte/response-byte ceilings. The older untyped live and typed runtime routes are not all wired into the explicit V4 operator-money accounting. Also finish the actual priced timeout and remaining counter/deadline boundary mapping. These are not replaced by the passing tests above. The current source audit is .agent-logs/0913-113-final-audit.md; its pending-build statements are superseded by these successful results, while its functional gaps remain.

Implemented the cumulative source provider I/O policy in main 54d8606f5d89d84af29802d4f13ff46f01382676 (starting head 7360e0745d9242853d94a989548a9b7e375486c9).

The additive V5 binding reserves exact canonical prompt bytes and the full per-attempt response limit before acknowledging an intent or dispatching. Request and response reservations never refund; settled response bytes are observed separately, and failed/uncertain responses retain Unknown reservation even with nonzero transport attempted bytes. Replay revalidates the same accounting. Checked migration carries totals across A→B→C and refuses widening or dropping the profile. CLI config/receipt v3 exposes this with strict operator pricing and I/O limits; V1–V4 journal and older CLI profiles keep their existing bytes. Owning spec: docs/SOURCE-LIVE-IO-V5.md.

Focused local macOS arm64 / Rust 1.98 checks (private target, one builder, no live provider):

cargo test --locked -p semaprax --features unstable-workflow-profiling --lib live_invocation: 158 passed (before the final three-line optional getter guard).
cargo test --locked -p semaprax-toolchain --features semaprax/unstable-workflow-profiling --lib source_live_cli: 21 passed, including zero/exact/one-short request and response limits, malformed retry, retained receipts, replay, drift and one-hop migration.
cargo test --locked -p semaprax --features unstable-workflow-profiling --test agent_runtime_v1 source_migration: 9 passed, including V5 A→B→C ending at the exact response ceiling and legacy API/profile/widening rejection.
cargo test --locked -p semaprax --features unstable-workflow-profiling --lib source_live: 23 passed on the final production source.
Module-size check and formatting passed; regenerated agent bundle bytes unchanged.

Evidence logs: .agent-logs/0913-io-{lib,cli-final,migration,source-final,module-size,fmt}.log in the integration worktree. Independent Terra read-only admission/replay/migration review found no concrete bypass. Initial authored fixtures were corrected for export-session arguments, acknowledged initialization on refusal, and exact API/cap semantics before the successful owning harness runs.

Still open: the older untyped/typed live paths do not all share the explicit operator-money + cumulative I/O policy; finish the remaining cross-path deadline/cancellation/counter mapping before claiming the issue-wide definition of done. No full quality profile or hosted CI claim; the user explicitly prioritizes minimal necessary checks and assigns hosted CI elsewhere. #85 remains excluded.

Pushed a concrete cancellation-path fix in 8501433.

OpenCode host cancellation observed before the attempt intent now returns Cancelled with zero runner calls, no intent and no reservation. The checked source session preserves that classification only when the adapter reports zero dispatch, the journal has not changed and its sink is healthy. A claimed dispatch or any journal mutation without the required receipt remains ModelFailed; an unresolved attempt is not converted to a clean stop.

The public outcome is a SourceLiveFailure with selected Cancelled, not a successful terminal checkpoint. No new journal schema or competing accounting ledger was added.

Two focused regressions passed locally: opencode_host::source_tests::durable_source::durable_source_host_cancellation_before_intent_is_a_zero_dispatch_terminal in the semaprax-toolchain lib harness, and agent_lifecycle::iterative::source_live::tests::adversarial_tests::predispatch_terminal_requires_an_untouched_journal_and_missing_receipts_model_fail in the semaprax lib harness. The latter covers clean cancellation, an adapter-written intent with a zero-dispatch claim, and a claimed dispatch lacking a receipt. Logs: .agent-logs/0913-opencode-predispatch-cancel.log and 0913-predispatch-cancel-final.log.

This issue stays open for its broader all-live-path accounting requirements. No full or hosted gates were run, per the requested workflow.

Pushed 06bec1c29adc0cc9c28671ba64bb2e7975a3381f from 85014337. Direct Runtime v1 now passes positive remaining monotonic time to provider calls and an additive tool deadline hook; exact expiration refuses dispatch/late sink bytes. Legacy tool hosts retain source compatibility and cooperative cancellation only.

A separate bounded accounting receipt distinguishes nonrefundable reserved exposure, explicitly reported charge, and unknown exposure without changing frozen Trace/Evidence v1 bytes. Missing/default usage stays unknown; explicitly reported zero is observed zero. Valid usage survives malformed proposal parsing. Receipt reconciliation checks bounded canonical structure, run/trace/evidence links, ordered attempts and totals; it conveys no billing or dispatch authority.

Focused local checks passed: agent_runtime::tests::deadline (2 tests), agent_runtime::tests::accounting (1 test including missing/zero/malformed response and hostile receipt mutation). One shared build also produced the owning integration harness. Logs: .agent-logs/0913-priority-{deadline,accounting}.log in the integration checkout. Module budgets and formatting pass; source-authority audit now joins extracted helpers. No full/hosted gates repeated.

Still open for generic untyped live operator-price/I/O composition and issue-wide acceptance. Source V4/V5 recovery/migration already exists and is not being rebuilt.

Accepted implementation commit 1e9e1d1d (main), following b8e7ccca.

