From 2fed01585a75af1f16f16fa6ec6f38c049172cda Mon Sep 17 00:00:00 2001 From: Dongkeun Lee Date: Wed, 26 Aug 2026 19:42:52 -0400 Subject: [PATCH] docs: publish Azure C3 acceptance evidence --- docs/azure-requirements.md | 14 +++- .../azure-c3-cost-guard-2026-08-24/README.md | 79 +++++++++++++++++++ .../evidence.json | 46 +++++++++++ 3 files changed, 136 insertions(+), 3 deletions(-) create mode 100644 docs/evidence/azure-c3-cost-guard-2026-08-24/README.md create mode 100644 docs/evidence/azure-c3-cost-guard-2026-08-24/evidence.json diff --git a/docs/azure-requirements.md b/docs/azure-requirements.md index b930b2ddb08..a50fe305d93 100644 --- a/docs/azure-requirements.md +++ b/docs/azure-requirements.md @@ -1126,7 +1126,7 @@ the controller serializing them. ## C3. Cost guard -Status: BUILT 2026-08-20; live acceptance pending. +Status: DONE, met live on 2026-08-24. The requirement is that a day's spend cannot quietly reach 100 dollars. @@ -1172,8 +1172,16 @@ recorded per-review cost, which it does not. No listener or acceptance is owed a Acceptance: a day cannot cross the bound without an explicit operator override, and a worker whose task ended deallocates unattended. -The hermetic legs are covered in `tests/fm-worker-lifecycle.test.sh`; the live demonstration on -billable capacity has not run yet. +The 600-second idle-deallocation subject remained assigned without release proof until ordinary +authority-backed cleanup. +Positive recorded spend 2.983466 USD crossed a controlled 1 USD bound and refused new compute +with `override=none`, after which the default 100 USD/no-override zero state was re-proved. +The compact tracked record is +[`docs/evidence/azure-c3-cost-guard-2026-08-24/evidence.json`](evidence/azure-c3-cost-guard-2026-08-24/evidence.json), +with its claim map and verification commands in the adjacent +[README](evidence/azure-c3-cost-guard-2026-08-24/README.md). +Cost Management still lags by hours, so this acceptance remains a backstop on recorded spend, +not a claim of real-time metering. ## Order of work diff --git a/docs/evidence/azure-c3-cost-guard-2026-08-24/README.md b/docs/evidence/azure-c3-cost-guard-2026-08-24/README.md new file mode 100644 index 00000000000..3a5b39b8916 --- /dev/null +++ b/docs/evidence/azure-c3-cost-guard-2026-08-24/README.md @@ -0,0 +1,79 @@ +# Azure C3 cost-guard acceptance evidence, 2026-08-24 + +[`evidence.json`](evidence.json) is the compact, secret-free record of the two live legs required by `docs/azure-requirements.md` C3. +It contains no subscription id, Azure resource id, account identity, credential, absolute machine path, or raw log. + +The 600-second idle-deallocation subject remained assigned without release proof until ordinary authority-backed cleanup. +Positive recorded spend 2.983466 USD crossed a controlled 1 USD bound and refused new compute with `override=none`, after which the default 100 USD/no-override zero state was re-proved. + +Azure Cost Management actuals lag by hours. +The daily bound is therefore a backstop on recorded spend rather than a real-time meter; per-mutation cumulative admission and idle deallocation remain the same-day protections ahead of it. + +## Claim map + +| C3 clause | Tracked field paths | +|---|---| +| Assigned worker deallocated unattended at the minimum supported threshold | `idle_deallocation` | +| No release proof was minted before the evidence capture | `idle_deallocation.queue_status_after_deallocation`, `idle_deallocation.release_proof_after_deallocation` | +| Positive recorded spend crossed the controlled bound with no override | `daily_bound` | +| Default policy and zero fleet state were restored | `default_state_reproof` | +| Cost Management lag remains explicit | `telemetry_caveat`, `limitations.cost_management_is_not_real_time` | +| Private source records are byte-bound without publishing infrastructure identity | `source_artifacts` | + +This record proves C3 only. +It does not prove C1 or C2, and it makes no Crosscheck acceptance claim. + +## Verify the tracked record + +From