cartethyia 2.7.2 → 2.7.3

package/src/transport/dispatch/proxy-request.ts

@@ -1,6 +1,9 @@
 import { isBundledProviderId } from "../../providers/provider-contracts";
 import type { ProviderDispatchContext, ProviderId, ProviderAdapter } from "../../providers/provider-contracts";
 import { GatewayError } from "../../protocol/gateway-error";
+import { isWrappedInjectionProvider } from "../../console/system-prompt/contracts";
+import { resolveTenantSystemPrompt } from "../request/system-prompt-injection";
+import { readTenantSystemPromptsForDispatch } from "../request/tenant-preferences";
 import type { CanonicalEvent } from "../../protocol/canonical-model";
 import { resolveCredentialForAccount } from "../../providers/operations/provider-credential-service";
 import type { ByokUpstreamHost } from "../../providers/operations/provider-catalog-service";
@@ -115,6 +118,26 @@ export async function handleProviderProxyRequest(
   if (!prepared)
     throw new GatewayError("admission_unavailable", 503, "The request was not prepared, so no route can be dialed. Resend the request.");
   const canonicalRequest = await applyTenantPreferences(prepared, deps.db);
+  // Tenant system-prompt injection, resolved once per request. For providers
+  // whose upstream validates the fixed system prompt as a channel identity
+  // (the buddy family), the text cannot ride the canonical `system` array —
+  // the adapter replaces it — so it travels through dispatch context and the
+  // adapter folds it into its fixed turn, wrapped in the gateway's markers.
+  // `override` degrades to wrapped append there: stripping the identity would
+  // have the upstream refuse the request outright.
+  const candidateForPrompt = prepared.candidate;
+  const tenantSystemPromptText = isWrappedInjectionProvider(candidateForPrompt.provider_id)
+    ? resolveTenantSystemPrompt(
+        await readTenantSystemPromptsForDispatch(
+          deps.db,
+          prepared.authorization.snapshot.tenant_id,
+        ),
+        {
+          providerId: candidateForPrompt.provider_id,
+          modelId: candidateForPrompt.model_id,
+        },
+      )?.text
+    : undefined;
   // Per-tenant timeout, applied as soon as the tenant is known. The deadline
   // was armed at admission with the deployment default; this re-arms it.
   await applyTenantDeadlineOverride(
@@ -153,8 +176,13 @@ export async function handleProviderProxyRequest(
       estimatedOutputTokens: prepared.estimatedOutputTokens,
       authorizationSnapshot: prepared.authorization.snapshot,
       // A continuation borrows the held Cursor Run: one upstream turn must not
-      // occupy two account/pool concurrency slots.
-      ...(prepared.continuationAffinity === undefined ? {} : { borrowsHeldSession: true }),
+      // occupy two account/pool concurrency slots. A rebaseable continuation
+      // (complete history, pinned account no longer routable) does NOT borrow —
+      // it starts a fresh Run on a newly selected account, so it leases like a
+      // normal request.
+      ...(prepared.continuationAffinity === undefined || prepared.continuationAffinity.rebaseable
+        ? {}
+        : { borrowsHeldSession: true }),
     },
     candidates: attemptCandidates,
     tenantId: prepared.authorization.tenantId,
@@ -231,6 +259,7 @@ export async function handleProviderProxyRequest(
           ? {}
           : { imageClampMaxBytes: state.imageClampMaxBytes }),
         ...(conversationAffinity ? { conversationAffinity } : {}),
+        ...(tenantSystemPromptText === undefined ? {} : { tenantSystemPrompt: tenantSystemPromptText }),
         ...(candidate.user_agent === undefined ? {} : { userAgent: candidate.user_agent }),
         ...(deps.networkBindingFactory
           ? {

