Phase 5 prep: bound /api/triage spend by construction (PUBLIC_DEMO)

A public Space with a billed /api/triage is a potential spend faucet. Close it
structurally rather than with after-the-fact limits.

The endpoint already only triages the 18 fixed campaigns (it takes a
campaign_id, never free-form text — arbitrary input can't reach the model). The
one remaining leak was force=true re-running past the per-campaign cache.

- New PUBLIC_DEMO config flag (src/config.py). When on, /api/triage ignores
force (no cache bypass) and locks the provider to Anthropic (also neutralizes
the Ollama toggle, which can't run on a Space anyway).
- ENV PUBLIC_DEMO=1 baked into the Dockerfile, so the deployed image is locked
with no extra Space secret. Local dev (no flag) keeps force + provider toggle.
- Result: max spend = 18 Haiku triages per container restart, then cache hits.

Pairs with the operator-side backstop (a hard monthly cap on a dedicated key in
the Anthropic Console) — documented in STATUS as the first deploy step.

Tested: scripts.test_api 9/9 (new PUBLIC_DEMO-caps-spend case proves force +
ollama are both neutralized — served from cache, which a live call would not be).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -31,6 +31,9 @@ COPY --from=frontend /app/frontend/dist ./frontend/dist
 RUN chmod -R a+rwX /app/data
 
 ENV LLM_PROVIDER=anthropic
+# Public-demo spend cap: lock /api/triage to Anthropic + no cache-bypass so a public Space can't be
+# used as a billing faucet (max spend = the 18 fixed campaigns once each per restart). See api.py.
+ENV PUBLIC_DEMO=1
 EXPOSE 7860
 # Shell form so $PORT (if the platform injects one) is honoured; defaults to 7860.
 CMD uvicorn api:app --host 0.0.0.0 --port ${PORT:-7860}

STATUS.md

@@ -337,10 +337,24 @@ container will actually build, and hardening the one thing that has ever flaked.
   → *same* `all-MiniLM-L6-v2` download. A 429 during the HF Space build would fail the build the same
   way — it's a one-shot build, so **just rebuild the Space** if it hits a transient 429 (or build the
   image locally first, where the model layer caches). Not a code bug.
-
-**Remaining (needs Docker Desktop running / an HF account — user actions):** local `docker build` +
-`docker run` smoke; create the HF **Docker** Space; set `ANTHROPIC_API_KEY` + `LLM_PROVIDER=anthropic`
-as Space secrets; add the Space git remote and push. Recipe in `PLAN.md` §5b.
+- **Spend protection on the public endpoint** — a public Space with a billed `/api/triage` is a
+  potential spend faucet. Closed structurally: the endpoint **already only triages the 18 fixed
+  campaigns** (it takes a `campaign_id`, never free-form text — arbitrary input can't reach the
+  model). The one leak was `force=true` re-running past the cache. New **`PUBLIC_DEMO`** mode
+  (`src/config.py`; `ENV PUBLIC_DEMO=1` baked into the `Dockerfile`, so no Space secret needed):
+  `/api/triage` **ignores `force`** and **locks the provider to Anthropic** (also neutralizes the
+  Ollama toggle on the Space). Result: **max spend = 18 Haiku triages per container restart, then
+  cache hits** — bounded by construction. Local dev (no `PUBLIC_DEMO`) keeps `force` + the provider
+  toggle. Tested offline: `scripts.test_api` **9/9** (new `PUBLIC_DEMO caps spend` case).
+
+**Remaining (needs Docker Desktop running / an HF account — user actions):**
+- **Set a hard billing cap (do first — the backstop only you can set):** in the Anthropic Console,
+  create a **dedicated** API key for the Space and set a low monthly usage limit on it, so even a
+  total failure of every other layer is bounded. Use that key (not your dev key) so it's revocable.
+- Local `docker build -t amana .` + `docker run` smoke (the image bakes `PUBLIC_DEMO=1`).
+- Create the HF **Docker** Space; set `ANTHROPIC_API_KEY` (the dedicated key) + `LLM_PROVIDER=anthropic`
+  as Space secrets; add the Space git remote and push. Recipe in `PLAN.md` §5b.
+- *(optional)* make the Space private, or rely on the spend cap and keep it public for evaluators.
 
