@stigmer/runner 3.12.5 → 3.12.6

package/src/activities/execute-cursor/__tests__/service-tier.test.ts

@@ -1,11 +1,12 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 /**
- * Verifies the service-tier → Cursor variant-parameter translation (#357):
- * the runner must always send an explicit selection whose price-bearing
- * parameters are a deterministic function of the requested tier — never
- * the catalog's (account-influenced) default variant.
+ * Verifies the variant-attribute → Cursor variant-parameter translation
+ * (#357 service tier, #772 thinking mode): the runner must always send an
+ * explicit selection whose user-selectable parameters are a deterministic
+ * function of the requested attributes — never the catalog's
+ * (account-influenced) default variant.
  *
  * Catalog fixtures mirror the real shapes observed 2026-08-06: composer
  * has a `fast` bool (default fast=true), haiku has a `thinking` bool
@@ -23,6 +24,7 @@ import {
   resetCatalogCacheForTests,
 } from "../service-tier.js";
 import { resolveEffectiveServiceTier } from "../../../shared/service-tier.js";
+import { resolveEffectiveThinkingMode } from "../../../shared/thinking-mode.js";
 
 const CATALOG = [
   {
@@ -66,8 +68,12 @@ const CATALOG = [
   },
 ];
 
-function opts(modelId: string, tier: ServiceTier.STANDARD | ServiceTier.FAST) {
-  return { apiKey: "key-1", modelId, tier, executionId: "aex_test" };
+function opts(
+  modelId: string,
+  tier: ServiceTier.STANDARD | ServiceTier.FAST,
+  thinking: ThinkingMode.DISABLED | ThinkingMode.ENABLED = ThinkingMode.DISABLED,
+) {
+  return { apiKey: "key-1", modelId, tier, thinking, executionId: "aex_test" };
 }
 
 beforeEach(() => {
@@ -88,6 +94,18 @@ describe("resolveEffectiveServiceTier", () => {
   });
 });
 
+describe("resolveEffectiveThinkingMode", () => {
+  it("resolves UNSPECIFIED to DISABLED — never the account default", () => {
+    expect(resolveEffectiveThinkingMode(ThinkingMode.UNSPECIFIED)).toBe(ThinkingMode.DISABLED);
+    expect(resolveEffectiveThinkingMode(undefined)).toBe(ThinkingMode.DISABLED);
+  });
+
+  it("preserves explicit DISABLED and ENABLED", () => {
+    expect(resolveEffectiveThinkingMode(ThinkingMode.DISABLED)).toBe(ThinkingMode.DISABLED);
+    expect(resolveEffectiveThinkingMode(ThinkingMode.ENABLED)).toBe(ThinkingMode.ENABLED);
+  });
+});
+
 describe("resolveServiceTierParams", () => {
   it("STANDARD pins fast=false on a fast-capable model", async () => {
     const params = await resolveServiceTierParams(opts("composer-2.5", ServiceTier.STANDARD));
@@ -123,6 +141,48 @@ describe("resolveServiceTierParams", () => {
     ]);
   });
 
+  it("ENABLED pins thinking=true on a thinking-capable model (#772)", async () => {
+    const params = await resolveServiceTierParams(
+      opts("claude-haiku-4-5", ServiceTier.STANDARD, ThinkingMode.ENABLED),
+    );
+    expect(params).toEqual([{ id: "thinking", value: "true" }]);
+  });
+
+  it("ENABLED on a model with no thinking parameter fails loudly, never a silent base variant", async () => {
+    await expect(
+      resolveServiceTierParams(opts("composer-2.5", ServiceTier.STANDARD, ThinkingMode.ENABLED)),
+    ).rejects.toThrow(/no "thinking" parameter/);
+  });
+
+  it("thinking combines freely with the fast tier — both pinned true, sorted", async () => {
+    const params = await resolveServiceTierParams(
+      opts("claude-opus-4-8", ServiceTier.FAST, ThinkingMode.ENABLED),
+    );
+    expect(params).toEqual([
+      { id: "fast", value: "true" },
+      { id: "thinking", value: "true" },
+    ]);
+  });
+
+  it("Auto + ENABLED is a loud failure (no variant dimensions to pin)", async () => {
+    await expect(
+      resolveServiceTierParams(opts("default", ServiceTier.STANDARD, ThinkingMode.ENABLED)),
+    ).rejects.toThrow(/requires a pinned model/);
+  });
+
+  it("unknown model + ENABLED fails loudly, never degrades", async () => {
+    await expect(
+      resolveServiceTierParams(opts("not-a-model", ServiceTier.STANDARD, ThinkingMode.ENABLED)),
+    ).rejects.toThrow(/does not list that model/);
+  });
+
+  it("catalog fetch failure + ENABLED fails loudly, never degrades", async () => {
+    listMock.mockRejectedValue(new Error("proxy down"));
+    await expect(
+      resolveServiceTierParams(opts("claude-haiku-4-5", ServiceTier.STANDARD, ThinkingMode.ENABLED)),
+    ).rejects.toThrow(/catalog fetch failed/);
+  });
+
   it("resolves models referenced by alias", async () => {
     const params = await resolveServiceTierParams(opts("composer", ServiceTier.STANDARD));
     expect(params).toEqual([{ id: "fast", value: "false" }]);