package/src/transport/dispatch/streaming/stream.ts

@@ -50,7 +50,9 @@ import {
   resolveCaptureModeForRequest,
   shouldCaptureProviderBodyForRequest,
 } from "../capture-policy";
-import { resolveTenantImageClampMaxBytes } from "../../request/tenant-preferences";
+import { resolveTenantImageClampMaxBytes, readTenantSystemPromptsForDispatch } from "../../request/tenant-preferences";
+import { resolveTenantSystemPrompt } from "../../request/system-prompt-injection";
+import { isWrappedInjectionProvider } from "../../../console/system-prompt/contracts";
 import { proxySuccessHeaders, buildUpstreamDispatchContext } from "../upstream";
 import type { AttemptLeaseOwnership } from "../leases";
 import type { ProviderContinuationScope } from "../../../providers/provider-contracts";
@@ -217,6 +219,19 @@ export async function dispatchStreamingAttempt(input: StreamingDispatchInput): P
       ? {}
       : { imageClampMaxBytes: state.imageClampMaxBytes }),
     ...(conversationAffinity ? { conversationAffinity } : {}),
+    // Same wrapped-injection text the non-streaming path carries: providers
+    // whose upstream validates the fixed system prompt as a channel identity
+    // (the buddy family) receive the tenant prompt through dispatch context
+    // so the adapter can fold it into its fixed turn. `override` degrades to
+    // wrapped append there; stripping the identity would be refused outright.
+    ...(await (async () => {
+      if (!isWrappedInjectionProvider(candidate.provider_id)) return {};
+      const text = resolveTenantSystemPrompt(
+        await readTenantSystemPromptsForDispatch(deps.db, prepared.authorization.snapshot.tenant_id),
+        { providerId: candidate.provider_id, modelId: candidate.model_id },
+      )?.text;
+      return text === undefined ? {} : { tenantSystemPrompt: text };
+    })()),
     ...(candidate.user_agent === undefined ? {} : { userAgent: candidate.user_agent }),
     ...(wrappedOutboundFetch ? { outboundFetch: wrappedOutboundFetch } : {}),
     ...(outboundFetch ? { outboundAttachmentFetch: outboundFetch } : {}),

package/src/transport/dispatch/upstream.ts

@@ -61,6 +61,13 @@ export function buildUpstreamDispatchContext(input: {
    * database handle.
    */
   readonly imageClampMaxBytes?: number;
+  /**
+   * Tenant system-prompt text resolved once per request (append/override
+   * injection). Carried through dispatch because the buddy adapters fold it
+   * into their fixed system turn after serialization — the canonical level
+   * cannot reach that turn.
+   */
+  readonly tenantSystemPrompt?: string;
   /** Opaque identity shared by retries of one logical gateway request. */
   readonly requestIdentity?: object;
 }): Record<string, unknown> {
@@ -101,6 +108,9 @@ export function buildUpstreamDispatchContext(input: {
     ...(input.imageClampMaxBytes === undefined
       ? {}
       : { image_clamp_max_bytes: input.imageClampMaxBytes }),
+    ...(input.tenantSystemPrompt === undefined
+      ? {}
+      : { tenant_system_prompt: input.tenantSystemPrompt }),
     ...(input.requestIdentity ? { request_identity: input.requestIdentity } : {}),
   } as Record<string, unknown>;
 }

