same shape, nulls included.

- The thread page shows the word `Unpriced` rather than a dollar figure, and

  labels a provisional figure as a working number rather than a bill.

- `/models` renders that same catalog for a person, because the contract asks

  that pricing be readable by the CLI **and** by the web before spend. An

  unpriced lane's rate cells carry the word rather than `$0.00`, every lane

  shows its basis and the id of the table it is priced against, and a

  deployment where no lane is `declared` says at the top that nothing on it is

  billable — derived from the catalog, so it cannot outlive the fact.

- `OpenAgents.Inference.Credit.spent/1` is a floor, not a total, while

  `unpriced_calls/1` is above zero; `balance/1` publishes `complete?` so no

  reader shows a balance as whole when it is not.

Evidence: `OpenAgents.Inference.Pricing`, `OpenAgents.Inference.PricingTest`,

`OpenAgents.Inference.CreditTest`, `OpenAgents.ThreadsTest`,

`OpenAgentsWeb.ModelCatalogControllerTest`,

`OpenAgentsWeb.ThreadControllerTest`, and `OpenAgentsWeb.ThreadShowLiveTest`.

`OpenAgentsWeb.ThreadControllerTest`, `OpenAgentsWeb.ThreadShowLiveTest`, and

`OpenAgentsWeb.ModelCatalogLiveTest`.

## Durable effects

| PROVENANCE-001 | `test/openagents/turn_provenance_test.exs` |

| PROVIDER-001 | `test/openagents/providers/provider_contract_test.exs`, `test/openagents/turn_provider_events_test.exs`, `test/openagents/dependency_boundary_test.exs` |

| PROVIDER-002 | `test/openagents/inference/models_test.exs`, `test/openagents_web/controllers/model_catalog_controller_test.exs`, `test/openagents_web/controllers/inference_proxy_controller_test.exs`, `test/openagents_web/controllers/thread_controller_test.exs` |

| METER-001 | `test/openagents/inference/pricing_test.exs`, `test/openagents/inference/credit_test.exs`, `test/openagents/threads_test.exs`, `test/openagents_web/controllers/model_catalog_controller_test.exs`, `test/openagents_web/controllers/thread_controller_test.exs`, `test/openagents_web/live/thread_show_live_test.exs` |

| METER-001 | `test/openagents/inference/pricing_test.exs`, `test/openagents/inference/credit_test.exs`, `test/openagents/threads_test.exs`, `test/openagents_web/controllers/model_catalog_controller_test.exs`, `test/openagents_web/controllers/thread_controller_test.exs`, `test/openagents_web/live/thread_show_live_test.exs`, `test/openagents_web/live/model_catalog_live_test.exs` |

| EFFECT-001 | `test/openagents/effects_test.exs`, `test/openagents/effects/work_launch_test.exs` |

| EFFECT-002 | `test/openagents/effects_test.exs`, `test/openagents/effects/work_launch_test.exs` |

| TOOL-001 | `test/openagents/tools/registry_and_runner_test.exs` |

        }

      ]

    },

    %{

      title: "Inference",

      items: [

        %{

          slug: "models",

          title: "Models and pricing",

          icon: "dollar-circle",

          route: "/models"

        }

      ]

    },

    %{

      title: "Transparency",

      items: [

defmodule OpenAgentsWeb.ModelCatalogLive do

  @moduledoc """

  `/models`: what each lane costs, and whether the figure can be trusted,

  before anything spends against it (#200, METER-001).

  The contract asks that per-model pricing be readable by the CLI **and** by

  the web before any spend. `GET /api/v1/models` answered the first half; a

  person could not read it. This page is that endpoint's other reader: it

  renders `OpenAgents.Inference.Models.catalog/0` directly, so the page and the

  endpoint cannot come to disagree about what this deployment serves or what it

  charges.

  Same principal as the endpoint, deliberately. `GET /api/v1/models` sits in

  the thread scope because the catalog names what a grant can be minted for, so

  the caller who can open a thread is the caller who reads it — and the reader

  of this page is the person who can open one. "Before spend" still holds:

  spending here requires an account.

  Two rules govern every cell. A lane with no declared rates shows the word

  `Unpriced`, never `$0.00` — the deployment not knowing what a call cost is a

  different fact from the call having cost nothing. And a rate this deployment

  wrote to make itself run is labelled `provisional`, so nobody reads a working

  figure as a price. Today that is every rate in the catalog, and the page says

  so at the top rather than leaving a reader to infer it column by column.

  Availability is `Models.availability/1`, the same word the endpoint

  publishes, refreshed on a slow tick: a page about what a lane costs that

  showed a dead lane as available would be lying about the more urgent half.

