4 Commits

Include renames

Author	SHA1	Message	Date
xsl	a4d59aca30	feat(llm): four-tier daily budget degradation with manual override ... 把单一日预算熔断升级为架构 §13.3 的四档分级降级（T-P1-25b / NFR-COST-02）： - budget.py：新增 BudgetTier 配置模型与档位判定（current_tier/tier_name/ blocked_scenes）。阈值相对 LLM_DAILY_BUDGET_CENTS：warn ≥60% 只告警； degrade_secondary ≥80% 拒 hd_export/report_regen；degrade_generation ≥90% 追加拒 hairstyle/tryon；block_all ≥100% 拒全部非 critical、allow 名单 （默认 agent_chat）放行。高档位 blocked 取「截至当前档的并集」（架构原文 「追加拒绝」）。critical 场景全档豁免但照常计成本。 - 手动 override：Redis 键 llm:budget:override（值 "1"~"4"），优先于成本水 位，读不到/非法则忽略；set_override TTL 到当日 UTC+8 24 点，跨预算日必然 失效。CostCounter 协议相应增加 set/delete。 - 指标：Gauge llm_budget_tier + Counter llm_budget_blocked_total{scene} 挂到共享 REGISTRY 随 /metrics 暴露；档位上升沿只告警一次 （budget_tier_raised，实例内记 last_tier）。 - errors.py 新增 SceneDegradedError（tier2/3 拒绝）；gateway.py 调用点换成 ensure_scene_allowed（保留 ensure_within_budget 兼容入口）；agent.py 映射 LLM_SCENE_DEGRADED(60006)；100% 档维持 DailyBudgetExceededError/60003 语义。 - 单测：新增 tests/unit/test_tiered_budget.py（27 例：四档边界、各档放行/ 拒绝、critical 豁免、override 加严/放宽/非法值/TTL、配置驱动）。 - 集成：tests/integration/test_vertical_slice.py 新增用例——预算 1 分 + block_all allow 清空 + Redis 注入当日成本，POST /agent/chat 返回 60003， 断言 bl_ledger 中 consume(refunded,-1)+refund(committed,+1) 净和为 0， 覆盖「reserve 之后才熔断 → refund」路径；fixture 重构为共享 FakeProvider/fake_client，断言语义未弱化。 门禁：ruff check/format、mypy（packages/llm strict + 其余包）、lint-imports、 单测 196 passed、集成 4 passed。 偏差说明： 1. tests/unit/test_gateway.py 的 test_daily_budget_rejects_non_critical_ scenes_before_spending 把被测场景 AGENT_CHAT 换成 REPORT_COPY（test_daily_ budget.py 同用例换 tryon）：block_all 档默认 allow=["agent_chat"]（架构 「仅保留纯文本对话」）后 agent_chat 在 100% 档不再被拒，原场景选择与新 语义冲突；断言本身（进 provider 前被拒）未弱化。 2. 集成测试的 block_all 档配置为 blocked="*"+allow=[]（文档示例为 blocked=["agent_chat"]）：后者按档位规则会走 SceneDegradedError/60006， 前者才能按设计走既有 60003 语义（文档允许二者取其一且"按上面设计应为 60003"）。	2026-08-14 16:27:21 +08:00
xsl	c97f8ae3e1	feat(cost): persist reasoning tokens and the peak/off-peak tier ... ob_ai_call is the only input to V2 pricing, and it was dropping the two numbers needed to interpret its own cost column. tokens_reasoning was captured from the provider response but never written to the table, so the cost of thinking mode was invisible once it left the process. Folding it into tokens_out was not an option either -- it is billed at the output rate, and mixing the two hides exactly the difference we now have to watch. rate_tier records which price list applied. Without it a row's cost_cents cannot be rechecked: DeepSeek's peak rate is double off-peak from 2026-08-17, so recomputing an old row at "the current rate" silently produces a different answer than what was actually billed. Migration 0002 adds both columns. tokens_reasoning defaults to 0 rather than NULL so cost aggregates do not collapse to NULL on historical rows; rate_tier stays nullable because rows written before this change genuinely have an unknown tier, and NULL says that more honestly than a guessed 'flat'. The smoke script now asserts both: reasoning tokens must be 0 (a non-zero value means a provider default re-enabled thinking mode behind our backs) and rate_tier must be present. Verified against the real API -- tokens_reasoning=0, rate_tier=off_peak, 3.9s round trip.	2026-08-14 01:02:13 +08:00
xsl	f46ecc5eb0	fix(llm): price by call time and stop paying for thinking tokens ... Two defects that only surface against the real DeepSeek API, both of which break the cost model rather than the code: deepseek-v4-flash enables thinking mode by default. The same single-turn question took 13.5s with it on and 1.8s with it off, and the thinking tokens are billed at the output rate. That misses NFR-PERF-02b (15s per turn) and inflates every conversational call. SceneConfig now carries an explicit `thinking` flag, all four V1 scenes set it to false, and the provider always sends the parameter rather than relying on the upstream default. Reasoning tokens are recorded separately in Usage.tokens_reasoning so the cost of ever turning it back on is visible. DeepSeek moves to peak/off-peak pricing on 2026-08-17, with peak (Beijing 09:00-12:00 and 14:00-18:00) at twice the off-peak rate. Reports are generated mostly during peak hours, so a single blended rate would leave ob_ai_call -- the only input to V2 pricing -- off by nearly a factor of two. PeakAwareRateTable resolves the rate at call time; cost is computed and stored then, never recomputed later at whatever the current rate happens to be. Also here: - Replace the live API key in the redaction test with a synthetic one. The test that proves we redact secrets was itself a secret leak waiting for its first commit. - Correct LLM_COST_RATES_JSON, which held placeholder rates. - Make ids.SnowflakeGenerator take an injectable clock so rollover and clock-rollback are testable without patching a slots class. - Rename exceptions to the -Error suffix (N818) and clear the remaining ruff, mypy and import-linter findings, including two dead lines: a duplicate pytestmark assignment and a no-op assert on a None return. Gates: ruff, mypy (96 files incl. tests), 4/4 import contracts, detect-secrets, 166 unit + 3 integration tests, migration up/down round-trip.	2026-08-14 00:54:40 +08:00
xsl	93b88db2f5	test: unit suite for the gateway invariants plus an integration slice ... Covers routing, failover, the circuit breaker, structured-output retries, the cache-prefix validator, cost computation including cached-token pricing, the daily budget breaker, the quota protocol, the task state machine and log redaction. HTTP is mocked -- no unit test spends money. The integration test runs the real slice against PostgreSQL and Redis with a faked provider.	2026-08-14 00:26:39 +08:00