maka-agent 0.2.0-dev.75.20261008 → 0.2.0-dev.76.20261009

package/node_modules/@maka/runtime-host/dist/server/execution-composition.js

@@ -2288,6 +2288,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 'turn.stop': turnControl.handlers['turn.stop'],
                 'usage.query': usagePricing.handlers['usage.query'],
             },
+            runSettlementCoverage: (from, to) => usagePricing.runSettlementCoverage(from, to),
             context: {
                 hostEpoch: context.hostEpoch,
                 connectionId: 'hosted-execution',

package/node_modules/@maka/runtime-host/dist/server/execution-model-authority.js

@@ -31,6 +31,7 @@ import { buildSessionTitlePrompt, cleanGeneratedSessionTitle, SESSION_TITLE_GENE
 import { createProxiedFetchTransport, } from '@maka/runtime/network/scoped-fetch-transport';
 import { generateToolFreeModelCall, generateProviderPrefixModelCall, ProviderPrefixModelCallUnavailableError, } from '@maka/runtime/tool-free-model-call';
 import { resolveModelRuntime } from '@maka/runtime/model-runtime';
+import { NO_RUN_TURN_ID } from '@maka/storage/model-call-ledger';
 import { memoryExtractionMaxOutputTokens, } from '@maka/runtime/memory-extraction';
 import { createHostOAuthModelFetch, OAuthExecutionCredentialError, } from './oauth-execution-authority.js';
 import { toRuntimePolicyProxy } from './runtime-policy-proxy.js';
@@ -304,6 +305,15 @@ export function createHostGoalEvaluator(input) {
         },
     });
 }
+/**
+ * Turn placeholder for canonical rows of calls no run owns: auxiliary calls
+ * happen outside any turn, and the ledger's countable rows require the column.
+ * The storage side records the rows' no-run ownership from this seam, so a
+ * failed auxiliary call cannot flip a hosted run to indeterminate (#5691) —
+ * including a hosted execution legally named like this placeholder
+ * (#5890 review).
+ */
+const AUXILIARY_TURN_ID = NO_RUN_TURN_ID;
 function createAuxiliaryModelCallAuthority(input) {
     let drainRequested = false;
     const requestDrain = () => {
@@ -328,6 +338,17 @@ function createAuxiliaryModelCallAuthority(input) {
                 }
             },
         },
+        modelCalls: {
+            recordUsageUnknownAttempt: async (record) => {
+                try {
+                    await input.usage.modelCalls.recordUsageUnknownAttempt(record);
+                }
+                catch (error) {
+                    requestDrain();
+                    throw error;
+                }
+            },
+        },
         requestDrain,
         now: input.now ?? Date.now,
         newId: input.newId ?? randomUUID,
@@ -373,6 +394,32 @@ async function runHostAuxiliaryModelCall(authority, input) {
             modelId: target.model,
             startedAt,
         };
+        // Abort and error paths know no token counts: their canonical row says
+        // usage-unknown (`usageBasis: 'missing'`, no tokens) instead of posing as a
+        // free call (#5691). Auxiliary calls run outside any AgentRun, so the
+        // canonical writer is this store seam, not the run's event stream.
+        const recordUsageUnknown = async (status, errorClass) => {
+            const completedAt = authority.now();
+            try {
+                await authority.modelCalls.recordUsageUnknownAttempt({
+                    attemptId: input.callId,
+                    completedAt,
+                    ...(input.telemetrySessionId ? { sessionId: input.telemetrySessionId } : {}),
+                    logicalCallId: input.callId,
+                    turnId: AUXILIARY_TURN_ID,
+                    callKind: input.callKind,
+                    connectionSlug: target.connection.slug,
+                    providerId: target.connection.providerType,
+                    modelId: target.model,
+                    latencyMs: Math.max(0, completedAt - startedAt),
+                    status,
+                    ...(errorClass ? { errorClass } : {}),
+                });
+            }
+            catch (accountingError) {
+                throw new AuxiliaryModelCallLocalError('accounting', accountingError);
+            }
+        };
         let result;
         try {
             result = await readDuringBackendCreation(() => {
@@ -408,24 +455,18 @@ async function runHostAuxiliaryModelCall(authority, input) {
         }
         catch (error) {
             const effectiveError = readDeferredOAuthFailure?.() ?? error;
-            try {
-                await recordLlmCallStrict({ repo: authority.telemetry, lookupPricing: pricing }, {
-                    ...baseRecord,
-                    inputTokens: 0,
-                    outputTokens: 0,
-                    latencyMs: Math.max(0, authority.now() - startedAt),
-                    status: input.abortSignal.aborted ? 'aborted' : 'error',
-                    errorClass: evaluatorErrorClass(effectiveError),
-                });
-            }
-            catch (accountingError) {
-                throw new AuxiliaryModelCallLocalError('accounting', accountingError);
-            }
+            await recordUsageUnknown(input.abortSignal.aborted ? 'aborted' : 'failed', evaluatorErrorClass(effectiveError));
             throw effectiveError;
         }
         try {
             await recordLlmCallStrict({ repo: authority.telemetry, lookupPricing: pricing }, {
                 ...baseRecord,
+                // A completion without reported usage stays on the legacy zero path:
+                // hosted execution settlement refuses any range containing
+                // usage-missing rows ('missing_attempt_usage'), so routing these
+                // rows to the canonical ledger marked every such hosted run
+                // indeterminate. The residual zero is known dishonesty, pending a
+                // ruling on that settlement coverage semantics (#5691).
                 ...(result.usage
                     ? llmCallUsageFields(result.usage)
                     : { inputTokens: 0, outputTokens: 0 }),

