feat(usage): distinguish unknown prices, estimates and provider receipts #1133

Outcome

Media handlers assume zero cost and upstream reports show cache/reasoning estimates replacing real usage. Audit local pricing fallback and all response paths; do not mark unpriced work free.

Evidence and source state

DurinDoor baseline: 93f6de64c69b17d52f790d6f14d09a74cffc7fa5.

• open-sse/providers/pricing.js
• src/sse/services/apiKeyPolicy.js
• omniroute #14604: fix(backend): one unpriced model blocks a usage-limited API key on every model, with a misleading quota message | OPEN
• omniroute #14608: feat(api): configurable unpriced-usage budget policy + admin notice (#14604) | OPEN
• omniroute #15529: feat(api): X-OmniRoute-Response-Cost reports metered rates for flat-rate subscription providers, disagreeing with analytics | OPEN

Implementation subtasks and acceptance criteria

• Record price provenance and authoritative/estimated/unknown usage states.
• Preserve provider cached/reasoning detail without double-counting.
• Document how budgets behave for unpriced/subscription/free models and test overrides.

Dependencies

• fix(usage): complete paid usage, price provenance and dollar-budget accounting #1085

Parent epic: #1063. Roadmap: #1056. Priority P1. Stage 1.

Delivery contract

Planning ticket only. No implementation, runtime test, live-provider call, deployment or stored-data mutation was performed in this audit. Before a port, confirm a merged final upstream diff or a reachable source commit, compare local equivalents/tests, and preserve local auth/routing/quota/database contracts. Open upstream work remains a review candidate. Use port(omniroute): title and target a focused PR at bloodf/durindoor:main. Behavior changes require a focused test plus docs. Run npm run lint and cd tests && npm run test:ci; never add baseline failures. Pure docs/CI edits may skip runtime tests. Regenerate registry/agent indexes with their scripts. Preserve stored credentials and unrelated work.

Implementation moved to #1085

The complete original scope and acceptance criteria are preserved in #1085. Follow that canonical ticket for implementation and verification. This consolidation does not mean the work shipped. Original discussion and source links remain here.

Implementation review evidence — 2026-10-19.

This is supplemental evidence for an already-closed issue; its existing state and acceptance record are preserved.

PR #1275, reviewed current head 77d93460954940a54d70bf815c3cba33aa1cf4b1: Reconciled main while retaining MCP epoch admission and sanitized errors. Fixed Gemini thoughts/cache token accounting and strict numeric USD receipt validation. Retained raw async video receipt provenance through terminal persistence and idempotent replay. Snapshotted exact token rates and builtin/override origin; cleared stale caller price metadata for known/unknown valuations. Added executable PostgreSQL multi-process counters/epoch/rollback/idempotence and terminal-crash/reopen fixture. Added exact provider/model native USD-unit overrides through pricing API and persistence: image, audio second, video second/job, speech character. Measured quantities only; no fabricated vendor default rates. Provider USD receipts now outrank provisional STT duration estimates and operator tariffs. Native rate/unit/quantity provenance is frozen at first ledger commit. Generated chat response cost fields now identify builtin estimated source, rate snapshot and response-token basis; no claim they equal configured/raw-token ledger estimates. Exact-head focused verification passed 991/991 assertions across 63 files in one command, zero skipped; actual PostgreSQL 18.6 passed 14/14 cases, zero skipped, including six multiprocess accounting and eight live cases. Root lint, docs, fixture ESLint and pinned commitlint passed. Native tariffs are explicit flat operator rates for one exact provider/model; size/quality/resolution or tiered native tariff dimensions are rejected rather than guessed. Unknown measured quantities remain unknown even under a zero tariff; provider receipts keep precedence. Vendor invoices/live provider accounts are not established by offline fixtures; public builtin chat response estimates can differ from configured raw-token ledger estimates and now identify that basis. Existing numeric committed-spend admission preserved: unknown-cost counts remain visible; configured free/subscription token values remain estimates, provider numeric zero is known. No invented deny-on-unknown decision or owner acceptance.

The linked PR records the exact-head full-checkpoint result and receipt separately. Focused, earlier-head and runtime evidence here does not itself establish a protected CI pass or issue-wide acceptance. Existing issue scope, acceptance checklist, state, Project phase/cycle, labels and dependencies are preserved; no owner acceptance, release decision or closure is inferred.

Reviewed PR evidence — 2026-10-19

• PR #1275, 77d93460954940a54d70bf815c3cba33aa1cf4b1: independently authenticated full local gate and published V5 Local CI success; 12,964 assertions passed, zero failed, 71 reviewed conditional assertions skipped. The skipped assertions were not executed. Receipt SHA-256 62ad1e3bde42375e06c0b5d1c1769768e75954134975a4abb720b9f459316313. See the PR description for source changes, focused history and runtime limits.

This records the bounded PR evidence on the named heads. It does not close this issue, check acceptance boxes, establish live-provider or all-platform acceptance, or change Project phases, cycles, labels, dependencies or ownership. A later head or main change requires fresh integration evidence.