BobSong-dev opened a new issue, #7958: URL: https://github.com/apache/shenyu/issues/7958
## Background P1-14 remaining budget policy in the mentor-approved OSPP plan; parent #7949. Identity-scoped multidimensional token/cost budgets must build on trustworthy per-attempt metering and existing reservations, not a competing settlement implementation. ## Existing ownership and reuse #7702 and open PR #7848 own opt-in estimated completion-token reservation/reconciliation, Redis-time fixed windows, idempotent settlement, cancellation/unknown-usage handling and validation/metrics. Do not duplicate that implementation or open another overshoot bug. As of 2026-10-21 #7848 was OPEN, not a merged baseline. #7934 owns the usage ledger and versioned estimated cost; #7911 / PR #7937 own Responses usage repair. P1-11 completes shared metering coverage. Preserve the existing token-limiter compatibility policy unless explicitly configured otherwise. ## Implementation scope: only gaps beyond #7848 - Extend the accepted reservation foundation to trusted tenant/subject/internal API-key ID/model dimensions and token/cost policy based on accepted P1-11 measurements and #7934 price provenance. - Define atomic reserve -> settle -> compensate across applicable dimensions: all-or-nothing admission or reliable compensation, one authoritative settlement chain, and idempotent attempt/logical correlation. - Cover retry/fallback attempts without creating a new retry policy or double charging. Specify failure, cancellation, missing usage, process crash, expired reservations and price/policy changes. - Ship P1-12 shadow/enforce integration with isolated shadow accounting, audited decisions and bounded metrics. Reuse P1-13 atomic-admission lessons. - State soft-budget exposure whenever maximum consumption or trustworthy final usage cannot be bounded. Reserved estimates and estimated monetary costs are not provider invoices or hard actual-spend guarantees. ## Non-goals Rewriting #7848, a second ledger/parser/settlement pipeline, provider invoicing, new model fallback, or unconditional hard-budget claims. Coordinate with the existing contributors without changing their issue scope or assignment. ## Acceptance criteria - [ ] An explicit gap matrix against the final #7848 implementation confirms no duplicate accounting/reservation ownership. - [ ] Concurrent multi-gateway/multidimensional admission cannot partially consume budgets without compensation. - [ ] Retry/fallback and duplicate settlement reconcile exactly once per accounting identity; late settlement cannot charge unrelated windows/policies. - [ ] Unknown usage, crash and expiry policies expose outstanding risk and do not silently become zero usage/cost. - [ ] Price version/currency/effective time remain traceable; shadow cannot debit enforce state. - [ ] Existing non-reservation rules remain compatible; documentation distinguishes completed-usage thresholds, estimated exposure and supported hard/soft bounds. ## Tests Extend #7848 real Redis suite: multi-identity/dimension races, retries/fallback, duplicate/late settlement, partial failure compensation, outage/crash/expiry, zero/unknown usage and price changes; actual JSON/SSE metering-to-budget fixture; shadow/enforce and trusted-identity isolation. ## Dependencies P0-02/P0-03, accepted P1-11 plus #7934, P1-12 and reusable #7702/#7848 foundation; coordinate #7911/#7937. Reassess this gap list when #7848 merges before implementation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
