Runbook: Release Orchestrator quota signals

Source reviewed on 2026-10-07 at 58fd27c7f0232bf40be341a159fe06d6931be314. JobEngine run usage and release promotion authorization are separate owner contracts. A run-usage measurement does not establish a promotion quota or a licence entitlement.

Current read contracts

• GET /api/v1/jobengine/quotas/usage is mapped by the consolidated JobEngine host. JobEngineQuotaEndpoints.cs and DailyRunQuotaUsageService.cs under src/JobEngine/StellaOps.JobEngine.__Libraries/StellaOps.JobEngine.Scheduling/Quotas/ return the authenticated tenant’s persisted run count for the current UTC day. All run states and retry records count; list pagination does not cap the aggregate. The required policy accepts quota.read or orch:quota. This is usage, without a configured ceiling, remaining allowance or enforcement decision.
• GET /api/v1/jobengine/jobs/{jobId}/detail exposes run-specific quotaEvidence from scheduler.runs.reason.quotaProof. JobEngineJobContracts.cs and JobEngineJobEndpointExtensions.cs now live under StellaOps.JobEngine.Scheduling/JobEngineJobs/, not in a separate Scheduler web host. Missing proof remains available=false with reason=quota_proof_not_recorded; it is not proof of an exhausted quota.
• These reads have distinct authorization. Quota-read permission does not grant run/job detail permission. The owner resolves the tenant from the authenticated identity; a spoofed tenant header does not replace it.

The serving host is src/JobEngine/StellaOps.JobEngine.WebService and router registration is jobengine. See JobEngine architecture for the source and fixture acceptance boundaries. This review does not attest the live installation.

Diagnosis

1. Record the exact failing operation, error and owning service. Inspect the mapped usage read if a daily run count is relevant, or the job detail if a particular run carries quota proof. Keep missing, unavailable and denied reads visible; do not manufacture a quota-exceeded diagnosis from them.
2. For a blocked promotion, inspect Release Orchestrator gate and workflow evidence. Follow the promotion runbook, gate timeout runbook, rollback failure runbook or promotion evidence contract for the actual failure. JobEngine’s usage result does not authorize or deny promotion.
3. Use the supported JobEngine run and schedule operations for an offending schedule. A usage API is not a quota-management API.

Management boundary and historical client withdrawal (2026-10-01)

The generic resource-consumption CLI orch quotas get|set|reset and Execution Quotas client described by PCD-129 were withdrawn on 2026-10-01. Their /api/v1/jobengine/quotas and /api/v1/jobengine/quotas:reset calls did not have a serving management owner. Their frozen clients are under src/__Obsoleted/Cli/StellaOps.Cli/PCD-129/ and src/__Obsoleted/Web/StellaOps.Web/PCD-129/.

That withdrawal does not withdraw the current /quotas/usage owner read. No quota write/allocate/reset or promotion-rate enforcement is supplied by the mapped JobEngine usage endpoint. Do not execute the old draft commands for quota increases, promotion prioritization, quota analysis or reset time.

Re-verification

Read the consolidated host’s quota policy registration and endpoint mappings, DailyRunQuotaUsageService, JobEngineJobEndpointExtensions.BuildQuotaEvidence, and the owner RunQuotaUsageReaderTests / RunQuotaUsageEndpointTests before changing this procedure. Release Orchestrator architecture owns promotion semantics; JobEngine architecture owns run usage. Documentation checks do not execute these runtime tests.