docs(droid): capture what /limits calls, and record that this account has no window to read - #257
Merged
gcko merged 1 commit intoSep 2, 2026
Conversation
… has no window to read Droid's /limits command is GET https://api.factory.ai/api/billing/limits with a bearer authorization and the CLI's X-Factory-Client, X-Client-Version and X-Factory-Org-Id headers. Measured 2026-09-02 on droid 0.210.0 through a loopback reverse proxy the CLI was pointed at with FACTORY_API_BASE_URL, two runs agreeing: on the signed-in organization account the route answers 200 with four fields (usesTokenRateLimitsBilling false, overagePreference, canManageOverage, extraUsageAllowed) and no `limits` object, and Droid's own panel then reads "Unable to fetch credit limits". The three rolling windows belong to individual plans on token-rate-limits billing, and the shape the CLI is written against, limits.standard.{fiveHour,weekly,monthly}.usedPercent, is read in the binary and labelled unmeasured. The credential the CLI sends is out of reach by design: a 44-byte encryption key in the Keychain (service "Factory CLI") protects the session token in ~/.factory/auth.v2.loginkeychain, beside a refresh lock. DEC-10 (DRC-4333) chose FACTORY_API_KEY from Cargento's own environment for the reader, which ships under DRC-4334 once an account with windows can run this capture. The design record's Q-5 and Q-10 carry the findings and the ruling, and decrypting the login store is recorded as a rejected alternative. Implements DRC-4073 on the documented-verdict clause of its Done condition. Signed-off-by: Jared Scott <jared.scott@variable.team>
Contributor
CoverageThreshold: |
gcko
deleted the
feature/drc-4073-usage-fetcher-droid-quota-via-factory-5h7d30d-windows-and
branch
September 2, 2026 12:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements DRC-4073 — Usage fetcher · Droid quota via Factory (5h/7d/30d windows and credits), on the documented-verdict clause of its Done condition.
What changed
Docs only. No runtime code, no manifest, no version field.
docs/captures/droid/billing-limits-0.210.0-macos.jsonl: what Droid's/limitscalls (GET https://api.factory.ai/api/billing/limits, bearer plus the CLI'sX-Factory-*headers), the response shape on the signed-in account (four fields, nolimitsobject,usesTokenRateLimitsBillingfalse), the CLI's own "Unable to fetch credit limits" verdict, the credential store (a Keychain-held key encrypting~/.factory/auth.v2.loginkeychain), and the windowed shape read in the binary and labelled unmeasured. Shapes and closed-vocabulary values only.docs/captures/README.md: the row for that file.docs/design-usage-quota.md: Q-10's Factory row and paragraph now state the measurement; Q-5 records that Droid has no token Cargento may read and the DEC-10 ruling (FACTORY_API_KEYfrom Cargento's environment, for the reader that ships under DRC-4334); decrypting Droid's login store is a recorded rejected alternative.User value
P4, sharpen, and the promise wording does not change. What a Droid user gets from this PR is an honest record: on an organization account Factory publishes no window, so Cargento shows nothing the vendor's own CLI cannot. The reader for individual plans is scoped in DRC-4334 and waits on an account that has windows.
Verification
python3 scripts/validate_plugins.py: passes (the check a docs-only diff needs).python3 -m unittest cargento.skills.cargento.tests.test_documentation: OK, including the captures-table contiguity test that caught a stray blank line on the first attempt.OK (skipped=1), no FAIL or ERROR lines. An earlier run of the same tree reported one unnamed failure that did not recur; DRC-4332 tracks the known wall-clock flake./limitsprobes through the loopback proxy agreed; the capture file records both the request and the response shape.Review depth: self-verified, per AGENTS.md's table (no behaviour change, nothing calls it).