Model portal, playground and reconciliation

The 1.1 candidate contract for identity, streaming delivery, frozen charges, components and monthly budgets.

This page documents reviewable branch source and isolated verification. It does not establish production deployment, real-provider/payment acceptance or release of every profile. Catalog visibility, HTTP200, DONE and a saved desired price are independent from execution and financial admission. Membership OAuth/SDK entitlements and PAYG API Credits have separate ledgers.

Catalog and profile selection

The /en/models and /zh/models portal and console read the same anonymous GET /api/open/v1/catalog/entries projection. A public detail URL uses m- plus the logical model ID encoded as canonical unpadded UTF-8 base64url. Execution selects profiles[].id, an actual UUID, and its exact wire. Compare at most four logical models; combined filters must match one profile rather than combining capabilities across profiles. Maker and bilingual descriptions come from explicitly registered metadata; missing metadata retains the runtime name.

The raw {version,observed_at,data} envelope has a 30-second public cache and ETag. Catalog observations older than 60 seconds retain read-only data but block trial until refreshed. An old observed_at must not be relabeled fresh after fetching. Protocol, financial admission, price ACK, release receipt and a known positive output limit are separate gates. Provider known_bad can still be probed by a server HALF_OPEN fixed-channel attempt, so it is not a permanent client prohibition. Performance staleness never substitutes for catalog staleness.

V1 reference display is Credits per million total TOKEN, including cache. The underlying legacy source rate remains Credits per total TOKEN. Decimal string arithmetic preserves microscopic prices. A zero becomes “Free” only when the price is ready and carries an explicit free reason; unknown price is —.

Code samples use only environment-variable credentials and a fixed demo prompt. Official clients are pinned to openai@5.12.2 and @anthropic-ai/sdk@0.60.0; their tabs require current compatV1Enabled=true and matching wire. Otherwise use /api/open/v1/models/<UUID>/chat or /anthropic with curl or explicit Go/Rust HTTP. OpenAI SDK baseURL is https://acosmi.com/v1; Anthropic SDK baseURL is https://acosmi.com because the SDK adds /v1/messages. If x-api-key support is disabled, explicitly send the Bearer Authorization header. Disable model-execution retries.

New channel UUIDs require explicit acosmi_options.routing={mode:'fixed',channel_id}. Priority means configured manual order, not cheapest/best/semantic routing. Smaller sortOrder wins, UUID breaks equal priority. New channels start disabled and legacySelectable=false. Membership/default, old SDK, tool/workflow readers retain their legacy projection. Changing adapter/wire/origin requires a new profile; existing executions must retain their original UUID.

Memory-only credential and transparent execution

Default browser execution uses /zhuanqian/api/console/playground/chat and a fixed Go /api/v4/open-api-playground/chat destination. The browser sends its current Java Bearer session, HttpOnly Nexus session cookie, explicit X-Acosmi-Playground-Key, a new UUID X-Request-ID, and {profile_id,wire,payload}. The BFF independently pairs both canonical principals; Go independently verifies the PAYG Key's canonical tenant/user, lifetime and scope before setting its billing context. Client model/user/tenant/endpoint overrides are forbidden. Writes require the same origin; reverse-proxy deployments can configure CONSOLE_PUBLIC_ORIGIN.

Explicitly create a 24-hour personal models:chat Key or paste one from secure storage. Plaintext lives only in React memory, never URL, logs or browser storage. Refresh, logout, token update or account switch clears the Key, prompt, previous output and stale callbacks, and stops old reception. Clearing is not revocation. PAYG Key rotation returns plaintext once, stops the old credential admitting new calls and preserves the stable budgetScopeId, history and unresolved holds. It never resumes a model automatically.

Output defaults to min(1024,profile.max_output_tokens), with a trusted positive integer cap. Switching profile resets the budget explicitly. Anthropic uses declared max_tokens; OpenAI prefers declared max_completion_tokens, otherwise declared max_tokens. Neither declared means no trial. The initial composer accepts text and existing supported tool definitions, with no media or legal execution adapter.

The dedicated ReadableStream bypasses the buffered 10-second management JSON relay. After 15 seconds without content, show waiting without retrying. Publication requires a measured positive GO_MODEL_EXECUTION_TIMEOUT_MS no greater than 3600000 and a BFF deadline at least Go+30000ms; missing configuration fails closed with503. UTF-8 and SSE fragments preserve partial frames. Native DONE/message_stop is a delivery fact, not a settlement receipt. Stopping reception, partial output, disconnection or lost headers does not mean no consumption.

Original records and financial status

X-Request-ID is transport tracking; X-Acosmi-Request-Id is the persistent consumption ID. Billing requestId is an event ID. Never synthesize settlement IDs or combine those meanings. If a response header is lost, query the original transport UUID rather than executing again.

Fixed console management BFFs forward requests, transport queries, private performance, budgets and budget operations with a verified Nexus Bearer derived from the paired Java session. All personal queries are no-store and owner checked; historical reconciliation does not require Key plaintext or an active Key. The Go consumption detail retains original reservation/finalization/usage/charge lines and exact money strings. Java's own financial endpoint uses camelCase. Old unprovable associations remain UNRESOLVED rather than invented.

