cartethyia 2.7.4 → 2.7.6

package/src/security/api-key-auth.ts

@@ -118,7 +118,7 @@ function freezeList(
   return arr;
 }
 
-export function freezeSnapshot(s: ApiKeyAuthorizationSnapshot): ApiKeyAuthorizationSnapshot {
+function freezeSnapshot(s: ApiKeyAuthorizationSnapshot): ApiKeyAuthorizationSnapshot {
   const model_list = freezeList(s.model_list);
   const model_access_mode: ApiKeyModelAccessMode =
     s.model_access_mode === "blacklist" ? "blacklist" : "whitelist";
@@ -363,6 +363,12 @@ export async function resolveApiKeyAuthorization(
   // keep the issued row values forever. Reading the parent here makes denylist /
   // one-time / recurring edits apply on the next cache miss.
   const policy = parent ?? row;
+  // Share-template concurrency scope decides whether the family shares one
+  // admission counter (default `family`) or each recipient has its own
+  // (`per_key`). In `family` mode the child participates in the parent's
+  // counter namespace; in `per_key` mode the child is its own admission
+  // identity and carries its own cap.
+  const perKeyConcurrency = parent !== undefined && row.concurrencyScope === "per_key";
   // Only a `share` parent can have children, and children are the only thing
   // the SUM below can find. Every other key ran an aggregate that was certain
   // to return 0 — one extra Postgres round-trip on the auth path for nothing.
@@ -381,7 +387,11 @@ export async function resolveApiKeyAuthorization(
     api_key_id: row.id,
     tenant_id: row.tenantId,
     // Family quota / concurrency share one admission counter namespace so two
-    // recipients cannot each burn a full lifetime/daily budget.
+    // recipients cannot each burn a full lifetime/daily budget. In `per_key`
+    // concurrency mode the child keeps its own cap and counter for
+    // *concurrency* only — token budgets (daily/monthly/lifetime) stay
+    // family-wide on the parent, so the admission identity is always the
+    // parent's.
     ...(parent ? { admission_identity: parent.id } : {}),
     ...(policy.modelList ? { model_list: policy.modelList as string[] } : {}),
     model_access_mode: policy.modelAccessMode ?? "whitelist",
@@ -393,7 +403,11 @@ export async function resolveApiKeyAuthorization(
     ...(policy.monthlyTokenLimit != null ? { monthly_tokens: policy.monthlyTokenLimit } : {}),
     ...(policy.lifetimeTokenBudget != null ? { lifetime_token_budget: policy.lifetimeTokenBudget } : {}),
     lifetime_tokens_consumed: consumed,
-    ...(policy.maxConcurrentRequests != null ? { max_concurrent: policy.maxConcurrentRequests } : {}),
+    // `per_key` mode: the child carries its own cap (copied at issue); family
+    // mode inherits the parent's cap.
+    ...((perKeyConcurrency ? row.maxConcurrentRequests : policy.maxConcurrentRequests) != null
+      ? { max_concurrent: perKeyConcurrency ? row.maxConcurrentRequests : policy.maxConcurrentRequests }
+      : {}),
     scopes,
   });
 

package/src/security/client-router-fingerprint.ts

@@ -21,7 +21,7 @@ import { getHeader as readRecordHeader } from "../protocol/canonical-model";
  * `id` is the stable token an operator stores in a key's denylist, so it is
  * part of the persisted contract and must not be renamed casually.
  */
-export interface ClientRouterDefinition {
+interface ClientRouterDefinition {
   readonly id: string;
   /** Human label for the dashboard. */
   readonly label: string;
@@ -40,7 +40,7 @@ export interface ClientRouterDefinition {
  * safe for a uniquely named header; a header whose value distinguishes it must
  * name a matcher instead.
  */
-export interface ClientRouterSignal {
+interface ClientRouterSignal {
   /** Header name, lowercase. */
   readonly field: string;
   /** Human description shown when the signal matches. */
@@ -114,14 +114,14 @@ export const CLIENT_ROUTERS: readonly ClientRouterDefinition[] = [
 const LEGACY_CLIENT_ROUTER_IDS: Readonly<Record<string, string>> = { omniroute: "9router" };
 