package/src/transport/request/preparer.ts

@@ -2,6 +2,7 @@ import { GatewayError } from "../../protocol/gateway-error";
 import type { CanonicalRequest, ServiceKind } from "../../protocol/canonical-model";
 import { toolResultParts } from "../../protocol/canonical-model";
 import type { ApiKeyAdmissionService } from "../../security/admission/service";
+import type { CallerIdentity } from "../../security/access-control";
 import type { RouteCandidate as RouteCandidate, InMemoryRouteSnapshotService, RoutePlan } from "../routing/route-model";
 import type { RouteContinuationAffinity } from "../routing/route-model";
 import { resolveAliasTarget, type RoutingEngine } from "../routing/router";
@@ -80,6 +81,8 @@ export function resolveContinuationAffinity(
     apiKeyId: authorization.id,
   };
   let affinity: RouteContinuationAffinity | undefined;
+  let anyResolved = false;
+  let allResolved = true;
   for (const callId of ids) {
     // The registry resolves by tenant + API key + provider + account, so a call
     // id replayed from another key or tenant resolves nothing.
@@ -91,6 +94,7 @@ export function resolveContinuationAffinity(
       // through the ids that still resolve; when none do, the ordinary routing
       // path decides (a Cursor adapter may rebase the full history into a
       // fresh Run).
+      allResolved = false;
       continue;
     }
     if (affinity !== undefined && affinity.providerAccountId !== record.providerAccountId) {
@@ -101,12 +105,21 @@ export function resolveContinuationAffinity(
         { callIds: [...ids] },
       );
     }
+    anyResolved = true;
     affinity = {
       providerId: record.providerId,
       providerAccountId: record.providerAccountId,
+      rebaseable: false,
     };
   }
-  return affinity;
+  if (affinity !== undefined) {
+    // Rebaseable when every supplied call id resolved to a live pending call
+    // (so none is owed to another account) — or when none resolved and the
+    // whole history is present. In both cases the conversation is complete and
+    // may travel as history to a fresh Run.
+    return { ...affinity, rebaseable: anyResolved ? allResolved : true };
+  }
+  return undefined;
 }
 
 /** Looks up one pending call across every provider that records continuations. */
@@ -137,6 +150,8 @@ export interface PreparedProxyRequest {
    * second account and pool slot.
    */
   readonly continuationAffinity?: RouteContinuationAffinity;
+  /** Single "who is speaking" identity, derived at auth. */
+  readonly caller: CallerIdentity;
   readonly estimatedInputTokens: number;
   readonly estimatedOutputTokens: number;
   readonly deadlineMs: number;
@@ -407,6 +422,7 @@ export class ProxyRequestPreparer {
       degradedCapabilities: degraded,
       plan,
       ...(continuationAffinity === undefined ? {} : { continuationAffinity }),
+      caller: authorization.caller,
       estimatedInputTokens,
       estimatedOutputTokens,
       deadlineMs: input.deadlineMs,

