cctally 1.111.0 → 1.112.0

package/bin/_lib_codex_conversation_query.py

@@ -3314,11 +3314,8 @@ def _stored_filter_sql(
         clauses.append(f"{alias}.project_key = ?")
         params.append(project_key)
         if undecodable_keys:
-            ordered = sorted(undecodable_keys)
-            placeholders = ",".join("?" for _ in ordered)
             clauses.append(
-                f"{alias}.conversation_key NOT IN ({placeholders})")
-            params.extend(ordered)
+                f"cctally_codex_undecodable({alias}.conversation_key) = 0")
     if model is not None:
         # models_json is the writer's canonical JSON array.  Searching for the
         # complete JSON string literal is exact and does not require JSON1.
@@ -3347,10 +3344,49 @@ def _page_costs(
     return totals
 
 
+@contextlib.contextmanager
+def _stored_undecodable_membership(
+    conn: sqlite3.Connection, undecodable_keys: "frozenset[str]",
+):
+    """Install the stored page's request-bounded membership predicate.
+
+    Only one membership bit crosses the SQL boundary; the raw unscoped read's
+    attribution values never do. Key cardinality consumes no host parameters,
+    registration executes no SQL, and cleanup prevents a later request from
+    seeing this request's frozen set.
+    """
+    if not undecodable_keys:
+        yield
+        return
+    frozen = frozenset(undecodable_keys)
+    conn.create_function(
+        "cctally_codex_undecodable", 1,
+        lambda conversation_key: int(conversation_key in frozen),
+        deterministic=True,
+    )
+    try:
+        yield
+    finally:
+        conn.create_function("cctally_codex_undecodable", 1, None)
+
+
 def _stored_browse_page(
     conn: sqlite3.Connection, *, effective_speed: str,
     project_key: str | None, model: str | None, limit: int,
     cursor: str | None, undecodable_keys: "frozenset[str]" = frozenset(),
+):
+    membership = undecodable_keys if project_key is not None else frozenset()
+    with _stored_undecodable_membership(conn, membership):
+        return _stored_browse_page_queries(
+            conn, effective_speed=effective_speed, project_key=project_key,
+            model=model, limit=limit, cursor=cursor,
+            undecodable_keys=undecodable_keys)
+
+
+def _stored_browse_page_queries(
+    conn: sqlite3.Connection, *, effective_speed: str,
+    project_key: str | None, model: str | None, limit: int,
+    cursor: str | None, undecodable_keys: "frozenset[str]" = frozenset(),
 ):
     where_sql, filter_params = _stored_filter_sql(
         "r", project_key, model, undecodable_keys)

package/bin/_lib_codex_metadata.py

@@ -23,6 +23,8 @@ from __future__ import annotations
 
 import dataclasses
 import sqlite3
+import threading
+from collections import OrderedDict
 
 
 #: The physical name of the raw threads table. ``resolve_codex_threads_table``
@@ -30,6 +32,16 @@ import sqlite3
 CODEX_THREADS_TABLE = "codex_conversation_threads"
 
 
+# ``sqlite3.Connection`` has no writable attribute dictionary and cannot be
+# weak-referenced. A small strong-key LRU carries each positive resolution on
+# the connection object itself. Holding the object prevents an ``id`` reuse
+# from inheriting another connection's answer; the bound prevents closed
+# connection objects from accumulating without limit.
+_THREADS_TABLE_RESOLUTION_CACHE_MAX = 64
+_threads_table_resolution_cache: "OrderedDict[object, str]" = OrderedDict()
+_threads_table_resolution_lock = threading.Lock()
+
+
 @dataclasses.dataclass(frozen=True)
 class DecodedCodexProjectMetadata:
     """One thread row's two project-metadata fields, decoded field by field.
@@ -171,7 +183,7 @@ def _schema_holds_threads_table(conn: sqlite3.Connection, schema: str) -> bool:
 
 
 def resolve_codex_threads_table(conn: sqlite3.Connection) -> str:
-    """The RAW threads table reference for this connection, resolved at call time.
+    """The RAW threads table reference for this connection.
 
