The replay store is the connector's one durable ledger. begin reserves the
request's worst case in the Active record it claims the request with, in one
write: a ledger that cannot be written means nothing runs. complete settles
the reservation to the charge derived from the outcome's usage under the
service's price table; a backend reports usage only, never cost, and a receipt
carrying any other cost is answered with the Provider stand-in at the whole
reservation. Amounts are integer micro-USD, prices micro-USD per million
tokens, rounded up once per request.
Refusals: CostBound (the worst case exceeds the invocation's max_cost_micro_usd,
decided before the replay lookup) and SpendCeiling (the caller's window cannot
hold the reservation, after the replay lookup). Each caller's config carries a
spend ceiling and window length, both required nonzero; windows are fixed and
aligned to the unix epoch, and a request belongs to the window it was admitted
in. The per-window spend is re-derived from the records at open.
gamecult.model.replay_record.v1 is replaced by v2 (no reader survives). The
published invocation, receipt and result schemas and their wire goldens are
regenerated; provider_request and input_reasoning_state stay byte-identical.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
b92c63149c