package/node_modules/@maka/runtime-host/dist/server/hosted-execution-runner.js

@@ -50,8 +50,10 @@ export class HostHostedExecutionRunner {
             await (signal.aborted
                 ? this.input.waitForAllResidencies()
                 : this.input.waitForExecutionResidencies());
-            const usage = await this.#readUsage(startedAt, (this.input.now ?? Date.now)());
-            const incompleteUsage = incompleteUsageReason(usage);
+            const settledAt = (this.input.now ?? Date.now)();
+            const usage = await this.#readUsage(startedAt, settledAt);
+            const runCoverage = await this.input.runSettlementCoverage(startedAt, settledAt);
+            const incompleteUsage = incompleteUsageReason(usage, runCoverage);
             if (incompleteUsage) {
                 return indeterminate(input.executionId, `Runtime Host usage did not settle: ${incompleteUsage}`);
             }
@@ -111,15 +113,20 @@ export class HostHostedExecutionRunner {
         return result;
     }
 }
-function incompleteUsageReason(result) {
-    const { coverage, unreadableRecords, pendingRepairs } = result.provenance;
+function incompleteUsageReason(result, runCoverage) {
+    // Unreadable and pending-repair rows stay ledger-wide: damage in the window
+    // is nobody's settled fact. Partial and missing usage are judged against the
+    // same window as the totals this check guards (#5890), so a delegated child
+    // Session cannot settle underneath them — the `no_run` sentinel rows stay
+    // excluded, and the shared coverage field still reports everything.
+    const { unreadableRecords, pendingRepairs } = result.provenance;
     if (unreadableRecords > 0)
         return 'unreadable_usage_record';
     if (pendingRepairs > 0)
         return 'pending_usage_repair';
-    if (coverage.usagePartialAttempts > 0)
+    if (runCoverage.usagePartialAttempts > 0)
         return 'partial_attempt_usage';
-    if (coverage.usageMissingAttempts > 0)
+    if (runCoverage.usageMissingAttempts > 0)
         return 'missing_attempt_usage';
     return undefined;
 }

package/node_modules/@maka/runtime-host/dist/server/usage-pricing-coordinator.js

@@ -33,6 +33,16 @@ export class HostUsagePricingCoordinator {
         'pricing.query': (input) => this.#queryPricing(input),
         'pricing.mutate': (input) => this.#mutatePricing(input),
     };
+    /**
+     * What the settlement window itself left unsettled (#5890) — hosted
+     * execution settlement's incompleteness check reads the same window as the
+     * totals it guards, minus the `no_run` sentinel rows. Deliberately off the
+     * operation handler map: the ledger-wide `usage.query` coverage keeps a
+     * different shape, so settlement scopes itself through this in-process seam.
+     */
+    async runSettlementCoverage(from, to) {
+        return this.#stores.modelCalls.modelCallRunSettlementCoverage(from, to);
+    }
     #stores;
     #requestDrain;
     #activation;

