Skip to content

Cloud acceptance receipts

Keep each rehearsal account separate. Record the owning account, UTC window, flow ID and saved revision, execution IDs, runner ID, requested model, observed provider model when reported, server and core commits, applied migration revision, and execution image digest. A deployment pin alone does not establish which image a completed execution used. Record credential backend references and provider subject/scope identifiers, never credential values.

Complete read-only capture

Save API exports directly to files. Copying terminal output can truncate a large preview while leaving a readable prefix. The capture helper validates the whole JSON or CSV response and replaces the destination only after successful capture. It performs one GET, refuses redirects, limits responses to 16 MiB, uses a 30-second timeout, creates files with mode 0600, and prints only byte count and SHA-256. It never sends email or triggers a flow. Failures report a static category (validation, size, length, request, or filesystem), without response or credential details. CSV permits empty lines after the header, including between data rows; nonempty rows must match the header width.

Set PRELOOP_API_TOKEN through the existing approved secret injection mechanism. Do not place a token in the URL, command arguments, shell history, or evidence. For an existing account-scoped report window:

python scripts/capture_acceptance_receipt.py \
  'https://your-preloop.example/api/v1/cost/by-issue/export?format=json&start_date=2026-10-01T00%3A00%3A00Z&end_date=2026-10-08T00%3A00%3A00Z' \
  evidence/issue-costs.json --format json
python scripts/capture_acceptance_receipt.py \
  'https://your-preloop.example/api/v1/cost/by-issue/export?format=csv&start_date=2026-10-01T00%3A00%3A00Z&end_date=2026-10-08T00%3A00%3A00Z' \
  evidence/issue-costs.csv --format csv

Use the same filters and account identity for both exports. Save the account identity and export query separately in the run manifest. JSON export includes contributing execution IDs; CSV is at issue grain, with an unassigned bucket. Compare by named columns, then join the contributing IDs to execution receipts. Check failed/retried/repair runs and coverage counts as well as successful runs. Unknown subscription spend remains unknown. Zero attributed cost is not zero allowance usage. Keep gateway estimates, imported billed spend and subscription API-list-price equivalents separately identified. Execution wall time is not issue cycle time. Configured-policy readiness requires its policy revision and head provenance; missing forge CI is not a passed check.

The helper validates transport and syntax. It does not certify account ownership, report completeness, exporter semantics, or live acceptance. Preserve a malformed original receipt and record its integrity failure separately from any product exporter defect. Capture a full existing preview through its documented read-only endpoint, or regenerate a preview with sending disabled through the normal UI. Do not turn a send endpoint into a supposed preview by omitting recipients.

Publication and recovery evidence

Create a dedicated publication-enabled host profile through the authorized runner configuration workflow. Preserve existing profiles. Bind only a verified owned sandbox repository from the runner's own account. Record the selected runner, allowed model mapping, auth inventory and secret references. Setting allow_checkout and allow_publish is configuration preparation, not proof of repository authority or successful publication.

Run one bounded native Copilot implementation and one feedback continuation. Record authoritative repository, branch, PR identity and before/after heads from the provider. Both executions must point at the same PR. A local Java test run or another executor's publication does not satisfy native publication. Reuse previous accepted Cloud and fixture receipts for their existing criteria.

Keep three recovery scenarios distinct:

  • Provider expiry: retain the provider-issued expiry timestamp and observation time, cross the actual lifetime without modifying expiry fields or clocks, then verify late REST/Git mutation and managed refresh on the same binding.
  • Grant revocation: revoke only the owned test grant, observe a controlled refusal, reconnect through consent, and verify resumed mutation on that binding.
  • Response loss: inject loss after the owned provider accepted publication, recover using authoritative branch/PR identity, and verify exactly one PR.

Deterministic fault-injection tests support implementation correctness. They do not substitute for real provider expiry or revocation. Record recovery test mode and receipt provenance explicitly.

Digest preview matrix

Use a synthetic account/window and capture previews without sending mail. Verify notify-only policy hits, imported Copilot spend with an explicit identity mapping, corrected/remapped superseded findings, unchanged dismissed history, an account with no gateway traffic, and recipients restricted to their authorized sections. Keep raw provider spend and mapped attribution separately traceable. Existing billing tests cover these rendering and authorization paths; live rehearsal acceptance still requires the account/window-linked receipt matrix.