peptide-repo/pr-vision
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PR Vision v0.3.0: per-call cost accountability + LLM call audit trail

Browse Source 
P0 security:
- PRV_Gateway_Client: remove response body from RuntimeException (HTTP status only)
- PRV_Capture_Writer: allowlist-only write (prompt/response text, never headers/auth)
- Mandatory capture order: can_afford → probe → persist_result → update_row_cost → write_meta → capture_io
- capture_io last and wrapped in swallowing try/catch

New tables (SCHEMA_VERSION 3):
- prv_call_meta: cost/metadata per call, kept indefinitely
- prv_call_io: rendered prompt + raw response, pruned on retention window (default 90d)

New classes:
- PRV_Call_Meta_Table, PRV_Call_Io_Table: table schema + dbDelta
- PRV_Capture_Writer: metadata + I/O write; security allowlist enforced
- PRV_Prune_Cron: daily prv_daily_prune cron deletes aged prv_call_io rows only
- PRV_Cost_Rollup_Query: MTD summary, model breakdown, drill-down, projection
- PRV_Call_Log_Query: paginated + filtered call-log query + per-call I/O fetch
- PRV_Costs_Page + PRV_Costs_Renderer: Costs admin sub-page (cap progress, bento, model table, drill-down)
- PRV_Call_Log_Page + PRV_Call_Log_Table_Renderer: Call Log admin sub-page (filter bar, paginated table, WCAG AA pagination)
- PRV_Call_Drawer_Renderer: non-modal complementary drawer (5 states: Normal/Pruned/Legacy/Failed/Loading)
- PRV_Call_Drawer_Script: inline JS for drawer (300-line split from renderer)
- PRV_Call_Detail_Ajax: wp_ajax_prv_call_detail AJAX handler
- PRV_Admin_Page_Css: CSS provider (300-line split from PRV_Admin_Page)
- PRV_Probe_Run_Executor: inner probe loop (300-line split from PRV_Probe_Runner)

Updated:
- PRV_Probe_Result: tokens_in/tokens_out params + getters
- Both providers: report tokens_in/tokens_out from usage.prompt_tokens/completion_tokens
- PRV_Probe_Runner: slimmed to lock+UUID+delegation; injects PRV_Capture_Writer
- PRV_Config: get_io_retention_days(); PRV_IO_RETENTION_DEFAULT_DAYS constant
- PRV_Upgrader/Activator/Deactivator/Plugin: register new tables, cron, pages, AJAX
- Settings: retention days field + save in controller
- uninstall.php: DROP both new tables, clear prv_daily_prune cron
- Subnav 4-tab strip (Dashboard | Costs | Call Log | Settings) on all pages
- ARCHITECTURE.md, CHANGELOG.md, CONTEXT.md, CONVENTIONS.md updated

Tests:
- test-capture-writer.php: write_meta, write_io, P0 security (401 record has no key/Bearer/sk-or-)
- test-cost-audit.php: MTD reconciliation, projection, prune, forced capture_io exception, table drops

Agent-Session: peptiderepo-geomonitor-v0.3.0-cost-audit
This commit is contained in:
peptiderepo
2026-06-15 09:09:29 +00:00
parent 2f4c1b2c72
commit 4eee9f5f64
37 changed files with 3137 additions and 328 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
CONTEXT.md
View File

@@ -1,6 +1,6 @@
# Context — Domain Glossary (PR Vision)
**Version:** 0.2.1 | **Last updated:** 2026-06-14
**Version:** 0.3.0 | **Last updated:** 2026-06-15
This file is the ubiquitous-language glossary for `pr-vision`. Every term below has a precise meaning within this codebase. AI agents and human contributors should use this terminology consistently.
@@ -141,3 +141,28 @@ The Settings page section that allows the operator to set/replace/clear the API
The symmetric key used to encrypt/decrypt `prv_provider_key_enc`. Derived via SHA-256 from `AUTH_KEY + SECURE_AUTH_KEY` (or `wp_salt()` fallback) — environment-specific and never stored. Derived fresh at every encrypt/decrypt call.
**Code identifiers:** `PRV_Key_Store::derive_encryption_key()`, `PRV_Crypto_Helper::encrypt()`, `PRV_Crypto_Helper::decrypt()`.
### Call Meta / Call Log
The per-call audit trail introduced in v0.3.0. Every LLM probe call produces a **call metadata** row (`prv_call_meta`) kept indefinitely, and a **call I/O** row (`prv_call_io`) retained for a configurable window.
**Code identifiers:** `PRV_Call_Meta_Table`, `PRV_Call_Io_Table`, `PRV_Capture_Writer`, `PRV_Call_Log_Query`.
### Capture Writer
The `PRV_Capture_Writer` class that writes call metadata + I/O rows after a probe. Implements a strict allowlist: stores rendered prompt text, response text, model, tokens, cost — NEVER headers, Authorization, or any raw HTTP request object.
**Code identifiers:** `PRV_Capture_Writer::write_meta()`, `PRV_Capture_Writer::write_io()`.
### Retention Window
The configurable number of days raw prompt + response text is kept in `prv_call_io` before the daily prune cron deletes it. Default 90 days. Cost/metadata in `prv_call_meta` is kept indefinitely.
**Code identifiers:** `PRV_Config::get_io_retention_days()`, `prv_io_retention_days` option, `PRV_Prune_Cron::prune_now()`.
### Detail Drawer
A non-modal, keyboard-accessible panel (`role="complementary"`) on the Call Log page that shows the exact rendered prompt + raw response for any selected call. Five states: Normal, Pruned, Legacy/not-captured, Failed, Loading. Focus-managed: opens to close button, Esc closes and returns focus to the triggering row, no tab-trap.
**Code identifiers:** `PRV_Call_Drawer_Renderer`, `PRV_Call_Drawer_Script`, `PRV_Call_Detail_Ajax`.
### Capture Ordering (P0)
The mandatory sequence within each probe iteration: `can_afford → probe → persist_result → update_row_cost → write_meta → capture_io`. `capture_io` is always last and wrapped in a swallowing try/catch so a write failure can never reach the probe path or corrupt cap accounting.
**Code identifiers:** `PRV_Probe_Run_Executor::probe_one()`.