7 Commits

Author	SHA1	Message	Date
rob thijssen	f4117224fc	feat(B6): served-usage ledger + reconciliation (#58) ... Operators are now metered for the tokens they serve on behalf of mesh accounts, and the upstream rolls that up for compensation. cortex-gateway: - served_usage.rs: an in-process per-(account,key,UTC-day) served-token counter, incremented in metering::usage_sink alongside spend/settle for every authenticated request. A flush task (spawned in run() when [upstream].enabled, mirroring poller/evictor) POSTs ABSOLUTE cumulative counters to upstream on [upstream].served_usage_report_interval_secs. - The no-limit infra key is the operator's local key with hard_cap=None (already supported) — it's metered for served-usage but never budget- refused and never hits upstream. helexa-upstream: - POST /authz/v1/served-usage: upserts rows keyed by (operator_id from the client bearer, account, key, period) with GREATEST(existing, incoming) — monotonic + idempotent, so re-sends, races, and a restarted cortex's lower counter never regress the total. - reconcile.rs + `helexa-upstream reconcile` CLI: rolls up unreconciled served_usage per operator/period (SUM::bigint), stamps reconciled_at, prints the totals. Payout mechanism out of scope. Validated against a throwaway Postgres: monotonic upsert (100→250, a 50 re-send stays 250, same-value idempotent) and reconcile rollup + stamp-once; cortex counter unit test for per-principal accumulation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6o3ddqmYNh9kzdwq6eowh	2026-06-23 11:45:57 +03:00
rob thijssen	a9d7382be8	feat(B3): cortex upstream entitlement client (#57) + chained provider ... cortex can now validate locally-unrecognised bearer keys against the helexa-upstream authority and reserve/settle their budget there — mesh accounts work for real inference. The EntitlementProvider trait is the seam, so cortex's enforcement (auth.rs, metering.rs) is otherwise unchanged. - entitlements_upstream.rs: UpstreamEntitlementProvider over reqwest → B2's /authz/v1 (resolve/reserve/settle/release/snapshot), presenting the operator client bearer. Maps the wire contract back to the trait: granted → Reservation, rejected → BudgetError, 401 → InvalidKey. Fail-closed — unreachable resolve → AuthError::Unavailable (503, never 401); unreachable reserve → retryable BudgetError::RateLimited (refuse, never serve un-authorized). settle/release are best-effort (the upstream sweeper reaps a lost one). - entitlements_chain.rs: ChainedEntitlementProvider tries local first (operator + infra keys, no network), falls through to upstream for unknown keys, and dispatches reserve/settle/release/snapshot to whichever backend resolved each account (local treats unknown principals as uncapped, so it can't be the blind default). - cortex-core: AuthError::Unavailable{retry_after_secs}; [upstream] config (enabled/url/bearer/timeout). auth.rs maps Unavailable → 503 + Retry-After distinctly from InvalidKey → 401, regardless of require_auth. - state.rs wires the chain when [upstream].enabled, else stays purely local. Tests (upstream_chain.rs, 4): local key resolves without touching upstream; unknown key falls through to a mock upstream; unknown-everywhere → 401 InvalidKey; upstream-unreachable → Unavailable (503-mapped), with local keys still resolving. Existing gateway suites updated for the new config field. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01F6o3ddqmYNh9kzdwq6eowh	2026-06-23 10:41:48 +03:00
rob thijssen	bc74e0e95f	feat(#47 phase 1a): EntitlementProvider trait + local/static provider ... Stage 1's build seam (#50): the interface auth, metering, and budget enforcement all hang off, with a local/static provider so the A0 amplification fix can land before any upstream clearing house exists. The future helexa-upstream client (#57) is just another impl. - cortex-core::entitlements: Principal {account_id, key_id}, CapWindow (Balance | Rolling{seconds}), Reservation handle, BudgetSnapshot, AuthError/BudgetError, and the async EntitlementProvider trait (resolve / reserve / settle / release / snapshot). BudgetError carries the window semantics so callers pick the #63 code (rate_limit_exceeded + Retry-After vs insufficient_quota) without the provider touching