forked from EduCraft/curriculum-project-hub
hongjr03
3f9b60f692
The spec/ Lean semantic master had no conformance gate, no codegen, and no CI tie to implementations — alignment was carried entirely by human review, the same mechanism that carries the ADRs. In practice the ADRs plus greppable code comments were already the load-bearing artifacts, so spec/ was the most expensive kind of stale documentation. - delete spec/ and the spec-check CI workflow - README: constitution rewritten around ADRs as decision truth - AGENTS.md/CLAUDE.md: discipline re-anchored (new decisions -> new ADR, never rewrite ADR history; supersede instead) - code comments: re-anchor 'Mirrors Spec.X' invariants to ADR numbers (cph-diag, cph-check, cph-model, hub runner/capacity/org, prisma) - leave ADR bodies and .scratch audit snapshots untouched (history); fix live references in open readiness tickets
44 lines
2.1 KiB
Markdown
44 lines
2.1 KiB
Markdown
# Define initial abuse and capacity controls
|
|
|
|
Type: grilling
|
|
Status: resolved
|
|
Blocked by: 02, 03
|
|
|
|
## Question
|
|
|
|
Which request limits, file limits, concurrency limits, agent budgets, tenant
|
|
quotas, and backpressure policies are mandatory for the accepted initial
|
|
production boundary, and which values or behaviors remain product decisions?
|
|
|
|
## Answer
|
|
|
|
The initial production service requires layered, fail-closed capacity controls:
|
|
every mandatory dimension has a versioned non-overridable platform ceiling,
|
|
while an Organization may configure only a lower policy limit. Agent work uses
|
|
a durable bounded queue, fair scheduling across Organizations, FIFO within an
|
|
Organization, explicit overload/expiry/cancellation states, and no automatic
|
|
whole-run replay after execution starts.
|
|
|
|
Hard controls cover request rate/body size, concurrency and queueing, files and
|
|
archive expansion, Project/Organization storage and entity counts, run/tool
|
|
budgets, and process resources. Reaching a limit blocks new growth without
|
|
deleting or hiding existing data. Token and provider cost remain attributed
|
|
soft-alert signals in the pilot, not hard spend controls; unknown cost is not
|
|
zero. Platform administrators also receive audited `DRAIN` and `STOP_NOW`
|
|
workload brakes.
|
|
|
|
The full current-state inventory, accepted behavior, and release evidence are
|
|
recorded in [Initial abuse and capacity controls](../assets/initial-abuse-capacity-controls.md),
|
|
with the durable decision in ADR-0022. Numerical
|
|
ceilings remain open until production-like calibration.
|
|
|
|
The implementation frontier is:
|
|
|
|
- [Implement layered limits and multi-dimensional request rate limiting](32-layered-limits-rate-limiting.md)
|
|
- [Build the durable Organization-fair admission scheduler](33-durable-fair-admission-scheduler.md)
|
|
- [Enforce file, archive, storage, and entity budgets](34-file-storage-budgets.md)
|
|
- [Enforce Agent Run and process resource budgets](35-run-runtime-budgets.md)
|
|
- [Implement provider-mode usage attribution and soft alerts](36-usage-soft-alerts.md)
|
|
- [Add audited emergency workload brakes](37-emergency-workload-brakes.md)
|
|
- [Calibrate and prove production capacity ceilings](38-calibrate-production-capacity.md)
|