 /** A signal that matched, with the product it belongs to. */
-export interface MatchedClientSignal {
+interface MatchedClientSignal {
   readonly field: string;
   readonly description: string;
   /** The observed value, capped, for the operator's audit trail. */
   readonly value: string;
 }
 
-export interface ClientRouterMatch {
+interface ClientRouterMatch {
   readonly routerId: string;
   readonly label: string;
   readonly signals: readonly MatchedClientSignal[];

package/src/security/credential-codec.ts

@@ -22,7 +22,7 @@ import { isRecord } from "../protocol/codecs";
 const TEXT_DECODER = new TextDecoder();
 
 /** Decodes a stored secret: UTF-8 bytes or a string, trimmed. */
-export function decodeSecretText(secret: Uint8Array | string): string {
+function decodeSecretText(secret: Uint8Array | string): string {
   const raw = typeof secret === "string" ? secret : TEXT_DECODER.decode(secret);
   return raw.trim();
 }
@@ -48,7 +48,7 @@ function fieldString(record: Record<string, unknown>, key: string): string {
 }
 
 /** `{accessToken, orgId?}` — the Kilo Code envelope (org scoping is optional). */
-export interface KiloEnvelope {
+interface KiloEnvelope {
   readonly accessToken: string;
   /** Organization the gateway scopes requests to; absent when the profile omits one. */
   readonly orgId?: string;
@@ -79,7 +79,7 @@ export function decodeKiloCredential(secret: Uint8Array | string): KiloEnvelope
 }
 
 /** `{oauthAccessToken, apiKey}` — the Muse Code (Meta) envelope. */
-export interface MuseEnvelope {
+interface MuseEnvelope {
   readonly oauthAccessToken: string;
   readonly apiKey: string;
 }

package/src/security/csrf.ts

@@ -16,7 +16,7 @@ import { isRecord } from "../protocol/codecs";
  * but cannot read the cookie value, so it cannot forge the header.
  */
 export const CSRF_COOKIE_NAME = "csrf_token";
-export const CSRF_HEADER_NAME = "x-csrf-token";
+const CSRF_HEADER_NAME = "x-csrf-token";
 
 /**
  * Name of the session cookie whose presence gates CSRF validation in
@@ -30,7 +30,7 @@ export const SESSION_COOKIE_NAME = "session_token";
  * `SessionCookiePolicy` structurally satisfies this (extra fields are fine),
  * so call sites keep passing their existing policy object unchanged.
  */
-export interface CsrfCookiePolicy {
+interface CsrfCookiePolicy {
   readonly maxAge: number;
   readonly sameSite: "Lax" | "Strict" | "None";
   readonly secure: boolean;

package/src/security/ip-boundary.ts

@@ -3,185 +3,25 @@
 import { isIP } from "node:net";
 import type { TrustedProxyBoundary } from "../config/network";
 import { log } from "../observability/logger";
+import {
+  cidrContainsAddress,
+  ipv4ToNumber,
+  ipv6ToBigInt,
+  isLoopbackAddress,
+  unwrapMappedIpv4,
+} from "../network/ip-utils";
 
