mirror of
https://github.com/hanzoai/compute.git
synced 2026-10-30 14:50:41 +00:00
zeekayandHanzo Dev
2881cba813
POST /v1/k8s/clusters provisioned on Hanzo's HOUSE DigitalOcean account with no balance check of any kind. Any authenticated org could ask for a cluster whose seed pool was eight H100s, get it, and be billed nothing — the cluster was never even recorded in the node_pool table the hourly meter reads, so no sweep would find it later. That is the leak: we pay the upstream, forever, for compute nobody was charged for. Same shape on /v1/create-node-pool and /v1/scale-node-pool, which provisioned first and then billed at a CostPerHour that was never computed at create. All three now run the gate the droplet launch already ran: price the resource from the resale catalog, authorize the org for its FULL first interval (rate × node count, never a token amount), and only then touch the upstream. A size that cannot be priced refuses just as loudly as an org that cannot be authorized — one control does not cover the other, and both are needed, because an unpriced GPU authorized at $0 passes any balance check ever written. A scale-up is a provision, so it authorizes the ADDED nodes. A scale-down is not, and is never gated: refusing to shrink a pool because a balance is low would keep the meter running on nodes the customer asked to release. The pool row now carries the resolved rate, its org and its project, so the hourly sweep bills the real number instead of falling back, and the create path debits the first hour — which the sweep skips, so that hour is billed once. The cluster path is split so the money gate is observable: createClusterMetered takes a clusterCreator, and the tests assert against a fake DigitalOcean that records what it was asked to build. Unfunded, 401 on a rotated service token, 500, timeout, and an unpriceable size each produce zero create requests and zero debits; a funded org still gets its four-node H100 cluster and is billed 12712 cents for it. All five refusals were confirmed to FAIL when the gate is mutated to allow-on-error or to fall back to a zero price, and reverting both mutations together reproduces the original leak exactly: the cluster provisions for free. Co-authored-by: Hanzo Dev <[email protected]>