package/node_modules/@maka/storage/dist/model-call-ledger.js

@@ -19,9 +19,10 @@
 import { decodeModelCallAttempt, MODEL_CALL_ATTEMPT_EVENT_TYPE, } from '@maka/core/model-call-attempt';
 import { resolveUsageRange, } from '@maka/core/model-call-usage-projection';
 import { usageBucketKey } from '@maka/core/usage-stats/bucket-key';
-import { bucketGrouping, CACHE_READ_TOKENS, count, countableFilter, COVERAGE_SUMS, PRICED_COST, REQUEST_SUMS, TOKEN_SUMS, unreadableFilter, } from './model-call-usage-sql.js';
+import { bucketGrouping, CACHE_READ_TOKENS, count, countableFilter, COVERAGE_SUMS, NO_RUN_TURN_ID, PRICED_COST, REQUEST_SUMS, RUN_SETTLEMENT_COVERAGE_SUMS, TOKEN_SUMS, unreadableFilter, } from './model-call-usage-sql.js';
 import { acquireOperationalStateDatabase, } from './operational-state-store.js';
 import { MODEL_CALL_COLUMNS } from './sqlite-usage-schema.js';
+export { NO_RUN_TURN_ID };
 export class ModelCallLedgerClosedError extends Error {
     constructor() {
         super('Model call ledger is draining or closed');
@@ -69,6 +70,11 @@ class SqliteModelCallLedger {
         const eventsPerRun = positiveInteger(input.eventsPerRun, 512, 'projection catch-up event limit');
         return this.write(() => catchUpModelCallProjection(this.#lease.database, input, limit, eventsPerRun));
     }
+    recordUsageUnknownAttempt(record) {
+        if (this.#state !== 'open')
+            return Promise.reject(new ModelCallLedgerClosedError());
+        return this.write(() => writeUsageUnknownModelCallAttempt(this.#lease.database, record));
+    }
     summary(query, now) {
         const db = this.#open();
         const range = resolveUsageRange(query.range, now);
@@ -159,6 +165,19 @@ class SqliteModelCallLedger {
             unreadableRecords: this.#unreadable(query, range),
         };
     }
+    runSettlementCoverage(from, to) {
+        const db = this.#open();
+        const row = db
+            .prepare(`SELECT ${RUN_SETTLEMENT_COVERAGE_SUMS}
+         FROM usage_model_call_attempts
+         WHERE cost_basis IS NOT NULL AND no_run = 0
+           AND completed_at >= ? AND completed_at <= ?`)
+            .get(from, to);
+        return {
+            usageMissingAttempts: count(row?.usageMissingAttempts),
+            usagePartialAttempts: count(row?.usagePartialAttempts),
+        };
+    }
     #open() {
         if (this.#state !== 'open')
             throw new ModelCallLedgerClosedError();
@@ -285,12 +304,51 @@ function bindModelCallAttempt(attempt) {
         reasoning_tokens: attempt.reasoningTokens ?? null,
         cost_basis: attempt.costBasis,
         cost_usd: attempt.costUsd ?? null,
+        // The projection's only source is the AgentRun authority: every row it
+        // writes is run-owned, whatever turn the run ran under.
+        no_run: 0,
     };
     return MODEL_CALL_COLUMNS.map((column) => values[column]);
 }
 function writeModelCallAttempt(db, attempt) {
     db.prepare(MODEL_CALL_UPSERT).run(...bindModelCallAttempt(attempt));
 }
+/**
+ * The usage-unknown binding: no token counts and no cost exist to record, and
+ * the table's CHECKs refuse any row that claimed otherwise.
+ */
+function bindUsageUnknownModelCallAttempt(record) {
+    const values = {
+        attempt_id: record.attemptId,
+        completed_at: record.completedAt,
+        session_id: record.sessionId ?? null,
+        logical_call_id: record.logicalCallId,
+        turn_id: record.turnId,
+        call_kind: record.callKind,
+        connection_slug: record.connectionSlug ?? null,
+        provider_id: record.providerId,
+        model_id: record.modelId,
+        latency_ms: record.latencyMs,
+        status: record.status,
+        error_class: record.errorClass ?? null,
+        usage_basis: 'missing',
+        input_tokens: null,
+        output_tokens: null,
+        cache_read_input_tokens: null,
+        cache_miss_input_tokens: null,
+        cache_write_input_tokens: null,
+        reasoning_tokens: null,
+        cost_basis: 'unpriced',
+        cost_usd: null,
+        // The one write outside any run's event stream: the ledger marks the row
+        // no-run here rather than inferring ownership from the turn value.
+        no_run: 1,
+    };
+    return MODEL_CALL_COLUMNS.map((column) => values[column]);
+}
+function writeUsageUnknownModelCallAttempt(db, record) {
+    db.prepare(MODEL_CALL_UPSERT).run(...bindUsageUnknownModelCallAttempt(record));
+}
 function catchUpModelCallProjection(db, input, limit, eventsPerRun) {
     const scope = projectionScope(input);
     const lagging = db

