Change: This is S-9 of the agent prompt-caching build (Epic-2050,
RFD docs/notes/rfd-agent-caching-strategy.md §7.4 / §4). It is a
test-only audit — no behaviour change. It locks the RFD's ambient money-safety
rule with tests over the whole surface of the two ambient agents, Vega
(framer) and Blake (registrar): an ambient seat must emit no explicit
cache markers (openrouter_cache_* / CachePoint /
cache_control) on any provider in paid_write_providers.
Vega runs one panel per trigger, triggers hours apart; Blake runs event-driven singles. Both are beyond every cache TTL — a written prefix is never re-read before it expires. On a paid-write provider (Anthropic-class, 1.25–2x write premium) an explicit cache write is therefore pure loss: you pay the premium and earn zero reads. So the rule is not a preference, it is arithmetic: ambient seats stay cold on paid-write routes. Free-write providers (OpenAI/DeepSeek/Gemini/…) cache harmlessly on their own — nothing to configure, nothing to suppress.
| File | Role |
|---|---|
agents/framer/tests/test_ambient_audit.py | Vega audit. Iterates every seat × every vendor in paid_write_providers() with the seat force-flipped on, asserting both wiring surfaces (model_settings(seat) and cache_point(seat)) stay cold; asserts the live agent.py factory path (ZDR_SETTINGS) carries no marker; asserts AGENT_IS_AMBIENT is True and the guard list is non-empty. |
agents/registrar/tests/test_registrar_ambient_audit.py | Blake audit. Asserts model_settings(config) carries no cache marker (and no cache_control in extra_body) for the paid-write vendors, with ZDR still pinned; plus a structural ratchet — Blake's source imports no CachePoint and writes no cache_control / openrouter_cache_* anywhere. |
Vega has the full S-1/S-2 cache wiring (a cache_policy_for loader
and a model_settings(seat) / cache_point(seat) provider layer), all
seats "off" in llm.yaml, and the emits_markers() guard
behind them. The audit proves the guard holds even if a deploy flips a seat on: for
every seat, across every paid-write vendor, both surfaces stay cold. Iterating
paid_write_providers() means a new vendor added to llm.yaml is covered
for free. It also pins the actual run path: agent.py's one factory builds
every role with model_settings=ZDR_SETTINGS (no cache field), so a live Vega run
writes no cache regardless of the wiring helpers existing.
Blake is different: its provider.py is hand-built
(OpenAIChatModelSettings with only temperature/max_tokens/ZDR provider prefs) and
has no cache-policy toggle at all. So the guarantee is structural — the code literally
cannot emit a marker. The audit both checks the settings output (for paid-write vendors) and
scans Blake's source for the forbidden markers, so a future edit that adds one fails here, on
every provider.
| AC | Proof |
|---|---|
test fails if an ambient agent ever sends cache_control/CachePoint on a paid-write provider | Vega: test_paid_write_guard_holds_for_every_seat_and_vendor (every seat × every paid-write vendor), test_every_seat_cold_as_shipped, test_live_agent_factory_emits_no_cache_marker. Blake: test_model_settings_never_carries_cache_marker_on_paid_write, test_blake_source_emits_no_cache_marker. |
paid_write_providers guard test | Vega: test_paid_write_providers_is_non_empty + the parametrized guard reads the live paid_write_providers() list. Blake: parametrized over the canonical vendors (anthropic, alibaba) from framer's llm.yaml. |
uv run --package framer pytest agents/framer/tests -q # 120 passed
uv run --package registrar pytest agents/registrar/tests -q # 287 passed
uv run ruff check agents/framer/tests/test_ambient_audit.py \
agents/registrar/tests/test_registrar_ambient_audit.py # All checks passed!
Test-only. No llm.yaml, config, provider, runtime, prompt, or brain
behaviour changes — this story proves the ambient invariant, it does not alter it.
No CodeZip rebuild or AgentCore redeploy is required.