Client or integration
Other
Area
Proxy and routing
Summary
The #4546 work added a durable spend-reservation ledger so token, identity and pool ceilings survive a restart. Nothing in production reaches it.
The only production call to admitWorkflowTurn() is src/server/index.ts:512, and it passes four arguments, omitting spend. src/lib/workflow-budget.ts:428 therefore never constructs sharedSpendLedger(), no reservation reaches the journal, and markDispatched, settleWorkflowSpend and abandonWorkflowSpend have no production caller. A repository-wide search finds no production configuration supplying SpendReservationPolicy.maxTokens either.
The practical effect: spend-ledger.jsonl is never created by ordinary traffic, and the ceilings the feature advertises remain process-local and count-only, resetting on restart. Nothing regressed — the capability simply is not wired.
Reproduction
- Run the proxy and send ordinary traffic.
- Look for
spend-ledger.jsonl under the OpenCodex home; it is absent.
- Read
src/server/index.ts:512 against the admitWorkflowTurn signature and the spend branch at src/lib/workflow-budget.ts:422-428.
Suggested fix: reserve at each physical dispatch once model, identity, pool, input tokens and the enforceable output ceiling are known; give every physical retry a unique send id; mark dispatched at the transport boundary and settle or mark lost from terminal usage handling; and expose an operator configuration path for the enforced limits.
Version
2.56.0 (e4a8539)
Operating system
macOS 15.5
Logs or error output
(no output: the code path never runs)
Checks
Client or integration
Other
Area
Proxy and routing
Summary
The #4546 work added a durable spend-reservation ledger so token, identity and pool ceilings survive a restart. Nothing in production reaches it.
The only production call to
admitWorkflowTurn()issrc/server/index.ts:512, and it passes four arguments, omittingspend.src/lib/workflow-budget.ts:428therefore never constructssharedSpendLedger(), no reservation reaches the journal, andmarkDispatched,settleWorkflowSpendandabandonWorkflowSpendhave no production caller. A repository-wide search finds no production configuration supplyingSpendReservationPolicy.maxTokenseither.The practical effect:
spend-ledger.jsonlis never created by ordinary traffic, and the ceilings the feature advertises remain process-local and count-only, resetting on restart. Nothing regressed — the capability simply is not wired.Reproduction
spend-ledger.jsonlunder the OpenCodex home; it is absent.src/server/index.ts:512against theadmitWorkflowTurnsignature and thespendbranch atsrc/lib/workflow-budget.ts:422-428.Suggested fix: reserve at each physical dispatch once model, identity, pool, input tokens and the enforceable output ceiling are known; give every physical retry a unique send id; mark dispatched at the transport boundary and settle or mark lost from terminal usage handling; and expose an operator configuration path for the enforced limits.
Version
2.56.0 (e4a8539)
Operating system
macOS 15.5
Logs or error output
Checks