Repository navigation
opencode config guard: fail CI when a metered/PAYG provider (cloudflare-*) is a route target or default without an explicit exception #2288
Description
Problem
The fleet's standing rule is plan quotas only, never PAYG — but nothing enforces it at the config layer. In October 2026 that gap cost real money: OpenCode sessions burned 4,114,515 Workers AI neurons (~$44.95 estimated) because a metered provider was selectable as a session model and sat in route fallbacks. The providers are disabled now; this issue makes the mistake structurally hard to repeat.
Verified facts (Workers AI cost investigation, 2026-10-29)
- 99.2% of the burn was one model —
@cf/deepseek-ai/deepseek-v4-pro-0813— via thecloudflare-gatewayprovider in the laptop's OpenCode config, in a two-day burst Oct 24–25 (sessions under~/work/id-train/). - Mechanism: every agent turn re-sent a ~200–500k-token context and Workers AI bills full input per call (336M cache-read tokens billed, not free).
- Workers AI is PAYG beyond 10k free neurons/day — there is no plan allowance to burn against, so it should never have been a workhorse/route target.
- Current state:
cloudflare-gateway,cloudflare-workers-ai, andcloudflare-ai-gatewayare all indisabled_providers; usage has been zero since Oct 25.
Ask
Add a config-level guard on the canonical pool config (this repo's .opencode/opencode.jsonc, the config-canonical source) so a PAYG/metered provider cannot silently become a route target or default again:
- Maintain an explicit metered-provider designation (the
cloudflare-*providers, plus any provider whose billing is per-call metered rather than a plan allowance). - A schema/CI check that fails when a metered provider appears in route targets, fallbacks, or session defaults — unless the config carries an explicit, visible exception marker at that spot (so any future exception is a deliberate, reviewable act, not an accident).
- Document the exception mechanism in
ci-policy.mdor in the config itself.
Acceptance criteria
- The check fails on a fixture config naming
cloudflare-gatewayas a route fallback without an exception marker. - The check passes on the current canonical config (Cloudflare providers disabled, no metered route targets).
- A fixture with a properly marked exception passes, and the marker format is documented in
ci-policy.mdor the config. - The check runs in CI on changes to
.opencode/opencode.jsonc.
Related: the companion collector alert issue (neurons/day threshold in pm-stack/cloudflare-export/) covers detection; this one covers prevention.
Activity
developing-today commentedon Oct 29, 2026
CODE-1146
dezren39 commentedon Oct 29, 2026
🤖 Agent note · filed
99 remaining items
dezren39 commentedon Nov 2, 2026
agent-note:v1 — holder: repo-worker-code (OpenChamber scheduled lane), at=2026-11-02T14:59:18Z. event: parked; task: 5235; queue: repo-health-code-pilot. PR #4165 remains OPEN, non-draft, Drew-authored/assigned and bound to this task. Prior note says CI + fresh Codex disposition are pending. Hard stop: no PR contents/checks/reviews/branch/worktree/source inspection or edits, no competing PR. Resume after owner release/PR resolution and revalidate all state.
Merge pull request #4165 from developing-today/queue/5235-2288-metere…
dezren39 commentedon Nov 2, 2026
agent-note:v1
event: picked_up
task: 5235 (repo-health-code-pilot, repo-worker-code; OpenChamber scheduled lane)
state: claimed; resumed from prior verification that canonical PR #4165 binds this task
next: Revalidate #2288 and #4165 metadata only. The PR, branch, worktree, and source are untouched under the Drew-owned hard stop.
dezren39 commentedon Nov 2, 2026
agent-note:v1
event: done
task: 5235 (repo-health-code-pilot, repo-worker-code; OpenChamber scheduled lane)
state: done (already_done)
evidence: Fresh gh metadata confirmed #2288 CLOSED and canonical PR #4165 MERGED. Queue task completed with outcome=already_done. PR contents, branch, worktree, and source were not inspected or touched.
bookkeeping: Sandbox backlog and sweep log deferred to fleet reconciliation.