[Abiorh001]

Closes #492

Outcome

Adds one non-resetting project MODEL-USAGE account shared by guide setup and approved POST checker agents. Operator-published profiles pin provider, model, pricing and finite call/tool/token/byte limits; Operator budget versions reconcile prior external spend without resetting lifetime counters. Provider credentials remain only in the trusted relay. Setup retains its native Agents or OmniCore loop, while checker images receive invocation-local bounded model access.

Paid requests are durably reserved before dispatch, and request/response evidence is retained through protected ART custody. Known terminal results settle once. Lost or ambiguous responses retain their reservation and cannot be recreated; setup uses provider storage disabled, so a provider ID alone is explicitly not treated as recoverable response evidence. Budget, provider and relay failures remain infrastructure outcomes and do not spend a Submission revision.

Scope

• strong setup and checker owner lineage with AUTH/currentness and SQL backstops
• one project-lifetime account, immutable budget/profile versions, per-run envelopes and per-dispatch effects
• bounded multi-call setup and POST sessions with finite aggregate call, tool, token and byte ceilings
• controlled OpenAI Responses and OpenRouter adapters with metadata/pricing preflight and no hidden paid retry
• exact System Operator effect inspection without provider coordinates, content or mutation authority
• hosted relay socket and credential isolation independent of setup runtime/provider choice
• explicit Smol boundary: model grants fail closed before VM admission because the current guest does not project host Unix sockets
• linear 0062_model_usage migration after main's 0061_project_catalogue_read and 0060_audit_restore_path

Current controlled evidence

• exact-head public API contract at 126a3a61f passed end to end through real System Operator grant and model-profile publication; both scripted setup compilations completed/replayed without inference, with Alembic 0062 and owned PostgreSQL/MinIO cleanup confirmed
• exact-head provider-free MCP profile lifecycle passed 21/21 with the shared API environment retaining ART disabled; separate full setup drill keeps its typed model socket and bounded ART custody
• canonical parent schema installs through 0062_model_usage; measured public-schema digest d14a06c088aae0e8876bebb637a7b3fb0c19344f8cc4fdfd31aa2c1a47348593
• real PostgreSQL owner-authority selection: 20/20 passed, covering checker/setup prepare, dispatch, observation and terminal substitutions; known-failed settlement; renewed legitimate grants; successor-run reuse of one effect; and stale/reused authorization denial
• independent QA: seven authority/renewal cases and the deterministic concurrent callback passed; a newest-grant reconstruction mutant was killed at renewed dispatch
• composed model boundary: four ordinary completion/replay/concurrent cases passed; proven no-effect and fully settled failure recovery each passed with a finite second dispatch while preserving the original effect
• manual setup correction/profile custody: 5/5 public HTTP/PostgreSQL cases passed, including immutable profile-v1 replay after profile-v2 publication and denial paths
• actual MinIO S3 adapter selection: 11/11 passed, including timeout/cancellation quiescence and no post-return source reads
• hosted configuration after current-main reconciliation: 38/38 passed; Ruff, behavior ownership and structural-debt validation pass
• current-main Smol/model service reconciliation: combined Rust service 44/44 passed; affected backend/CI selection 108/108 passed
• retained-data upgrade from parent 0062_model_usage through stacked 0064: 1/1 real PostgreSQL case passed at 44a6a01d2, preserving all three lineages with the parent d14a… schema checked before migration; owned database and probed MinIO cleanup completed (this fixture uses local ART storage and is not a child-runtime claim)
• an actual built Rust relay Docker smoke passed with no network, read-only input/root filesystem, invocation-only socket exposure, concealed global grant and owned cleanup

All provider checks are controlled and offline. No paid provider call, deployment, activation or merge was performed. The relay smoke does not qualify hosted deployment or composed gVisor execution.

Still pending before ready

• current hosted CI completion
• remaining independent review gates; QA passed its reviewed atoms, but security-review attempts ended in platform errors and no security sign-off is claimed
• [PILOT-06] Complete guide-derived project POST checkers and isolated execution #493 stacked project-specific execution-trial and Terminal Systems rubric integration
• external reconciliation of the remaining allowance under the existing aggregate US$10 rehearsal ceiling before any paid call

This PR remains draft and requires human merge approval.