provider-SSOT P2-B -> main: billing derives from provider (re-target #1971) #1972

Merged

hongming merged 3 commits from feat/internal-718-p2a-registry-codegen-distribution into main 2026-05-28 02:09:10 +00:00

Conversation 0 Commits 3 Files Changed 12

+1177 -232

hongming commented 2026-05-28 01:23:45 +00:00

Owner

Copy Link

Copy Source

Re-targets the already-Five-Axis-APPROVED P2-B (#1971) content to main. #1971 was merged into the P2-A branch (feat/internal-718-p2a-registry-codegen-distribution) because Gitea did not auto-retarget it to main after #1970 merged. #1970 (P2-A) is already in main, so this PR carries exactly the #1971 billing-derive delta. internal#718 P2-B. Behavior-affecting: non-platform provider -> byok + fail-closed; platform/unset -> platform_managed unchanged.

Re-targets the already-Five-Axis-APPROVED P2-B (#1971) content to main. #1971 was merged into the P2-A branch (feat/internal-718-p2a-registry-codegen-distribution) because Gitea did not auto-retarget it to main after #1970 merged. #1970 (P2-A) is already in main, so this PR carries exactly the #1971 billing-derive delta. internal#718 P2-B. Behavior-affecting: non-platform provider -> byok + fail-closed; platform/unset -> platform_managed unchanged.

hongming added 2 commits 2026-05-28 01:23:46 +00:00

fix(workspace-server): P2-B internal#718 — billing/credential decision DERIVES the provider; supersede #1966 stored-read; retire org rung; only-registered validation (BEHAVIOR-AFFECTING) ... 3165b98cc8

Re-points the platform-vs-BYOK billing/credential decision to DERIVE the provider
from (runtime, model) via the registry SSOT, per the CTO directive (internal#718
comment, 2026-05-27): "the billing read must DERIVE the provider, not read a
stored LLM_PROVIDER", "remove LLM_PROVIDER entirely as a billing source", "retire
organizations.llm_billing_mode as a billing source".

## BEHAVIOR DELTA (this PR changes behavior — tested explicitly)
- platform-derived (or unset → platform default) → platform_managed → platform
  creds. UNCHANGED.
- non-platform-derived → byok → the already-merged #1963 strips platform
  scope:global LLM creds + FAIL-CLOSES if the workspace has no own cred. THIS IS
  THE INTENDED FIX (the Reno billing-leak class: Reno Stars SEO 352e3c2b /
  Marketing 6b66de8d ran on the platform's Anthropic credits because the never-
  written org rung always resolved platform_managed).
- unset model → platform default (CTO-confirmed).

## What changed
- `ResolveLLMBillingModeDerived(ctx, ws, runtime, model, authEnv)` — the new SSOT
  resolver: explicit `workspaces.llm_billing_mode` override (precedence 1, the
  only stored billing signal that survives — operator escape hatch) → else
  DeriveProvider + IsPlatform → else default-closed platform_managed.
- `ResolveLLMBillingMode(ctx, ws, orgMode)` legacy signature retained for callers
  without (runtime, model) (admin route, secrets remote-pull): reads the stored
  runtime + MODEL + auth-env names from DB and delegates to the derived resolver.
  `orgMode` is RETIRED/ignored; the org rung is gone.
- `applyPlatformManagedLLMEnv` calls the derived resolver directly (it has
  runtime + model + the workspace env) — no stored LLM_PROVIDER read. Feeds
  #1963's strip + fail-closed the correct DERIVED signal.
- SUPERSEDES core#1966: that PR made the billing read consult a stored
  LLM_PROVIDER first; this reworks the decision onto derive-from-provider. #1966
  should be closed in favor of this.
- Removed the now-dead org-default normalization (normalizeOrgDefault).
- ONLY-REGISTERED validation at create (model_registry_validation.go +
  WorkspaceHandler.Create): a (runtime, model) not in the registry's
  ModelsForRuntime for a REGISTRY-known runtime is flagged
  (X-Molecule-Model-Unregistered header + warning log). P2 = WARN mode (NOT hard
  422) because the legacy colon-namespaced model vocabulary ("anthropic:claude-
  opus-4-7") is still live across the create/import/template corpus and is not
  yet reconciled into the registry — hard-reject is a one-line flip gated on
  P3/P4 vocabulary convergence. Fails OPEN for non-registry runtimes
  (langgraph/external/kimi/mock/federated) so those flows are unchanged.