package/src/activities/execute-cursor/__tests__/usage-accumulator.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeAll } from "vitest";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 import { UsageAccumulator } from "../usage-accumulator.js";
 
@@ -129,4 +129,36 @@ describe("UsageAccumulator", () => {
     expect(unspecified.snapshot().estimatedCostUsd)
       .toBe(standard.snapshot().estimatedCostUsd);
   });
+
+  it("records the requested thinking mode into the snapshot (#772 audit trail)", () => {
+    const acc = new UsageAccumulator(
+      "claude-haiku-4-5",
+      ServiceTier.STANDARD,
+      [{ id: "thinking", value: "true" }],
+      ThinkingMode.ENABLED,
+    );
+    acc.addTurn({ inputTokens: 10, outputTokens: 5 });
+    const snap = acc.snapshot();
+    expect(snap.requestedThinkingMode).toBe(ThinkingMode.ENABLED);
+    expect(snap.requestedModelParams).toBe('[{"id":"thinking","value":"true"}]');
+  });
+
+  it("thinking never changes the estimate — per-token price-neutral (#772)", () => {
+    // Ledger-verified 2026-08-15: thinking wire ids bill exactly base
+    // per-token rates; the extra cost of thinking is more output tokens,
+    // which the accumulator already counts as they arrive.
+    const turn = { inputTokens: 1_000_000, outputTokens: 1_000_000 };
+
+    const disabled = new UsageAccumulator(
+      "composer-2.5", ServiceTier.STANDARD, [], ThinkingMode.DISABLED,
+    );
+    disabled.addTurn(turn);
+    const enabled = new UsageAccumulator(
+      "composer-2.5", ServiceTier.STANDARD, [], ThinkingMode.ENABLED,
+    );
+    enabled.addTurn(turn);
+
+    expect(enabled.snapshot().estimatedCostUsd)
+      .toBe(disabled.snapshot().estimatedCostUsd);
+  });
 });

package/src/activities/execute-cursor/error-classifier.ts

@@ -21,6 +21,7 @@
  */
 
 import type { CapturedRejection } from "./rejection-capture.js";
+import { PLATFORM_CAPACITY_SENTINEL } from "../../shared/model-error.js";
 
 export type ErrorCategory =
   | "auth"
@@ -212,6 +213,15 @@ interface SynthesizeErrorOpts {
   durationMs?: number;
   /** Number of messages received from the stream (0 = no response at all). */
   messageCount?: number;
+  /**
+   * True when the execution key is platform-managed (the run rides the
+   * Stigmer proxy). Enables the D4 attribution of the platform provider
+   * error contract (see shared/model-error.ts): billing errors on a
+   * platform key must never tell the customer to fix an account they do
+   * not own. BYO-key runs leave this false — there the raw Cursor message
+   * IS the actionable one (it is the user's own account).
+   */
+  proxyMode?: boolean;
 }
 
 /**
@@ -244,7 +254,38 @@ export function synthesizeError(opts: SynthesizeErrorOpts): ClassifiedError {
     return { ...classified, category: "agent-stale", retryable: true };
   }
 
