John Smith
f763bf22e8
fix(audit): remediate all 15 adversarial audit findings (VULN-01..15)
...
Critical/High:
- update-data.yml opens a data-refresh PR instead of auto-pushing to main;
all GitHub Actions pinned by commit SHA; validate-data gains price sanity
bounds (non-free $0 prices, ceilings, NaN/negative rejection) (VULN-01)
- cache scaling in computeApplesToApples gated on isDollarPoolTier; metered
quotas deliver fixed tokens at any cache rate; unmatched tiers use the
same model-priced ratio (VULN-02, VULN-08)
- new 'overage' throttle status for payg-overage profiles with overageTurns
reporting and severity-ordered overall status; BurstSimulator Overage
filter/badge/stat (VULN-03)
- hardware economics: decode-hour feasibility check (requiredInferenceHours,
infeasibleWorkload, feasibleMonthlyVolumeM) + payback gated on positive
amortized alpha (VULN-04)
- log-parser measuredTokens provenance; receipts flag synthetic token
accounting with ESTIMATED banners (VULN-05)
Medium/Low:
- reasoning effort feasibility guard vs contextWindow/maxOutput (VULN-06)
- parsePlanCacheAssumption anchored to cache context, clamped <= 0.95 (VULN-07)
- arbitrage callout discloses API-vs-subscription spend asymmetry (VULN-09)
- tos classifier: 'no guarantee' not training evidence; indemnity warnings
with carve-out caveats; gotcha severity on strong signals only (VULN-10)
- build-data benchmark fuzzy fallback + 25% match-rate floor; match rate
29% -> 60% (VULN-11)
- weekly quota x52/12 conversion; queue delays defer turns (VULN-12)
- shared numParam helper for zero-safe URL params (VULN-13)
- cacheWriteShare (0.06) wired into agentBlendedCost in both data scripts;
SALVAGE_CLAMP_MAX unification; costPer1kRequests ?? fix (VULN-14)
- session cache-bust residual and provider cache-read fallback ratios moved
to estimate-constants.json; teams.ts no longer fabricates 10% cache
discount for unknown cache prices (VULN-15)
Docs: VERIFICATION.md records the full pass. Tests: 130/130; lint clean;
validate-data OK; production build clean.
2026-09-20 22:54:19 -04:00
John Smith
98ce11bab8
feat(pipeline): generate and publish usage-limits.json in GitHub Pages workflow
2026-09-19 21:36:31 -04:00
John Smith
fc4ae5c9be
test(pricing): add vitest suite for pricing math and stacking invariants
...
- covers agent-request cost formula, weighted/value scores, budget filters,
plan-model matching, apples-to-apples rows, stack candidate selection,
Dave stacks and Mix & Match budget/distinctness properties
- run tests in the deploy workflow alongside lint and data validation
2026-09-19 00:55:31 -04:00
John Smith
c7b191067f
chore(guardrails): add data validator, wire into CI, reproducible plan generation
...
- scripts/validate-data.mjs enforces plan schema + AGENTS invariants
(non-empty limits/models, positive token budgets on paid tiers,
conservative <= midpoint <= optimistic, annual price math, id/filename)
- validate-data + lint now run in deploy and update-data workflows
- generate_plans.py: relative output path, single LAST_VERIFIED constant
- fix zero-token paid tiers (kilo-code Teams, opencode Zen, tabnine) with
documented platform-fee-equivalent estimates so stacking no longer drops them
2026-09-19 00:54:33 -04:00
John Smith
ec3f7f8c02
feat: initial implementation of Token-Max model and coding plan usage tracker
2026-09-18 20:36:08 -04:00
John Smith