     A bare cache connection (``open_cache_db()``) holds the table in its own
     ``main`` schema; a conversations connection
@@ -187,6 +199,16 @@ def resolve_codex_threads_table(conn: sqlite3.Connection) -> str:
     with ``no such table`` on the bare cache connection, which is why the
     reference is resolved rather than written out.
 
+    A positive resolution is retained for this connection object. Production
+    connections establish their fixed ``main``/``cache_db`` topology before
+    their first read, so steady-state requests perform no repeated
+    ``sqlite_master`` or ``database_list`` probes. A caller that changes that
+    topology with ATTACH, DETACH, or table DDL must call
+    :func:`invalidate_codex_threads_table_resolution` before the next read.
+    Closing the connection ends the useful lifetime of its entry, and the
+    bounded LRU eventually releases the closed object. Absent-table results
+    are never cached.
+
     ``RuntimeError`` means exactly one thing: the table is absent from every
     schema this connection can see. A ``sqlite3.Error`` raised while
     resolving is a read the store could not perform and propagates unchanged,
@@ -194,14 +216,38 @@ def resolve_codex_threads_table(conn: sqlite3.Connection) -> str:
     (zero undecodable rows, the empty key set) never gives that answer for a
     locked or malformed store.
     """
+    with _threads_table_resolution_lock:
+        cached = _threads_table_resolution_cache.get(conn)
+        if cached is not None:
+            _threads_table_resolution_cache.move_to_end(conn)
+            return cached
+
+    resolved = None
     if _schema_holds_threads_table(conn, "main"):
-        return f"main.{CODEX_THREADS_TABLE}"
-    attached = tuple(conn.execute("PRAGMA database_list"))
-    for row in attached:
-        name = str(row[1]) if len(row) > 1 else ""
-        if name == "cache_db" and _schema_holds_threads_table(conn, name):
-            return f"cache_db.{CODEX_THREADS_TABLE}"
-    raise RuntimeError(
-        "the Codex threads table is not present in this connection's main "
-        "schema and no cache database is attached as cache_db"
-    )
+        resolved = f"main.{CODEX_THREADS_TABLE}"
+    else:
+        attached = tuple(conn.execute("PRAGMA database_list"))
+        for row in attached:
+            name = str(row[1]) if len(row) > 1 else ""
+            if name == "cache_db" and _schema_holds_threads_table(conn, name):
+                resolved = f"cache_db.{CODEX_THREADS_TABLE}"
+                break
+    if resolved is None:
+        raise RuntimeError(
+            "the Codex threads table is not present in this connection's main "
+            "schema and no cache database is attached as cache_db"
+        )
+
+    with _threads_table_resolution_lock:
+        _threads_table_resolution_cache[conn] = resolved
+        _threads_table_resolution_cache.move_to_end(conn)
+        while len(_threads_table_resolution_cache) > (
+                _THREADS_TABLE_RESOLUTION_CACHE_MAX):
+            _threads_table_resolution_cache.popitem(last=False)
+    return resolved
+
+
+def invalidate_codex_threads_table_resolution(conn: sqlite3.Connection) -> None:
+    """Forget a positive raw-table answer after connection schema changes."""
+    with _threads_table_resolution_lock:
+        _threads_table_resolution_cache.pop(conn, None)