-  return classified;
+  return attributePlatformBilling(classified, opts.proxyMode === true);
+}
+
+/**
+ * D4 attribution (platform provider error contract, Cursor surface): a
+ * billing error on a platform-managed key is the PLATFORM's fault — the
+ * customer's org credits are fine, and Cursor's raw prose ("reach out to
+ * an admin to enable on-demand usage") points at a Cursor dashboard they
+ * do not own. Reword with platform attribution, quoting the original so
+ * Cursor's limit-reset date survives.
+ *
+ * <p>Two cases pass through untouched: messages already carrying the
+ * sentinel (the proxy's end-stream rewrite landed — this is the runner-side
+ * fallback for the message-bearing in-stream error path the proxy relays
+ * verbatim), and BYO-key runs (the raw message is about the user's own
+ * account and must never be hidden).
+ */
+function attributePlatformBilling(
+  classified: ClassifiedError,
+  proxyMode: boolean,
+): ClassifiedError {
+  if (classified.category !== "billing" || !proxyMode) return classified;
+  if (classified.message.includes(PLATFORM_CAPACITY_SENTINEL)) return classified;
+  return {
+    ...classified,
+    message:
+      `The Stigmer platform's Cursor capacity is temporarily exhausted. ` +
+      `This is a platform-side issue - your organization's credits were not ` +
+      `charged for this call. Ask your platform operator to restock Cursor ` +
+      `execution keys. Provider message: "${classified.message}" ` +
+      `[code: ${PLATFORM_CAPACITY_SENTINEL}]`,
+  };
 }
 
 /**

package/src/activities/execute-cursor/index.ts

@@ -138,6 +138,7 @@ import { setInterceptorExecutionId, runWithExecutionContext } from "./fetch-inte
 import { closeProxySessions } from "./http2-interceptor.js";
 import { resolveModelId, ensureLoaded as ensurePricingLoaded } from "./model-pricing.js";
 import { resolveEffectiveServiceTier } from "../../shared/service-tier.js";
+import { resolveEffectiveThinkingMode } from "../../shared/thinking-mode.js";
 import { resolveServiceTierParams } from "./service-tier.js";
 import { UsageAccumulator } from "./usage-accumulator.js";
 import { StreamingUsageSummarySchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/usage_pb";
@@ -960,9 +961,10 @@ async function executeCursorInner(
     await ensurePricingLoaded();
     setupTiming.mark("load_pricing");
 
-    // Phase 6: Validate model selection and resolve the service tier.
-    // UNSPECIFIED → STANDARD resolves here and nowhere else (#357): every
-    // upstream layer preserves the caller's raw enum value.
+    // Phase 6: Validate model selection and resolve the variant attributes.
+    // UNSPECIFIED → STANDARD (#357) and UNSPECIFIED → DISABLED (#772)
+    // resolve here and nowhere else: every upstream layer preserves the
+    // caller's raw enum values.
     const requestedModel = spec.executionConfig?.modelName || "default";
     const validatedModel = resolveModelId(requestedModel);
     if (validatedModel !== requestedModel) {
@@ -971,6 +973,7 @@ async function executeCursorInner(
       );
     }
     const requestedServiceTier = resolveEffectiveServiceTier(spec.executionConfig?.serviceTier);
+    const requestedThinkingMode = resolveEffectiveThinkingMode(spec.executionConfig?.thinkingMode);
 
     heartbeat();
 
@@ -1005,13 +1008,15 @@ async function executeCursorInner(
       );
     }
 
-    // Translate the tier into the explicit variant params sent with every
-    // create/resume. Never a bare { id }: the catalog's default variant is
-    // account-influenced and picks the price (#357).
+    // Translate the tier + thinking mode into the explicit variant params
+    // sent with every create/resume. Never a bare { id }: the catalog's
+    // default variant is account-influenced and picks the served variant
+    // (#357 fast pricing, #772 thinking).
     const modelParams = await resolveServiceTierParams({
       apiKey: effectiveApiKey,
       modelId: validatedModel,
       tier: requestedServiceTier,
+      thinking: requestedThinkingMode,
       executionId,
     });
 
@@ -1228,6 +1233,7 @@ async function executeCursorInner(
       validatedModel,
       requestedServiceTier,
       modelParams,
+      requestedThinkingMode,
     );
 
