Kintsugi v0.3.5

Kintsugi v0.3.5

This patch adds opt-in Graphite token-consumption telemetry, improves native-agent usage attribution and incorporates two reviewed upstream fixes through e38fff5d.

Graphite token telemetry

Open Settings → Token telemetry to configure a trusted Carbon plaintext TCP receiver, port (default 2003), stable instance name and interval (default 15 minutes, configurable from 1 to 60). Export is disabled by default. It starts with new recorded usage and excludes disabled periods; enabling it does not backfill old conversations.

• Use PiClaw-compatible paths under kintsugi.<instance>.usage.<provider>.<model>.
• Export available input/output, cache-read/write, reasoning and total token counts, complete prompt-token counts and available API-equivalent cost estimates. Estimates are not subscription charges.
• Calculate cache-hit/write percentages from grouped token counts, not averages of per-call percentages. Omit percentages when cache coverage is incomplete; do not turn missing counters or costs into zero.
• Read committed built-in model accounting and bounded, incremental native Claude, Codex and Pi histories. Do not estimate consumption from text, intercept provider traffic or start workspaces.
• Preserve actual provider/model attribution for built-in classifier/image calls. Include native compaction and subagent accounting without charging inherited history twice.
• Persist source positions, invocation deduplication, counter high-water marks and pending exports across restarts. Bound retries to seven days or 10 MiB and retain original timestamps. Carbon provides no storage acknowledgement or exactly-once guarantee.
• Keep configuration/checkpoints private in app data. Do not export prompts, replies, tool output or credentials. Admin JSON read/save/test/discard operations require security scope.
• Keep every provider's cache policy and native session/resume identity intact. Do not force longer retention or trigger cache warming.

Carbon plaintext has no encryption or authentication; use a trusted network or a separately managed secure tunnel. This is an app-level destination, not a workspace LAN permission. Pending exports must be delivered or explicitly discarded before changing the destination or instance.

Graphite should sum token/cost interval metrics. Percentage series are gauges; recompute longer-range rates from matching complete-coverage counts rather than averaging interval percentages. See the telemetry guide for all suffixes, coverage, limits and JSON endpoints.

Native-agent accounting

• Recover Claude identity from session metadata for partial response records, while giving the response's model priority.
• Preserve explicit Codex provider IDs and turn/model changes, including a provider header outside the bounded recent-history tail. Separate cached input from uncached input and convert cumulative counts into deltas.
• Use Pi's branch-local model context and physical response model. Collect standalone model-attributed usage, including cache-warming requests when Pi records them.
• Include recorded Pi tool, compaction and branch-summary usage. Use explicit metadata or an unambiguous single-model code-mode roll-up when possible.
• Retain ambiguous/mixed-model Pi counts under the reserved provider unattributed, with pi_assistant, pi_usage, pi_tools, pi_compaction and pi_branch_summary categories. Do not guess the parent model or divide tokens according to cost. Count a combined roll-up once, not once per nested call.

Pi's missing per-call model metadata is tracked in earendil-works/pi#11090. Its contributor gate auto-closed the proposal pending triage. A backend request with no persisted usage cannot be reconstructed; these metrics are not complete billing reconciliation.

Upstream fixes and verification

• Display Claude Bash timeouts in seconds instead of milliseconds, including the native two-minute default.
• Break the shared presentation/barrel import cycle while retaining Kintsugi's independent wire-schema safeguard; update native CLI adapter checks.
• Clarify the README's fork-only additions and update current telemetry/operator documentation, preserving creator and third-party attribution and existing external links.

The pre-release full AMD64 CI checkpoint passed 2,399 tests, with 39 skips and zero failures. Module generation, lint and TypeScript passed. Accounting/API/native-session focused checks passed 42 tests. A disposable TCP receiver captured known counts, weighted cache percentages and Pi unattributed categories. Settings test/save/refresh and failed/successful connection handling were reviewed in isolated desktop/mobile fixtures. No UI tests were added.

The first documentation/accounting checkpoint exposed a pre-existing local-proxy test race: its global HTTP agent could reuse a socket after the fixture deliberately closed the application listener. The fixture now opens a fresh connection; explicit persistent-TLS checks and proxy runtime policy are unchanged. The failure was reproduced locally, and 120 repeated proxy tests passed after the change. The final full checkpoint passed.

Live production Graphite ingestion/retention, real-account usage across every native backend, sustained inference, physical microphones, iOS behaviour, physical-host reboot and a fresh installed update/rollback cycle were not verified for this patch. Protocol/storage fixtures and native task tests do not establish those acceptances. External dependency versions were not updated.

Compatibility and rollout

System capability 3, default app minimum 0, network-policy reader 2 and resource-policy reader 1 are unchanged. Telemetry is app-owned and optional; it introduces no new System operation or environment variable. Existing finite resource boundaries, overlapping workspace caps, network exclusions, custom repositories/registries, credentials, pins and retained-pair rollback remain intact. Image rollback preserves data rather than restoring earlier settings.

The tagged workflow runs full release checks and native AMD64/ARM64 image verification before publishing. Publication advances latest, leaves stable unchanged and does not update or restart user installations.

Published verification

Tagged release workflow passed on its first attempt for source d8908dc9062babbd6b6cd6d3de2a65c199b31562: 2,399 passed, 39 skipped, zero failures. Native AMD64/ARM64 app smoke checks passed. The unchanged System/workspace images were reused after source/signature verification, and the candidate pair passed compatibility checks. Independent public-registry reads verified both architectures, app source/revision and policy-reader labels, System capability 3, immutable workspace pins and matching version/latest digests. stable was absent before and after publication. No user installation was updated or restarted.

Image	v0.3.5 and latest digest
kintsugi	sha256:9808a94d971ccabf10b56a34b28b09fab2258ef85fe9bf7eda8288698b9a2f5e
kintsugi-system	sha256:4ff2834f62cfaadd92750f96044ce47a0f7d0b4d7334a9569f80c9a01a04a300
kintsugi-workspace	sha256:846be1b2bed0ff0dabb08fff77c4f390078563d65d1925263873e6ce018ae455