-function ipv4ToNumber(address: string): number | undefined {
-  const parts = address.split(".");
-  if (parts.length !== 4 || parts.some((part) => !/^\d+$/.test(part))) return undefined;
-  const octets = parts.map(Number);
-  if (octets.some((part) => part < 0 || part > 255)) return undefined;
-  const [a, b, c, d] = octets;
-  if (a === undefined || b === undefined || c === undefined || d === undefined) return undefined;
-  return ((a * 256 + b) * 256 + c) * 256 + d;
-}
-
-function ipv6ToBigInt(address: string): bigint | undefined {
-  const value = address.toLowerCase().split("%", 1)[0] ?? "";
-  if (value.includes(".")) return undefined;
-  const halves = value.split("::");
-  if (halves.length > 2) return undefined;
-  const left = halves[0] ? halves[0].split(":") : [];
-  const right = halves.length === 2 && halves[1] ? halves[1].split(":") : [];
-  if (halves.length === 1 && left.length !== 8) return undefined;
-  const missing = 8 - left.length - right.length;
-  if (missing < 0 || (halves.length === 2 && missing < 1)) return undefined;
-  const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
-  if (groups.length !== 8 || groups.some((part) => !/^[0-9a-f]{1,4}$/.test(part)))
-    return undefined;
-  let result = 0n;
-  for (const group of groups) result = (result << 16n) | BigInt(Number.parseInt(group, 16));
-  return result;
-}
-
-/**
- * Unwraps an IPv4-mapped IPv6 address to plain IPv4.
- *
- * Bun reports an IPv4 loopback peer as `::ffff:127.0.0.1` on Windows, and
- * `isIP` classifies it as IPv6 — so `ipv6ToBigInt` (which bails on a dotted
- * quad) never matched `127.0.0.1/32`. The trust check therefore failed for the
- * exact peer `TRUSTED_PROXY_CIDRS=127.0.0.1/32` is meant to cover, forwarded
- * headers were ignored, and every cloudflared request stored the loopback peer
- * as the client address. Accepts both the dotted and the hex (`::ffff:7f00:1`)
- * spelling.
- */
-function unwrapMappedIpv4(address: string): string {
-  const value = address.toLowerCase().split("%", 1)[0] ?? "";
-  // Recognize the mapped range STRUCTURALLY, not by its compressed spelling. The
-  // old `startsWith("::ffff:")` test missed any form that writes the leading zero
-  // groups out — `0:0:0:0:0:ffff:7f00:1` is the same host as `::ffff:127.0.0.1`,
-  // but it failed the prefix test, fell through to `ipv6ToBigInt`, and was treated
-  // as an unrelated IPv6 address. The trust check then refused a peer the allowlist
-  // covered, and `canonicalClientIpKey` minted a second key for one host — which is
-  // stored on issued child keys for consistent usage reporting and audit.
-  //
-  // A mapped address is `::ffff:<32 bits>`, i.e. the first 80 bits are zero and the
-  // next 16 are `0xffff`. Matching that is the same test `isIP` uses internally.
-  const tail = mappedIpv4Tail(value);
-  if (tail === undefined) return address;
-  // `mappedIpv4Tail` always returns two hex groups, so the dotted and hex
-  // spellings have already converged by here.
-  const groups = tail.split(":");
-  if (groups.length !== 2) return address;
-  const high = Number.parseInt(groups[0] ?? "", 16);
-  const low = Number.parseInt(groups[1] ?? "", 16);
-  if (!Number.isInteger(high) || !Number.isInteger(low) || high < 0 || high > 0xffff || low < 0 || low > 0xffff)
-    return address;
-  return `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
-}
-
-/**
- * The 32-bit tail of an IPv4-mapped IPv6 address, or `undefined` when `value` is
- * not one. Accepts every spelling of the same address: `::ffff:1.2.3.4`,
- * `::ffff:102:304`, `0:0:0:0:0:ffff:102:304`, and `::ffff:0:102:304`.
- *
- * Works by normalizing to exactly eight 16-bit groups first. That is the only way
- * to compare spellings: a dotted tail is written as ONE colon-separated token but
- * occupies TWO group slots, so any check that counts `split(":")` entries gets the
- * position of the `ffff` marker wrong.
- */
-function mappedIpv4Tail(value: string): string | undefined {
-  const groups = normalizeIpv6Groups(value);
-  if (groups === undefined) return undefined;
-  // The first five groups (80 bits) must be zero, and the sixth must be `ffff`.
-  for (let index = 0; index < 5; index += 1) {
-    if (groups[index] !== "0") return undefined;
-  }
-  if (groups[5] !== "ffff") return undefined;
-  const high = groups[6];
-  const low = groups[7];
-  if (high === undefined || low === undefined) return undefined;
-  return `${high}:${low}`;
-}
-
-/**
- * An IPv6 literal as exactly eight lowercase 16-bit hex groups, or `undefined`
- * when it is not one. Expands a `::` run and converts a trailing dotted quad into
- * the two groups it represents.
- */
-function normalizeIpv6Groups(value: string): string[] | undefined {
-  const text = value.trim();
-  if (text.length === 0) return undefined;
-  const doubleIndex = text.indexOf("::");
-  // More than one `::` is invalid, as is a `::` inside a group.
-  if (doubleIndex !== text.lastIndexOf("::")) return undefined;
-
-  const headText = doubleIndex >= 0 ? text.slice(0, doubleIndex) : text;
-  const tailText = doubleIndex >= 0 ? text.slice(doubleIndex + 2) : "";
-  const head = headText.length > 0 ? headText.split(":") : [];
-  const tail = tailText.length > 0 ? tailText.split(":") : [];
-
-  // A dotted quad is a single token that fills two groups.
-  const expandDotted = (tokens: string[]): string[] | undefined => {
-    const last = tokens[tokens.length - 1];
-    if (last === undefined || !last.includes(".")) return tokens;
-    const quad = last.split(".");
-    if (quad.length !== 4) return undefined;
-    const octets = quad.map((part) => Number(part));
-    if (octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return undefined;
-    const [a, b, c, d] = octets;
-    if (a === undefined || b === undefined || c === undefined || d === undefined) return undefined;
-    const high = ((a << 8) | b).toString(16);
-    const low = ((c << 8) | d).toString(16);
-    return [...tokens.slice(0, -1), high, low];
-  };
-
-  const expandedHead = expandDotted(head);
-  const expandedTail = expandDotted(tail);
-  if (expandedHead === undefined || expandedTail === undefined) return undefined;
-
-  let full: string[];
-  if (doubleIndex >= 0) {
-    const missing = 8 - expandedHead.length - expandedTail.length;
-    // `::` must stand for at least one group, so exactly-8 without it is invalid.
-    if (missing < 1) return undefined;
-    full = [...expandedHead, ...Array.from({ length: missing }, () => "0"), ...expandedTail];
-  } else {
-    full = expandedHead;
-  }
-  if (full.length !== 8) return undefined;
-  const normalized: string[] = [];
-  for (const group of full) {
-    if (!/^[0-9a-f]{1,4}$/.test(group)) return undefined;
-    normalized.push(Number.parseInt(group, 16).toString(16));
-  }
-  return normalized;
-}
+export { isLoopbackAddress };
 