     // Phase 10c: Start OTel turn span. Coarse-grained — spans the whole turn
@@ -1819,6 +1825,7 @@ async function executeCursorInner(
           fallbackContext: { model: validatedModel, mode: agentMode, agentId: resolution.agentId },
           durationMs: (result as unknown as Record<string, unknown>).durationMs as number | undefined,
           messageCount: status.messages.length,
+          proxyMode: !!config.proxyEndpoint,
         });
 
         console.error(
@@ -1958,6 +1965,7 @@ async function executeCursorInner(
             conversationErrorText: retryConversationErrorText,
             isResumedHandle: false,
             fallbackContext: { model: validatedModel, mode: agentMode, agentId: freshAgent.agentId },
+            proxyMode: !!config.proxyEndpoint,
           });
 
           status.phase = ExecutionPhase.EXECUTION_FAILED;
@@ -2259,6 +2267,7 @@ async function executeCursorInner(
         capturedRejection: getCapturedRejection(executionId),
         isResumedHandle: false,
         fallbackContext: errorContext,
+        proxyMode: !!config.proxyEndpoint,
       });
       clearCapturedRejection(executionId);
       status.phase = ExecutionPhase.EXECUTION_FAILED;

package/src/activities/execute-cursor/service-tier.ts

@@ -1,18 +1,23 @@
 /**
- * Service-tier → Cursor variant-parameter translation (stigmer/stigmer#357).
+ * Variant-attribute → Cursor variant-parameter translation
+ * (stigmer/stigmer#357 service tier, #772 thinking mode).
  *
  * The platform contract: an execution's model selection is ALWAYS explicit.
- * A bare `{ id }` lets the Cursor catalog's default variant decide the price
- * (observed 2026-08-06: composer-2.5 defaults to fast=true at ~4x base
- * rates, claude-haiku-4-5 to thinking=true), and that default follows an
- * out-of-band account setting. This module pins every price-bearing variant
- * parameter the model declares, so the billed variant is a deterministic
- * function of ExecutionConfig.service_tier:
+ * A bare `{ id }` lets the Cursor catalog's default variant decide the
+ * variant (observed 2026-08-06: composer-2.5 defaults to fast=true at ~4x
+ * base rates, claude-haiku-4-5 to thinking=true), and that default follows
+ * an out-of-band account setting. This module pins every user-selectable
+ * variant parameter the model declares, so the served variant is a
+ * deterministic function of the execution config:
  *
- * - STANDARD: every price-bearing boolean pinned to its base value
- *   (fast=false, thinking=false where the parameter exists).
- * - FAST: fast=true, thinking still pinned false.
- * - Price-neutral parameters (e.g. effort) are deliberately NOT pinned —
+ * - fast: pinned from ExecutionConfig.service_tier (FAST → true).
+ *   Price-bearing — the fast variant bills at pricingVariants.fast rates.
+ * - thinking: pinned from ExecutionConfig.thinking_mode (ENABLED → true).
+ *   Per-token price-neutral (ledger-verified 2026-08-15: thinking wire ids
+ *   bill exactly base rates; thinking+fast bills exactly the fast rate) —
+ *   pinned anyway because the served variant must never follow the account
+ *   default, and ENABLED turns consume more output (reasoning) tokens.
+ * - Parameters that are neither (e.g. effort) are deliberately NOT pinned —
  *   they follow the catalog default and do not change the bill.
  *
  * Parameter bundles come from Cursor.models.list() (worker-cached): the
@@ -20,17 +25,19 @@
  * rides the same proxy fetch-interceptor as every other SDK call, so it
  * works identically in proxy and direct modes.
  *
- * The harness-neutral halves — the tier enum semantics, and the single
- * UNSPECIFIED→STANDARD resolution point — live in
- * `shared/service-tier.ts` since #361 extended tiers to the native
- * harness; this module keeps only the Cursor-catalog translation.
+ * The harness-neutral halves — the enum semantics and the single
+ * UNSPECIFIED→default resolution points — live in `shared/service-tier.ts`
+ * (since #361 extended tiers to the native harness) and
+ * `shared/thinking-mode.ts`; this module keeps only the Cursor-catalog
+ * translation.
  */
 
 import { Cursor } from "@cursor/sdk";
 import type { ModelListItem, ModelParameterValue } from "@cursor/sdk";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 import { serviceTierLabel, type EffectiveServiceTier } from "../../shared/service-tier.js";
+import { thinkingModeLabel, type EffectiveThinkingMode } from "../../shared/thinking-mode.js";
 
 /**
  * Catalog ids that mean "Cursor picks the model" (Auto). Auto's single
@@ -42,9 +49,11 @@ import { serviceTierLabel, type EffectiveServiceTier } from "../../shared/servic
 const AUTO_MODEL_IDS = new Set(["default", "auto"]);
 
