Correct curated AI-credit model prices

[Copilot]

Curated prices overstated AI-credit usage for Sonnet 5, GPT-6 Luna/Sol, and GPT-5.6 models, affecting default-model workflows and budget enforcement. Update the published rates and add an offline reference check to catch future drift.

• Prices: Correct all four rates for the six mispriced models and add GPT-6 Astra’s cache-write rate.
• Reference: Add a versioned pricing catalog with provider sources and check dates; compare every referenced curated rate and report unreferenced models without failing.
• Regression coverage: Add usage-record accounting and operator-price precedence cases; update existing assertions for corrected prices.

'gpt-6-luna': { input: 0.10, cachedInput: 0.01, cacheWrite: 0.125, output: 0.50 }

• Fixes api-proxy: curated AI-credit prices are wrong for claude-sonnet-5, gpt-6-luna/sol and gpt-5.6-*; default-model runs overstated up to 100x #9970

[Copilot]

🟡 Changes recommended

The reference check does not implement the required missing cached-input rate behavior.

1 open finding

• Normalize missing cached-input rates to zero before comparison · New

What changed in this PR

Corrects curated AI-credit pricing to prevent inflated usage accounting and budget enforcement.

Changes:

• Updates seven model pricing entries.
• Adds an offline, versioned pricing reference check.
• Adds regression coverage for usage accounting and operator-price precedence.

File	Description
containers/​api-proxy/​ai-credits-pricing.js	Corrects curated rates.
containers/​api-proxy/​ai-credits-pricing-reference.json	Adds authoritative pricing references.
containers/​api-proxy/​ai-credits-pricing-reference.test.js	Checks curated pricing against references.
containers/​api-proxy/​token-budget-log.test.js	Covers real usage records and precedence.
containers/​api-proxy/​guards/​ai-credits-guard.test.js	Updates expected credit calculations.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.30%	93.31%	📈 +0.01%
Statements	91.88%	91.90%	📈 +0.02%
Functions	90.63%	90.63%	➡️ +0.00%
Branches	85.64%	85.64%	➡️ +0.00%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/enclave/host-executor-server.ts	90.3% → 90.3% (+0.00%)	88.8% → 89.1% (+0.31%)
src/log-directory-setup.ts	96.8% → 100.0% (+3.18%)	96.9% → 100.0% (+3.13%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

[github-actions]

🪪 Smoke Copilot BYOK AOAI (Entra) is testing Azure OpenAI BYOK (Entra / GitHub OIDC) mode on this pull request...

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Smoke Codex

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Smoke Codex · gpt54 · 12.2 AIC · ⊞ 20.9K · ◷

🔮 The oracle has spoken through Smoke Codex

[github-actions]

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

🛡️ Egress verdict from Smoke Copilot Network Isolation

[github-actions]

✅ Smoke Claude passed

Generated by Smoke Claude for #9982

[github-actions]

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

[github-actions]

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #9982

[github-actions]

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

[github-actions]

🔑 Smoke Copilot BYOK AOAI (api-key) is testing Azure OpenAI BYOK (api-key) mode on this pull request...

[github-actions]

✅ Security Guard completed successfully!

Security Guard

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Security Guard · haiku45 · 4.04 AIC · ⊞ 6.0K · ◷

Generated by Security Guard for #9982

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

[github-actions]

💎 Smoke Gemini is crystallizing results on this pull request...

[github-actions]

Smoke Test: Claude Engine Validation

Check	Status
API	✅ PASS
gh CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #9982 · claude · haiku45 · 48.8 AIC · ⊞ 6.1K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Cloud Hypervisor + Copilot Smoke Test

Check	Result
1. List merged PR (github/gh-aw-firewall)	PASS — #9981
2. curl https://github.com → 200/301	PASS — 200
3. Write/read /tmp/gh-aw/agent/smoke-cloud-hypervisor-*.txt	PASS
4. curl (example.com/redacted) blocked (000/403)	PASS — 000

All checks passed.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
_{Add label ready-for-aw to run again}

[github-actions]

EGRESS_RESULT allow=pass deny=pass

• ✅ Allowed domain (api.github.com): HTTP 200
• ✅ Blocked domain (example.com): blocked (TLS cert error from the proxy, curl exit 60)
  Overall: PASS (PR author: @lpcox as triggering actor)

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Copilot: PASS

• ✅ GitHub MCP (latest merged PR: "fix: use stable runner baseline for pilot progression")
• ✅ github.com connectivity (HTTP 200)
• ✅ File write/read
  PR: "Correct curated AI-credit model prices" — author @Copilot, assignees @lpcox @Copilot

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke services: ✅ Redis PONG, ✅ pg_isready, ✅ SELECT 1. Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

OTEL smoke test

• ✅ S1 Module loading: otel.js loads and exports its functions.
• ✅ S2 Tests: 3 suites, 68 tests passed.
• ✅ S3 Env forwarding: trace context (GITHUB_AW_OTEL_TRACE_ID, GITHUB_AW_OTEL_PARENT_SPAN_ID) is in env-passthrough.ts. OTLP vars are in api-proxy-env-config.ts.
• ✅ S4 Token tracker: the onUsage hook exists in token-tracker-http.js.
• ✅ S5 Diagnostics: otel.jsonl has 1 span record.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

✅ Smoke Test: Copilot BYOK (Direct) Mode

All tests passed. Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

• ✅ GitHub MCP: Connected (verified 2 recent merged PRs)
• ✅ GitHub.com: HTTP 200
• ✅ File I/O: Read/write working
• ✅ BYOK Inference: Active and responding

Status: PASS

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	❌	not run	❌ FAIL
Bun	hono	❌	not run	❌ FAIL
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	❌	not run	❌ FAIL
Deno	std	❌	not run	❌ FAIL
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 6/8 ecosystems passed — FAIL

Failures:

• Bun / Deno: The curl ... | bash installer commands for Bun and Deno were denied by the sandbox permission policy ("Permission denied and could not request permission"). Neither runtime was installed, so no tests ran. This is an environment limitation, not a firewall or project failure.
• Note: .NET and Maven needed workarounds (XDG_RUNTIME_DIR/DOTNET_CLI_HOME and -Dmaven.repo.local set to a writable temp dir) because the default home paths weren't writable. After that they succeeded.

The build-test label was not added because not all ecosystems passed.

Generated by Build Test Suite for #9982 · copilot · auto · 25.2 AIC · ⊞ 11.9K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

• fix: use stable runner baseline for pilot progression ✅
• Skip Copilot token verification after agent failure ✅
• Merged PR lookup ✅
• PR detail lookup ✅
• Playwright title check ❌
• File write/read ✅
• AWF build ✅
• Overall: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.15	Python 3.12.15	✅ YES
Node.js	v24.21.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed. Node.js differs between the host (v24) and the chroot (v22), so the smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}