  """

  use OpenAgentsWeb, :live_view

  alias OpenAgents.Inference.Models

  @tick_ms 15_000

  @impl true

  def mount(_params, _session, socket) do

    if connected?(socket), do: Process.send_after(self(), :tick, @tick_ms)

    {:ok,

     socket

     |> assign(:page_title, "Models · OpenAgents")

     |> assign_catalog()}

  end

  @impl true

  def handle_info(:tick, socket) do

    Process.send_after(self(), :tick, @tick_ms)

    {:noreply, assign_catalog(socket)}

  end

  defp assign_catalog(socket) do

    models = Models.catalog()

    socket

    |> assign(:models, models)

    |> assign(:default_id, Models.default_id())

    |> assign(:billable?, Enum.any?(models, &(&1["pricing_basis"] == "declared")))

  end

  @impl true

  def render(assigns) do

    ~H"""

    <Layouts.app

      flash={@flash}

      sidebar_sections={assigns[:sidebar_sections]}

      current_scope={@current_scope}

    >

      <main id="model-catalog" class="mx-auto w-full max-w-5xl space-y-6 px-4 py-10">

        <.header>

          Models

          <:subtitle>

            Every model this deployment serves, what each lane charges, and on whose

            authority. The same catalog

            <.kbd>GET /api/v1/models</.kbd>

            publishes.

          </:subtitle>

        </.header>

        <.alert

          :if={!@billable?}

          id="model-catalog-not-billable"

          variant={:warning}

          label="Nothing here is billable"

        >

          No lane on this deployment carries rates read off a provider's price page, so

          every figure below is a working number and nothing bills from any of them.

          A lane marked <strong>Unpriced</strong>

          has no rates at all: its calls record no cost, and the sessions that touch it

          report no total rather than a zero.

        </.alert>

        <.table id="model-catalog-table" rows={@models} row_id={&"model-#{&1["id"]}"}>

          <:col :let={model} label="Model">

            <span class="font-mono text-xs">{model["id"]}</span>

            <.badge :if={model["id"] == @default_id} class="ml-2" variant={:dim}>default</.badge>

            <p class="mt-0.5 text-xs text-muted-foreground">{model["provider"]} lane</p>

          </:col>

          <:col :let={model} label="Availability">

            <.badge

              id={"model-availability-#{model["id"]}"}

              variant={availability_variant(model["availability"])}

            >

              {model["availability"]}

            </.badge>

          </:col>

          <:col :let={model} label="Input">

            <span

              id={"model-input-rate-#{model["id"]}"}

              class="tabular-nums"

            >{rate(model, "input_per_million_tokens")}</span>

          </:col>

          <:col :let={model} label="Cached input">

            <span class="tabular-nums">{cached_rate(model)}</span>

          </:col>

          <:col :let={model} label="Output">

            <span

              id={"model-output-rate-#{model["id"]}"}

              class="tabular-nums"

            >{rate(model, "output_per_million_tokens")}</span>

          </:col>

          <:col :let={model} label="Basis">

            <.badge

              id={"model-basis-#{model["id"]}"}

              variant={basis_variant(model["pricing_basis"])}

              data-basis={model["pricing_basis"]}

            >

              {model["pricing_basis"]}

            </.badge>

            <p

              id={"model-pricing-id-#{model["id"]}"}

              class="mt-0.5 font-mono text-xs text-muted-foreground"

            >

              {get_in(model, ["pricing", "id"]) || "unpriced"}

            </p>

          </:col>

          <:col :let={model} label="Context">

            <span class="tabular-nums">{tokens(model["context_window"])}</span>

            <p class="mt-0.5 text-xs text-muted-foreground">

              {tokens(model["max_output"])} out

            </p>

          </:col>

        </.table>

        <p class="text-xs text-muted-foreground">

          Rates are US dollars per million tokens. Cached reads are charged at the cached

          rate where a lane declares one and at the input rate where it does not, because

          a lane that has not said otherwise has not offered a discount.

        </p>

        <section id="model-catalog-bases" class="space-y-2">

          <h2 class="text-sm font-semibold">What the basis means</h2>

          <.list>

            <:item title="declared">

              The operator entered the provider's published rates. This is the only basis

              anything may bill from.

            </:item>

            <:item title="provisional">

              Rates this deployment wrote to make itself run, or rates whose table it can

              no longer resolve. A figure, not a bill.

            </:item>

            <:item title="unpriced">

              No rates. Calls on this lane record no cost, and every surface that reads

              them shows the word rather than a zero.