 function matchesCidr(address: string, cidr: string): boolean {
-  const [network, rawPrefix] = cidr.split("/");
-  if (!network) return false;
-  // A bare address (`"127.0.0.1"`) has no prefix and means "this exact host". A
-  // present-but-blank prefix (`"10.0.0.0/"`) must NOT be treated as /0: `Number("")`
-  // is 0, and /0 matches every address — which made `isTrustedProxyPeer` true for
-  // ANY peer, so the gateway believed a caller's own `X-Forwarded-For` and every
-  // per-address decision downstream (abuse throttling, model bans, the audit
-  // trail) read a forged value.
-  //
-  // Requiring a run of digits also refuses the exotic spellings `Number` accepts
-  // for zero (`-0`, `+0`, `0x0`, `0b0`, `0o0`, `0.0`), all of which are typos
-  // rather than a deliberate "trust everyone".
-  const prefixText = rawPrefix === undefined ? undefined : rawPrefix.trim();
-  if (prefixText !== undefined && !/^\d+$/.test(prefixText)) return false;
-  // A mapped peer and a plain-IPv4 allowlist entry describe the same host.
-  const subject = unwrapMappedIpv4(address);
-  const base = unwrapMappedIpv4(network);
-  const family = isIP(subject);
-  if (family === 4) {
-    const value = ipv4ToNumber(subject);
-    const networkValue = ipv4ToNumber(base);
-    if (value === undefined || networkValue === undefined) return false;
-    const prefix = prefixText === undefined ? 32 : Number(prefixText);
-    if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false;
-    const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
-    return ((value >>> 0) & mask) === ((networkValue >>> 0) & mask);
-  }
-  if (family !== 6) return false;
-  const value = ipv6ToBigInt(subject);
-  const networkValue = ipv6ToBigInt(base);
-  if (value === undefined || networkValue === undefined) return false;
-  const prefix = prefixText === undefined ? 128 : Number(prefixText);
-  if (!Number.isInteger(prefix) || prefix < 0 || prefix > 128) return false;
-  const shift = BigInt(128 - prefix);
-  return (value >> shift) === (networkValue >> shift);
+  // `unwrapMapped: true`: a mapped peer and a plain-IPv4 allowlist entry
+  // describe the same host (Bun reports the IPv4 loopback peer as
+  // `::ffff:127.0.0.1` on Windows). `requirePrefix: false`: a bare address
+  // (`"127.0.0.1"`) means "this exact host".
+  return cidrContainsAddress(address, cidr, {
+    requirePrefix: false,
+    unwrapMapped: true,
+  });
 }
 
 function isTrustedPeer(peer: string, boundary: TrustedProxyBoundary): boolean {
@@ -206,20 +46,7 @@ const CLIENT_IDENTITY_HEADERS = [
 
 /**
  * True when `address` is a loopback address.
- *
- * Structural, not a string-prefix test: `127.0.0.1`, `::1`, and the mapped
- * `::ffff:127.0.0.1` a Windows/Bun peer arrives as are all the same host, and
- * a prefix test would miss the mapped form — the exact shape that hid this
- * class of bug before.
  */
-export function isLoopbackAddress(address: string): boolean {
-  const normalized = unwrapMappedIpv4(address.trim().split("%", 1)[0] ?? "");
-  if (normalized === "::1") return true;
-  if (isIP(normalized) !== 4) return false;
-  const value = ipv4ToNumber(normalized);
-  // 127.0.0.0/8 — the whole loopback block, not just 127.0.0.1.
-  return value !== undefined && ((value >>> 0) & 0xff000000) === (127 << 24);
-}
 
 /**
  * Whether a peer may vouch for forwarded headers *for client-address

package/src/security/model-access-rule.ts

@@ -24,7 +24,7 @@ import type { ApiKeyModelAccessMode } from "../persistence/schema";
 export type ModelRejectionReason = "model-denied" | "model-not-allowed";
 
 /** The subset of an authorization snapshot this rule reads. */
-export interface ModelAccessPolicy {
+interface ModelAccessPolicy {
   readonly model_access_mode?: ApiKeyModelAccessMode | null | undefined;
   readonly model_list?: readonly string[] | ReadonlySet<string> | null | undefined;
 }

package/src/security/outbound-headers.ts

@@ -21,6 +21,24 @@ export const X_FRAME_OPTIONS = "DENY";
  */
 export const BADGE_IMAGE_ORIGIN = "https://img.shields.io";
 
+/**
+ * Invariant: upstream response headers are NEVER forwarded wholesale to
+ * callers. There is no denylist-and-forward step on the egress path — the
+ * success projection (`proxySuccessHeaders` in
+ * `transport/dispatch/upstream.ts`) rebuilds the caller-facing header set from
+ * scratch (`cache-control: no-store`, `x-request-id`, and
+ * `GATEWAY_SECURITY_HEADERS` below), so credential-bearing upstream fields
+ * (`set-cookie`, `www-authenticate`, `proxy-authorization`) and hop-by-hop
+ * headers can never leak through by omission from a strip list.
+ *
+ * Any future feature that wants to pass upstream response fields to a caller
+ * must copy only the specific content-bearing headers it needs — do not
+ * reintroduce a "forward everything except" filter. A module implementing
+ * exactly that (`src/network/response-headers.ts` + `stripResponseHeaders`)
+ * existed once and was deleted as dead code (see git history for it), because
+ * every egress path had already moved to the rebuild-from-scratch projection.
+ */
+
 /**
  * Security headers on every `/v1` response, whichever path produced it.
  *