 /**
- * Variant parameter ids that change the per-token price. Pinning exactly
- * these keeps the bill deterministic while leaving latency/effort knobs on
- * their catalog defaults. Sourced from the Cursor catalog survey
+ * The user-selectable variant parameter ids. Pinning exactly these keeps
+ * the served variant deterministic while leaving effort knobs on their
+ * catalog defaults. `fast` changes the per-token price; `thinking` is
+ * price-neutral but changes token consumption and must never follow the
+ * account default. Sourced from the Cursor catalog survey
  * (stigmer-cloud _projects/2026-08/20260806.04.model-service-tier).
  */
 const FAST_PARAM_ID = "fast";
@@ -108,46 +117,55 @@ export interface ResolveServiceTierParamsOptions {
   /** Validated model id the execution runs on (may be "default" for Auto). */
   readonly modelId: string;
   readonly tier: EffectiveServiceTier;
+  readonly thinking: EffectiveThinkingMode;
   /** For log correlation only. */
   readonly executionId: string;
 }
 
 /**
- * Translate the effective tier into the explicit variant parameters to send
- * with every Agent.create/resume for this execution.
+ * Translate the effective tier + thinking mode into the explicit variant
+ * parameters to send with every Agent.create/resume for this execution.
  *
- * Fail-closed posture: FAST with no pinnable fast dimension is an error,
- * never a silent downgrade — create-time validation makes this unreachable
- * unless the registry and the provider catalog have drifted, and that drift
- * must be heard about, not absorbed.
+ * Fail-closed posture: an ACTIVE selection (FAST tier, ENABLED thinking)
+ * with no pinnable dimension is an error, never a silent downgrade —
+ * create-time validation makes this unreachable unless the registry and the
+ * provider catalog have drifted, and that drift must be heard about, not
+ * absorbed.
  *
- * STANDARD degrades to empty params on catalog failures rather than failing
- * the execution — but be clear about what that costs: an unpinned selection
- * falls to the catalog default variant, which for several models IS the
- * fast/thinking variant at multiples of base rates (the incident this module
- * exists to prevent). Failing every standard execution whenever the catalog
- * endpoint blips would be the worse trade; the WARN below plus billing's
- * requested-vs-billed mismatch alarm (which catches exactly this window)
- * are the compensating controls.
+ * The base selection (STANDARD + DISABLED) degrades to empty params on
+ * catalog failures rather than failing the execution — but be clear about
+ * what that costs: an unpinned selection falls to the catalog default
+ * variant, which for several models IS the fast/thinking variant (the
+ * incident this module exists to prevent). Failing every base execution
+ * whenever the catalog endpoint blips would be the worse trade; the WARN
+ * below plus billing's requested-vs-billed mismatch alarms (which catch
+ * exactly this window) are the compensating controls.
  */
 export async function resolveServiceTierParams(
   options: ResolveServiceTierParamsOptions,
 ): Promise<ModelParameterValue[]> {
-  const { apiKey, modelId, tier, executionId } = options;
+  const { apiKey, modelId, tier, thinking, executionId } = options;
   const tierName = serviceTierLabel(tier);
+  const thinkingName = thinkingModeLabel(thinking);
+  // Selections that actively deviate from the base variant must fail loudly
+  // when they cannot be pinned; the base selection may degrade with a WARN.
+  const active: string[] = [];
+  if (tier === ServiceTier.FAST) active.push("service_tier=fast");
+  if (thinking === ThinkingMode.ENABLED) active.push("thinking=enabled");
 
