Repository navigation
Merge reviewed changes for pricing provenance, cost cohorts, launch custody and SSH execution - #783
Merged
Merged
Conversation
Stacked on #766 (task-shape ceilings and the assignment-shape identity); GitHub retargets this PR to main once #766 merges. - Accepted-task cost feedback now follows the exact candidate, role, task profile and validated assignment shape. - Incomplete or unresolved cohorts cannot supply feedback; legacy and shape-unbound rows stay explicitly unattributed. - Known partial spend is reported separately, and rejected retry and rework costs stay with their originating lane. - Role-level replay keeps the expected cost until a target assignment shape is validated. - Adds attribution and refusal regressions and synchronizes the final and collect report schemas. Validation: formatting and 31 exact Linux library tests, including schema synchronization and production report persistence; Clippy and the full suites run in CI.
…ted-task-cost-cohorts-20261029
Stacked on #755 (dated operator pricing contract validator); GitHub retargets this PR to main once #755 merges. Second slice of #754. - Require a dated, scoped operator pricing contract before real-runtime USD admission; token-only accounting keeps working without one. - Keep the exact contract and table inputs and their normalized binding in authenticated run artifacts, and reject changed or expired contracts on continuation. - Use the same validated pricing view for reservations and private observed-identity settlement, including contract-priced Cursor and non-bridge Gemini runs. - Keep pricing refusal diagnostics on resume, and keep reroute refusal and the single observed-model allocation unchanged. No prices are shipped; tests use synthetic operator rates. Validation: formatting and 61 exact Linux tests passed; contained integration, Clippy and the full suites run in CI.
Stacked on #771 (selected-account lease custody); GitHub retargets this PR to main once #771 merges. First slice of #725. - Bind selected-account launches to one-shot run/operation lifecycle guards and the exact account incarnation. - Check expiry and pre-spawn revocation at admission and at spawn, and expose only reference-level lifecycle evidence. - Declare inherited credential environment inputs (including Cursor's API key) while keeping adapter-specific clearing and home confinement. - Finalize only on refusal, spawn failure or confirmed child exit or cancellation; custody is retained when the exit is unknown. Tests use synthetic child and store fixtures only. Root executor integration and coordinated rotation/revocation follow in later changes. Validation: formatting, 17 exact library tests, the launch-contract tests and the Grok and Cursor launch regressions passed on Linux; the desktop tests and platform suites run in CI.
Follow-up fix.
Second slice of #717. - Add an attempt-scoped supervised executor adapter over the existing external-agent lifecycle with an explicit trusted transport factory. The transport is built only after an exact match of the selected SSH target and its trust configuration. - Translate declared local paths into bounded logical manifest names and reuse the existing manifest and argv validation before staging. - Bind run, assignment, attempt, nonce, manifest, launch specification and collection policy through the existing lifecycle identities and idempotency keys; hold cancellation and termination custody for the whole attempt. - Reconcile lost launch replies by status without replay, and keep the exact identity and policy for lost collection replies. Remote results stay candidate evidence; the adapter never imports a candidate or cleans up. - The supervisor still refuses SSH execution; durable write-ahead receipts, import ordering and the opt-in two-host qualification follow in later changes. Qualification commands are documented, not run. Validation: formatting, ten offline fake-transport tests and the existing supervisor SSH refusal regression passed on Linux; Clippy and the full suites run in CI.
Second slice of #720. - Add closed `launch.start`, `launch.status` and `launch.cancel` operations for socket-backed authorities, bound to the exact authority, account and incarnation, the provider-declared command and the authenticated requesting identity. - Credentials stay inside the authority service; the desktop receives only an operation handle and non-secret process status. - Start, status and cancel keep lease custody for the child lifetime with idempotent retry and disconnect handling; an unknown exit keeps the lease. - Connections are served off the accept thread with a hard concurrency cap that fails closed when full, so a stuck start cannot block status or cancel of other operations. - Existing selection-mutation barriers are unchanged. Desktop client wiring follows separately. Validation: formatting and the exact core tests, including a listener regression where a blocked start does not block cancelling another live child, passed on Linux; desktop tests and platform suites run in CI.
Stacked on #774 (operator pricing contracts in budget admission); GitHub retargets this PR to main once #774 merges. Third slice of #754: report provenance for operator pricing. - Final and collect reports and rolling-window records carry the frozen contract identity (contract id, effective dates, scope, table digest and normalized binding digest) and the pricing basis of each charge. - Charges with no USD amount stay `unpriced`; `conservative_reservation` is used only when incomplete usage conserves a reserved or observed amount; cost-complete Fake charges are `synthetic`. - The contract body is stored once per run and ledger events keep only its digest and basis, so records stay within the journal size limit. - Runs with no bound contract are reported as such, not as synthetic. Historical reports and records still deserialize. - Report schemas are regenerated from Rust. No prices are shipped; tests use synthetic operator rates. Validation: formatting and the exact pricing, reporting and ledger tests passed on Linux; Clippy and the full suites run in CI.
… budget admission
…ection cohorts
…ecycle custody
…count authority
…ifest registration
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges a second batch of individually reviewed pull requests as one change, so CI runs once over the combined result. Each PR head is merged unchanged, in this order:
Closes #722.
Refs #754, #725, #720 and #717; their remaining slices follow separately.