            </:item>

          </.list>

        </section>

      </main>

    </Layouts.app>

    """

  end

  defp availability_variant("available"), do: :success

  defp availability_variant("degraded"), do: :warning

  defp availability_variant(_unavailable), do: :danger

  defp basis_variant("declared"), do: :success

  defp basis_variant("provisional"), do: :warning

  defp basis_variant(_unpriced), do: :dim

  # A lane with no rates gets the word, never a figure. `$0.00` here would be

  # the most confident wrong number on the page.

  defp rate(%{"pricing" => %{} = pricing}, key), do: dollars(Map.get(pricing, key))

  defp rate(_model, _key), do: "Unpriced"

  # A priced lane that declares no cached rate is not offering free cache

  # reads: `Pricing.price/2` charges them at the input rate, so that is what

  # this cell says.

  defp cached_rate(%{"pricing" => %{} = pricing}) do

    case Map.fetch(pricing, "cached_input_per_million_tokens") do

      {:ok, value} -> dollars(value)

      :error -> "at input rate"

    end

  end

  defp cached_rate(_model), do: "Unpriced"

  defp dollars(nil), do: "Unpriced"

  defp dollars(microusd) when is_integer(microusd) do

    "$" <> :erlang.float_to_binary(microusd / 1_000_000, decimals: 2)

  end

  defp tokens(count) when is_integer(count) do

    count

    |> Integer.to_string()

    |> String.reverse()

    |> String.replace(~r/(\d{3})(?=\d)/, "\\1,")

    |> String.reverse()

  end

  defp tokens(_count), do: "—"

end

          >

            <div class="flex gap-1.5">

              <dt>Model</dt>

              <dd class="font-mono text-xs leading-5">{@thread.model}</dd>

              <%!-- To the catalog, where this lane's rates and the authority

              behind them are readable. The cost cell below says what this

              session spent; this says what a call on it costs. --%>

              <dd class="font-mono text-xs leading-5">

                <.link navigate={~p"/models"} id="thread-model-link" class="hover:underline">

                  {@thread.model}

                </.link>

              </dd>

            </div>

            <div class="flex gap-1.5">

              <dt>Reasoning</dt>

    # authenticated even where a thread's own tier widens who may read it

    # (THREAD-002): the wider audience is still signed in.

    "/threads",

    # The model catalog and its rates. Same principal as `GET /api/v1/models`,

    # which sits in the thread scope because the catalog names what a grant can

    # be minted for: the reader of the prices is the caller who can spend them.

    "/models",

    "/settings/api-tokens",

    "/github/connection",

    "/api/tokens",

  defp browser_scope("/github/connection"), do: "github-tools:self"

  defp browser_scope("/notifications"), do: "notification:self"

  defp browser_scope("/settings/api-tokens"), do: "api-token:self"

  defp browser_scope("/models"), do: "model-catalog:read"

  defp browser_scope(_path), do: "product:self"

  defp browser_mutation?(path, :get),

      live "/artifact-catalog", ArtifactCatalogLive, :index

      live "/notifications", NotificationsLive, :index

      live "/settings/api-tokens", ApiTokensLive, :index

      # What each lane costs, before a thread spends against it. Same principal

      # as `GET /api/v1/models`, which the page renders (METER-001).

      live "/models", ModelCatalogLive, :index

      live "/threads", ThreadIndexLive, :index

      live "/threads/:id", ThreadShowLive, :show

      live "/device", DeviceAuthorizationLive, :show

# Models and pricing

[The models page](/models) lists every model this deployment serves, what each

one charges per million tokens, and where those rates came from. Read it before

you open a thread: a thread pins one model for its whole life, and the grant

that pays for it meters against that model's rates.

The page renders the same catalog as `GET /api/v1/models`, so the CLI and the

web cannot disagree about what is served or what it costs.

## What each column tells you

- **Model** — the id you name when you open a thread, and the provider lane that

  serves it. The default is the model a thread pins when you name none.

- **Availability** — `available`, `degraded`, or `unavailable`. A lane whose

  credential is not configured is listed as `unavailable` rather than hidden, and

  selecting it is refused by name. No call is ever answered by a different model

  than the one you asked for.

- **Input**, **Cached input**, and **Output** — US dollars per million tokens.

  Where a lane declares no cached rate, cached reads are charged at the input

  rate.

- **Basis** — where the rates came from, and the id of the rate table a call is

  priced against.

- **Context** — the context window, and the maximum output tokens one call can

  produce.

## Reading the basis

A price on this page is only as good as its source, so every lane says what its

source was.

- `declared` — the operator entered the provider's published rates. This is the

  only basis anything may bill from.

- `provisional` — rates written to make the system run, or rates whose table this

  deployment can no longer resolve. A working figure, not a bill.

- `unpriced` — no rates at all. Calls on this lane record no cost.

An unpriced lane is not a free lane. It is the deployment saying it does not know

what a call cost, which is a different fact from the call having cost nothing. So

an unpriced lane shows the word `Unpriced` instead of `$0.00`, a thread that

touched one reports no total spend rather than a total that looks complete, and

the lanes that made the total unknowable are named beside it.

That distinction survives everywhere the number goes: the models page, the thread

page, `GET /api/v1/threads/{id}`, and your account balance, which publishes

whether it is complete.

## Ceilings

A grant carries call, token, and cost ceilings. A cost ceiling can only stop

spend it can measure, so a grant on an unpriced lane is bounded by its call and

token ceilings instead. The thread page shows both what a grant has spent and

what it may spend, and an unbounded ceiling reads as `∞` rather than as a blank.

## Reading the catalog from the CLI

The same list is available over the API:

```sh

openagents api models

```

Every entry carries `availability` and `pricing_basis`. An unpriced model

publishes no `pricing` block, so a client that checks for the key sees no price

rather than a zero.

defmodule OpenAgentsWeb.ModelCatalogLiveTest do

  @moduledoc """

  `/models`: the half of "pricing visible before spend" a person can read

  (#200, METER-001).

  The endpoint answered the CLI; nothing rendered the catalog for a human. What

  matters here is not that the page exists but that it carries the same absence

  the endpoint does: an unpriced lane shows the word rather than `$0.00`, and a

  deployment with no declared rates says so at the top instead of presenting a

  column of working figures as a price list.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Phoenix.LiveViewTest

  alias OpenAgents.Inference.Models

  defp signed_in(conn, user), do: Plug.Test.init_test_session(conn, %{"user_id" => user.id})

  defp reader(conn, handle), do: signed_in(conn, github_user(handle))

  defp unpriced_id, do: Application.fetch_env!(:openagents, :openai_model)

  test "every model this deployment serves has a row", %{conn: conn} do

    {:ok, view, _html} = live(reader(conn, "model-catalog-rows"), ~p"/models")

    assert has_element?(view, "#model-catalog-table")

    for id <- Models.ids() do

      assert has_element?(view, ~s([id="model-#{id}"])), "no row for #{id}"

    end

  end

  test "an unpriced lane shows the word, never a zero", %{conn: conn} do

    id = unpriced_id()

    {:ok, view, _html} = live(reader(conn, "model-catalog-unpriced"), ~p"/models")

    assert view |> element(~s([id="model-basis-#{id}"])) |> render() =~ "unpriced"

    assert view |> element(~s([id="model-input-rate-#{id}"])) |> render() =~ "Unpriced"

    assert view |> element(~s([id="model-output-rate-#{id}"])) |> render() =~ "Unpriced"

    refute view |> element(~s([id="model-input-rate-#{id}"])) |> render() =~ "$0.00"

    refute view |> element(~s([id="model-output-rate-#{id}"])) |> render() =~ "$0.00"

  end

  test "a lane with rates publishes them and names the table they came from", %{conn: conn} do

    {:ok, view, _html} = live(reader(conn, "model-catalog-priced"), ~p"/models")

    # 1_250_000 microUSD per million tokens is $1.25 per million tokens.

    assert view |> element(~s([id="model-input-rate-gemini-3.7-flash"])) |> render() =~ "$1.25"

    assert view |> element(~s([id="model-basis-gemini-3.7-flash"])) |> render() =~ "provisional"

    assert view |> element(~s([id="model-pricing-id-gemini-3.7-flash"])) |> render() =~

             "placeholder.gemini-3.7-flash.v1"

  end

  test "the page says nothing is billable while no lane declares its rates", %{conn: conn} do

    {:ok, view, _html} = live(reader(conn, "model-catalog-not-billable"), ~p"/models")

    assert has_element?(view, "#model-catalog-not-billable")

  end

  test "the billable notice is derived from the catalog, not written into the page",

       %{conn: conn} do

    previous = Application.fetch_env!(:openagents, :model_catalog)

    declared =

      List.update_at(previous, 0, fn entry ->

        Map.put(entry, :pricing, %{

          id: "declared.test.v1",

          source: :declared,

          input_per_million_tokens: 3_000_000,

          output_per_million_tokens: 15_000_000

        })

      end)

    Application.put_env(:openagents, :model_catalog, declared)

    on_exit(fn -> Application.put_env(:openagents, :model_catalog, previous) end)

    {:ok, view, _html} = live(reader(conn, "model-catalog-declared"), ~p"/models")

    refute has_element?(view, "#model-catalog-not-billable")

    assert view |> element(~s([id="model-basis-gemini-3.7-flash"])) |> render() =~ "declared"

    assert view |> element(~s([id="model-input-rate-gemini-3.7-flash"])) |> render() =~ "$3.00"

    # The lane with no rates is untouched by another lane becoming billable.

    assert view |> element(~s([id="model-input-rate-#{unpriced_id()}"])) |> render() =~ "Unpriced"

  end

  test "an anonymous visitor is sent to sign in", %{conn: conn} do

    assert {:error, {:redirect, %{to: path}}} = live(conn, ~p"/models")

    refute path == ~p"/models"

  end

end