package/src/transport/request/system-prompt-injection.ts

@@ -0,0 +1,89 @@
+/**
+ * Tenant system-prompt injection at the canonical level.
+ *
+ * Runs inside `applyTenantPreferences`, after reasoning/thinking shaping and
+ * before RTK/PonyTail, so the injected text composes with (and is then
+ * appended-to by) the compression directive. Wire-agnostic: one transform
+ * covers messages/chat/responses/gemini/codex/kiro; provider-native
+ * injection (Claude identity/billing prepend, buddy fixed system turn,
+ * antigravity identity) happens later, in the adapters, and is untouched.
+ *
+ * Resolution is most-specific-wins: model > provider > global, where a
+ * provider either follows the tenant's global prompt or carries a custom one.
+ * Failure is non-fatal — an unusable configuration must not fail a
+ * dispatchable request.
+ */
+import type { CanonicalRequest } from "../../protocol/canonical-model";
+import type { ServiceKind } from "../../protocol/canonical-model";
+import type {
+  PromptSetting,
+  TenantSystemPrompts,
+} from "../../console/system-prompt/contracts";
+import {
+  systemPromptModelKey,
+} from "../../console/system-prompt/contracts";
+
+/** The route facts the resolution needs. */
+export interface SystemPromptRoute {
+  readonly providerId: string;
+  readonly modelId: string;
+  readonly serviceKind: ServiceKind;
+}
+
+/**
+ * Resolves the effective prompt for a route: the most-specific enabled scope
+ * wins. A provider scope honours its `followGlobal` toggle; model scope is
+ * always explicit. Returns `undefined` when nothing applies.
+ */
+export function resolveTenantSystemPrompt(
+  prompts: TenantSystemPrompts | undefined,
+  route: Pick<SystemPromptRoute, "providerId" | "modelId">,
+): PromptSetting | undefined {
+  if (prompts === undefined) return undefined;
+  const model = prompts.models[systemPromptModelKey(route.providerId, route.modelId)];
+  if (model !== undefined && model.enabled) return model;
+  const provider = prompts.providers[route.providerId];
+  if (provider !== undefined) {
+    if (provider.followGlobal) {
+      return prompts.global !== null && prompts.global.enabled ? prompts.global : undefined;
+    }
+    if (provider.setting !== undefined && provider.setting.enabled) return provider.setting;
+  }
+  return prompts.global !== null && prompts.global.enabled ? prompts.global : undefined;
+}
+
+/** Marker text guard so retries never double-inject. */
+function carriesText(system: readonly { kind: string }[] | undefined, text: string): boolean {
+  return (system ?? []).some((part) => part.kind === "text" && (part as { text?: string }).text === text);
+}
+
+/**
+ * Applies the resolved tenant prompt to the canonical request. Appends after
+ * existing system content (or replaces the caller's system content for
+ * `override` — provider-native identity injection later re-adds the fixed
+ * provider prompt, so override is never a bare wire).
+ */
+export function applyInjectSystemPrompt(
+  request: CanonicalRequest,
+  prompts: TenantSystemPrompts | undefined,
+  route: SystemPromptRoute,
+): CanonicalRequest {
+  // Non-chat native protocols have no system surface to inject into.
+  if (route.serviceKind !== "llm") return request;
+  const setting = resolveTenantSystemPrompt(prompts, route);
+  if (setting === undefined || setting.text.length === 0) return request;
+
+  const text = setting.text;
+  // `override` replaces only the CALLER's system content: the adapters later
+  // prepend their mandatory identity/billing blocks (claude, antigravity) or
+  // install their fixed system turn (buddy), so the wire always keeps the
+  // provider-native prompt. For wrapped-injection providers the override
+  // cannot survive the replace at all — the identity must stay the opener —
+  // so it degrades to append there.
+  const existing = request.system ?? [];
+  if (setting.mode === "override" && existing.length > 0) {
+    return { ...request, system: [{ kind: "text", text }] };
+  }
+  if (carriesText(existing, text)) return request;
+  return { ...request, system: [...existing, { kind: "text", text }] };
+}

package/src/transport/request/tenant-preferences.ts

@@ -12,9 +12,42 @@ import type { CanonicalRequest } from "../../protocol/canonical-model";
 import type { PreparedProxyRequest } from "./preparer";
 import { normalizeThinkingConfig } from "../../protocol/translation/thinking";
 import { compressRequest } from "./rtk/compress-request";
+import { applyInjectSystemPrompt } from "./system-prompt-injection";
 import { preferencesReaderFor } from "../../persistence/tenant-preferences";
+import {
+  readTenantSystemPrompts,
+  type StoredTenantSystemPrompts,
+} from "../../persistence/system-prompt-store";
+import { currentSettingsRevision } from "../../persistence/settings-revision";
+import { TtlCache } from "../../persistence/ttl-cache";
 import { resolveUpstreamTimeoutMs } from "../../config/timeouts";
 
