diff --git a/BUILD-LOG.md b/BUILD-LOG.md index 10d72d71d..88a8df33a 100644 --- a/BUILD-LOG.md +++ b/BUILD-LOG.md @@ -5183,3 +5183,5 @@ Before: managed project/thread verbs had no Console conversation area. After: fi 2026-10-21T18:45:47Z | Huey | Q198 system-manager design r2, mos-1194, Vikunja 452 | Before: Scrooge requested changes on add7cb506 for decision-key worker exposure, cap scope and absent sampler ownership. After: distinct MOSAIC_DECISION_OPENROUTER_KEY with S6 sessionEnv canary requirement; exclusive per-instance key with per-key caps and provider limit on every enablement; S2 owns supervisor sampler and waits until after MVP/re-pin. Also records P1 interpretation, missing-confidence fallback and stand-in timeout selection, explains verified Noul spelling, excludes notifier/gateway retry loops with citations, and cites lifecycle revocation requirement. Verification: 30 pinned citation spans resolve, ten-line summary, manual diff/source review and whitespace/queue-guard checks. No builds, suites, live changes, credential reads or paid calls. 2026-10-21T19:56:11Z | Huey | Q198 design r3, mos-1201/1201a, Vikunja 452 | Before: Scrooge approved r2 7e785a08f with three notes. After: N1 names proposed system.health bus read verb and includes broker handler/authorization in S2 scope and review; N2 labels exclusive ownership as a setup attestation that cannot be mechanically proved and identifies provider key limit as real ceiling; N3 adds recommended Q4 for P1 narrowing and removes the Mos-flag instruction. Other design content retained. Verification: manual r2-to-r3 delta review, ten-line summary, whitespace and installed queue-guard checks. No builds, suites, live changes or paid calls. + +2026-10-21T20:19:53Z | Huey | Q198 design r4, mos-1203, DECISIONS Q204, Vikunja 452 | Before: r3 a36952564 presented Q1–Q4 for owner approval. After: section 9 records Q20a–Q20c verbatim as approved; D11 labels Huey’s reading of configurable daily/monthly caps with $0.10/$1 defaults in the one instance config via reviewed schema; provider key ceiling and explicit enable/key requirements retained; Q4 pending, Jason restated 2026-10-21, P1 unchanged. Verification: quotes match DECISIONS ledger, unrelated sections and P1 equal r3, ten-line summary, whitespace and installed queue guard checked. No builds, suites, live changes or paid calls. diff --git a/docs/SESSIONS.md b/docs/SESSIONS.md index b65ee3784..4d5efd9d0 100644 --- a/docs/SESSIONS.md +++ b/docs/SESSIONS.md @@ -1422,3 +1422,4 @@ are never rewritten or removed; corrections are new entries. 2026-10-21T16:34:44Z | Huey (gpt-6.1-sol) | mos-1183, Q198/Q199 system-manager design, Vikunja 452, huey/system-manager-design on 6c75887b0 | design and six proposed slices documented; pinned citations and docs checks pass; no build, suite, live action or paid call; Gitea/queue capture remains Sage-owned 2026-10-21T18:45:47Z | Huey (gpt-6.1-sol) | mos-1194, Q198 design r2, scrooge-0001 findings 1–8, Vikunja 452 | all findings addressed in design and slice acceptance criteria; 30 citation references checked, no suites/live changes/paid calls; Mos routes r2 back to Scrooge 2026-10-21T19:56:11Z | Huey (gpt-6.1-sol) | mos-1201/1201a, Q198 design r3, scrooge-0002 N1–N3 | three doc notes applied; Q4 ready for Mos’s combined owner approval question; no builds, suites, live changes or paid calls +2026-10-21T20:19:53Z | Huey (gpt-6.1-sol) | mos-1203, Q198 design r4, DECISIONS Q204 | Q1–Q3 approved quotes recorded, cap settings interpretation labelled, Q4 pending and P1 unchanged; doc-only checks, no builds/live changes/paid calls diff --git a/docs/plans/2026-10-21_q198-system-manager.md b/docs/plans/2026-10-21_q198-system-manager.md index 28c722e3b..f086a4747 100644 --- a/docs/plans/2026-10-21_q198-system-manager.md +++ b/docs/plans/2026-10-21_q198-system-manager.md @@ -12,8 +12,8 @@ No live trial, key installation or runtime change is authorized by this design. MVP work (Vikunja 414 and 416) keeps first claim on Sage’s gate. Brief: mos-1183, DECISIONS Q198/Q199, Vikunja **452**. Owner: Huey. Design only. -Revision **r3**, mos-1201, applies Scrooge’s three notes on approved r2 `7e785a08f` -(scrooge-0002). +Revision **r4**, mos-1203, records Jason’s DECISIONS Q204 answers to section 9 +on r3 `a36952564`. Q4 remains pending. All defaults below are proposals, not measured safe operating limits or new authority. ## 1. Existing pieces and reuse @@ -282,8 +282,11 @@ routing, but still account for their charge. The hook cannot authorize work, cho P0/P1 status, change thresholds, clear a kill, replay effects, or choose outside the eligible set. Recheck eligibility after it returns. Never call it for safety actions. -**D11 Cost scope.** Proposed opt-in defaults: **$0.10/day and $1/month per dedicated -decision key**, both enforced by its owning instance’s durable ledger. Each instance +**D11 Cost scope.** Huey’s reading of DECISIONS Q204 Q20b: daily and monthly USD caps +are user settings, with defaults of **$0.10/day and $1/month per dedicated decision key**. +They live in the instance’s one system config through D3’s reviewed schema/bootstrap +path. Both configured caps are enforced by the owning instance’s durable ledger. +No spending starts until Jason enables paid decisions and installs the key. Each instance must use a separately provisioned key used only for that instance’s decisions, with a non-secret provider key ID bound to the instance in the approved setup record. Exclusive ownership is a setup attestation, not something the manager can prove mechanically. @@ -351,17 +354,27 @@ bounded synthetic pressure. No load experiment on the shared development host. - **Q1 Initial authority:** should the manager ever force-stop background work just for load? **Recommend no.** Cooperative yield for load, hard stop only through an already-authorized safety/explicit stop. Broader authority needs a separate decision. + **Approved**, DECISIONS Q204. Jason, verbatim: “Q20a: no” - **Q2 Trial spend:** accept $0.10/day and $1/month per exclusive instance key, with a provider-side key ceiling for every enablement? **Recommend yes**, with the combined account budget shown and rules staying default until Jason enables it and installs the slot. Q199 provides readiness, not approval to spend now. + **Approved**, DECISIONS Q204. Jason, verbatim: “Q20b: yes, tunable in the settings.” + Huey’s reading: D11’s daily/monthly caps become user settings with the stated defaults. + The provider-side key limit remains required for every enablement and is the real ceiling. + Nothing spends until Jason enables paid decisions and installs the key. - **Q3 Reroute consent:** may setup authorize a named alternative model/provider list? **Recommend yes**, per role and privacy requirement. Empty list means hold/fail visibly instead of silently changing providers or model quality. -- **Q4 System recovery priority:** approve the P1 narrowing of Q198 so heavy recovery + **Approved**, DECISIONS Q204. Jason, verbatim: “Q20c: yes” +- **Q4 System recovery priority (pending, Jason restated 2026-10-21):** approve the + P1 narrowing of Q198 so heavy recovery takes priority over eligible normal work but still waits for authorization, kill-clear and hard capacity? **Recommend yes.** Keep health/reconciliation on reserved control capacity, without letting a recovery launch bypass those safeguards. + DECISIONS Q204 Q20d is conditional on Jason’s reading about returning to normal + operations, which differs from the design’s P1 recovery admission restriction. Mos + has restated the distinction to Jason. Q4 remains pending, with P1 unchanged. ## Verification and handoff