HTTP. - cortex-core::config: [entitlements] section on GatewayConfig (require_auth + [[entitlements.keys]] with account_id, optional key_id, hard_cap, window). Additive + serde(default) — anonymous/uncapped when omitted, so existing setups are unaffected. - cortex-gateway::entitlements_local: LocalEntitlementProvider. Budget math serialized under one Mutex so spent+reserved can never exceed a hard cap under concurrency (the #52 guarantee); rolling windows reset lazily; uncapped keys (no hard_cap) always reserve but still meter. - CortexState gains Arc<dyn EntitlementProvider> + require_auth, built in from_config. Not yet consumed by the request path — auth middleware is 1b (#49), enforcement is 1d (#52). - cortex.example.toml documents the section; test GatewayConfig literals updated for the new field. 6 provider unit tests (resolve, unknown-key, round-trip, balance/rolling over-cap codes, uncapped infra key). Local fmt/clippy/test all green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 19:00:05 +03:00
rob thijssen	11b2e6f78c	fix(cortex): default models_config to the packaged absolute path ... cortex resolved the catalogue path "models.toml" relative to the service's working directory, so the systemd-launched binary never found /etc/cortex/models.toml and ran with an EMPTY catalogue in production — limits, cost, pinning, aliases and feasibility were all silent no-ops, with models surfacing only via the neuron poller. Tests never caught it because they pass models_config explicitly; only the defaulted, packaged path was broken. Default to the absolute /etc/cortex/models.toml (where cortex.spec installs it) and document the override in cortex.example.toml. Restores the #62 limit/cost advertisement (the catalogue is now actually read) along with pinning/aliases/feasibility. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 10:04:29 +03:00
rob thijssen	3cccc2c56b	refactor(neuron): cut mistralrs/llamacpp, scaffold candle harness ... Stage 1 of the candle-native pivot. Replaces the external-process harness model (mistralrs over HTTP, llamacpp placeholder) with an in-process Harness trait whose sole implementation is candle. The trait keeps its shape so future engines slot in additively, but start/stop default to no-ops and HarnessConfig drops endpoint and systemd_unit since no harness needs external supervision. Behaviour is unchanged on the wire: load_model returns a "not implemented yet (Stage 2)" error and list_models is empty. The gateway-side proxy, poller, and router are untouched. CLAUDE.md Phase 11 (llama.cpp) and Phase 12 (mistral.rs COPR) are marked superseded; the staged plan lives in ~/.claude/plans/create-a-more-aggressive-calm-naur.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-18 15:53:04 +03:00
rob thijssen	3f94c50817	chore: move default ports out of common-collision ranges ... Previous defaults collided with well-trodden infra services and with the Linux ephemeral port range: - cortex API 8000 — common dev-server default (Django, minio UI) - cortex metrics 9100 — Prometheus node_exporter default - neuron API 9090 — Cockpit default on Fedora, Prometheus self Move to helexa-themed palindromic ports, all below Linux's 32768-60999 ephemeral range and not registered to any well-known service: - cortex API 31313 - cortex metrics 31314 - neuron API 13131 Updated places: - cortex.example.toml, neuron.example.toml defaults - default impls in cortex-core and neuron config - cortex-cli --endpoint default for the status subcommand - doc comments citing example URLs - README.md and CLAUDE.md snippets Consumers already on the old ports need a one-line edit in their /etc/cortex/cortex.toml or /etc/neuron/neuron.toml to match; firewall rules and prometheus scrape configs will also need updating. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-16 17:45:25 +03:00
rob thijssen	0da68833af	feat: scaffold cortex workspace ... Rust reverse-proxy for multi-node mistral.rs inference clusters. Includes crate structure (cortex-core, cortex-gateway, cortex-agent, cortex-cli), config loading, OpenAI/Anthropic translation stubs, model routing, eviction, polling, and streaming proxy scaffolding. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-14 18:13:30 +03:00