the repository root, run: + +```sh +set -eu +evidence=docs/evidence/azure-c3-cost-guard-2026-08-24/evidence.json +jq -e ' + .schema == "fm.azure-c3-cost-guard-evidence/v1" and + .acceptance_date == "2026-08-24" and + .requirement == "C3" and + .idle_deallocation.threshold_seconds == 600 and + .idle_deallocation.unattended_deallocation_observed == true and + .idle_deallocation.provider_power_state == "deallocated" and + .idle_deallocation.queue_status_after_deallocation == "assigned" and + .idle_deallocation.release_proof_after_deallocation == false and + .idle_deallocation.ordinary_authority_backed_cleanup_after_capture == true and + .daily_bound.recorded_spend_usd == 2.983466 and + .daily_bound.controlled_bound_usd == 1 and + .daily_bound.override == "none" and + .daily_bound.new_compute_refused == true and + .daily_bound.request_assigned == false and + .daily_bound.wind_down_available == true and + .default_state_reproof.daily_bound_usd == 100 and + .default_state_reproof.override == "none" and + .default_state_reproof.tripped == false and + .default_state_reproof.queue_depth == 0 and + .default_state_reproof.desired_workers == 0 and + .default_state_reproof.active_workers == 0 and + .default_state_reproof.assignment_count == 0 and + .default_state_reproof.used_vcpus == 0 and + .default_state_reproof.committed_vcpus == 0 and + .limitations.cost_management_is_not_real_time == true and + .limitations.does_not_prove == ["C1", "C2"] +' "$evidence" >/dev/null +``` + +When the operator-local sources are available, verify their exact bytes before comparing projections: + +```sh +set -eu +evidence=docs/evidence/azure-c3-cost-guard-2026-08-24/evidence.json +IDLE_REPORT=/path/to/idle-subject-report.md +BOUND_REPORT=/path/to/daily-bound-report.md +COMPLETION=/path/to/zero-to-zero-completion.md +test "$(shasum -a 256 "$IDLE_REPORT" | awk '{print $1}')" = \ + "$(jq -r '.source_artifacts.idle_subject_report_sha256' "$evidence")" +test "$(shasum -a 256 "$BOUND_REPORT" | awk '{print $1}')" = \ + "$(jq -r '.source_artifacts.daily_bound_report_sha256' "$evidence")" +test "$(shasum -a 256 "$COMPLETION" | awk '{print $1}')" = \ + "$(jq -r '.source_artifacts.zero_to_zero_completion_sha256' "$evidence")" +``` + +The hashes bind the private source reports without publishing their infrastructure identities. diff --git a/docs/evidence/azure-c3-cost-guard-2026-08-24/evidence.json b/docs/evidence/azure-c3-cost-guard-2026-08-24/evidence.json new file mode 100644 index 00000000000..c2911b19082 --- /dev/null +++ b/docs/evidence/azure-c3-cost-guard-2026-08-24/evidence.json @@ -0,0 +1,46 @@ +{ + "schema": "fm.azure-c3-cost-guard-evidence/v1", + "acceptance_date": "2026-08-24", + "requirement": "C3", + "idle_deallocation": { + "threshold_seconds": 600, + "unattended_deallocation_observed": true, + "provider_power_state": "deallocated", + "queue_status_after_deallocation": "assigned", + "release_proof_after_deallocation": false, + "ordinary_authority_backed_cleanup_after_capture": true + }, + "daily_bound": { + "utc_day": "2026-08-24", + "recorded_spend_usd": 2.983466, + "controlled_bound_usd": 1, + "override": "none", + "new_compute_refused": true, + "request_assigned": false, + "wind_down_available": true + }, + "default_state_reproof": { + "daily_bound_usd": 100, + "override": "none", + "tripped": false, + "queue_depth": 0, + "desired_workers": 0, + "active_workers": 0, + "assignment_count": 0, + "used_vcpus": 0, + "committed_vcpus": 0 + }, + "telemetry_caveat": "Azure Cost Management actuals lag by hours; this is a backstop on recorded spend, not a real-time meter.", + "source_artifacts": { + "idle_subject_report_sha256": "10270961a947511e3a96b316ecfcc5fce617c2699f5fca7acd82ca76b0a5dce8", + "daily_bound_report_sha256": "155b020538f866cba11df2743d5e5149a81dc98d50853db6c99f90dd9d3949f1", + "zero_to_zero_completion_sha256": "4595bf49b7319db4acd0d334f4f520d6c2ee9a24fdb412050ec3dc486877962d" + }, + "limitations": { + "cost_management_is_not_real_time": true, + "does_not_prove": [ + "C1", + "C2" + ] + } +}