hongjr03
3f9b60f692
The spec/ Lean semantic master had no conformance gate, no codegen, and no CI tie to implementations — alignment was carried entirely by human review, the same mechanism that carries the ADRs. In practice the ADRs plus greppable code comments were already the load-bearing artifacts, so spec/ was the most expensive kind of stale documentation. - delete spec/ and the spec-check CI workflow - README: constitution rewritten around ADRs as decision truth - AGENTS.md/CLAUDE.md: discipline re-anchored (new decisions -> new ADR, never rewrite ADR history; supersede instead) - code comments: re-anchor 'Mirrors Spec.X' invariants to ADR numbers (cph-diag, cph-check, cph-model, hub runner/capacity/org, prisma) - leave ADR bodies and .scratch audit snapshots untouched (history); fix live references in open readiness tickets
2.1 KiB
Define initial abuse and capacity controls
Type: grilling Status: resolved Blocked by: 02, 03
Question
Which request limits, file limits, concurrency limits, agent budgets, tenant quotas, and backpressure policies are mandatory for the accepted initial production boundary, and which values or behaviors remain product decisions?
Answer
The initial production service requires layered, fail-closed capacity controls: every mandatory dimension has a versioned non-overridable platform ceiling, while an Organization may configure only a lower policy limit. Agent work uses a durable bounded queue, fair scheduling across Organizations, FIFO within an Organization, explicit overload/expiry/cancellation states, and no automatic whole-run replay after execution starts.
Hard controls cover request rate/body size, concurrency and queueing, files and
archive expansion, Project/Organization storage and entity counts, run/tool
budgets, and process resources. Reaching a limit blocks new growth without
deleting or hiding existing data. Token and provider cost remain attributed
soft-alert signals in the pilot, not hard spend controls; unknown cost is not
zero. Platform administrators also receive audited DRAIN and STOP_NOW
workload brakes.
The full current-state inventory, accepted behavior, and release evidence are recorded in Initial abuse and capacity controls, with the durable decision in ADR-0022. Numerical ceilings remain open until production-like calibration.
The implementation frontier is:
- Implement layered limits and multi-dimensional request rate limiting
- Build the durable Organization-fair admission scheduler
- Enforce file, archive, storage, and entity budgets
- Enforce Agent Run and process resource budgets
- Implement provider-mode usage attribution and soft alerts
- Add audited emergency workload brakes
- Calibrate and prove production capacity ceilings