ualtinok · Oct 18, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,9 +13,13 @@ This repo is a CortexKit-maintained Anthropic auth monorepo for OpenCode and Pi.
 - When vault setup finds no Claude account it can use, it now says why from the vault's own listing (#354). With no read grant for the host, it prints the `ck auth grant` command that adds one. With a grant that reaches no Claude login, it suggests `ck auth reclassify --from-registry` and checking the logins with `ck auth status`. On older vaults that do not report grant reach, the previous message is unchanged.
 - When setup fails after vault enrollment began, it now prints one line per host: connected to the vault, not connected, or unknown (check with `ck auth status`). A host left connected also gets the Disconnect / run-setup-again remedy. Setup no longer rereads enrollment files for this, so a failure before enrollment began no longer reports a host connected by an earlier run.
 
+### Quota
+
+- Vault-mode quota now reads Claude's cached quota from insula, with Anthropic usage polls retained as a per-account fallback for stale or missing readings.
+
 ### Compatibility
 
-- Move to `@cortexkit/common-auth` 0.19.0 and `@cortexkit/claustrum-client` 0.10.0.
+- Move to `@cortexkit/common-auth` 0.19.1 and `@cortexkit/claustrum-client` 0.10.0.
 - Update the OpenCode plugin and SDK test dependencies together to 1.19.0. The plugin's peer range and the OpenCode 1.18.18 host used by the process E2E and packed TUI checks are unchanged.
 - Update the Pi SDK test dependencies (`pi-coding-agent`, `pi-ai`, `pi-agent-core`, `pi-tui`) together to 1.2.0. The Pi peer range is unchanged.
 

diff --git a/bun.lock b/bun.lock
diff --git a/mutations.toml b/mutations.toml
@@ -374,6 +374,7 @@ old = '''            const unavailable = await refreshFallbackQuotas(
               false,
               requiredByPolicy,
               options.modelId,
+              'admission',
             )'''
 new = '''            const unavailable = new Set<string>() // NON-VACUITY BREAK: choose a route without polling due fallbacks'''
 test_file = "packages/opencode/src/tests/quota-sweep.test.ts"
@@ -392,9 +393,14 @@ id = "fallback-quota-sweeps-do-not-overlap"
 guards = "A fallback quota sweep started while another sweep's poll is outstanding must read the pool after that reading is stored, not poll the same account again from an older snapshot."
 file = "packages/opencode/src/index.ts"
 old = '''    const operation = fallbackQuotaRefreshQueue.then(() =>
-      pollFallbackQuotas(force, requiredByPolicy, modelId),
+      pollFallbackQuotas(force, requiredByPolicy, modelId, purpose),
     )'''
-new = '''    const operation = pollFallbackQuotas(force, requiredByPolicy, modelId) // NON-VACUITY BREAK: start sweeps without waiting for the previous one'''
+new = '''    const operation = pollFallbackQuotas(
+      force,
+      requiredByPolicy,
+      modelId,
+      purpose,
+    ) // NON-VACUITY BREAK: start sweeps without waiting for the previous one'''
 test_file = "packages/opencode/src/tests/quota-sweep.test.ts"
 runner = "command"
 command = ["bun", "scripts/run-mutation-bun.ts", "packages/opencode/src/tests/quota-sweep.test.ts", "{test}"]
@@ -555,7 +561,13 @@ broad_id = "{name}"
 id = "pi-forwards-physical-quota-dispatch"
 guards = "Pi forwards each native usage GET through the shared quota dispatcher rather than bypassing physical-request spacing."
 file = "packages/pi/src/stream.ts"
-old = "fetchQuota(\n          id,\n          fetchPiOAuth,\n          undefined,\n          dispatch,\n        )"
+old = '''fetchQuota(
+          id,
+          fetchPiOAuth,
+          undefined,
+          dispatch,
+          request.purpose,
+        )'''
 new = "fetchQuota(id, fetchPiOAuth)"
 test_file = "packages/pi/src/tests/quota-dispatch.test.ts"
 runner = "command"
@@ -1061,6 +1073,21 @@ expect_message = "error: expect(received).toBeGreaterThanOrEqual(expected)"
 broad_command = ["bun", "scripts/run-mutation-bun.ts", "--broad", "packages/core", "tmp/mutations/core.xml"]
 broad_report = "tmp/mutations/core.xml"
 broad_id = "{name}"
+[[control]]
+id = "vault-insula-joins-vault-account-id"
+guards = "A background insula lookup must join on the roster row's vault account id (list_scoped account_id), never another row field such as the credential id."
+file = "packages/core/src/native-vault-runtime.ts"
+old = "swept = insulaReading(row.accountIdentity)"
+new = "swept = insulaReading(row.credentialId) // NON-VACUITY BREAK: join on the credential id"
+test_file = "packages/core/src/tests/native-vault-insula-quota.test.ts"
+runner = "command"
+command = ["bun", "scripts/run-mutation-bun.ts", "packages/core/src/tests/native-vault-insula-quota.test.ts", "{test}"]
+test_count_pattern = "CKDEV executed {count} tests"
+expect_red = ["background sweep takes a fresh insula reading and sends no usage GET", "the primary account is looked up in insula by its roster row account id, not its logical id", "a stale, missing or failed insula entry falls back to one usage GET for that account only", "runtimes on one connection file and token path share one insula source until all release it", "the Fable window from extraRateWindows drives scoped routing and the scoped killswitch floor", "the source switch is logged once per change with fixed codes and no identity"]
+expect_message = '/error: expect\(received\)\.(toBe|toEqual)\(expected\)/'
+broad_command = ["bun", "scripts/run-mutation-bun.ts", "--broad", "packages/core", "tmp/mutations/core.xml"]
+broad_report = "tmp/mutations/core.xml"
+broad_id = "{name}"
 
