jason.woltje
2627321f64
Commits the 18 product paths of the row 333 R1 repair exactly as the reviewed overlay. Packet hashes: source-tests.patch sha256 a78bc385801b64be270fb9d6e84672c443738a5fce8eb68f7d2a01359a57a770 (40623 bytes), INDEX.json sha256 3eb9b8d10445aa328be3b854385e4792dda2c5712b19d443d485d1b00a18d0f8, changed-source-tests.json sha256 42f770fc3e2384362efd1e416091355c064b6cca22dd40f3b5ef8f7b67e43a52. The committed bytes were checked by applying source-tests.patch to503b91e56in a scratch tree and comparing the 18 paths. The approvals are source only: R2 (APPROVE source-only, 2026-10-26 23:32:39Z) and Boyd's first review (APPROVE, source only, 2026-10-27T00:27:55Z), both on HEAD503b91e56plus this overlay. No test has run on these bytes yet.
Optional CLIProxyAPI queue telemetry (P5)
Enable through the human plugins.set transport with plugins.usage set to
"cliproxy-queue". Omission is off. The same patch may set
usage.cliproxyQueue.pollSeconds (integer 1 through 59, default 15); usage: null
removes this setting. Both switches and polling changes are human-only, including
on the tester path. The existing instance configuration and proxy key paths do
not change.
Interface 1 exports read({client}). The bus supplies its management client;
the module never reads credentials, configuration paths or the environment.
The client performs exactly one bounded GET of
/v8/management/observability/usage/queue?count=100 per poll. Existing fixed
loopback, timeout, response byte cap and no-redirect/no-retry controls apply.
The proxy's array response is validated completely and mapped immediately:
api_key and source become their first 12 hexadecimal SHA-256 characters.
Only whitelisted token counts, a failure flag/status, and IDs leave the client.
No request IDs, failure bodies, client values or upstream values are retained.
Malformed batches fail atomically and yield a fixed, value-free failure code.
One bus/store writer owns the reader for its instance. It serializes polls,
drains the shared queue once, and assigns IDs to current and retiring model-key
metadata owners. Unknown msk- IDs go to the reconcile receipt. Foreign keys
without that prefix are ignored. Disabled businesses receive no telemetry.
Telemetry uses the existing append-only usage table with source
@proxy/cliproxy-queue, separate from native session source records. turnRecords
excludes it before every limit check and native usage total. Proxy totals may be
incomplete (60-second upstream retention and a 100-event drain); the Console
labels them proxy-reported and reports the reader's availability. They never
independently enforce quotas.
Native transcript counts carry the immutable run's safe modelKeyId in the
usage cursor, preserved at turn begin and end. The Console exposes byKey.
A business can set a daily per-key quota at
launch.limits.tokens.keys.<12-hex-key-id> with {limit, since, reset, timeZone};
the human writer stamps since. Enable limit-check: ["daily-quota"] to apply
that quota. Plain {limit,since} keys leaves remain cumulative legacy account limits, even
when the name is twelve hex characters. They use token-limit and never resolve
model metadata. Omitting a limit means no quota. Existing named account keys and
tokens.daily.<account> retain their existing behavior. Model-key limits and
resets are human-only through every organization writer. Missing, ambiguous or
foreign run-key metadata fails closed with proxy-key-refused; a retiring run
counts against its own retained key, never the agent's newer key.