+/**
+ * Revision-keyed cached read of the tenant's system-prompt configuration, the
+ * same convergence mechanism as the runtime-preferences reader: a mutation
+ * bumps the settings revision, which changes every cache key, so writes are
+ * visible to the dispatch path immediately without a per-request round trip.
+ */
+const systemPromptCache = new TtlCache<StoredTenantSystemPrompts>({
+  ttlMs: 5_000,
+  maxEntries: 128,
+});
+
+async function readTenantSystemPromptsCached(
+  db: CartethyiaDatabase,
+  tenantId: string,
+): Promise<StoredTenantSystemPrompts> {
+  const cacheKey = `${tenantId}:${currentSettingsRevision()}`;
+  const cached = systemPromptCache.get(cacheKey);
+  if (cached !== undefined) return cached;
+  const prompts = await readTenantSystemPrompts(db, tenantId);
+  systemPromptCache.set(cacheKey, prompts);
+  return prompts;
+}
+
+/** Cached read for the dispatch path (same revision-keyed cache). */
+export { readTenantSystemPromptsCached as readTenantSystemPromptsForDispatch };
+
 /**
  * Re-arms the request deadline from the tenant's timeout override.
  *
@@ -91,6 +124,16 @@ export async function applyTenantPreferences(
       const next = normalizeThinkingConfig(canonicalRequest);
       if (next !== canonicalRequest) canonicalRequest = next;
     }
+    // Tenant system-prompt injection runs before compression: the PonyTail
+    // directive must stay the tail of the system content, and the injected
+    // prompt is itself stable per scope, so the prefix-cache invariant holds.
+    const prompts = await readTenantSystemPromptsCached(db, tenantId);
+    const candidate = prepared.candidate;
+    canonicalRequest = applyInjectSystemPrompt(canonicalRequest, prompts, {
+      providerId: candidate.provider_id,
+      modelId: candidate.model_id,
+      serviceKind: candidate.service_kind ?? "llm",
+    });
     if (prefs) {
       // When the routed model is Responses (codex/openai/muse-spark) and the
       // client hit a Chat surface, force the configured summary mode so the

package/src/transport/routing/admission.ts

@@ -17,15 +17,25 @@ import type {
 /**
  * The admission bucket one candidate draws from.
  *
+ * Bucket identity is `provider:model[:account][:ownerTenant]`:
+ * - A candidate with no account (credential-less provider) buckets per
+ *   provider:model.
+ * - A **shared** account (`owner_tenant_id` null) is one bucket across all
+ *   tenants — the account is pool-wide, so its concurrency ceiling is global.
+ * - A **tenant-owned** account is scoped to its owner tenant, so two tenants
+ *   cannot drain each other's ceiling on an account only one of them owns.
+ *
  * Exported so the router can order candidates by the same counters admission
  * enforces against: a second copy of this format would drift and quietly
  * deprioritize the wrong accounts.
  */
 export function admissionKey(candidate: RouteCandidate): string {
   const base = `${candidate.provider_id}:${candidate.model_id}`;
-  return candidate.provider_account_id === undefined
-    ? base
-    : `${base}:${candidate.provider_account_id}`;
+  if (candidate.provider_account_id === undefined) return base;
+  const account = `${base}:${candidate.provider_account_id}`;
+  return candidate.owner_tenant_id === undefined || candidate.owner_tenant_id === null
+    ? account
+    : `${account}:${candidate.owner_tenant_id}`;
 }
 
 /**

package/src/transport/routing/route-catalog.ts

@@ -670,6 +670,8 @@ class RouteCatalogRepository {
                 ...(model.outputLimit == null ? {} : { output_limit: model.outputLimit }),
                 capability_profile: capabilityProfile,
                 tenant_id: tId,
+                // Public credential-less candidates have no account to own them.
+                owner_tenant_id: null,
                 requires_account: false as const,
                 network_pool_ids: tenantPools.ids,
                 network_pool_required: true,
@@ -696,6 +698,8 @@ class RouteCatalogRepository {
           ...(model.outputLimit == null ? {} : { output_limit: model.outputLimit }),
           capability_profile: capabilityProfile,
           tenant_id: providerTenantId,
+          // Public credential-less candidates have no account to own them.
+          owner_tenant_id: null,
           ...(providerRequiresAccount
             ? { health_status: "disabled" as const }
             : { requires_account: false as const }),
@@ -738,6 +742,9 @@ class RouteCatalogRepository {
           ...(routeUserAgent === undefined ? {} : { user_agent: routeUserAgent }),
           tenant_id: rowTenantId,
           provider_account_id: account.id,
+          // The account's owning tenant (null = shared pool-wide) — the bucket
+          // key for admission, distinct from the requesting tenant.
+          owner_tenant_id: account.tenantId ?? null,
           // The plan gate is per (account, model): the model may be refused on
           // a free plan and the account may be on one. Both ride here because
           // `plan()` sees the candidate and nothing else.