package/bin/_lib_cost_provenance.py

@@ -0,0 +1,303 @@
+"""Durable evidence for cost facts whose model lacked a direct rate card."""
+
+from __future__ import annotations
+
+import datetime as dt
+import hashlib
+import json
+import math
+
+
+def _pricing():
+    """The pricing kernel the cost engine prices with, resolved per call.
+
+    A module-top binding pins whichever `_lib_pricing` object existed when this
+    module first loaded. A test loader that replaces that entry would then
+    leave this evidence describing a different rate table from the one the
+    cost it annotates was computed with.
+    """
+    import _lib_pricing
+    return _lib_pricing
+
+
+def codex_cost_with_provenance(entries, *, end, speed):
+    """Price one retained Codex population and fingerprint its exact inputs."""
+    _lib_pricing = _pricing()
+    total = 0.0
+    fallback_cost = 0.0
+    model_costs = {}
+    source = []
+    fallback = set()
+    for entry in entries:
+        if entry.timestamp >= end:  # budgets use a half-open period
+            continue
+        item = [
+            entry.timestamp.isoformat(), entry.source_path, entry.session_id,
+            entry.model, entry.input_tokens, entry.cached_input_tokens,
+            entry.output_tokens, entry.reasoning_output_tokens,
+        ]
+        source.append(item)
+        used_fallback = (
+            entry.input_tokens or entry.output_tokens
+        ) and _lib_pricing._is_codex_fallback(entry.model)
+        if used_fallback:
+            fallback.add(entry.model)
+        cost = _lib_pricing._calculate_codex_entry_cost(
+            entry.model, entry.input_tokens, entry.cached_input_tokens,
+            entry.output_tokens, entry.reasoning_output_tokens, speed=speed,
+        )
+        total += cost
+        model_costs[entry.model] = model_costs.get(entry.model, 0.0) + cost
+        if used_fallback:
+            fallback_cost += cost
+    encoded = json.dumps(
+        sorted(source), sort_keys=True, separators=(",", ":"),
+        ensure_ascii=False,
+    ).encode("utf-8")
+    evidence = {
+        "version": 1,
+        "pricingDate": _lib_pricing.current_pricing_snapshot().snapshot_date,
+        "fallbackModels": sorted(fallback),
+        "sourceHash": "sha256:" + hashlib.sha256(encoded).hexdigest(),
+        "entryCount": len(source),
+        "speed": speed,
+        "directCostUsd": total - fallback_cost,
+        "modelCostsUsd": model_costs,
+    }
+    return total, evidence
+
+
+# ---------------------------------------------------------------------------
+# Historical Claude five-hour closes (#869)
+# ---------------------------------------------------------------------------
+
+#: The ``basis`` of a close whose missing card was proven AFTER it closed, from
+#: its retained entries, rather than recorded while its cost was computed. The
+#: marker freezes the corrected close against every later card revision.
+HISTORICAL_CLOSE_BASIS = "historical-zero-cost-inference"
+
+#: The ``basis`` of a close corrected from the missing-card state its own cost
+#: computation recorded. Without it the corrected marker is indistinguishable
+#: from a close that was priced all along, and the plan could not freeze the
+#: corrected close's five-hour milestones with it.
+RECORDED_CLOSE_CORRECTION_BASIS = "computation-time-missing-card"
+
+_BLOCK_TOKEN_KEYS = (
+    "input_tokens", "output_tokens", "cache_create_tokens", "cache_read_tokens",
+)
+_CLAUDE_BASE_RATES = (
+    "input_cost_per_token",
+    "output_cost_per_token",
+    "cache_creation_input_token_cost",
+    "cache_read_input_token_cost",
+)
+_CLAUDE_TIER_RATES = (
+    "input_cost_per_token_above_200k_tokens",
+    "output_cost_per_token_above_200k_tokens",
+    "cache_creation_input_token_cost_above_200k_tokens",
+    "cache_read_input_token_cost_above_200k_tokens",
+)
+
+
+def _positive_rate(value) -> bool:
+    return (
+        isinstance(value, (int, float))
+        and not isinstance(value, bool)
+        and math.isfinite(value)
+        and value > 0
+    )
+
+
+def _zero_amount(value) -> bool:
+    return (
+        isinstance(value, (int, float))
+        and not isinstance(value, bool)
