feat(models): Phase 3 — pricing axis to D2' (authority, model) exact-lookup contract

[wpfleger96]

Summary

Implements the D2' pricing contract from the Usage v2 plan: an optional generated pricing table/API keyed on exact (billing-authority domain, billable-model-string) pairs. No family inference, no prefix stripping, no case normalization. Billing authority is a distinct namespace from the runtime transport Provider enum; match is exact or nothing.

Manifest (scripts/model-capabilities.json)

Replaced pricing_rules (17 prefix-match rules) + pricing_exact_records (3 records) with a flat pricing_records list of 20 exact records, each containing:

• authority — registered bare-host billing-authority token (api.anthropic.com, api.openai.com)
• model — exact model string returned by the provider API in its response body
• usd_per_mtok — input, output, cache_read, cache_write (null fields = price unpublished, never zero)
• _source — models.dev entry + retrieval date (2026-08-03, SHA 6fd293ae)

Semantics: current list prices (ccusage-aligned). cache_write scoped to default ephemeral class; other classes/TTLs unknown.

Authorities included: api.anthropic.com (11 models) and api.openai.com (9 models). Databricks routes and custom/unknown endpoints are not represented. The publisher (P2 scope) must omit PricingIdentity for those routes; manifest lookup returns null/None.

Generator (scripts/generate-model-capabilities.mjs)

Replaced all old pricing machinery with strict validation + exact-emit:

Validation (hard errors on non-conforming records — no silent skips):

• authority must be an exact registered token from the closed set (api.anthropic.com, api.openai.com, openrouter.ai); path-bearing, scheme-prefixed, or unknown values rejected
• model must be nonempty; control/NUL/quote/backslash characters rejected
• usd_per_mtok.input and .output: finite nonneg required; both cache_read and cache_write are required fields (absent member is hard error; use null for unpublished prices)
• _source provenance field required and nonempty
• Duplicate detection on exact emitted (authority, model) pairs

Generation: no toLowerCase() anywhere — records are emitted verbatim. PRICING_TABLE keys on ${authority}\0${model} (exact strings, no transforms).

modelPricing.ts is standalone — no import from modelCapabilities.ts.

Generated API

generated_model_capabilities.rs:

pub fn lookup_pricing(authority: &str, model: &str) -> Option<ModelPricing>

Exact match — no to_ascii_lowercase(), no fallback. Returns None for unknown authority, unknown model, or noncanonical casing.

modelPricing.ts (new file):

export function lookupModelPricing(authority: string, model: string): ModelPricing | null

Same semantics: exact Map lookup, null means price unknown, never treat as zero.

CI (.github/workflows/ci.yml)

Replaced the two-step regenerate-then-diff check with a single step:

- name: Check generated artifacts are up to date
  run: |
    if ! node scripts/generate-model-capabilities.mjs --check; then
      echo ""
      echo "ERROR: Generated model-capability files are stale."
      echo "Run: node scripts/generate-model-capabilities.mjs"
      echo "Then commit the regenerated files."
      exit 1
    fi

The --check mode validates all three generated artifacts (Rust capabilities, TS capabilities, TS pricing) without writing. It exits 1 with CHECK FAILED on any stale or missing file and self-maintains if a fourth artifact is added.

Tests

Rust pricing tests (23):

• Anthropic and OpenAI model rates
• Null guards: unknown authority, custom base URL, unknown model, empty authority/model, both empty, wrong authority for known model
• Exact-match guards: uppercase authority → None; mixed-case authority → None; mixed-case model → None (no case folding)
• Databricks guards: workspace URL authority → None; "databricks" authority → None

Manifest validator mutation tests (21 new, 45 total in scripts/test-manifest-validator.mjs):

• Missing authority, unregistered/path-bearing/scheme authority, uppercase authority (case collision)
• Empty model, unsafe chars in model (double-quote, backslash, NUL, control character)
• Missing usd_per_mtok.output, negative rates, string cache rate, negative cache_read
• Deleted cache_read member, deleted cache_write member (absent member rejected; use null for unpublished)
• Missing/empty _source provenance
• Duplicate (authority, model) pair

Gate

Check	Result
cargo test -p buzz-agent pricing	23 passed, 0 failed
cargo test -p buzz-agent (full)	452 passed, 0 failed
node scripts/generate-model-capabilities.mjs --check	OK: Rust + TS + TS Pricing
node --test scripts/test-manifest-validator.mjs	45 passed, 0 failed
just desktop-check	Clean
git diff --check vs base	Clean
modelCapabilities.ts lines	809 ≤ 1000 ✓
modelPricing.ts lines	172 ✓

Related

Stacks on #3603 (duncan/databricks-model-label-registry) — when that merges, this PR retargets to main and gets rebased.

Related: #4632 (P1 — NIP-AM normative amendment, defines authority token registry), #4000 (P2+P4a — cache-category repair, aggregation, Usage v2 backend), #4001 (P5 — Usage v2 UI). P4b (cost computation in #4000) consumes lookup_pricing(authority, model) from this PR after it lands on main.