Skip to main content

AI Cost Firewall v0.8.3 — Assessment Context

AI Cost Firewall v0.8.3 adds the runtime and configuration context required to turn a bounded Observe-mode period into a reproducible assessment.

This release does not change the Observe -> Enforce request-path behavior introduced in v0.8.0 or the deployment hardening delivered in v0.8.2. It adds a safe, deterministic description of the effective AIF runtime for assessment and reporting tools.

Assessment Context API​

AIF now exposes:

GET /assessment-context

The endpoint returns an allow-listed effective configuration snapshot including product/schema metadata, enforcement mode and effective cache scope, cache and embedding configuration, request-path settings relevant to interpretation, pricing assumptions, optional-module state, and a deterministic configuration_hash.

The response does not expose provider API keys, credentials, tenant identifiers, private license material, or other secret configuration values.

Assessment Context schema​

AIF v0.8.3 introduces Assessment Context schema 1.0. /version advertises the supported schema through assessment_context_schema so clients can verify compatibility before finalizing an assessment.

Deterministic configuration identity​

AIF computes a deterministic SHA-256 identity for the safe effective configuration represented by /assessment-context.

Pricing entries are normalized before hashing, so ordering alone does not change the identity. Secret-only changes do not change the public configuration hash.

Historical runtime identity​

AIF now exports:

aif_runtime_info{version="0.8.3",config_schema="1",configuration_hash="sha256:..."} 1

Prometheus-backed assessment tools can query this metric over an exact historical window to verify which AIF version/configuration identity was active during that period.

When a supported configuration reload changes the effective configuration, AIF replaces the current runtime-info label set. Prometheus can retain the previous series historically.

Reload safety​

AIF continues to support SIGHUP configuration reloads. v0.8.3 rejects reloads that attempt to change restart-only settings:

  • listen_addr
  • max_request_body_bytes
  • max_inflight_requests
  • graceful_shutdown_timeout_seconds

Restart the AIF process/container to apply those changes.

Evaluation and Assessment separation​

Evaluation Mode continues to provide hypothetical cache and cost telemetry. Assessment Context provides the configuration/runtime evidence needed to interpret that telemetry reproducibly.

A bounded assessment can combine:

Evaluation telemetry
+
GET /assessment-context
+
historical aif_runtime_info

AIF itself does not create or persist assessment reports. Assessment lifecycle, persistence, report generation, and finalization belong to an external assessment layer such as VCAL Console.

Compatibility​

  • Observe/Enforce request-path semantics are unchanged.
  • Evidence schema remains vcal.evidence.event 1.1.
  • v0.8.2 deployment hardening, /startupz, /v1/models, controlled streaming, content-array pass-through, and generic non-root OCI behavior remain available.
  • Existing Docker, Docker Compose, Kubernetes, and OpenShift deployment models remain supported.