 [[control]]
 id = "quota-call-gap-one-second"
@@ -1077,3 +1104,38 @@ expect_message = '/error: expect\(received\)\.(toBeGreaterThanOrEqual|toEqual)\(
 broad_command = ["bun", "scripts/run-mutation-bun.ts", "--broad", "packages/core", "tmp/mutations/core.xml"]
 broad_report = "tmp/mutations/core.xml"
 broad_id = "{name}"
+[[control]]
+id = "vault-insula-reading-skips-usage-poll"
+guards = "A current insula reading for a vault account must replace that account's usage GET; only a miss polls Anthropic."
+file = "packages/core/src/native-vault-runtime.ts"
+old = '''          if (reading) {
+            const stored'''
+new = '''          if (reading && !reading) { // NON-VACUITY BREAK: always poll instead of using an insula reading
+            const stored'''
+test_file = "packages/core/src/tests/native-vault-insula-quota.test.ts"
+runner = "command"
+command = ["bun", "scripts/run-mutation-bun.ts", "packages/core/src/tests/native-vault-insula-quota.test.ts", "{test}"]
+test_count_pattern = "CKDEV executed {count} tests"
+expect_red = ["background sweep takes a fresh insula reading and sends no usage GET", "the primary account is looked up in insula by its roster row account id, not its logical id", "a stale, missing or failed insula entry falls back to one usage GET for that account only", "admission reads only the insula cache: never refreshes it, polls on a miss", "runtimes on one connection file and token path share one insula source until all release it", "the Fable window from extraRateWindows drives scoped routing and the scoped killswitch floor", "the source switch is logged once per change with fixed codes and no identity"]
+expect_message = '/error: expect\(received\)\.(toBe|toEqual)\(expected\)/'
+broad_command = ["bun", "scripts/run-mutation-bun.ts", "--broad", "packages/core", "tmp/mutations/core.xml"]
+broad_report = "tmp/mutations/core.xml"
+broad_id = "{name}"
+
+[[control]]
+id = "vault-insula-source-released-on-close"
+guards = "Closing a vault runtime must release its reference to the shared insula source, so the source is dropped once its last holder closes."
+file = "packages/core/src/native-vault-runtime.ts"
+old = """      insula?.release()
+"""
+new = """      // NON-VACUITY BREAK: never release
+"""
+test_file = "packages/core/src/tests/native-vault-insula-quota.test.ts"
+runner = "command"
+command = ["bun", "scripts/run-mutation-bun.ts", "packages/core/src/tests/native-vault-insula-quota.test.ts", "{test}"]
+test_count_pattern = "CKDEV executed {count} tests"
+expect_red = ["runtimes on one connection file and token path share one insula source until all release it"]
+expect_message = "error: expect(received).toBe(expected)"
+broad_command = ["bun", "scripts/run-mutation-bun.ts", "--broad", "packages/core", "tmp/mutations/core.xml"]
+broad_report = "tmp/mutations/core.xml"
+broad_id = "{name}"
diff --git a/packages/core/package.json b/packages/core/package.json
@@ -30,7 +30,7 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@cortexkit/common-auth": "0.19.0"
+    "@cortexkit/common-auth": "0.19.1"
   },
   "dependencies": {
     "@cortexkit/claustrum-client": "0.10.0",

