e0c0832ae0
The reservation and the replay claim are one write in the connector's replay store; a failed ledger write runs nothing. Amounts are integer micro-USD with checked arithmetic, and the service derives every cost from usage and the configured price. One function, ProviderCall::charge, decides the charge: a result bound to its request and caller pays its true cost with a truthful overrun, anything else pays the reservation (ruling spend-bills-on-identity-not-validity). Each caller has a spend ceiling over fixed epoch-aligned windows in its root-owned config (connector-spend-caller-window-ceiling); the admission window is monotonic, so a clock stepping back cannot reopen budget, and a clock-locked caller is refused ClockBehindAdmissionWindow (spend-window-clock-ahead-fails-closed). Refusals CostBound, SpendCeiling and ClockBehindAdmissionWindow are typed. Spec eureka-body:cut_spec:cut-connector-spend.r1; reports h1-h5; Soul s5 holds (verdict eureka-body:verdict:cut-connector-spend.s5). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
218 lines
5.9 KiB
JSON
218 lines
5.9 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"title": "TransportReceipt",
|
|
"type": "object",
|
|
"properties": {
|
|
"caller_runtime_id": {
|
|
"type": "string"
|
|
},
|
|
"cost_micro_usd": {
|
|
"description": "What the request cost, in micro-USD. The service derives it from the\noutcome's usage and its price table; a backend never writes it.",
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
},
|
|
"foreign_reasoning_dropped": {
|
|
"description": "How many foreign `ReasoningState` items the service removed from the\nrequest before the backend saw it.",
|
|
"type": "integer",
|
|
"format": "uint32",
|
|
"minimum": 0
|
|
},
|
|
"model": {
|
|
"type": "string"
|
|
},
|
|
"native_request_sha256": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "integer",
|
|
"format": "uint8",
|
|
"maximum": 255,
|
|
"minimum": 0
|
|
},
|
|
"maxItems": 32,
|
|
"minItems": 32
|
|
},
|
|
"outcome": {
|
|
"$ref": "#/$defs/TransportOutcome"
|
|
},
|
|
"overrun_micro_usd": {
|
|
"description": "How far `cost_micro_usd` exceeds what the service reserved for the\nrequest: zero unless the backend reported usage above the worst case\nthe request allowed, which is a breach of the backend's contract. The\ncost is still the true one and the caller's window is charged all of\nit. The service derives this; a backend never writes it.",
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
},
|
|
"provider": {
|
|
"type": "string"
|
|
},
|
|
"provider_request_sha256": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "integer",
|
|
"format": "uint8",
|
|
"maximum": 255,
|
|
"minimum": 0
|
|
},
|
|
"maxItems": 32,
|
|
"minItems": 32
|
|
},
|
|
"request_id": {
|
|
"type": "string"
|
|
},
|
|
"schema_id": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"schema_id",
|
|
"request_id",
|
|
"caller_runtime_id",
|
|
"native_request_sha256",
|
|
"provider_request_sha256",
|
|
"model",
|
|
"provider",
|
|
"foreign_reasoning_dropped",
|
|
"cost_micro_usd",
|
|
"overrun_micro_usd",
|
|
"outcome"
|
|
],
|
|
"$defs": {
|
|
"FailureKind": {
|
|
"description": "What kind of failure a provider reported. `ResultSize` is the connector's own\nstand-in for a result whose sealed frame cannot be carried.",
|
|
"type": "string",
|
|
"enum": [
|
|
"result_size",
|
|
"invalid_request",
|
|
"authentication",
|
|
"rate_limited",
|
|
"unavailable",
|
|
"timeout",
|
|
"provider"
|
|
]
|
|
},
|
|
"StopReason": {
|
|
"description": "Why a provider stopped producing output.",
|
|
"type": "string",
|
|
"enum": [
|
|
"end_turn",
|
|
"tool_use",
|
|
"max_output_tokens",
|
|
"stop_sequence",
|
|
"refusal",
|
|
"context_window"
|
|
]
|
|
},
|
|
"TransportOutcome": {
|
|
"oneOf": [
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"Completed": {
|
|
"type": "object",
|
|
"properties": {
|
|
"provider_response_id": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"stop_reason": {
|
|
"$ref": "#/$defs/StopReason"
|
|
},
|
|
"usage": {
|
|
"$ref": "#/$defs/Usage"
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"stop_reason",
|
|
"usage"
|
|
]
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"Completed"
|
|
]
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"Failed": {
|
|
"type": "object",
|
|
"properties": {
|
|
"kind": {
|
|
"$ref": "#/$defs/FailureKind"
|
|
},
|
|
"message": {
|
|
"type": "string"
|
|
},
|
|
"usage": {
|
|
"description": "What the provider billed for the failed request: `Some` when it\nreported usage (`Some` of zeros when it billed nothing), `None`\nwhen unknown.",
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/$defs/Usage"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"kind",
|
|
"message"
|
|
]
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"Failed"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"Usage": {
|
|
"description": "Token accounting for one request, as the backend reports it; the service\nprices it. Cache reads and writes are counted apart from plain input.\n`output_tokens` includes reasoning tokens: `reasoning_tokens` is a detail\n(absent when the provider does not report it) and is never priced apart.",
|
|
"type": "object",
|
|
"properties": {
|
|
"cache_read_tokens": {
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
},
|
|
"cache_write_tokens": {
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
},
|
|
"input_tokens": {
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
},
|
|
"output_tokens": {
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
},
|
|
"reasoning_tokens": {
|
|
"type": [
|
|
"integer",
|
|
"null"
|
|
],
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"input_tokens",
|
|
"cache_read_tokens",
|
|
"cache_write_tokens",
|
|
"output_tokens"
|
|
]
|
|
}
|
|
}
|
|
}
|