package/src/transport/routing/route-model.ts

@@ -1,6 +1,9 @@
 // Routing contracts and snapshots.
 import { GatewayError } from "../../protocol/gateway-error";
 import { type ServiceKind, type WireFamily } from "../../protocol/canonical-model";
+import type { CallerIdentity } from "../../security/access-control";
+
+export type { CallerIdentity };
 
 
 export type RoutingRevision = number;
@@ -57,6 +60,14 @@ export interface RouteCandidate {
   readonly network_pool_provider_limit?: number;
   /** `null`/`undefined` = globally routable; a tenant id = routable only for that tenant's requests (BYOK). */
   readonly tenant_id?: string | null;
+  /**
+   * The tenant that owns this candidate's account (`provider_accounts.tenant_id`),
+   * or null for a shared pool-wide account. Distinct from `tenant_id` (the
+   * requesting tenant). Used to scope the admission bucket: a shared account
+   * is one bucket across tenants; a tenant-owned account is scoped to its
+   * owner so two tenants cannot drain each other's ceiling.
+   */
+  readonly owner_tenant_id?: string | null;
   /** `false` only for a genuinely credential-less provider (e.g. OpenCode
    * Free) dispatched with zero `provider_accounts` rows — the handler skips
    * `resolveCredentialForAccount` and dispatches with a `"none"` credential.
@@ -80,6 +91,11 @@ export interface RouteCandidate {
    * "free": guessing free here would defeat the gate it exists to serve.
    */
   readonly account_plan?: string | null;
+  /** Usage-floor ceiling from Routing Strategy; read live at plan time. */
+  readonly usage_floor?: number;
+  readonly usage_floor_unit?: "credit" | "percent";
+  /** Live quota windows (cache) the floor check evaluates. */
+  readonly quota_windows?: readonly unknown[];
 }
 
 /**
@@ -163,6 +179,16 @@ export interface PoolRoutingSetting {
 export interface RouteContinuationAffinity {
   readonly providerId: string;
   readonly providerAccountId: string;
+  /**
+   * True when the request's tool-result ids are all already answered by the
+   * conversation history (a replay), so no call is still owed to the pinned
+   * account. In that case, if the pinned account is no longer routable for
+   * the requested model, the request may safely rebase to a fresh Run on an
+   * eligible account instead of being refused — the recorded exchange travels
+   * as history. When false, the pin is a hard constraint: a live pending call
+   * must reach the exact account that owns it.
+   */
+  readonly rebaseable: boolean;
 }
 
 export interface RoutePlan {
@@ -171,6 +197,33 @@ export interface RoutePlan {
   readonly requested_model: string;
   readonly resolved_model: string;
   readonly provider_id: string;
+  /**
+   * The system decision behind each candidate, keyed by the candidate's
+   * admission bucket. Written once at plan time; every later layer (dispatch,
+   * telemetry) reads this instead of re-deriving its own ordering.
+   */
+  readonly decisions: ReadonlyMap<string, RoutingDecision>;
+}
+
+/** How eligible a candidate is and why — written once, read by every layer. */
+export const ROUTING_RANK = {
+  FRESH: 0,
+  SLOW: 1,
+  COOLING: 2,
+  SATURATED: 3,
+} as const;
+export type RoutingRank = (typeof ROUTING_RANK)[keyof typeof ROUTING_RANK];
+
+export interface RoutingDecision {
+  readonly eligible: boolean;
+  readonly rank: RoutingRank;
+  readonly reason: string;
+  readonly health_status?: string;
+  readonly cooldown_until?: number;
+  readonly floor_blocked?: boolean;
+  readonly plan_gate_blocked?: boolean;
+  readonly capability_blocked?: boolean;
+  readonly saturated?: boolean;
 }
 
 import type { ComboStrategy, PoolRoutingStrategy, ProviderRoutingStrategy } from "../../persistence/schema";