PR Vision v0.3.0: per-call cost accountability + LLM call audit trail

P0 security:
- PRV_Gateway_Client: remove response body from RuntimeException (HTTP status only)
- PRV_Capture_Writer: allowlist-only write (prompt/response text, never headers/auth)
- Mandatory capture order: can_afford → probe → persist_result → update_row_cost → write_meta → capture_io
- capture_io last and wrapped in swallowing try/catch

New tables (SCHEMA_VERSION 3):
- prv_call_meta: cost/metadata per call, kept indefinitely
- prv_call_io: rendered prompt + raw response, pruned on retention window (default 90d)

New classes:
- PRV_Call_Meta_Table, PRV_Call_Io_Table: table schema + dbDelta
- PRV_Capture_Writer: metadata + I/O write; security allowlist enforced
- PRV_Prune_Cron: daily prv_daily_prune cron deletes aged prv_call_io rows only
- PRV_Cost_Rollup_Query: MTD summary, model breakdown, drill-down, projection
- PRV_Call_Log_Query: paginated + filtered call-log query + per-call I/O fetch
- PRV_Costs_Page + PRV_Costs_Renderer: Costs admin sub-page (cap progress, bento, model table, drill-down)
- PRV_Call_Log_Page + PRV_Call_Log_Table_Renderer: Call Log admin sub-page (filter bar, paginated table, WCAG AA pagination)
- PRV_Call_Drawer_Renderer: non-modal complementary drawer (5 states: Normal/Pruned/Legacy/Failed/Loading)
- PRV_Call_Drawer_Script: inline JS for drawer (300-line split from renderer)
- PRV_Call_Detail_Ajax: wp_ajax_prv_call_detail AJAX handler
- PRV_Admin_Page_Css: CSS provider (300-line split from PRV_Admin_Page)
- PRV_Probe_Run_Executor: inner probe loop (300-line split from PRV_Probe_Runner)

Updated:
- PRV_Probe_Result: tokens_in/tokens_out params + getters
- Both providers: report tokens_in/tokens_out from usage.prompt_tokens/completion_tokens
- PRV_Probe_Runner: slimmed to lock+UUID+delegation; injects PRV_Capture_Writer
- PRV_Config: get_io_retention_days(); PRV_IO_RETENTION_DEFAULT_DAYS constant
- PRV_Upgrader/Activator/Deactivator/Plugin: register new tables, cron, pages, AJAX
- Settings: retention days field + save in controller
- uninstall.php: DROP both new tables, clear prv_daily_prune cron
- Subnav 4-tab strip (Dashboard | Costs | Call Log | Settings) on all pages
- ARCHITECTURE.md, CHANGELOG.md, CONTEXT.md, CONVENTIONS.md updated

Tests:
- test-capture-writer.php: write_meta, write_io, P0 security (401 record has no key/Bearer/sk-or-)
- test-cost-audit.php: MTD reconciliation, projection, prune, forced capture_io exception, table drops

Agent-Session: peptiderepo-geomonitor-v0.3.0-cost-audit
This commit is contained in:
peptiderepo
2026-06-15 09:09:29 +00:00
parent 2f4c1b2c72
commit 4eee9f5f64
37 changed files with 3137 additions and 328 deletions

View File

@@ -0,0 +1,100 @@
<?php
/**
* PR Vision Call Log admin sub-page (v0.3.0).
*
* @package PrVision
*/
declare(strict_types=1);
/**
* Call Log sub-page: paginated call list + per-call detail drawer.
*
* Registers "PR Vision > Call Log" sub-menu. Reads filter/page params from
* the URL, queries PRV_Call_Log_Query, and delegates rendering to
* PRV_Call_Log_Table_Renderer and PRV_Call_Drawer_Renderer.
*
* Who triggers: PRV_Plugin::init() — is_admin() guard.
* Dependencies: PRV_Call_Log_Query, PRV_Call_Log_Table_Renderer,
* PRV_Call_Drawer_Renderer, PRV_Config.
*
* @see class-prv-call-log-table-renderer.php — Table + drawer rendering.
* @see class-prv-call-drawer-renderer.php — Detail drawer rendering.
* @see class-prv-call-log-query.php — Query layer.
* @package PrVision
*/
class PRV_Call_Log_Page {
/**
* Admin menu slug.
*/
const MENU_SLUG = 'pr-vision-calls';
/**
* Register WordPress admin hooks.
*
* Side effects: Adds admin_menu action.
*
* @return void
*/
public function register_hooks(): void {
add_action( 'admin_menu', array( $this, 'add_submenu' ) );
}
/**
* Register the Call Log sub-menu under PR Vision.
*
* Side effects: Adds a WP admin sub-menu entry.
*
* @return void
*/
public function add_submenu(): void {
add_submenu_page(
PRV_Admin_Page::MENU_SLUG,
__( 'PR Vision — Call Log', 'pr-vision' ),
__( 'Call Log', 'pr-vision' ),
'manage_options',
self::MENU_SLUG,
array( $this, 'render_page' )
);
}
/**
* Render the full Call Log page.
*
* Side effects: Outputs HTML.
*
* @return void
*/
public function render_page(): void {
if ( ! current_user_can( 'manage_options' ) ) {
wp_die( esc_html__( 'Insufficient permissions.', 'pr-vision' ) );
}
// Read filter params (no nonce: read-only display only).
// phpcs:disable WordPress.Security.NonceVerification.Recommended
$filters = array(
'model' => isset( $_GET['prv_filter_model'] ) ? sanitize_text_field( wp_unslash( $_GET['prv_filter_model'] ) ) : '',
'peptide' => isset( $_GET['prv_filter_peptide'] ) ? sanitize_text_field( wp_unslash( $_GET['prv_filter_peptide'] ) ) : '',
'date_from' => isset( $_GET['prv_filter_from'] ) ? sanitize_text_field( wp_unslash( $_GET['prv_filter_from'] ) ) : '',
'date_to' => isset( $_GET['prv_filter_to'] ) ? sanitize_text_field( wp_unslash( $_GET['prv_filter_to'] ) ) : '',
'status' => isset( $_GET['prv_filter_status'] ) ? sanitize_text_field( wp_unslash( $_GET['prv_filter_status'] ) ) : '',
);
$page = isset( $_GET['prv_page'] ) ? max( 1, absint( wp_unslash( $_GET['prv_page'] ) ) ) : 1;
// phpcs:enable WordPress.Security.NonceVerification.Recommended
$query = new PRV_Call_Log_Query();
$result = $query->get_page( $filters, $page );
$renderer = new PRV_Call_Log_Table_Renderer();
$renderer->render(
array(
'rows' => $result['rows'],
'total' => $result['total'],
'pages' => $result['pages'],
'page' => $page,
'filters' => $filters,
)
);
}
}