package/src/shared/invoke-guard.ts

@@ -0,0 +1,47 @@
+/**
+ * InvokeGuard — a process-local foreground-activity gauge (G-03).
+ *
+ * Every foreground request path signals its activity here: the console control
+ * plane bumps the counter for the duration of each request, and the proxy data
+ * plane exposes its in-flight count through `setProxyBusySource`. The scheduled
+ * worker registry (and the sweep runner between waves) consults
+ * `foregroundBusy()` before starting background work, so a page open / an
+ * invoke in progress is never forced to share the single event loop with a
+ * heavy sweep.
+ *
+ * The defer policy is at the call sites (scheduler: bounded pause before a
+ * tick; sweep runner: bounded pause between waves). This module only owns the
+ * gauge — it never decides when to pause.
+ */
+
+/** Console request counter. Bumped per in-flight console request. */
+let consoleActivity = 0;
+
+/** Optional live source of "the proxy plane is busy" (the in-flight store). */
+let proxyBusySource: (() => boolean) | undefined;
+
+/** Registers the proxy plane's busy source (wired once from the app root). */
+export function setProxyBusySource(source: () => boolean): void {
+  proxyBusySource = source;
+}
+
+/** Marks a foreground console request; returns the matching end callback. */
+export function beginConsoleActivity(): () => void {
+  consoleActivity += 1;
+  let ended = false;
+  return () => {
+    if (ended) return;
+    ended = true;
+    consoleActivity = Math.max(0, consoleActivity - 1);
+  };
+}
+
+/** Live foreground-request count (console counter + proxy source if wired). */
+export function foregroundActivityCount(): number {
+  return consoleActivity + (proxyBusySource?.() === true ? 1 : 0);
+}
+
+/** True when any foreground work is in flight right now. */
+export function foregroundBusy(): boolean {
+  return consoleActivity > 0 || (proxyBusySource?.() ?? false);
+}

package/src/transport/contracts.ts

@@ -54,12 +54,12 @@ export interface CanonicalAdapter {
  */
 
 /** One native service: the path it is served at and the kind its models carry. */
-export interface NativeServiceRoute {
+interface NativeServiceRoute {
   readonly serviceKind: Exclude<ServiceKind, "llm">;
   readonly path: string;
 }
 
-export const NATIVE_SERVICES: readonly NativeServiceRoute[] = [
+const NATIVE_SERVICES: readonly NativeServiceRoute[] = [
   { serviceKind: "systemone", path: "/v1/systemone" },
   { serviceKind: "websearch", path: "/v1/search" },
   { serviceKind: "imageGeneration", path: "/v1/images/generations" },
@@ -75,7 +75,7 @@ export const NATIVE_SERVICE_PATHS: readonly string[] = NATIVE_SERVICES.map(
 );
 
 /** Whether `path` is served by a native service route. */
-export function isNativeServicePath(path: string | undefined): boolean {
+function isNativeServicePath(path: string | undefined): boolean {
   return path !== undefined && NATIVE_SERVICE_PATHS.includes(path);
 }
 
@@ -97,6 +97,15 @@ export function isNativeServicePath(path: string | undefined): boolean {
  */
 export const TOKEN_COUNT_PATH = "/v1/messages/count_tokens";
 
+/**
+ * The native Codex compaction route (`POST /v1/responses/compact`).
+ *
+ * Not a native service (it has no `serviceKind` of its own — Codex rows are
+ * `llm`-adjacent), so it is declared separately from `NATIVE_SERVICE_PATHS`,
+ * but its body is equally opaque and must skip the canonical chat stage.
+ */
+export const RESPONSES_COMPACT_PATH = "/v1/responses/compact";
+
 /**
  * Whether `path` reads a JSON body that is *not* a canonical chat request.
  *
@@ -105,7 +114,7 @@ export const TOKEN_COUNT_PATH = "/v1/messages/count_tokens";
  * will either reject a body the upstream accepts or plan it twice.
  */
 export function isOpaqueBodyRoute(path: string | undefined): boolean {
-  return isNativeServicePath(path) || path === TOKEN_COUNT_PATH;
+  return isNativeServicePath(path) || path === TOKEN_COUNT_PATH || path === RESPONSES_COMPACT_PATH;
 }
 
