v2026.09.03 — Track A experiment/eval 收官 + 双语计费分组

Track A(消除 control 单例 DO 租户镜像)

• 0043: DROP experiment_shadow_legs / online_eval_scores — control 空表(backfill 已跑完,source_rows=0),experiment/eval 家族收官,零数据丢失
• gateway G2: 停 control 写 request_logs + guardrail 投影(index.ts 硬编码 projectRequestLogToControl:false / projectGuardrailToControl:false)
• CP SIEM 读切: request_logs 读改租户对象 fleet 扇出(fc0ace1)——摘掉 control 投影最后一个运行时读者
• spend_throttles G2: default-OFF flag(可逆)

产品

• 0044: 计费分组中英双语 name_zh / description_zh
• 客户端 typed 重新生成清 Gemini drift

部署

本地 wrangler 已上线:gateway c934dfc0 / control-plane e4b7504b;#migrate 已 apply 0043+0044,healthz 全 200。

FerroGate v2026.09.02 — Track A 投影退役(fleet rollup / anomaly / leg_quality)

Track A:消除 CONTROL_DATA 单例 DO 里的租户数据镜像

本次退役三条投影腿并物理 DROP 其 control 副本(reader-free + writer-free,权威均在 per-tenant TenantDataObject):

• fleet rollups(本次新片,commit 7f54c9a):tenant_agent_cost_rollups / tenant_spend_rollups / tenant_asset_rollups — reader 切 DO 扇出、writer-stop、0040_drop_tenant_rollups.sql DROP(derived 数据,无 backfill 依赖)。
• anomaly:spend_anomaly_episodes — 0038 DROP。
• leg_quality:online_eval_leg_quality — 0039 DROP。

迁移 0038/0039/0040 由 ControlDataObject 冷启 #migrate apply(gateway 定义,已随本次 gateway 部署生效)。

部署

• control-plane Version 58771db2(reader-switch 先行)
• gateway Version e8c94217(writer-stop + 0038/0039/0040 DROP)
• 已验证 healthz/readyz 全 200。

🤖 Generated with Claude Code

v2026.08.29

计费准确性(#976)

• Phase B1 · buffered 本地 tokenizer 兜底:上游返回 2xx 成功但 body 无 usage 时,用 gpt-tokenizer(o200k_base,纯 JS / workerd 安全)本地真数 prompt+completion token 归账,取代 chars/4 粗估。新增可审计计费来源标签 local_tokenizer。三处 buffered 站点接线:chat/responses、messages、gemini-native。
• 反误标不变量:仅在 2xx + body 解析成功 + provider 未给 usage 时才兜底;!ok / 解析失败一律不合成。
• 体积取舍已实测,B1 只内嵌 o200k(gzip +1.11MB),encodingForModel 留口子将来补 cl100k。
• Phase A · Bedrock/Vertex $0 漏记修复:缺 dialect 分支导致真实用量被记 $0 的 BUG 已修。

其它(自 v2026.08.23.9 起累积)

• 控制面 tenant-teardown / tenant-consumption-purge 运营路由 + 10 条 anti-drift 红清理
• inference body 上限 1 MiB → 64 MiB
• 计费分组配置发布到 KV 快照,去掉逐租户 fan-out
• 受信 OAuth-bridge 免密登录(仅 verified email);console 网关 key 绑定浏览器会话
• 租户后台展示 owner email

验证

gateway 全测绿(3293 + ratelimit 26 + tenancy 50)、billing 120、类型干净。已随超级仓 release v0.27.48 部署上线并核验(/healthz 200、/v1/models 401 missing_api_key)。

v2026.08.23.9

static_resource per-request billing + serve hardening (consumed by enterprise via submodule bump). Gateway bills a static_resource pull per served GET, kept out of per-GB egress (HEAD/304 free); static_resource content-type allowlist; serve hardening (nosniff always; attachment + CSP sandbox for html/xhtml/svg) scoped to static_resource. Verify: gateway tsc clean, billing 8 tests, gateway asset suite 448 tests.

v2026.08.23.8

Native Gemini generateContent / streamGenerateContent ingress.

Accept tenant virtual keys from x-goog-api-key and route native Gemini requests to Gemini suppliers with byte-for-byte protocol preservation. The caller's Gemini body reaches the supplier untouched (UpstreamPlan.nativeBody); buffered bytes and SSE frames relay through a null normalizer. FerroGate owns auth, routing, metering and the credential swap — the tenant key is never forwarded (supplier x-goog-api-key written by the gateway; only x-goog-api-client passes through). A non-Gemini supplier is refused with 502 provider_protocol_mismatch rather than mis-served.

Also fixes a prompt_cache control-member leak on the native Anthropic passthrough.

FerroGate v2026.08.23.7

Changes

• preserve native OpenAI Responses request bodies and complete streaming event graphs for Codex, function tools, and remote MCP
• relay only approved Responses capability headers while keeping tenant credentials and session metadata isolated
• explicitly disable provider-side response storage while FerroGate owns conversation state

Validation

• gateway: 205 files / 3239 tests, 26 rate-limit tests, 50 tenancy tests
• focused Responses/Codex coverage: 5 files / 73 tests
• gateway typecheck, Biome, diff and secret checks
• Cloudflare Worker dry-run build

FerroGate v2026.08.23.6

Changes

• keep official model prices as the tenant billing baseline
• apply provider cost multipliers only to cost-aware routing and operator margin analytics
• publish a v2 shared catalog snapshot so stale cost-adjusted prices cannot survive rollout
• hide supplier economics from tenant-scoped billing reads

Validation

• gateway: 205 files / 3237 tests, 26 rate-limit tests, 50 tenancy tests
• control plane: 92 files / 1293 tests
• gateway and control-plane typechecks
• Biome, diff check, and focused billing/catalog tests

v2026.08.23.5

Full Changelog: v2026.08.23.4...v2026.08.23.5

FerroGate v2026.08.23.4 - Pi Agent Anthropic compatibility

Changes

• map standard Anthropic ephemeral cache markers to automatic-cache upstream semantics
• preserve strict refusal for explicit cache disable and one-hour retention when an upstream cannot honor them
• add regression coverage for Pi Agent-style cache markers and long-retention refusal

Validation

• release review found no blocking issues or leaked credentials
• gateway typecheck and Biome passed
• 3,234 gateway tests, 26 rate-limit tests, and 50 tenancy tests passed

Deployment scope

• FerroGate gateway only

FerroGate v2026.08.23.3 - Anthropic Messages compatibility

Changes

• preserve the Anthropic Messages response contract when a provider uses the OpenAI Responses upstream protocol
• compose Responses-to-Chat and Chat-to-Anthropic stream normalization for Claude Code and Anthropic SDK clients
• reject invalid successful Responses payloads instead of returning an empty Anthropic message
• add buffered and streaming protocol and billing regression coverage

Validation

• gateway typecheck passed
• Biome checks passed
• 3,232 gateway tests passed
• 26 rate-limit harness tests passed
• 50 tenancy harness tests passed

Deployment scope

• FerroGate gateway only