 ## AWAITING — user action
 - **Build/run the container** (start Docker Desktop): `docker build -t amana .` then

api.py

@@ -135,12 +135,21 @@ def get_campaign(cid: str) -> dict:
 @app.post("/api/triage")
 def run_triage(req: TriageRequest) -> dict:
     provider = req.provider.lower()
+    force = req.force
+    # Public-demo spend cap (PUBLIC_DEMO=1, set on the deployed Space): bound billing BY CONSTRUCTION.
+    # The endpoint already only triages the 18 fixed campaigns (arbitrary text can't reach the model),
+    # so the only spend faucet is force-rerunning the cache — disabled here — and a non-Anthropic
+    # provider (Ollama can't run on the Space anyway). With both shut, max spend is 18 calls/restart,
+    # then cache hits. Local dev (no PUBLIC_DEMO) keeps force + the provider toggle.
+    if CONFIG.public_demo:
+        provider = "anthropic"
+        force = False
     if provider not in _PROVIDERS:
         raise HTTPException(status_code=400, detail=f"provider must be one of {_PROVIDERS}")
     campaign = _campaign_or_404(req.campaign_id)
 
     cached = _triage_cache.get(req.campaign_id)
-    if cached and not req.force and cached["provider"] == provider:
+    if cached and not force and cached["provider"] == provider:
         gated = cached["gated"]
     else:
         from src.agent import triage, _resolve_model  # lazy: pulls in pydantic-ai

scripts/test_api.py

@@ -95,6 +95,22 @@ def t_triage_returns_enriched_rule_text():
     assert rv["rule_text"] and "interest" in rv["rule_text"].lower(), "PROH-3 rule text should be enriched in"
 
 
+def t_public_demo_caps_spend():
+    # With PUBLIC_DEMO on, the billed endpoint must neutralize the two spend faucets: force-rerun
+    # (cache bypass) and a non-Anthropic provider. A force+ollama request should therefore be served
+    # from the seeded cache — a live call would 502 here (no key), so a 200 proves both were ignored.
+    _seed_cache("camp-005")  # provider "anthropic"
+    object.__setattr__(api.CONFIG, "public_demo", True)
+    try:
+        r = client.post("/api/triage", json={"campaign_id": "camp-005", "provider": "ollama", "force": True})
+        assert r.status_code == 200, f"lockdown should serve cache, got {r.status_code}: {r.text}"
+        body = r.json()
+        assert body["provider"] == "anthropic", "lockdown forces the Anthropic provider"
+        assert body["decision"]["rule_violations"][0]["rule_id"] == "PROH-3", "served the cached decision"
+    finally:
+        object.__setattr__(api.CONFIG, "public_demo", False)
+
+
 def t_decision_agree_and_override_governance():
     _seed_cache("camp-005")
     # Agreeing with the AI (REJECT) needs no reason.
@@ -124,6 +140,7 @@ def main() -> int:
         ("GET /api/policy (5 sections, all rules)", t_policy_sections),
         ("POST /api/decisions 409 before triage", t_decision_requires_triage_first),
         ("POST /api/triage enriches rule text", t_triage_returns_enriched_rule_text),
+        ("POST /api/triage PUBLIC_DEMO caps spend", t_public_demo_caps_spend),
         ("POST /api/decisions override governance", t_decision_agree_and_override_governance),
         ("GET /api/decisions round-trip", t_decisions_log_roundtrip),
     ]:

src/config.py

@@ -46,5 +46,10 @@ class Config:
     policy_collection: str = os.getenv("POLICY_COLLECTION", "policy_rules")
     cases_collection: str = os.getenv("CASES_COLLECTION", "past_cases")
 
+    # Public-demo lockdown (set PUBLIC_DEMO=1 on the deployed Space). When on, the billed
+    # /api/triage endpoint refuses to bypass its per-campaign cache and serves Anthropic only, so
+    # total spend is bounded by construction to the 18 fixed campaigns once each (then cache hits).
+    public_demo: bool = os.getenv("PUBLIC_DEMO", "").strip().lower() in ("1", "true", "yes", "on")
+
 
 CONFIG = Config()