Make authority and spending explicit.

Approvals are scoped, not ceremonial

The server derives a canonical approval scope from the organization, investigation, action, protocol version, and action context. The approver signs that scope; callers cannot choose or weaken the stored hash.

• Execution approval names the current protocol and ceiling
• Compute approval names the region and dedicated-machine specification
• Repository write and publication approvals are separate actions
• An approver who loses authority can no longer authorize the action

Three nested hard caps

Spend is reserved and settled across the organization, project, and investigation in one transaction. If any level lacks room, the entire hold fails and no partial reservation remains.

1. 01Estimate the next bounded unit of work
2. 02Reserve against all three ceilings
3. 03Execute only while the lease and hold are live
4. 04Settle actual usage and release the remainder
5. 05Checkpoint and stop at the first exhausted boundary

Research-hour capacity

Customer plans express included capacity in research hours using GPT-5.6 Luna as the baseline. Hosted launch execution is pinned to that model and the official OpenAI endpoint; it does not silently fall back to another provider. Internally, usage is normalized against a fixed token denominator so input and output can be reconciled consistently.

Overages require visibility

Included provider allowance is tracked separately from customer charges. Only the incremental amount above the allowance is sent to the billing meter, and the local ledger remains the source of truth.

• Usage appears before it is billable
• Meter events are idempotent
• Provider cost and customer charge remain separate
• A plan-period research-hour ceiling still stops work even when a card is available