+        and value == 0
+    )
+
+
+def claude_card_rate_violations(snapshot) -> list:
+    """Every ``(model, rate)`` a zero-cost inference would silently rely on.
+
+    A closed amount of exactly $0 proves a missing card only while no Claude
+    card prices a used token class at zero. Base rates, any present long-
+    context tier, the derived 1-hour cache-write rate and any Fast multiplier
+    must all be positive; an empty list is that invariant.
+    """
+    _lib_pricing = _pricing()
+    out = []
+    multiplier = snapshot.cache_write_1h_multiplier
+    fast = snapshot.fast_multipliers.get("claude") or {}
+    for model, card in sorted(snapshot.claude_pricing.items()):
+        for field in _CLAUDE_BASE_RATES:
+            if not _positive_rate(card.get(field)):
+                out.append((model, field))
+        for field in _CLAUDE_TIER_RATES:
+            if field in card and not _positive_rate(card[field]):
+                out.append((model, field))
+        if not (_positive_rate(multiplier)
+                and _positive_rate(card.get("input_cost_per_token"))):
+            out.append((model, "cache_write_1h"))
+        tier_input = card.get("input_cost_per_token_above_200k_tokens")
+        if tier_input is not None and not (
+            _positive_rate(multiplier) and _positive_rate(tier_input)
+        ):
+            out.append((model, "cache_write_1h_above_200k_tokens"))
+        stripped = _lib_pricing._strip_anthropic_model_prefix(model)
+        if stripped in fast and not _positive_rate(fast[stripped]):
+            out.append((model, "fast_multiplier"))
+    return out
+
+
+def claude_entry_rates_positive(card, entry, snapshot) -> bool:
+    """True iff every rate that prices one of ``entry``'s tokens is positive.
+
+    Mirrors `_lib_pricing._calculate_entry_cost` term by term: each token class
+    is priced below the long-context threshold at its base rate and above it at
+    a present tier rate, and a known 1-hour cache-write split prices its share
+    at the derived input-times-multiplier rate.
+    """
+    if card is None:
+        return False
+    _lib_pricing = _pricing()
+    threshold = snapshot.tier_thresholds["claude"]
+
+    def tiered(tokens, base_key, tier_key):
+        if tokens <= 0:
+            return True
+        if not _positive_rate(card.get(base_key)):
+            return False
+        tier = card.get(tier_key)
+        if tokens > threshold and tier is not None:
+            return _positive_rate(tier)
+        return True
+
+    if not (
+        tiered(int(entry.input_tokens or 0), "input_cost_per_token",
+               "input_cost_per_token_above_200k_tokens")
+        and tiered(int(entry.output_tokens or 0), "output_cost_per_token",
+                   "output_cost_per_token_above_200k_tokens")
+        and tiered(int(entry.cache_read_tokens or 0),
+                   "cache_read_input_token_cost",
+                   "cache_read_input_token_cost_above_200k_tokens")
+    ):
+        return False
+    flat = int(entry.cache_creation_tokens or 0)
+    if flat > 0:
+        raw_1h = getattr(entry, "cache_1h_tokens", None)
+        hour = 0 if raw_1h is None else max(0, min(int(raw_1h), flat))
+        if hour == 0:
+            if not tiered(flat, "cache_creation_input_token_cost",
+                          "cache_creation_input_token_cost_above_200k_tokens"):
+                return False
+        else:
+            multiplier = snapshot.cache_write_1h_multiplier
+            base = card.get("input_cost_per_token", 0.0)
+            rate_5m = card.get("cache_creation_input_token_cost", 0.0)
+            below = min(flat, threshold)
+            above = max(0, flat - threshold)
+            terms = (
+                (below and hour, _positive_rate(multiplier)
+                 and _positive_rate(base)),
+                (above and hour, _positive_rate(multiplier) and _positive_rate(
+                    card.get("input_cost_per_token_above_200k_tokens", base))),
+                (below and flat - hour, _positive_rate(rate_5m)),
+                (above and flat - hour, _positive_rate(card.get(