diff --git a/packages/core/scripts/check-native-type-closure.test.ts b/packages/core/scripts/check-native-type-closure.test.ts
@@ -110,7 +110,7 @@ test('rejects unsupported published producer versions before copying declaration
     producer,
     'package.json',
     JSON.stringify({
-      version: '0.19.1',
+      version: '0.19.0',
       exports: { './store': { types: './dist/store.d.ts' } },
     }),
   )
@@ -124,7 +124,7 @@ test('rejects unsupported published producer versions before copying declaration
   )
 
   await expect(closeNativeTypeDeclarations(dist, producer)).rejects.toThrow(
-    'Expected published common-auth 0.19.0, got 0.19.1',
+    'Expected published common-auth 0.19.1, got 0.19.0',
   )
   expect(await readdir(dist)).not.toContain('internal-types')
 })
@@ -137,7 +137,7 @@ test('copies the complete published relative declaration graph including cycles
     producer,
     'package.json',
     JSON.stringify({
-      version: '0.19.0',
+      version: '0.19.1',
       exports: { './store': { types: './dist/store/index.d.ts' } },
     }),
   )
@@ -273,7 +273,7 @@ test('packed Core types and Node runtime work in a fresh consumer without common
   const manifest = JSON.parse(
     await readFile(join(core, 'package.json'), 'utf8'),
   )
-  expect(manifest.devDependencies['@cortexkit/common-auth']).toBe('0.19.0')
+  expect(manifest.devDependencies['@cortexkit/common-auth']).toBe('0.19.1')
   expect(manifest.dependencies['@cortexkit/claustrum-client']).toBe('0.10.0')
   expect(manifest.dependencies['@cortexkit/subc-client']).toBe('^0.16.0')
   expect(manifest.dependencies['jsonc-parser']).toBe('^3.3.1')

diff --git a/packages/core/scripts/check-native-type-closure.ts b/packages/core/scripts/check-native-type-closure.ts
@@ -185,9 +185,9 @@ export async function closeNativeTypeDeclarations(
     version: string
     exports: Record<string, { types?: string }>
   }
-  if (manifest.version !== '0.19.0')
+  if (manifest.version !== '0.19.1')
     throw new Error(
-      `Expected published common-auth 0.19.0, got ${manifest.version}`,
+      `Expected published common-auth 0.19.1, got ${manifest.version}`,
     )
   const producerDist = join(producerRoot, 'dist')
   const assets = join(distRoot, TYPE_ASSETS)

diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
@@ -234,6 +234,7 @@ export {
   openNativePiAuthSlot,
 } from './native-vault-connection.ts'
 export type {
+  NativeVaultQuotaPurpose,
   NativeVaultRuntime,
   NativeVaultRuntimeOptions,
   NativeVaultWatch,