Generic live execution now pairs an exact quoted work reservation with money accounting and durably commits them before dispatch. The additive persisted-priced-journal.v1 envelope recovers unknown generic provider charges, rejects identity drift, and carries immutable predecessor exposure into a constrained successor. Existing generic journal bytes remain unchanged. Three focused tests cover settled accounting, unresolved durable intent with zero redispatch, and successor dispatch/recovery. Remaining: durable cumulative generic I/O limits and production work-ledger adapter; source V5 already owns its separate I/O profile.

Validation: private macOS Rust build, one job, focused gates only. Generic priced3 PASS; source live1 PASS; source policy denial/nonrefund1 PASS; retained-vector1 PASS. No full or hosted CI gates; issue remains open for stated residual scope. Logs: .agent-logs/0913-next-*-final.log and .agent-logs/0913-next-graph.log.

Pushed e56a492b (22-file combined batch): generic priced-I/O v2 retains exact complete canonical requests, worst-case response exposure, observed/unknown usage, and nonrefundable successor carry. Independent recovery reconstructs all typed request fields and rejects noncanonical bytes; monetary and I/O handoffs must share predecessor identity/generation/chain. Production cumulative work ledger supports exact pricing quotes. A mutating quote-violating host now causes a durable conservative reservation plus pre-dispatch refusal, never a model call.

Focused local gates: priced6 PASS (five in 0913-durable-priced-final.log, final host-violation in 0913-priced-host-final.log), pure I/O2 PASS, affected cancellation5 and cumulative budget2 PASS. Shared builds succeeded; no full/hosted gates per operator. Independent review drove handoff/canonicality/ACK fixes. #113 remains open: two agents are now implementing the remaining durable SourceModelPolicyLedger quote/usage bridge using an additive Source Live profile and existing migration authority.

Implemented through dfc7b8696ed6dd241712d0802fced495a5027472 on main. This final tranche starts at 8da8ef38; implementation commit 4308e16e adds 29 files / 4,234 lines, merged with the concurrent main fixes in 9faa3a98.

The remaining typed-source gap is now executable: V6 journals bind exact model/policy identities, effective limits and absolute deadlines, ACK quote-derived reservations before provider work, retain observed/unknown exposure without refunds, and preserve cumulative ordinals/token/cost/I/O exposure through real typed migration and terminal replay. Ordinary policy admission also retains observed quote overages. The typed migration facade reuses the existing linked migration authority and typed dispatcher; raw V6 policy facts are internal.

Acceptance mapping:

Malformed/failed/cancelled/uncertain attempts retain reservations; existing bounded generic retry/repair paths remain separately charged. Unsupported source retry/provider switches refuse.
Pre-dispatch cancellation/deadline gates prevent factory/start; in-flight settlement cannot publish late effects/results. Source-dispatch traversal counters remain distinct from physical adapter starts.
Recovery and migration carry ceilings and the original deadline; destination clock floors cannot rewind. The new actual A→B test checks cumulative observed overage, I/O reservations, rejected I/O widening/runtime substitution, and terminal replay with a hostile quoter and zero new provider/effect calls.
Checked quote/unit/counter validation and existing generic priced/I/O guards reject invalid configuration, mismatch and overflow. The new token table covers zero, exact and exhausted capacity; cost-overage and zero-latency cases refuse while keeping earlier evidence.

Final local validation on the merged implementation:
cargo test --locked --features unstable-workflow-profiling --lib --test agent_runtime_v1 --no-run passed (2m29s; private target, jobs=1, incremental/debug=0). The profiling feature was only reused for existing artifacts, not #85 work.

Library selector policy_v6: 3 passed.
Integration selector execution_revision::typed::live_streaming: 8 passed, including real typed V6+I/O migration and the existing unpriced compatibility/cancellation cases.
After an existing success fixture was given explicit source cost headroom (its zero-cost policy correctly refused newly retained observed overage), the integration-only rebuild passed in 2.57s and all eight passed again. Zero-cost refusal tests remain intact.

Logs: .agent-logs/0913-policy-v6-main-merge-build.log, 0913-policy-v6-main-lib.log, 0913-policy-v6-success-fixture-build.log, 0913-policy-v6-main-streaming-final.log. Independent reviews covered journal chronology/carry, typed identity/effect/deadline narrowing and ordinary deadline admission. The discovered raw-AST graph accounting shortcut was rejected and excluded from this batch.

Per maintainer direction, only necessary focused local checks were run; full/hosted CI is being handled separately. This does not claim actual provider billing, live hosted-provider verification or provider-switch migration support. Implementation criteria are complete; closing #113.

feat(source-live): surface the compiled reducer's evidence in run rec…

Navigation Menu

Repository navigation

[P1] [SPX-AI-014] Enforce nonrefundable live-model budgets, deadlines and cancellation at every attempt #113

SPX-AI-014 — Enforce nonrefundable live-model budgets, deadlines and cancellation at every attempt

Outcome

Current evidence and distinction from existing work

Read these owners first

Bounded scope and non-goals

Implementation steps

Required tests and failure cases

Test discovery and integration

Definition of done

Guardrails for the implementing agent

Evidence to attach before closing

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[P1] [SPX-AI-014] Enforce nonrefundable live-model budgets, deadlines and cancellation at every attempt #113

Description

SPX-AI-014 — Enforce nonrefundable live-model budgets, deadlines and cancellation at every attempt

Outcome

Current evidence and distinction from existing work

Read these owners first

Bounded scope and non-goals

Implementation steps

Required tests and failure cases

Test discovery and integration

Definition of done

Guardrails for the implementing agent

Evidence to attach before closing

Activity

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

wsdt commented on Sep 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions