Report Grok usage with recorded and estimated spend

[olddonkey]

Problem and resulting behavior

Grok's local fallback reads ending context occupancy from signals.json, which is not completed-turn usage, and publishes no local cost. This PR reads completed turns from bounded native CLI logs and carries recorded-versus-estimated cost through the menu and Usage & Spend.

• Read both session/update and _x.ai/session/update records in updates.jsonl, with daily, model, and request breakdowns.
• Prefer a positive outer usage.costUsdTicks / 1e10 as the authoritative turn total. Count it once. Show nested model dollars only when all nested ticks exist and reconcile to that total; otherwise retain model tokens with unknown model dollars. Missing recorded cost falls back to disclosed public xAI list prices.
• Keep useful remote data during billing failures while rescanning local sessions. Consumers select the newer publication for the current configuration and preserve account override isolation.
• Retain cost provenance after menu and dashboard window/day filtering. Populated surfaces disclose Grok CLI-recorded spend, list price where unrecorded · not a bill.
• Refresh the xAI models.dev catalog for Grok-only installs and keep its pricing fingerprint independent from native Codex pricing.

OpenCodex integration

With the existing Include OpenCodex usage logs switch enabled (off by default), Usage & Spend also includes reported physical Grok OAuth attempts. The producer contract originally proposed in OpenCodex #3642 has now landed in dev through the attributed carry #3762, merged as f00f2bcaea251ebe7ad4de9e38337b4be0ccee47. It writes attempts[].credentialSource from the resolved upstream transport. Compatibility is verified against the pinned producer commit in the evidence below; availability in a released OpenCodex version is not claimed.

The landed carry's immutable source contract has additionally been inspected directly, including resolved-adapter stamping, persistence normalization, and OAuth/API-key regression assertions. The executable capture remains pinned to its documented producer revision; this source audit does not claim a new capture or released-version coverage.

Only provider: "xai", credentialSource: "grok-oauth" attempts with an upstream send and reported token usage qualify. API-key traffic, historic rows, locally answered requests, unknown sources, and estimated/unreported token counts stay excluded. Current configuration and top-level credential metadata cannot retroactively classify usage.

Combo requests contribute each qualifying attempt's own token counts, never the parent aggregate. Duplicate request IDs are resolved before grouping; duplicate attempt ordinals are rejected. SQLite cache schema 3 retains attempt metadata and rebuilds older derived caches from the log. OpenCodex dollars use list prices and remain estimates, including when combined with native CLI-recorded spend. Missing token classes and unknown prices retain tokens without inventing a dollar value. The Grok menu continues to use native CLI logs.

Producer-to-dashboard evidence and review fixes

The committed evidence report and raw ledger fixture contain output from OpenCodex's unmodified production handlers and durable usage writer at 146ed679c9633e5d68726217fcadc8e0b107339b. Two localhost HTTP requests exercised OAuth 401 replay through Responses and native Chat API-key dispatch. Upstream responses and credentials used isolated fixtures; this is production-path capture evidence, not live vendor authentication or billing evidence. The capture helper rejects unexpected external fetches and is reproducible against that pinned checkout.

CodexBar imports the exact captured bytes through the production disk loader, with no injected entries or loader closure, and reopens the persisted cache:

producer_capture_sha256=ef6d8758b40910f6e5993d5b5a105a2ad2834c6c1bd0565ab87b61cf091c4978
producer_log_rows=2 total_reported_tokens=10 grok_oauth_tokens=5
producer_import_dashboard_tokens=5 cache_reopen_bytes=0
producer_api_key_only_subscription_rows=0

Standalone reports retain explicit xAI custom-price estimates from either the caller overlay or the application overlay, including known zero. Raw xAI records without an explicit price remain token-only, and the subscription fan-out still excludes API-key and historic records. opencode and opencode-free retain their existing catalog and custom prices.

Application overlays first match the original model name before the provider-qualified catalog name. Bare keys retain precedence when both keys exist; incomplete rates stay unknown, cached-input accounting is preserved, and caller-supplied custom pricing still takes precedence over the application overlay. New regressions cover these cases through the application-overlay parameter and the standalone disk/cache loader. Coverage includes known-zero overrides, incomplete rates, cache accounting, and both snapshot and application overlays.

Both async native Grok scan entry points propagate the executor's cancellation callback through discovery, JSONL reads, and aggregation. An in-flight regression cancels after parsing begins, observes CancellationError, and confirms the next queued scan runs within one second. Cancelled partial parses are uncacheable and cannot establish complete history. The final serial proof stopped at 4,874/40,000 decoded records and released the queue after 0.001864583 seconds. The evidence report also retains the initial measurement.

Bounds and compatibility

Native scans run on the dedicated executor with limits of 64 MiB / 20,000 turns per file, 1 MiB per record, 256 sessions / 256 MiB / 100,000 turns per scan, and 4,096 discovery entries. The process cache retains at most 64 files or 50,000 turns. Cancellation and truncated history cannot publish complete coverage.

Merged main 912eac22372d7c3f1a1afff77acb97dc502117f4, retaining its shared report accumulation, bounded pricing resolver, provider fixes, and 0.56.8 release. Model-target mapping is colocated with the existing Codex resolver extension without changing its API or mapping; the separate xAI pricing fingerprint remains intact. The architecture gate retains the same provider-reference fingerprints at the updated source locations.

Regenerated the native parser hash from the merged source: c3a879df4eff7187. Current-main hash 9ca89383b9957b07, prior-PR hash 1a4afd74939160fd, and intermediate upstream hash ba2eca901de4c53d remain compatible because these report and lookup changes preserve native parsed rows and checkpoints. Existing predecessors are retained. Parameterized SQLite adoption tests cover these hashes without rebuilding. Grok release notes are under 0.56.9 — Unreleased; the published 0.56.8 and earlier sections match main.

Validation

Head: c35734ad5a747a83c46b3844c8ce33fd46dbefe1.

• Current-head make check passed: zero SwiftLint violations in 2,143 files.
• Focused cache-adoption, Codex resolver/report-work, Grok/OpenCodex pricing, and provenance regressions passed. After relocating the unchanged model-target mapping, all 41 architecture tests also passed with the original reference fingerprints retained.
• Current-head make test passed: 1,036 selections, 87/87 groups successful on the first attempt, zero failures, retries, or timeouts (947.9 seconds execution; 964.5 seconds total).
• All nine GitHub CI checks passed on this head, including both macOS shards, all three Linux builds, lint, and the aggregate gate.
• git diff --check passed.
• Earlier supplemental proof remains pinned to c3919a224: 136 cache/pricing/architecture/chart tests and 206 native Grok/producer-import/pricing/cache/cancellation tests passed on that revision. The current integration is validated separately by the regression checks above and the full suite.

The supplemental proof and local-corpus measurements below were captured at c3919a224. They remain historical, source-linked evidence; current-head validation is recorded separately above. The supplemental proof uses the repository’s serial execution mode because those suites share scanner-cache counters.

The September 6 local-corpus proof retained vendorMetered for populated windows: 7 days = 95,891,889 tokens / $12.57875572; 30 days = 98,631,812 tokens / $12.94957366. The empty 1-day window retained unknown. Controlled JSONL fixtures also proved recorded-only and estimate-only windows after narrowing mixed source history.

CODEXBAR_LIVE_GROK_CATALOG_PROOF=1 CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 CODEXBAR_ALLOW_TEST_KEYCHAIN_ACCESS=0 CODEXBAR_TEST_CODEX_FILE_ISOLATION=1 swift test --skip-build --no-parallel --filter 'GrokWindowProvenanceProofTests|GrokXAISpendCatalogTests|GrokTokenSnapshotProjectionTests|GrokCostUsagePricingTests|GrokLocalSessionScannerTests|ProviderArchitectureGatekeeperTests|CostProvenanceTests|SpendDashboardGrokFreshnessTests|GrokOpenCodexUsageTests|CostUsageScanExecutorTests|OpenCodexUsagePricingTests|CostUsageStoreTests|SpendStackedBarChartTests'

The OpenCodex regressions cover mixed OAuth/API-key/provider attempts, historical and malformed records, duplicate suppression, cache reopen/incremental append/schema upgrade, missing-price behavior, recorded-plus-estimated date filtering, and the dashboard's opt-in switch. Existing native regressions cover bounded parsing, outer/nested cost reconciliation, local fallback freshness, account isolation, and menu/dashboard provenance.

All ordinary tests suppress Keychain access and isolate provider files. The optional native proof reads local Grok logs and the cached pricing catalog without authentication, browser-cookie import, or live provider requests. Presentation evidence uses production menu/dashboard models; no app-bundle screenshot is claimed.

Maintainer decision

Please revisit the 2026-08-21 Grok cost ruling before merge. It preferred public-card pricing based partly on my incorrect 1e9 divisor; #3345 established 1e10, and the corrected measurement explains the difference. This branch uses recorded spend with public-card fallback.

Whether existing Grok users should receive this disclosed dollar surface by default remains an owner decision. The accounting corrections and source labeling do not override that decision. Maintainer approval is still required.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 09cf7edb0f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[clawsweeper]

Codex review: blocked before merge. Reviewed September 7, 2026, 9:32 PM ET / September 8, 2026, 01:32 UTC.

ClawSweeper review

What this changes

The PR counts completed Grok CLI turns, reports recorded spend with labeled price estimates where needed, and imports qualifying OpenCodex OAuth usage into Usage & Spend.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open: the accounting improvement remains absent from main and v0.56.8, and no blocking code finding remains. The unresolved owner decision about displaying Grok dollars to existing users still prevents landing.

Priority: P2
Reviewed head: c35734ad5a747a83c46b3844c8ce33fd46dbefe1
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Strong production-path evidence and focused compatibility coverage support a good patch; the owner decision is separate from implementation quality.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): Pinned terminal evidence exercises the Grok scanner on real local logs through menu/dashboard models and imports producer-written OAuth/API-key attempts through the production disk loader and persisted cache. Observations establish corrected totals, retained provenance, and exclusion of API-key usage; they do not claim live vendor billing or execution of the later producer carry.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): Pinned terminal evidence exercises the Grok scanner on real local logs through menu/dashboard models and imports producer-written OAuth/API-key attempts through the production disk loader and persisted cache. Observations establish corrected totals, retained provenance, and exclusion of API-key usage; they do not claim live vendor billing or execution of the later producer carry.
Evidence reviewed	11 items	Repository policy and ownership: Read the full root AGENTS.md; no nested AGENTS.md or maintainer-notes directory exists. Applied provider isolation, bounded scanning, and safe validation guidance. The origin remote identifies steipete/CodexBar. No builds, tests, or target scripts were executed; final git status was clean. Still necessary on current main: Current main still sums contextTokensUsed and totalTokensBeforeCompaction from signals.json and publishes nil local costs. This does not implement completed-turn accounting or recorded spend. Latest release comparison: The v0.56.8 scanner likewise reads context snapshots and reports no local dollars. The scanner and OpenCodex fan-out have no differences between that release and fetched main.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar combines local usage logs with provider snapshots to populate its menu and spend dashboard. This change updates Grok accounting and filters optional OpenCodex imports using each recorded attempt’s credential provenance.

flowchart TD
  A[Grok CLI session logs] --> B[Bounded completed-turn scan]
  B --> C[Recorded spend or price estimate]
  D[Optional OpenCodex logs] --> E[Reported Grok OAuth attempts]
  E --> F[Windowed spend dashboard]
  C --> F
  C --> G[Grok menu]

Loading

Decision needed

Question	Recommendation
Should existing Grok users with cost tracking enabled receive CLI-recorded dollars with disclosed list-price fallback?	Approve the disclosed dollar display: Accept recorded-first accounting under the existing cost-tracking setting and explicitly reconsider the earlier changes-requested review.

Why: The independent accounting evidence supports the implementation, but it cannot settle the requested reconsideration of the earlier display-policy ruling.

Before merge

• Resolve merge risk (P2) - Existing Grok users who enabled cost tracking would begin seeing dollar figures after upgrade; acceptance of recorded-first spend with estimated fallback remains an explicit owner choice.
• Resolve merge risk (P1) - The later OpenCodex carry could not be independently retrieved in this review environment; the supplied immutable-source audit supports it, while executable coverage remains limited to the documented producer revision.
• Complete next step (P2) - Have steipete decide the Grok dollar-display default and explicitly reconsider the earlier changes-requested review.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +1,505 net lines; tests +2,959 net lines	Production growth is explained by bounded log parsing, accounting, provenance, and publication handling, with substantial regression coverage.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3345
Summary: This PR is a candidate implementation for the independently documented Grok accounting problem; the related issue remains open pending implementation and the display decision.

Members:

• canonical: Grok local scan: signals.json undercounts by 54.5x, and costUsdTicks is a usable real-spend source (divisor verified as 1e10) #3345 - It corroborates the same context-occupancy undercount and supplies independent evidence for recorded-cost conversion.
• adjacent_distinct: Keep Grok session scans off the menu thread #3198 - The merged menu-thread isolation work supplies existing infrastructure but does not implement completed-turn accounting.
• adjacent_distinct: Price OpenCodex usage once per entry and stop per-entry catalog/overlay reloads #3136 - The merged OpenCodex pricing optimization does not supply Grok attempt attribution or native recorded spend.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

1. Approve the existing-setting behavior (recommended)
   Explicitly accept the new dollar surface for users who already enabled cost tracking, retaining the recorded-versus-estimated disclosure.
2. Preserve token-only upgrades
   Require a separate Grok dollar opt-in with fresh-install and existing-setting coverage before landing.

Technical review

Best possible solution:

Keep completed-turn accounting and clear cost-source disclosures, with the owner explicitly approving the dollar-display behavior for existing users.

Do we have a high-confidence way to reproduce the issue?

Yes for the token-accounting defect: current main reads context occupancy instead of completed-turn consumption, corroborated by two independent corpora. This read-only review did not execute a reproduction.

Is this the best way to solve the issue?

Yes for accounting: bounded completed-turn scans, recorded-cost precedence, and attempt-specific import are coherent repairs. Whether dollars should appear under existing settings remains a product decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 9810f24b0609.

Labels

Label justifications:

• P2: This is a useful, bounded provider-accounting improvement with no demonstrated emergency impact.
• merge-risk: 🚨 compatibility: The existing cost-tracking preference would expose new Grok dollar figures on upgrade before the owner has approved that behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): Pinned terminal evidence exercises the Grok scanner on real local logs through menu/dashboard models and imports producer-written OAuth/API-key attempts through the production disk loader and persisted cache. Observations establish corrected totals, retained provenance, and exclusion of API-key usage; they do not claim live vendor billing or execution of the later producer carry.
• proof: sufficient: Contributor real behavior proof is sufficient. Pinned terminal evidence exercises the Grok scanner on real local logs through menu/dashboard models and imports producer-written OAuth/API-key attempts through the production disk loader and persisted cache. Observations establish corrected totals, retained provenance, and exclusion of API-key usage; they do not claim live vendor billing or execution of the later producer carry.

Evidence

What I checked:

• Repository policy and ownership: Read the full root AGENTS.md; no nested AGENTS.md or maintainer-notes directory exists. Applied provider isolation, bounded scanning, and safe validation guidance. The origin remote identifies steipete/CodexBar. No builds, tests, or target scripts were executed; final git status was clean. (AGENTS.md:1, c35734ad5a74)
• Still necessary on current main: Current main still sums contextTokensUsed and totalTokensBeforeCompaction from signals.json and publishes nil local costs. This does not implement completed-turn accounting or recorded spend. (Sources/CodexBarCore/Providers/Grok/GrokLocalSessionScanner.swift:137, 9810f24b0609)
• Latest release comparison: The v0.56.8 scanner likewise reads context snapshots and reports no local dollars. The scanner and OpenCodex fan-out have no differences between that release and fetched main. (Sources/CodexBarCore/Providers/Grok/GrokLocalSessionScanner.swift:50, 6ef82690b4a7)
• Accounting and prior findings: Reviewed recorded-turn reconciliation, bounded JSONL ingestion, cancellation propagation, first-catalog refresh, fallback republication, and source-aware window narrowing. The earlier repeated-failure and missing-pricing findings are addressed, with focused regressions. (Sources/CodexBarCore/Providers/Grok/GrokLocalSessionScanner.swift:1006, c35734ad5a74)
• Proof continuity: The native Grok provider sources, OpenCodex consumer sources, token publication implementation, and window-proof test are unchanged from the recorded proof revision. The captured PR body reports a real local corpus with 98,631,812 tokens and $12.94957366 over 30 days, retaining recorded provenance. Additional presentation/pricing history comparisons encountered unavailable historical blobs; this does not invalidate the inspected proof. (Tests/CodexBarTests/GrokWindowProvenanceProofTests.swift:74, c35734ad5a74)
• Production import and cache evidence: The evidence report records two producer HTTP requests and import of the exact resulting ledger through the production dashboard disk loader: five OAuth tokens included, API-key traffic excluded, and zero log bytes read on cache reopen. The inspected tests also cover schema-v2 rebuild, incremental append, malformed attempts, duplicate suppression, and the existing opt-in switch. (docs/evidence/grok-opencodex-producer-2026-09-05.md:30, c35734ad5a74)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• olddonkey: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (54 earlier review cycles; latest 8 shown)

• reviewed 2026-09-06T18:36:11.840Z sha c3919a2 :: blocked before merge. :: none
• reviewed 2026-09-06T20:30:06.415Z sha 0874450 :: blocked before merge. :: none
• reviewed 2026-09-06T21:21:40.103Z sha 6f4a7d1 :: blocked before merge. :: none
• reviewed 2026-09-06T21:33:40.105Z sha 6f4a7d1 :: blocked before merge. :: none
• reviewed 2026-09-06T21:57:12.639Z sha 6f4a7d1 :: blocked before merge. :: none
• reviewed 2026-09-08T00:51:48.532Z sha c35734a :: blocked before merge. :: none
• reviewed 2026-09-08T01:02:38.334Z sha c35734a :: blocked before merge. :: none
• reviewed 2026-09-08T01:07:50.811Z sha c35734a :: blocked before merge. :: none

[olddonkey]

Both automated findings are addressed, plus the review's other checklist items. The inline comments were left against 09cf7edb0, which no longer exists — the branch has since been rebased onto 27c7f334e and the head is now 03e5a25dc, so I'm summarising here rather than replying in a stale diff.

P1 — Preserve the Grok fallback on repeated probe failures

Fixed in 923193ec0, Sources/CodexBar/UsageStore+Refresh.swift. The guard had been hoisted into the if provider == .grok, publication == nil condition, so a Grok failure with a publication fell through to the generic else if tokenCostRequiresProviderSnapshot { clearTokenSnapshot } branch. Grok now owns its branch outright and can never reach the clear:

if provider == .grok {
    if self.tokenSnapshotPublicationForCurrentProviderConfig(for: provider) == nil {
        Task { @MainActor [weak self] in
            await self?.scanAndPublishGrokLocalTokenSnapshot(...)
        }
    }
} else if Self.tokenCostRequiresProviderSnapshot(provider) {
    self.clearTokenSnapshot(for: provider)
}

Regression coverage is in missing remote snapshot scans and publishes local tokens then clears empty data. Per the review's request it now drives two consecutive failing refreshes (03e5a25dc) rather than one — which matters here, because the first failure is what publishes through the fallback scan and only the second arrives with a publication in place, i.e. the failure that used to wipe the row. Both iterations assert the row still reads 77 tokens and that no redundant rescan ran.

P2 — Refresh pricing before scanning Grok sessions

Correct, and thank you — this was a genuine gap and not one the local tests would have surfaced. refreshPricingIfAllowed is gated to Codex and Claude, and Grok never reaches it at all because its snapshot comes from the provider probe rather than CostUsageFetcher.loadTokenSnapshot. On a machine with Codex or Claude also enabled the shared cache is already populated, so the failure is invisible there; enable only Grok and the catalog never appears and the Cost row shows tokens with no money, permanently.

Fixed in 744677e68. The Grok scan paths now request ModelsDevPricingPipeline.refreshIfNeeded through a summarizeRequestingPricingRefresh wrapper, called from all four scan sites (GrokStatusProbe, both branches in GrokProviderDescriptor, and UsageStore.scanAndPublishGrokLocalTokenSnapshot). It is detached rather than awaited, matching how the Codex and Claude paths already treat it — pricing availability must not delay or fail a local scan — and it is safe to call repeatedly, since it returns immediately unless the cache is stale and serialises through its own coordinator. summarize itself stays synchronous and side-effect free.

Note the inline comment still points at GrokLocalSessionScanner.swift:662; that line is the unchanged pricing lookup, and the fix is upstream of it in the new wrapper, so the anchor looks live even though it is addressed.

Coverage: absent models dev cache requests a background refresh, stale models dev cache requests a background refresh, and fresh models dev cache skips the background refresh. All three assert whether a refresh was requested through an injected transport — no test touches the network.

Real-session evidence

CODEXBAR_LIVE_GROK_CATALOG_PROOF=1 swift test --filter GrokXAISpendCatalogTests, against real local Grok CLI sessions, through the shipped code path:

catalog_source=grok
today_tokens=5043749
last_30_days_tokens=52696354
today_cost_usd=3.3471699999999993
window_cost_usd=49.353424
cost_provenance=listPriceEstimate
history_days=365
priced_days=4
token_days=4
daily_buckets=4
available_sources=grok

The same corpus on main reports 653K tokens and no cost. history_days=365 shows the requested window is honoured (it was pinned to 30). priced_days == token_days shows no day was silently left unpriced. The gated proof was extended in e3cd3b9ce to print cost, provenance and priced-day coverage, since tokens alone cannot evidence the half of this change that is about money.

Those figures were cross-checked against an independent reimplementation of the pricing formula over the same logs; the two agree to the cent.

Merge risk / branch state

Rebased onto current main (27c7f334e); the branch reports clean. Full suite on the head: 77/77 groups, 922 selections, 0 failures. swiftformat --lint and swiftlint --strict clean. Upstream CI green on the previous head including all three Linux builds.

One thing deliberately left undone: no CHANGELOG.md entry. 0.54.1 was finalized and there is no open Unreleased section, so I did not invent a version heading — happy to add one wherever you prefer.

[olddonkey]

Both new findings addressed at 44d79a95a.

P1 — Do not map every xAI log record to the Grok subscription

Agreed, and taken as specified rather than argued down. Routing on the prefix alone is right for the case that motivated this — traffic authenticated with the user's Grok account, which is what makes it consume SuperGrok quota — but it silently folds an API-key user's pay-as-you-go xAI spend into the subscription row. CodexBar already models the developer platform as its own xai provider precisely to keep those apart, so the old behaviour crossed a boundary the app deliberately maintains.

The usage log carries no per-record credential evidence; I checked every field emitted for xai rows (requestId, timestamp, provider, model, requestedModel, resolvedModel, usage, usageStatus, status, routeDecision, …) and there is nothing about auth, account or key. The signal that does exist is ~/.opencodex/config.json, which records authMode per provider.

So attribution now requires positive OAuth evidence:

• xai routes to .subscription(.grok) only when its configured authMode is OAuth. Anything else returns .tokenOnly — the spend is real, it just belongs to no tracked subscription — rather than .unknown, which would read as "unrecognised provider".
• Fail closed. A missing or malformed config, a providers block without xai, or an entry without authMode all count as no evidence and keep the records off the Grok row.
• OpenCodexRouteDispatcher stays a pure function. The set of OAuth-backed provider ids is threaded in from the caller (OpenCodexUsageFanOut → SpendDashboardSource), so the routing site never touches the filesystem and every existing caller and test that does not care about auth keeps working.
• The gate applies only to xai. openai, kimi-coding, deepseek and opencode-go are untouched — changing them would be an unreviewed behaviour change for other providers — and a test pins that they ignore xAI auth state entirely.

Coverage: xai OAuth config routes to Grok, xai non OAuth config stays token only (parameterised over several non-OAuth values), xai routing fails closed without readable complete OAuth config, non xai subscription routes ignore xai auth state, plus fan-out cases proving the same entries land on the Grok row under an OAuth config and are absent under an API-key one. No test reads the developer's real ~/.opencodex; the home directory is injected.

docs/grok.md no longer claims this path cannot distinguish OAuth from API-key traffic, because it now can.

P2 — Republish the Grok snapshot after a missing catalog refreshes

I looked at this closely and am deliberately not adding a republish path. Reasoning, so you can overrule it if you disagree:

The refresh is fire-and-forget, so the scan that requests it returns whatever the cache currently holds — that part is accurate. But the parse cache stores parsed turns, not prices, so aggregation and pricing re-run on every summarize. The next Grok scan therefore prices against the refreshed catalog with no extra machinery, bounding the unpriced window to a single refresh cycle. That is the same behaviour Codex and Claude already have: refreshPricingIfAllowed dispatches into Task.detached and their current scan does not wait for it either.

The alternative — plumbing a completion signal back across the actor boundary into the @MainActor publication path — buys one refresh cycle of latency on first run, at the cost of a new cross-actor completion path in code that publishes user-visible spend. That trade looked disproportionate, and inconsistent with how the two established providers behave. I have recorded the reasoning as a comment at the call site rather than leaving it implicit, so the next reader does not have to re-derive it.

Happy to build it if you would rather have it.

Evidence

The attribution itself only becomes visible in the app: SpendDashboardSource.mergingOpenCodexInputs is what merges the fan-out into provider rows, and the CLI's cost command reports OpenCodex as its own source rather than routing it, so terminal output cannot show this path. The figures below are read off the freshly packaged build running against real local data, on a machine whose ~/.opencodex/config.json has "xai": { "authMode": "oauth" }; screenshots of both panes follow.

The two halves stay distinguishable in the UI, which makes the attribution legible rather than something you have to take on trust: the CLI goes through the responses API so its SKU is grok-4.6-build, while OpenCodex's records resolve to the bare grok-4.6 / grok-4.5 / grok-4.3. Both sit under the Grok provider.

model row	source	shown
grok-4.6-build	Grok CLI session logs	$50.52 · 54M
grok-4.6	OpenCodex	$161.21 · 182M
grok-4.5	OpenCodex	$4.54 · 5.5M
grok-4.3	OpenCodex	$0.50 · 201K

Independently recomputing the same corpus agrees to the cent on both halves: 54,121,501 tokens / $50.52 for the CLI logs, and $166.25 across 1,520 OpenCodex xai records. The CLI half is reproducible by anyone on their own machine through the gated proof test (CODEXBAR_LIVE_GROK_CATALOG_PROOF=1), whose output is in the PR body.

The negative direction — API-key traffic staying off the Grok row — is covered by tests rather than a screenshot, since demonstrating it live would mean rewriting the machine's OpenCodex config.

State

Full suite on 44d79a95a: 77/77 groups, 922 selections, 0 failures. swiftformat --lint and swiftlint --strict clean. Rebased on 27c7f334e.

[olddonkey]

Addressed both current findings in 211e1977d and resolved the two review threads.

• P1 / historical xAI attribution: removed current-config-based xAI → Grok routing. usage.jsonl has no request-time credential provenance, so xAI records now remain token-only until the producer can persist that evidence. Removed the config reader/plumbing and added dispatcher/fan-out regressions.
• P2 / first pricing publication: when no models.dev artifact exists, the first Grok scan now awaits the initial best-effort refresh attempt before summarizing. A successful refresh prices the first returned snapshot; stale catalogs still price immediately and refresh in the background. Added a regression that writes the catalog during refresh and asserts the first summary is priced.
• Updated the PR title/body and docs/grok.md so they no longer claim OpenCodex xAI traffic is merged into the Grok subscription row.

Validation on the exact pushed head:

• focused Grok/OpenCodex suites: 32 tests passed
• make check: passed
• make test: 922 selections, 77/77 groups, 0 failed groups, 0 retries
• branch is based on current main (27c7f334e) and the merge-tree is clean

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[olddonkey]

Rebased onto current main 4d27bb113e5e4899b1d481a1c989adc03c63bcdf and pushed 9aba5e0d62b0168c611e14515a9b22e16442a6db.

The existing opt-in OpenCodex import now accepts only reported physical Grok OAuth attempts with request-time provenance from OpenCodex #3642. It excludes API-key/historic/unknown records, avoids combo-parent and duplicate counting, preserves provenance through the derived cache, and keeps OpenCodex list-price estimates distinct from native CLI-recorded spend. The menu remains backed by native CLI logs.

Validation on this head:

• make check: zero violations in 2,131 files.
• make test: 1,024 selections; 86/86 groups passed first try; zero failures, retries, or timeouts.
• Focused OpenCodex and architecture tests: 102 passed.
• Native and OpenCodex provenance tests plus the local-corpus proof: 112 passed in ten suites. The redacted real-log result retains vendor-metered provenance for the populated 7- and 30-day windows; controlled mixed-source fixtures retain the correct source after date filtering.

The PR description contains the exact commands and evidence. The default Grok dollar surface remains an owner/product decision before merge.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[olddonkey]

Addressed both custom-pricing findings on 81f1e2e0917425992c356e4a0413d390f6020a8a.

• Resolve the application overlay against the original model before provider-qualified catalog lookup. Bare-key precedence, explicit zero prices, missing-rate behavior, and cached-input accounting are preserved. Caller-provided custom pricing retains its previous precedence.
• Preserve explicit xAI custom estimates in the standalone disk/cache report through both override paths. Unconfigured raw xAI rows stay token-only. The physical-attempt fan-out still rejects API-key and historic records for the Grok subscription.

The new regression suite reproduced both findings before the repair. Validation on the final tree: make check passed with zero violations in 2,132 files; make test passed all 1,025 selections / 86 groups on the first pass, with zero failures, retries, or timeouts; the serial Grok/provenance/custom-pricing/producer-import proof passed 124 tests in 12 suites. The production-ledger import still reports five OAuth tokens and zero API-key subscription rows, with a zero-byte cache reopen. Actual native-log totals and recorded-cost provenance remain unchanged.

The PR body now contains the final-head validation and the explicit standalone-price contract. The Grok dollar-display decision remains with the maintainer. Please review this final description and head.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[olddonkey]

Synced #3135 with main 0be7714904c311b6349a250407ad88f0ba73c524 in final head c3919a224eeb50298728921290efa784ba987b21.

The generated parser-hash conflict is resolved by regeneration from the merged source (1a4afd74939160fd). Main's atomic catalog replacement does not change native parsed rows or checkpoints, so the released-main hash 9547dc9d7b7675f6 and prior-PR hash 0bd6588c70196700 are retained as compatible predecessors. The actual SQLite adoption tests verify that both preserve stored state without rebuilding. Existing predecessors remain intact.

Main's Linux cache fixes, stacked-chart rendering, provider/widget changes, and release metadata are preserved. The two Grok changelog entries now live under 0.56.8 Unreleased; published release sections match main. The evidence report also records that the producer contract landed through the attributed OpenCodex #3762 carry; its original captured bytes remain pinned and are not represented as a new capture of that carry.

Validation on this final head:

• make check: zero violations in 2,137 files.
• make test: 1,031 selections, 86/86 groups passed on the first attempt; zero failures, retries, or timeouts.
• Focused cache adoption, OpenCodex, architecture, and chart tests: 136 passed.
• Serial native Grok/producer import/pricing/cache adoption proof: 206 tests in 14 suites passed. Native recorded-cost totals remain unchanged; the producer fixture still contributes five OAuth tokens, excludes API-key subscription rows, and reopens its cache without reading log bytes.

The PR description now contains the final source, commands, and evidence. The default Grok dollar display remains an owner decision. Please review the final head and description.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[olddonkey]

Updated to 08744509f9691781b67ee47b242cb57df065012f on current main 7353c717502de72ed10dd1507a3f91d5e9ccb716. The only merge conflict was in CHANGELOG.md; both Grok entries and the new upstream Poe fix are retained.

Current-head validation: make check passed with zero SwiftLint violations; make test passed all 1,031 selections in 86 groups on the first attempt, with zero failures, retries, or timeouts. Grok accounting and OpenCodex import source is unchanged. The PR body distinguishes the current full-suite validation from the earlier supplemental proof.

The default Grok dollar display remains an owner decision, and the prior maintainer change-request review still needs reconsideration.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[olddonkey]

@steipete The latest ClawSweeper review of 08744509f reports no actionable findings, and local make check plus all 1,031 test selections passed. Could you confirm whether recorded-first Grok costs with disclosed list-price fallback should be shown to existing users who already enabled cost tracking, and revisit the earlier changes-requested review? The current PR body records the accounting evidence and leaves this display policy decision with you. Cross-platform CI is still running.