package/node_modules/@maka/storage/dist/model-call-usage-sql.js

@@ -36,6 +36,17 @@ export const CACHE_READ_TOKENS = `
 export const PRICED_COST = `CASE WHEN cost_basis = 'priced' THEN COALESCE(cost_usd, 0) ELSE 0 END`;
 /** Only a provider failure is an error. */
 const ERROR_ROW = `status = 'failed'`;
+/**
+ * The turn placeholder on rows recorded outside any AgentRun — failed and
+ * aborted auxiliary Host model calls (#5691). Such a row is honest accounting
+ * (real spend shape, unknown usage), so the ledger-wide coverage counts it.
+ * The value is a placeholder for the table's required turn column, not the
+ * settlement discriminator: rows carry a `no_run` column written by whichever
+ * seam recorded them, because a hosted execution legally named `auxiliary`
+ * owns rows under this same turn value (#5890 review). Shared with the writer
+ * so the placeholder cannot drift.
+ */
+export const NO_RUN_TURN_ID = 'auxiliary';
 export const TOKEN_SUMS = `
   SUM(COALESCE(input_tokens, 0)) AS input,
   SUM(COALESCE(output_tokens, 0)) AS output,
@@ -51,6 +62,18 @@ export const COVERAGE_SUMS = `
   SUM(usage_basis = 'reported') AS usageReportedAttempts,
   SUM(usage_basis = 'partial') AS usagePartialAttempts,
   SUM(usage_basis = 'missing') AS usageMissingAttempts`;
+/**
+ * Coverage a hosted execution's settlement may hold a run to (#5691): the
+ * rows the run owns — the ones its Session's event-stream projection
+ * recorded, outside the `no_run` mark the usage-unknown seam writes. The
+ * ownership exclusion is the query's WHERE clause, not an aggregate here, so
+ * this stays narrower than the ledger-wide {@link COVERAGE_SUMS} on purpose:
+ * one answers "what does the ledger hold unknown-usage rows for", the other
+ * "what did this run leave unsettled".
+ */
+export const RUN_SETTLEMENT_COVERAGE_SUMS = `
+  SUM(usage_basis = 'partial') AS usagePartialAttempts,
+  SUM(usage_basis = 'missing') AS usageMissingAttempts`;
 export const REQUEST_SUMS = `
   COUNT(*) AS totalRequests,
   SUM(${PRICED_COST}) AS totalCostUsd,