RESERVED is a hold, SETTLED is consumption, RELEASED releases a hold rather than refunding cash, UNKNOWN_RESOLVED finalizes liability, and pending/unavailable finances remain unconfirmed. Null is shown as —, never0. Do not add holds and actual charges. Contractual, customer-charged and platform-covered Credits are separate immutable fields, independently from execution status.

Components, observations and monthly budget

V2 is only TEXT_COMPONENTS_V2 / UNIFIED, with input_uncached, output_total (including reasoning), cache_read and cache_write_total rates per million corresponding TOKEN. There are no TTL/search/request/reasoning surcharges. V1 and V2 source/publication/cursor/ACK domains remain independent; a logical model has unified customer prices across channels, without supplier purchase-price exposure.

An administrator reads or updates /api/v4/managed-models/:id/components-price with {measurement_schema,rates,free_reason,withdrawn}. Schema is OPENAI_GROSS_READ_V1 or ANTHROPIC_NET_CACHE_V1; all four rates are decimal strings, any zero requires an explicit reason, and withdrawal sends exactly {} rates. Saving desired source is not release acceptance. V2 execution also requires its own ready price, financial_ready_v2 and release_accepted_v2.

For a complete native text payload, POST the Java reference quote with {executionProfileId:UUID,payload}. Server-side identity/model/schema/measurement determines the estimate; client token estimates are not accepted. The camel response contains a positive integer effectivePriceVersion, decimal-string estimatedHoldCredits and string outputLimit. Quote does not execute a provider. A separate explicit user click sends acosmi_options={contract_version:'TEXT_COMPONENTS_V2',expected_price_version:quote.effectivePriceVersion,max_credits:'decimal string'}. Default cap is the quote hold, never silently increased. Parameter/config changes discard the quote;409PRICE_CHANGED requires a new quote and user submission even for a price decrease. Reserve recomputes peak/hold and freezes the contract. Customer charge cannot exceed the cap; excess contractual cost is separately platform covered.

Public and private observations use a 15-minute window and only accepted_payg_text samples, grouped by exact profile/channel/config_revision/wire. Server and provider success rates retain separate denominators. TTFT is first visible text/tool content, not headers/heartbeats. TPS is null for hidden output or missing final counters. Each public metric needs100 valid samples and an observation within5 minutes; otherwise display — plus status/window/count/observed_at. Private samples neither enter public metrics nor use the public100 threshold. Performance does not set charges or independently prohibit admitted trials.

Execution success is Go completed with intact native termination divided by all admitted executions; provider success is intact successful provider termination divided by all entered send chains. Failed/unknown/in-progress counts remain separate, and pre-admission rejects do not enter the provider denominator. TTFT is first_visible_content_at minus dispatch_at; role/reasoning is not visible first content, and interrupted requests can retain a measured TTFT. TPS is final_output_tokens divided by (provider_terminal_at minus first_provider_content_at) in seconds; explicit provider reasoning may start that interval, but hidden output, mismatched counter scope, synchronous replies, missing counters or nonpositive intervals make it null. P50/P95 use nearest-rank ceil(p*n), with independent samples per metric. Dispatch assigns the UTC [observed_at-15min,observed_at) window; process-monotonic time measures duration. Old total latency never creates a TTFT.

Budget GET/PUT is scoped to a stable credential family and UTC calendar month. PUT {limit_credits:null|string,warning_ratio:string} uses a UUID Idempotency-Key. Null is an explicit owner disable,0 blocks positive holds, warning ratio is a decimal 0.x string with1-6 fractional digits, strictly between0 and1. Confirmed consumption plus unresolved holds must fit the hard limit. Rotation does not reset the scope. Reserve freezes the month, including late settlement; cash refunds do not undo usage budget. V1/V2 and paid legal/compliance calls in the same scope are covered. warningIssued reflects one durable warning per scope per UTC month. Lost/unreadable ACK is not success: retain operationId and query APPLIED/REJECTED/PENDING rather than creating a new PUT blindly.

Fulfilled continuation and deployment boundary

An API_CREDITS order may store only canonical /console/playground?model=m-key&profile=UUID&wire=openai|anthropic, at most1024 characters and exactly those three query keys. No host/scheme/fragment/secret/prompt/identity or unknown query is accepted. The server binds it to the original order owner; other products reject it. Only a trusted FULFILLED order shows manual return. Paid pending is not usable balance; returning never executes, restores a Key/prompt or silently substitutes an invalid profile.

Both old consumer themes share /zhuanqian/products; GET/HEAD redirects307 to fixed relative /zh/models, dropping query data without Referer-based routing. Acosmi navigation points directly to Model API; the legal theme and its separate legal SKU/membership paths retain their own boundaries. Local fixtures, compilation and public browsing are not real-provider/payment or production acceptance.

Frozen charge reconciliation reads measurement_schema, effective_price_version and peak_multiplier from the original request. Rates use Credits per million tokens. rounding_difference is the signed contractual total minus four displayed charge lines; it explains display rounding and never adds a cash adjustment. Confirmed late usage after UNKNOWN_RESOLVED may provide this difference; unprovable values stay null.