   if (AUTO_MODEL_IDS.has(modelId)) {
-    if (tier === ServiceTier.FAST) {
+    if (active.length > 0) {
       throw new Error(
-        `service_tier=fast requires a pinned model — Auto ("${modelId}") has no ` +
-        `tier dimension. Execution ${executionId} should have been refused at ` +
-        `create time; the model registry and provider catalog may have drifted.`,
+        `${active.join(" + ")} requires a pinned model — Auto ("${modelId}") has ` +
+        `no variant dimensions. Execution ${executionId} should have been ` +
+        `refused at create time; the model registry and provider catalog may ` +
+        `have drifted.`,
       );
     }
     console.log(
-      `ServiceTier: execution=${executionId} model=${modelId} tier=${tierName} — ` +
-      `Auto has no variant parameters; Cursor picks the model and variant ` +
-      `(documented v1 limitation).`,
+      `VariantParams: execution=${executionId} model=${modelId} tier=${tierName} ` +
+      `thinking=${thinkingName} — Auto has no variant parameters; Cursor picks ` +
+      `the model and variant (documented v1 limitation).`,
     );
     return [];
   }
@@ -156,37 +174,38 @@ export async function resolveServiceTierParams(
   try {
     models = await listCatalogModels(apiKey);
   } catch (err) {
-    if (tier === ServiceTier.FAST) {
+    if (active.length > 0) {
       throw new Error(
-        `service_tier=fast for execution ${executionId} needs the Cursor model ` +
-        `catalog to resolve variant params for "${modelId}", and the catalog ` +
-        `fetch failed: ${err instanceof Error ? err.message : String(err)}`,
+        `${active.join(" + ")} for execution ${executionId} needs the Cursor ` +
+        `model catalog to resolve variant params for "${modelId}", and the ` +
+        `catalog fetch failed: ${err instanceof Error ? err.message : String(err)}`,
       );
     }
     console.warn(
-      `ServiceTier UNPINNED: execution=${executionId} model=${modelId} tier=${tierName} — ` +
-      `catalog fetch failed (${err instanceof Error ? err.message : err}); ` +
-      `sending no variant params, so the catalog DEFAULT variant decides the ` +
-      `price for this execution (fast/thinking on several models — the ` +
-      `expensive direction). Billing's requested-vs-billed mismatch alarm ` +
-      `covers this window.`,
+      `VariantParams UNPINNED: execution=${executionId} model=${modelId} tier=${tierName} ` +
+      `thinking=${thinkingName} — catalog fetch failed ` +
+      `(${err instanceof Error ? err.message : err}); sending no variant params, ` +
+      `so the catalog DEFAULT variant decides the served variant for this ` +
+      `execution (fast/thinking on several models — the expensive direction). ` +
+      `Billing's requested-vs-billed mismatch alarms cover this window.`,
     );
     return [];
   }
 
   const model = findCatalogModel(models, modelId);
   if (!model) {
-    if (tier === ServiceTier.FAST) {
+    if (active.length > 0) {
       throw new Error(
-        `service_tier=fast requested for "${modelId}" (execution ${executionId}) ` +
-        `but the Cursor catalog does not list that model — cannot pin a fast ` +
-        `variant. The model registry and provider catalog have drifted.`,
+        `${active.join(" + ")} requested for "${modelId}" (execution ${executionId}) ` +
+        `but the Cursor catalog does not list that model — cannot pin its ` +
+        `variant parameters. The model registry and provider catalog have drifted.`,
       );
     }
     console.warn(
-      `ServiceTier UNPINNED: execution=${executionId} model=${modelId} tier=${tierName} — ` +
-      `model not in the Cursor catalog; sending no variant params, so the ` +
-      `catalog DEFAULT variant decides the price for this execution.`,
+      `VariantParams UNPINNED: execution=${executionId} model=${modelId} tier=${tierName} ` +
+      `thinking=${thinkingName} — model not in the Cursor catalog; sending no ` +
+      `variant params, so the catalog DEFAULT variant decides the served ` +
+      `variant for this execution.`,
     );
     return [];
   }
@@ -196,10 +215,13 @@ export async function resolveServiceTierParams(
     if (def.id === FAST_PARAM_ID) {
       params.push({ id: FAST_PARAM_ID, value: tier === ServiceTier.FAST ? "true" : "false" });
     } else if (def.id === THINKING_PARAM_ID) {
-      params.push({ id: THINKING_PARAM_ID, value: "false" });
+      params.push({
+        id: THINKING_PARAM_ID,
+        value: thinking === ThinkingMode.ENABLED ? "true" : "false",
+      });
     }
-    // Any other parameter (e.g. effort) is price-neutral: left to the
-    // catalog default variant on purpose.
+    // Any other parameter (e.g. effort) is price-neutral and not
+    // user-selectable: left to the catalog default variant on purpose.
   }
 
   if (tier === ServiceTier.FAST && !params.some((p) => p.id === FAST_PARAM_ID)) {
@@ -211,10 +233,19 @@ export async function resolveServiceTierParams(
     );
   }
 
