M1: Implement secure Z.ai quota acquisition

creatidy commented

2026-09-03 18:30:07 +00:00

(Migrated from github.com)

Summary

Z.ai already has provider evidence, redacted fixtures, a normalized pure parser (scarcity_router/providers/zai.py) and the v1 capacity contract. The missing piece is the production acquisition boundary: reading the existing Kilo credential, making the fixed authenticated HTTPS GET, and feeding the decoded payload to the existing parser.

Scope

Implement scarcity_router/providers/zai_acquisition.py:

Kilo credential (~/.local/share/kilo/auth.json, zai-coding-plan)
  -> strict credential discovery (type == "api", non-empty string key, sent as-is)
  -> fixed HTTPS GET https://api.z.ai/api/monitor/usage/quota/limit
     (destination validated before Authorization is attached; no redirects)
  -> bounded strict JSON decoding (bounded auth-file read and bounded response body)
  -> existing parse_zai_quota_response(...)
  -> CapacitySnapshot

Constraints

Public API: collect_zai_capacity(*, retrieved_at: str, auth_file: Path | None = None) -> CapacitySnapshot; caller-supplied retrieved_at, optional explicit auth path for deterministic tests/controlled local configuration.
Security-first per docs/security.md: no credential in output/exceptions/logs; no Bearer fallback; no retries; no endpoint override; no redirect following; no raw response persistence; bounded reads with safe failures.
Failure mapping per docs/capacity-model.md v1: credential unavailable/unusable and HTTP 401 -> auth_required; received-but-unusable success body -> schema_changed; network/DNS/timeout -> unavailable; redirect rejection and other unevidenced HTTP failures -> unknown/telemetry_unknown.
Parser stays pure; acquisition adds zero quota semantics. Tests use only synthetic fake secrets and mocked transport; no live request, no network in tests.
Non-scope: CLI/status, aggregation, OpenAI/Codex, Ollama, selection, retry/backoff, freshness (U-003).

One branch, one PR targeting main; PR left open for human review.

## Summary Z.ai already has provider evidence, redacted fixtures, a normalized pure parser (`scarcity_router/providers/zai.py`) and the v1 capacity contract. The missing piece is the production acquisition boundary: reading the existing Kilo credential, making the fixed authenticated HTTPS GET, and feeding the decoded payload to the existing parser. ## Scope Implement `scarcity_router/providers/zai_acquisition.py`: ``` Kilo credential (~/.local/share/kilo/auth.json, zai-coding-plan) -> strict credential discovery (type == "api", non-empty string key, sent as-is) -> fixed HTTPS GET https://api.z.ai/api/monitor/usage/quota/limit (destination validated before Authorization is attached; no redirects) -> bounded strict JSON decoding (bounded auth-file read and bounded response body) -> existing parse_zai_quota_response(...) -> CapacitySnapshot ``` ## Constraints - Public API: `collect_zai_capacity(*, retrieved_at: str, auth_file: Path | None = None) -> CapacitySnapshot`; caller-supplied `retrieved_at`, optional explicit auth path for deterministic tests/controlled local configuration. - Security-first per docs/security.md: no credential in output/exceptions/logs; no Bearer fallback; no retries; no endpoint override; no redirect following; no raw response persistence; bounded reads with safe failures. - Failure mapping per docs/capacity-model.md v1: credential unavailable/unusable and HTTP 401 -> `auth_required`; received-but-unusable success body -> `schema_changed`; network/DNS/timeout -> `unavailable`; redirect rejection and other unevidenced HTTP failures -> `unknown`/`telemetry_unknown`. - Parser stays pure; acquisition adds zero quota semantics. Tests use only synthetic fake secrets and mocked transport; no live request, no network in tests. - Non-scope: CLI/status, aggregation, OpenAI/Codex, Ollama, selection, retry/backoff, freshness (U-003). One branch, one PR targeting `main`; PR left open for human review.

Rows
Columns

M1: Implement secure Z.ai quota acquisition #10

Summary

Scope

Constraints