package/node_modules/@maka/storage/dist/sqlite-usage-schema.js

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-export const SQLITE_USAGE_SCHEMA_VERSION = 9;
+export const SQLITE_USAGE_SCHEMA_VERSION = 10;
 /**
  * The canonical ledger's columns, in the order every statement binds them.
  *
@@ -45,6 +45,7 @@ export const MODEL_CALL_COLUMNS = [
     'reasoning_tokens',
     'cost_basis',
     'cost_usd',
+    'no_run',
 ];
 /**
  * The JSON path each pricing column was read from before the columns existed,
@@ -131,6 +132,11 @@ const MODEL_CALL_TABLE = `
     reasoning_tokens INTEGER,
     cost_basis TEXT,
     cost_usd REAL,
+    -- Which writer recorded the row: the run's event-stream projection (0) or
+    -- the usage-unknown seam for calls no AgentRun owns (1). Settlement reads
+    -- this, not the turn value — a hosted execution legally named like the
+    -- no-run sentinel owns rows under the sentinel turn too (#5890 review).
+    no_run INTEGER NOT NULL DEFAULT 0,
     CHECK (${MODEL_CALL_REQUIRED_COLUMNS.map((column) => `(${column} IS NULL) = (cost_basis IS NULL)`).join(' AND ')}),
     -- A price that could not be resolved must never surface as an amount, and a
     -- priced call must carry one. Zero stays legal: it is the only way to say a
@@ -209,6 +215,12 @@ export function migrateSqliteUsageDatabase(db) {
     // through, and the conversion below reads one.
     ensureColumn(db, 'usage_model_call_attempts', 'session_id', 'TEXT');
     spreadModelCallRecordJson(db);
+    // no_run is written by the recorder, never inferred from the turn value:
+    // a backfill keyed on the auxiliary turn string would flip a legally named
+    // execution's own run-owned rows (see the settlement-coverage regression in
+    // model-call-usage-query.test.ts). Databases from before this column cannot
+    // hold auxiliary rows - recording them is what introduced the column.
+    ensureColumn(db, 'usage_model_call_attempts', 'no_run', 'INTEGER NOT NULL DEFAULT 0');
     db.exec(`
     CREATE INDEX IF NOT EXISTS usage_model_call_attempts_completed_at
       ON usage_model_call_attempts(completed_at DESC, attempt_id);
@@ -350,7 +362,10 @@ function spreadModelCallRecordJson(db) {
       attempt_id,
       completed_at,
       session_id,
-      ${pricing}
+      ${pricing},
+      -- Pre-column rows all predate the usage-unknown seam: every one of them
+      -- was recorded by the run's event-stream projection.
+      0 AS no_run
     FROM classified;
 
     DROP TABLE usage_model_call_attempts_blob;

package/node_modules/@maka/storage/dist/usage-stores.js

@@ -309,7 +309,9 @@ function createWriterFacade(lease, telemetry, modelCalls, pricing, screen) {
             modelCallSummary: (query, now) => read(() => modelCalls.summary(query, now)),
             modelCallBuckets: (query, groupBy, now) => read(() => modelCalls.buckets(query, groupBy, now)),
             modelCallLogs: (query, now, offset, limit) => read(() => modelCalls.logs(query, now, offset, limit)),
+            modelCallRunSettlementCoverage: (from, to) => read(() => modelCalls.runSettlementCoverage(from, to)),
             catchUpModelCallProjection: admitModelCallProjectionCatchUp,
+            recordUsageUnknownAttempt: (record) => admitSessionUsageMutation(record.sessionId, () => modelCalls.recordUsageUnknownAttempt(record)),
         },
         pricing: {
             snapshot: () => read(() => pricing.snapshot()),
@@ -343,6 +345,7 @@ function modelCallReader(ledger, run) {
         modelCallSummary: (query, now) => run(() => ledger.summary(query, now)),
         modelCallBuckets: (query, groupBy, now) => run(() => ledger.buckets(query, groupBy, now)),
         modelCallLogs: (query, now, offset, limit) => run(() => ledger.logs(query, now, offset, limit)),
+        modelCallRunSettlementCoverage: (from, to) => run(() => ledger.runSettlementCoverage(from, to)),
     });
 }
 function pricingReader(store, run) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maka-agent",
-  "version": "0.2.0-dev.75.20261008",
+  "version": "0.2.0-dev.76.20261009",
   "description": "Apache Maka (Incubating) developer snapshot; not an Apache release.",
   "license": "Apache-2.0",
   "type": "module",