marginfuse 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed4b052cde767f31778131e10df10f850d206c4db7f2215040de98faec393af0
-  data.tar.gz: 428cb94a4937c73876d998db48026aea9b2f8b69730b1149bd5e3947051a19c9
+  metadata.gz: c0b1ac060efeb37a1cff83a21bfec10f5e5972c67622a637100b00746a9defbe
+  data.tar.gz: '0058b2089e6d46488e0db908ad66e675f83e1b4a8116abdb2edef4a557e7445f'
 SHA512:
-  metadata.gz: e7d968bfd7aa9d82acaa132b72402396cca466b6940d825da506326b7a508376dcbacf203cc16529a7f8d98c0a52f9e3b6d04ba3341820ca1eea8541b0443bb5
-  data.tar.gz: 2cd18e81de9e717d56607177da46c46c758bb46a443c9bebe2298e16ad68873156bd1e5123d3b09c24460f68823d53ec7064d942be43da0938d52e07fa2b1a5e
+  metadata.gz: 79059326eec63bb75f28c62b93d144d236d14450d477100be60423b7a6a655dfba9556277f9452ae55f204b8c90e60bb43fcc9008fe3bfedc5b4dbf8f0c334a8
+  data.tar.gz: 0f8bea6add4ee66ac6badb04073b362b08f1ab22524479407b9cd1b475b7d2f152e69d020a41c712eadef3dcf5fd667bc82ce005edb8e39b3682bc4f7734ceb9

data/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project
 follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0]
+
+### Fixed
+
+- A downgrade that crosses vendors is reported against the vendor that actually
+  ran it. `guard()` already ran the model the server chose, but the usage event
+  still named the requested provider, so the call was priced from the wrong
+  catalog and the saving the downgrade exists to prove was computed against the
+  wrong basis. An `allow` is unchanged, because the decision already defaults
+  its provider to the requested one.
+- A downgrade whose provider call then fails is acknowledged as
+  `used_downgrade_model` rather than `proceeded_as_requested`. The cheaper model
+  did run; what failed came after. Reporting otherwise told reconciliation the
+  policy never applied, which skewed realized-savings attribution on the error
+  path.
+
+### Changed
+
+- Pinned contract v2, whose new scenarios cover both corrections above and add
+  a privacy check that hands the SDK content-bearing fields and scans the bytes
+  that actually leave the process.
+
 ## [0.2.0]
 
 ### Added

data/lib/marginfuse/client.rb

@@ -208,7 +208,8 @@ module MarginFuse
     #
     # Yields the decision to the block, which must return a hash with +:usage+
     # and optionally +:result+, +:cost_usd+ and +:outcome+. Use
-    # +decision.model+: a downgrade verdict changes it.
+    # +decision.model+ and +decision.provider+: a downgrade verdict changes
+    # them, and it can send you to another vendor.
     #
     # It yields rather than returning a decision for you to act on, because
     # enforcement must not depend on the caller remembering to check anything.
@@ -234,27 +235,34 @@ module MarginFuse
         return GuardOutcome.new(kind: :topup_required, decision: decision)
       end
 
+      # A downgrade can cross vendors, so the vendor that ran the call comes
+      # from the decision exactly as the model does. Reporting the caller's
+      # would price the call from the wrong catalog and credit the saving to the
+      # wrong vendor. The decision defaults both to what was asked for, so
+      # anything but a downgrade reports what it always did.
       model_used = decision.action == :downgrade ? decision.model : model
+      provider_used = decision.action == :downgrade ? decision.provider : provider
+      # A downgrade whose provider call then fails is still a downgrade: the
+      # cheaper model is the one that ran, so both paths acknowledge the same.
+      acknowledgment =
+        decision.action == :downgrade ? :used_downgrade_model : :proceeded_as_requested
 
       begin
         call = yield(decision)
       rescue Exception => e # rubocop:disable Lint/RescueException
-        track(customer_id: customer_id, plan: plan, feature: feature, provider: provider,
+        track(customer_id: customer_id, plan: plan, feature: feature, provider: provider_used,
               model: model_used, requested_model: model, usage: {},
               outcome: :provider_error, decision_id: decision.id)
-        acknowledge(decision.id, :proceeded_as_requested) if decision.id
+        acknowledge(decision.id, acknowledgment) if decision.id
         raise e
       end
 
       call ||= {}
-      track(customer_id: customer_id, plan: plan, feature: feature, provider: provider,
+      track(customer_id: customer_id, plan: plan, feature: feature, provider: provider_used,
             model: model_used, requested_model: model, usage: call[:usage],
             cost_usd: call[:cost_usd], outcome: call[:outcome] || :success,
             decision_id: decision.id)
-      if decision.id
-        acknowledge(decision.id,
-                    decision.action == :downgrade ? :used_downgrade_model : :proceeded_as_requested)
-      end
+      acknowledge(decision.id, acknowledgment) if decision.id
 
       GuardOutcome.new(kind: :completed, decision: decision, result: call[:result])
     end

data/lib/marginfuse/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module MarginFuse
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 
   # The version of the shared SDK contract this build was verified against.
   #
@@ -12,5 +12,5 @@ module MarginFuse
   # same vectors.
   #
   # See github.com/marginfuse/sdk-contract
-  CONTRACT_VERSION = 1
+  CONTRACT_VERSION = 2
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: marginfuse
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Pemira Labs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-03 00:00:00.000000000 Z
+date: 2026-09-04 00:00:00.000000000 Z
 dependencies: []
 description: |-
   MarginFuse server-side SDK. Connect revenue to per-request AI cost, see gross