+                    "cache_creation_input_token_cost_above_200k_tokens",
+                    rate_5m))),
+            )
+            if any(quantity and not positive for quantity, positive in terms):
+                return False
+    if getattr(entry, "speed", None) == "fast":
+        fast = (snapshot.fast_multipliers.get("claude") or {}).get(
+            _lib_pricing._strip_anthropic_model_prefix(entry.model), 1.0)
+        if not _positive_rate(fast):
+            return False
+    return True
+
+
+def historical_close_marker(close_payload, owned_entries, *, unattributed):
+    """The correction marker for an unmarked zero-cost close, or None.
+
+    The close must carry no computation-time marker, total exactly $0, and have
+    every positive-token model child at exactly $0; one priced model makes the
+    whole close unprovable, because its project children have no model axis.
+    ``owned_entries`` are the retained entries the current ownership rule
+    assigns to this close. Each one must belong to the close's account, a
+    positive-token model's entries must carry no provider cost, and today's
+    card for that model must price every token class the entry used at a
+    positive rate. The caller still compares the replayed child populations.
+    """
+    if (
+        close_payload.get("_pricing")
+        or close_payload.get("pricing_provenance_json") is not None
+        or close_payload.get("is_closed") != 1
+        or not _zero_amount(close_payload.get("total_cost_usd"))
+        or owned_entries is None
+    ):
+        return None
+    inferred = set()
+    for child in close_payload.get("_models") or []:
+        if any(int(child.get(key) or 0) > 0 for key in _BLOCK_TOKEN_KEYS):
+            model = child.get("model")
+            if not isinstance(model, str) or not model:
+                return None
+            if not _zero_amount(child.get("cost_usd")):
+                return None
+            inferred.add(model)
+    if not inferred or any(
+        not _zero_amount(child.get("cost_usd"))
+        for child in close_payload.get("_projects") or []
+    ):
+        return None
+    account = close_payload.get("account_key") or unattributed
+    _lib_pricing = _pricing()
+    snapshot = _lib_pricing.current_pricing_snapshot()
+    source = []
+    priced_models = set()
+    for entry in owned_entries:
+        offset = getattr(entry, "source_line_offset", None)
+        if (getattr(entry, "source_account_key", None) or unattributed) != account:
+            return None
+        if offset is None:
+            return None
+        positive = any((
+            entry.input_tokens, entry.output_tokens,
+            entry.cache_creation_tokens, entry.cache_read_tokens,
+        ))
+        if entry.model in inferred:
+            if entry.cost_usd is not None:
+                return None
+            if positive and not claude_entry_rates_positive(
+                _lib_pricing._resolve_model_pricing(entry.model, warn=False),
+                entry, snapshot,
+            ):
+                return None
+            if positive:
+                priced_models.add(entry.model)
+        elif positive:
+            return None
+        source.append([
+            entry.timestamp.astimezone(dt.timezone.utc).isoformat(),
+            entry.source_path, int(offset), entry.model,
+            int(entry.input_tokens or 0), int(entry.output_tokens or 0),
+            int(entry.cache_creation_tokens or 0),
+            getattr(entry, "cache_1h_tokens", None),
+            int(entry.cache_read_tokens or 0),
+            getattr(entry, "speed", None),
+        ])
+    if priced_models != inferred:
+        return None
+    encoded = json.dumps(
+        sorted(source, key=lambda item: json.dumps(item)),
+        sort_keys=True, separators=(",", ":"), ensure_ascii=False,
+    ).encode("utf-8")
+    return {
+        "version": 1,
+        "basis": HISTORICAL_CLOSE_BASIS,
+        "inferredModels": sorted(inferred),
+        "pricingDate": snapshot.snapshot_date,
+        "sourceHash": "sha256:" + hashlib.sha256(encoded).hexdigest(),
+        "entryCount": len(source),
+        "unpricedModels": [],
+    }