 /** The route path serving `serviceKind`, when one is declared. */

package/src/transport/dispatch/attempt-finalize.ts

@@ -16,6 +16,7 @@ import { finalizeRequestTelemetry } from "../guards/error-lifecycle";
 import { debitCachedQuota, quotaLens } from "../../providers/quota/cache";
 import { BUDDY_PROVIDER_IDS } from "../../providers/provider-metadata";
 import { log } from "../../observability/logger";
+import { modelsDevCatalog } from "../../providers/discovery/models-dev-catalog";
 import {
   disablePoolForProxyHttpStatus,
   recordPoolDispatchOutcome,
@@ -394,7 +395,7 @@ let captureFailureReported = false;
  * deployment condition that does not change per request, so repeating it for
  * every request would bury the rest of the log without adding information.
  */
-export function reportCaptureFailure(error: unknown): void {
+function reportCaptureFailure(error: unknown): void {
   if (captureFailureReported) return;
   captureFailureReported = true;
   const directory = payloadDirectory();
@@ -711,6 +712,32 @@ async function debitBuddySpend(completion: AttemptCompletion): Promise<void> {
   }
 }
 
+/**
+ * Whether a completed attempt is a "degenerate stop": output far smaller than
+ * the model's ceiling, ended by an ordinary `stop` rather than `length`.
+ *
+ * This is the signature of a model truncating itself on a cached prefix — the
+ * pattern that surfaced as short, cut-off chat replies that the upstream still
+ * reported as a clean stop. It is measured so the operator can see how often
+ * it happens instead of eyeballing request detail.
+ */
+export function isDegenerateStop(
+  usage: UsageRecord | undefined,
+  outputLimit: number | undefined,
+): boolean {
+  if (usage === undefined) return false;
+  const output = usage.output_tokens;
+  const reasoning = typeof usage.reasoning_tokens === "number" ? usage.reasoning_tokens : 0;
+  const totalOutput = output + reasoning;
+  if (totalOutput === 0 || totalOutput > 512) return false;
+  // A model with no meaningful ceiling cannot be "far smaller than it can
+  // produce", so the flag is only meaningful when a ceiling exists.
+  if (!(typeof outputLimit === "number" && Number.isFinite(outputLimit) && outputLimit > 0)) {
+    return false;
+  }
+  return totalOutput <= Math.max(1, Math.floor(outputLimit / 10));
+}
+
 export async function completeAttempt(
   state: ProxyRequestState,
   completion: AttemptCompletion,
@@ -761,6 +788,15 @@ export async function completeAttempt(
     ...(completion.firstContentDeltaAtMs === undefined ? {} : { firstContentDeltaAtMs: completion.firstContentDeltaAtMs }),
     ...(completion.lastEventAtMs === undefined ? {} : { lastEventAtMs: completion.lastEventAtMs }),
     ...(completion.reportedModel === undefined ? {} : { reportedModel: completion.reportedModel }),
+    ...(completion.status === "completed" &&
+    isDegenerateStop(
+      completion.usage,
+      completion.providerId !== undefined && completion.modelId !== undefined
+        ? (modelsDevCatalog.resolve(completion.providerId, completion.modelId)?.outputLimit ?? undefined)
+        : undefined,
+    )
+      ? { degenerateStop: true }
+      : {}),
   };
   if (completion.terminal) state.completed = true;
   // Usage reconciliation is bookkeeping, and it is the last thing standing
@@ -785,27 +821,39 @@ export async function completeAttempt(
   // advisory: a failed report must never re-enter the retry path (a retry
   // would see `completed` and skip completion entirely), so it is swallowed.
   if (completion.status !== "cancelled" && !disableProxy) {
-    // DEPLOYMENT_DISABLED and similar infra errors are proxy pool failures,
-    // not account quota. Classify with scope pool so account stays healthy.
-    const msg = completion.error instanceof Error ? completion.error.message.toLowerCase() : "";
-    const isProxyDeploymentError = msg.includes("deployment_disabled") || (msg.includes("sin1::") && msg.includes("deployment"));
-    const evidence = isProxyDeploymentError
-      ? { scope: "pool" as const, origin: "network" as const }
-      : { ...classifyUpstreamFailure(completion.error) };
-    try {
-      await reportAttemptOutcome(completion.db, {
-        accountId: completion.accountId,
-        ...(completion.modelId === undefined ? {} : { modelId: completion.modelId }),
-        ...(completion.status === "failed"
-          ? {
-              error: completion.error,
-              evidence,
-            }
-          : {}),
-        ...(completion.snapshotService ? { snapshotService: completion.snapshotService } : {}),
-      });
-    } catch {
-      // Swallowed: health reporting is non-critical bookkeeping.
+    // Account health records only failures that are evidence about the
+    // provider's own account: upstream verdicts (quota, auth, model
+    // capacity, rate limits), or credential-scoped refusals from the
+    // upstream. Local rejections — API-key admission (`max_concurrent`,
+    // rpm/token budgets), routing capacity, pool selection, request
+    // preparation — are decisions this gateway made about its own limits;
+    // they say nothing about the account and must not cool it or write a
+    // phantom `logged -> cooldown` transition. Success always reports so a
+    // cooling account recovers.
+    const succeeded = completion.status === "completed";
+    const gatewayError = completion.error instanceof GatewayError ? completion.error : undefined;
+    const upstreamVerdict = gatewayError?.origin === "upstream";
+    const isProxyDeploymentError =
+      completion.error instanceof Error ? completion.error.message.toLowerCase().includes("deployment_disabled") || (completion.error.message.toLowerCase().includes("sin1::") && completion.error.message.toLowerCase().includes("deployment")) : false;
+    if (succeeded || isProxyDeploymentError || upstreamVerdict) {
+      const evidence = isProxyDeploymentError
+        ? { scope: "pool" as const, origin: "network" as const }
+        : { ...classifyUpstreamFailure(completion.error) };
+      try {
+        await reportAttemptOutcome(completion.db, {
+          accountId: completion.accountId,
+          ...(completion.modelId === undefined ? {} : { modelId: completion.modelId }),
+          ...(completion.status === "failed"
+            ? {
+                error: completion.error,
+                evidence,
+              }
+            : {}),
+          ...(completion.snapshotService ? { snapshotService: completion.snapshotService } : {}),
+        });
+      } catch {
+        // Swallowed: health reporting is non-critical bookkeeping.
+      }
     }
   }
   if (completion.networkPoolId && completion.status !== "cancelled") {