+  if (thinking === ThinkingMode.ENABLED && !params.some((p) => p.id === THINKING_PARAM_ID)) {
+    throw new Error(
+      `thinking=enabled requested for "${modelId}" (execution ${executionId}) ` +
+      `but the Cursor catalog declares no "thinking" parameter for it. The ` +
+      `model registry claims a thinking capability the provider no longer ` +
+      `offers — refusing rather than silently serving the base variant.`,
+    );
+  }
+
   params.sort((a, b) => a.id.localeCompare(b.id));
   console.log(
-    `ServiceTier: execution=${executionId} model=${modelId} tier=${tierName} ` +
-    `params=${JSON.stringify(params)}`,
+    `VariantParams: execution=${executionId} model=${modelId} tier=${tierName} ` +
+    `thinking=${thinkingName} params=${JSON.stringify(params)}`,
   );
   return params;
 }

package/src/activities/execute-cursor/usage-accumulator.ts

@@ -14,7 +14,7 @@
  */
 
 import type { ModelParameterValue } from "@cursor/sdk";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 import { getCursorModelPricingForVariant, computeTurnCost } from "./model-pricing.js";
 
@@ -39,6 +39,8 @@ export interface UsageSnapshot {
   readonly requestedServiceTier: ServiceTier;
   /** JSON-encoded ModelSelection.params the runner sent; "" when none. */
   readonly requestedModelParams: string;
+  /** Thinking mode the runner requested — always explicit post-translation (#772). */
+  readonly requestedThinkingMode: ThinkingMode;
 }
 
 const EMPTY_SNAPSHOT: UsageSnapshot = {
@@ -53,6 +55,7 @@ const EMPTY_SNAPSHOT: UsageSnapshot = {
   observedAt: "",
   requestedServiceTier: ServiceTier.UNSPECIFIED,
   requestedModelParams: "",
+  requestedThinkingMode: ThinkingMode.UNSPECIFIED,
 };
 
 export interface TurnRecord {
@@ -85,6 +88,12 @@ export class UsageAccumulator {
      */
     private readonly requestedServiceTier: ServiceTier = ServiceTier.UNSPECIFIED,
     requestedModelParams: readonly ModelParameterValue[] = [],
+    /**
+     * The explicit thinking mode the runner requested. Price-neutral
+     * (thinking bills at base rates, #772), so it never enters the
+     * estimate — recorded purely as the audit trail twin of the tier.
+     */
+    private readonly requestedThinkingMode: ThinkingMode = ThinkingMode.UNSPECIFIED,
   ) {
     this.requestedModelParams =
       requestedModelParams.length > 0 ? JSON.stringify(requestedModelParams) : "";
@@ -154,6 +163,7 @@ export class UsageAccumulator {
       observedAt: this.observedAt,
       requestedServiceTier: this.requestedServiceTier,
       requestedModelParams: this.requestedModelParams,
+      requestedThinkingMode: this.requestedThinkingMode,
     };
   }
 }

package/src/shared/caller-identity.ts

@@ -58,15 +58,18 @@ export const ANONYMOUS_KIND = "anonymous";
 
 /**
  * Audit-actor id that backends stamp when NO caller identity exists —
- * the OSS server writes it on every create (no local auth), and the
- * cloud's AuditActorBuilder falls back to it for caller-less internal
- * writes. It names "nobody in particular": unrelated sessions from
- * unrelated people all carry it, so presenting it as a caller identity
- * would make the one string a grantable value that silently covers ALL
- * such traffic in an MCP server's binding sheet. A creator matching this
+ * the OSS server writes it on every create unless the deployment
+ * configured an operator identity (STIGMER_OPERATOR_EMAIL,
+ * stigmer/stigmer#400; a configured install stamps a real actor whose
+ * email resolves below like any other), and the cloud's
+ * AuditActorBuilder falls back to it for caller-less internal writes.
+ * It names "nobody in particular": unrelated sessions from unrelated
+ * people all carry it, so presenting it as a caller identity would make
+ * the one string a grantable value that silently covers ALL such
+ * traffic in an MCP server's binding sheet. A creator matching this
  * sentinel (and carrying no email) is therefore unresolvable and falls
  * to anonymous — the deny-by-default the docs guide already promises
- * for self-hosted backends.
+ * for unconfigured self-hosted backends.
  */
 export const SYSTEM_CREATOR_SENTINEL = "system";