## Tests (TDD; behavior delta explicit)
- llm_billing_mode_derived_test.go — platform/non-platform/unset/override/
  unregistered/auth-env-disambiguation table + DB-error default-closed + empty-id.
- workspace_provision_shared_test.go — DERIVED platform→unchanged,
  non-platform→byok+strip+fail-closed (the FIX), unset→platform default, through
  the real applyPlatformManagedLLMEnv path. Existing #1963 override-byok strip +
  fail-closed tests unchanged (still pass).
- model_registry_validation_test.go + workspace_test.go — only-registered warn +
  registered-no-warn + non-registry-fail-open.
- Reworked the legacy resolver/admin/secrets tests off the retired org rung.

## Build/CI
go build ./... (+ -tags=integration) green; full `go test ./...` (43 pkgs) green
incl. -race on handlers; vet clean; changed files gofmt-clean. cp#362 anthropic
passthrough untouched (CP repo); merged #1963 strip+fail-closed reused unchanged.

internal#718 P2-B. BEHAVIOR-AFFECTING. Supersedes #1966. Not merged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Merge pull request 'P2-B internal#718: billing/credential derives from provider + only-registered validation (BEHAVIOR-AFFECTING; supersedes #1966)' (#1971) from feat/internal-718-p2b-billing-derives-from-provider into feat/internal-718-p2a-registry-codegen-distribution 3ab690c273

agent-reviewer approved these changes 2026-05-28 01:26:42 +00:00

Dismissed

agent-reviewer left a comment

Member

Copy Link

Copy Source

re-target of Five-Axis-APPROVED #1971 (3165b98c) to main; diff confirmed identical P2-B delta, zero P2-A files

re-target of Five-Axis-APPROVED #1971 (3165b98c) to main; diff confirmed identical P2-B delta, zero P2-A files

claude-ceo-assistant approved these changes 2026-05-28 01:27:09 +00:00

Dismissed

claude-ceo-assistant left a comment

Owner

Copy Link

Copy Source

2nd approval (claude-ceo-assistant). Concur with agent-reviewer Five-Axis verdict (CTO-approved batch). Merge once required checks green.

2nd approval (claude-ceo-assistant). Concur with agent-reviewer Five-Axis verdict (CTO-approved batch). Merge once required checks green.

hongming added 1 commit 2026-05-28 01:39:29 +00:00

test(workspace-server): remove unused wantWhy field in model_registry_validation_test (golangci-lint unused) — internal#718 P2-B 924dfa5598

hongming dismissed agent-reviewer's review 2026-05-28 01:39:29 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

hongming dismissed claude-ceo-assistant's review 2026-05-28 01:39:29 +00:00

Reason:

New commits pushed, approval review dismissed automatically according to repository settings

agent-reviewer approved these changes 2026-05-28 01:42:03 +00:00

agent-reviewer left a comment

Member

Copy Link

Copy Source

re-approve after stale-dismiss; sole delta vs approved 3ab690c2 is removal of unused wantWhy test field (golangci-lint unused), compile-safe, P2-B substance unchanged

re-approve after stale-dismiss; sole delta vs approved 3ab690c2 is removal of unused wantWhy test field (golangci-lint unused), compile-safe, P2-B substance unchanged

claude-ceo-assistant approved these changes 2026-05-28 02:09:09 +00:00

claude-ceo-assistant left a comment

Owner

Copy Link

Copy Source

re-approve on current head 924dfa55 after the golangci-lint wantWhy fix; P2-B substance unchanged (Five-Axis APPROVED #7786)

re-approve on current head 924dfa55 after the golangci-lint wantWhy fix; P2-B substance unchanged (Five-Axis APPROVED #7786)

hongming merged commit 1e783ff6a2 into main 2026-05-28 02:09:10 +00:00

hongming referenced this issue from a commit 2026-05-28 02:09:10 +00:00

Merge pull request 'provider-SSOT P2-B -> main: billing derives from provider (re-target #1971)' (#1972) from feat/internal-718-p2a-registry-codegen-distribution into main

hongming referenced this issue from a commit 2026-05-28 02:14:59 +00:00

feat(workspace-server): P3 internal#718 — serve GET /templates selectable provider/model list from the registry

hongming referenced this pull request 2026-05-28 02:15:39 +00:00

P3 internal#718: serve GET /templates selectable provider/model list FROM the registry (PR-A backend; NOT merged) #1977

hongming referenced this issue from a commit 2026-05-28 02:21:08 +00:00

feat(workspace-server): P3 internal#718 — serve GET /templates selectable provider/model list from the registry

Sign in to join this conversation.

Reviewers

No Reviewers

agent-reviewer

claude-ceo-assistant

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#1972