package/src/transport/dispatch/attempt-loop.ts

@@ -61,6 +61,27 @@ function comboCandidateKey(candidate: RouteCandidate): string {
   ].join(":");
 }
 
+/**
+ * True when the rejection is about the API key or the gateway's own policy,
+ * not about the provider account that was dialled.
+ *
+ * These are decided before the upstream is ever called, so every candidate in
+ * the plan fails identically; walking the rest of the list would just burn
+ * attempts and write phantom account-health rows (a local `capacity_exhausted`
+ * used to read as a provider `rate_limit_transient` cooldown).
+ */
+function isClientScopedRejection(error: unknown): boolean {
+  if (!(error instanceof GatewayError)) return false;
+  return (
+    error.code === "capacity_exhausted" ||
+    error.code === "tenant_capacity_exhausted" ||
+    error.code === "admission_unavailable" ||
+    error.code === "model_not_allowed" ||
+    error.code === "ambiguous_model" ||
+    error.code === "route_unavailable"
+  );
+}
+
 /**
  * Which combo member a candidate belongs to.
  *
@@ -402,6 +423,7 @@ export async function runAttemptLoop<TResult, TAdapter>(
       }
       const terminalAttempt =
         cancelled ||
+        isClientScopedRejection(error) ||
         !isRetryableFailure(error) ||
         (index === candidates.length - 1 && !poolScopedFailure);
       // Track only the most recent fired exchange; the array this replaced