Rate admission: enforce time-based quotas shared across client/provider aliases #75

New issue

Open

opened 2026-09-12 23:06:24 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-12 23:06:24 +00:00

Owner

Priority and relationship

User's September 12 instruction makes rate limiting the highest-priority next slice. Extend #70 / PR #74 rather than adding another scheduler. #74 currently limits concurrent requests only; fast completions can still produce an arbitrarily high request rate.

Bounded next slice

Add a monotonic-clock request token bucket, independently enforcing requests/minute and burst alongside max-active and bounded FIFO queue limits.
Consume quota only on admission; releasing an active slot does not refund request quota. Rejected/expired/cancelled waiters consume none.
Let trusted configuration map provider aliases to one shared limit group. Agent Zero/OpenCode presentation must not select a different quota bucket or multiply limits.
Preserve provider isolation outside explicit shared groups.
Return a scheduler-computed Retry-After, rounded up, and Cache-Control: no-store on local 429 responses.
Clean up FIFO waiters on every nonlocal exit; check deadlines before admission.
Make time/sleep injectable for deterministic, no-wall-clock rate/deadline regression tests.
Keep one in-process scheduler authoritative. Document that multiple processes and restarts require a later shared/persistent budget design; do not call these account-global quotas.

Compatibility profile requirement

User explicitly wants Agent Zero to present an OpenCode client identity upstream. Keep this requirement in #71: a trusted, pinned outbound wire profile separate from original client provenance and separate from rate-limit group ownership. Do not claim a changed User-Agent proves complete harness equivalence. The rate-control slice takes precedence; no automatic profile/credential rotation on 429.

Validation

Add regression tests before implementation. Cover burst exhaustion despite available active slots, refill boundaries, no refund after release/error, shared alias quotas, isolated providers, FIFO/deadline cleanup, and HTTP 429 headers/no upstream work. Require real Common Lisp/Nix execution before merge; static/source checks are not runtime evidence.

## Priority and relationship User's September 12 instruction makes rate limiting the highest-priority next slice. Extend #70 / PR #74 rather than adding another scheduler. #74 currently limits concurrent requests only; fast completions can still produce an arbitrarily high request rate. ## Bounded next slice - Add a monotonic-clock request token bucket, independently enforcing requests/minute and burst alongside max-active and bounded FIFO queue limits. - Consume quota only on admission; releasing an active slot does not refund request quota. Rejected/expired/cancelled waiters consume none. - Let trusted configuration map provider aliases to one shared limit group. Agent Zero/OpenCode presentation must not select a different quota bucket or multiply limits. - Preserve provider isolation outside explicit shared groups. - Return a scheduler-computed Retry-After, rounded up, and Cache-Control: no-store on local 429 responses. - Clean up FIFO waiters on every nonlocal exit; check deadlines before admission. - Make time/sleep injectable for deterministic, no-wall-clock rate/deadline regression tests. - Keep one in-process scheduler authoritative. Document that multiple processes and restarts require a later shared/persistent budget design; do not call these account-global quotas. ## Compatibility profile requirement User explicitly wants Agent Zero to present an OpenCode client identity upstream. Keep this requirement in #71: a trusted, pinned outbound wire profile separate from original client provenance and separate from rate-limit group ownership. Do not claim a changed User-Agent proves complete harness equivalence. The rate-control slice takes precedence; no automatic profile/credential rotation on 429. ## Validation Add regression tests before implementation. Cover burst exhaustion despite available active slots, refill boundaries, no refund after release/error, shared alias quotas, isolated providers, FIFO/deadline cleanup, and HTTP 429 headers/no upstream work. Require real Common Lisp/Nix execution before merge; static/source checks are not runtime evidence.

nsaspy referenced this issue from a commit

2026-09-12 23:17:20 +00:00

feat: enforce shared request-rate admission with bounded FIFO and computed 429s (#75)

nsaspy referenced this issue

2026-09-12 23:19:21 +00:00

Versioned outbound privacy/compatibility profiles for Hermes, OpenClaw and Agent Zero #72

nsaspy referenced this issue

2026-09-12 23:21:00 +00:00

Rate admission: time-based quotas shared across client aliases #77

nsaspy referenced this issue

2026-09-13 01:55:56 +00:00

Provider-reported subscription quota telemetry for z.AI and GPT / Qtile #79