# Budget admission and settlement contract

Rethinking Agents · v0.1 · October 1, 2026

**A visible cost counter is not a spend ceiling.** State the accounting scope and reserve a sufficient upper bound before dispatch where the provider contract supports one. Existing gateways already implement reservation; this is a deployment review aid, not a claim to invent it.

## Contract record — NOT RUN

- Budget owner / task / period / currency or internal unit: UNKNOWN
- Hard ceiling or estimate? UNKNOWN
- Metered operations, route allowlist and pricing version: UNKNOWN
- Maximum billable units per dispatch, including retries and fallbacks: UNKNOWN
- Admission authority and atomic reservation store: UNKNOWN
- Mandatory routing / direct-path prevention: UNKNOWN
- Settlement source and duplicate-event handling: UNKNOWN
- Missing usage, timeout and unavailable accounting behavior: UNKNOWN
- Async-job maximum duration/charge and cancellation acknowledgement: UNKNOWN
- Reservation expiry/reconciliation policy: UNKNOWN
- Useful-task control and measured admission latency: UNKNOWN

For a bounded supported route, require `settled charges + outstanding reservations <= ceiling`. Reservation sufficiency matters: reserving less than a possible charge can satisfy the arithmetic while failing the actual cap. Use integer minor units with an explicit pricing/rounding policy. Internal fixture units are not dollars.

## Cases to take to an existing gateway

| Case | Expected evidence and decision |
|---|---|
| Concurrent dispatch | Atomic admission allows only requests whose combined maximum cost fits |
| Retry/fallback | A distinct billable attempt needs its own reservation and approved priced route |
| Lost acknowledgement | Keep enough reservation for the possible charge; reconcile before replay |
| Duplicate settlement | Same charge event must not double-count; a different provider charge must not disappear |
| Accounting outage | No unreserved dispatch while required accounting is unavailable |
| Unknown pricing | Deny/review unsupported routes; never silently assign price zero |
| Cancellation requested | Do not refund on request alone; obtain acknowledgement and final usage |
| Direct provider path | Verify the path is unreachable or independently bounded; a bypass is FAIL even without observed overspend |
| Async job | Reserve its supported maximum liability or label the cap an estimate |

The [OpenHands issue](https://github.com/OpenHands/OpenHands/issues/17691) reports active-cost visibility behavior. It motivates checking live accounting; we have not independently reproduced it. [LiteLLM's budget documentation](https://docs.litellm.ai/docs/proxy/users) is a starting point for existing controls, not a claim that this kit tested a deployed gateway.

## Worked failure — fictional, NOT RUN

A budget is 10 internal units. Two operations can each cost at most 6. Separate reads both see 10 available and both dispatch: up to 12 units can be charged. A shared atomic reservation admits only one. If its acknowledgement is lost, its 6-unit reservation remains until settlement establishes the actual charge. Expiring it merely because the worker stopped recreates the overspend path.

## What the executable establishes

The local lab tests a small in-memory reference ledger with fixed synthetic prices and no actual provider. It establishes that ledger's admission/settlement behavior for its cases. It does not test gateway persistence, distributed atomicity, provider metering, route bypass prevention, real cancellation or an actual currency ceiling. Run the cases against your configured gateway before recording deployment conformance.