[olddonkey]

Updated to 6f4a7d1058de2180f1f293824074cbbcd15ec5cc after main advanced to 31131374b. The latest integration preserves the upstream Claude warning-state and MiMo fixes. The sole conflict was the architecture gate's source locations and Grok bridge record; the merged gate retains the existing Grok reference fingerprints and correct source lines.

make check passed with zero violations in 2,138 files; 46 focused architecture/Claude/Grok/dashboard tests passed. The required full suite and new CI run are in progress. The previous head passed the full local suite, all nine CI checks, and an exact-head review with no actionable findings. The Grok display-policy decision still belongs to the owner.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[olddonkey]

Final validation for 6f4a7d1058de2180f1f293824074cbbcd15ec5cc:

• All nine GitHub CI checks passed: https://github.com/steipete/CodexBar/actions/runs/34060587552
• Local make check passed with zero violations in 2,138 files.
• Local make test passed all 1,032 selections in 86 groups on the first attempt, with no failures, retries, or timeouts.
• The 46 focused architecture, Claude credential-warning, Grok fallback, and dashboard checks passed.
• ClawSweeper reviewed this exact head and reports no actionable findings; there are no unresolved inline review threads.

The PR body is updated with the current source and validation. The default Grok dollar-display policy and the earlier maintainer changes-requested review still require the owner's decision.

[olddonkey]

Synced with main 912eac223 and pushed c35734ad5a747a83c46b3844c8ce33fd46dbefe1. The merge preserves the upstream shared report/pricing optimizations and the Grok/OpenCodex accounting behavior.

The parser hash is regenerated as c3a879df4eff7187; SQLite adoption coverage includes the current-main, prior-PR, and intermediate upstream hashes without rebuilding. Existing compatible predecessors remain. The model-target mapping moved unchanged into the existing resolver extension to keep the pricing type within the repository limit; the architecture gate retains its exact reference fingerprints at the new source locations. Grok notes now live under 0.56.9 Unreleased, with published sections matching main.

make check passed with zero violations in 2,143 files. Cache/pricing/provenance regressions and all 41 architecture tests passed. The required full suite and current-head CI are running. The PR body distinguishes current validation from the earlier pinned supplemental proof. The default dollar-display policy remains an owner decision.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/34175148373
• Updated: 2026-09-08T01:00:04.650Z

[olddonkey]

I retrieved the landed OpenCodex carry directly through the GitHub API to clarify the dependency-inspection limitation in the latest review.

#3762 is merged, with immutable merge commit f00f2bcaea251ebe7ad4de9e38337b4be0ccee47. I inspected that commit's source, not a floating branch:

• The attempt schema and persistence normalizer retain only grok-oauth or xai-api-key on provider === "xai" attempts. Historic/unknown attribution remains absent.
• The stamping helper clears prior attribution before evaluating the resolved adapter, auth mode and exact destination. Responses stamps it after adapter selection; native Chat stamps from the active provider each time it builds the request.
• The carry's regression source asserts the same documented fixture contract: OAuth replay produces two sends and five tokens, native Chat API-key traffic produces one send and five tokens, and key-pool rotation retains API-key attribution.

For content identity, the inspected schema/persistence blob is 257cb86d3ef8419bc2fbb8ad1a4afa765742f1b0, and the stamping-helper blob is a4c942bd883bb81f3cd08e392c6afe2cc8c8d3ec.

This verifies the landed source contract. The executable capture remains pinned to 146ed679, as the evidence report explicitly states; I am not claiming a new capture of the carry, released-version coverage, or live vendor billing evidence. Please distinguish the review environment's failed dependency-page retrieval from a demonstrated compatibility defect. The owner display-policy decision remains open.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: A newer review tuple already exists; this stale result was superseded.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/34176674440
• Updated: 2026-09-08T01:27:12.862Z

[olddonkey]

Final validation for c35734ad5a747a83c46b3844c8ce33fd46dbefe1:

• All nine GitHub CI checks passed, including both macOS shards and all Linux builds.
• Local make check passed with zero violations in 2,143 files.
• Local make test passed all 1,036 selections in 87 groups on the first attempt, with zero failures, retries, or timeouts.
• Cache-adoption, pricing/provenance regressions and the 41-test architecture gate passed. The generated parser hash is c3a879df4eff7187, with current-main and previous-PR cache compatibility retained.
• GitHub reports this head mergeable/clean; there are no unresolved inline threads. The latest ClawSweeper review reports no actionable code findings.

The PR body now has the final validation results and the immutable landed-producer source audit. The owner display-policy decision and older changes-requested review remain unresolved. The review environment's inability to retrieve the later producer carry is also recorded; the supplied source audit does not expand the pinned executable capture into a claim about a released producer version.