Feature requests

JOY requested expanding the collector into a mechanism that fetches and refreshes pricing dynamically for every provider in use, following the OpenRouter catalog experience. Scope: full provider/offering inventory, native and aggregated sources with provenance, exact decimals and complete pricing dimensions, refresh outside the request path, and price snapshots kept so in-flight requests and the billing ledger never change mid-request. Prices sold through OpenRouter must not be conflated with native contract/list prices. On source errors or missing data, keep the last known price and report coverage clearly. Catalog boundary: shared Supabase migrations remain owned by DOS-Me; implement the DOS-AI side first and prepare the pricing-update integration contract for a dedicated review.

Developer portal for developers who want to bring DOS.AI to their products

Problem (measured 2026-09-24): every model request carries the FULL JSON schema of every connected MCP tool - 605-677KB (~150-170K tokens) per request across 16/16 sampled coding-agent sessions, before any user message. With many plugins this alone fills most of a 200K-token context window and inflates cost on every turn. Proposal, two layers: API Gateway: implement Anthropic-compatible Tool Search server-side - accept tools with defer_loading=true, expose tool_search_tool_regex / tool_search_tool_bm25 as server tools, return tool_reference results per the Tool Search beta contract, so clients like Claude Code can keep tool search enabled behind ANTHROPIC_BASE_URL instead of falling back to eager loading of every schema. DOSClaw agents: expose FastMCP-style meta-tools (search_tools + call_tool + optional read_result for paginated large outputs) so an agent discovers and loads only the schemas it needs, with per-tool permission checks enforced at call time, not by hiding tools. Acceptance: initial request context scales with tools actually needed for the task, not with total installed plugin count; task completion rate unchanged; permission checks unchanged.

Add the three new models with official list pricing and zero markup. Test every OpenAI, Anthropic, Azure and OpenRouter route on the beta gateway, verifying streaming, tool calls and billing before promoting to prod. Routes without sufficient access or untested routes must not be advertised as ready.

Run agent containers on partner servers (partner DC) as an official Location, starting with Heno (Em Huyen - Tingee CS, Em Huong - Heno Marketing). Scope: Productized edge kit: versioned images, install/doctor scripts, Cloudflare Tunnel by default, bidirectional health + alerts, backups Cutover of the 2 Heno agents from DOS Cloud (Mumbai) to the An Nhan location (Heno DC) via MigrateAgent External MCP Server Registry: partners self-host their own tools (e.g. Tingee's speaker reset) and the gateway renders them into agents with a per-agent HMAC token A standard onboarding playbook for the next partner plus a pricing model (platform license + inference billed as usual) Foundation already exists (code verified): the 'partner' backend, 'dosai.locations' + 'project_location_grants', the 'infra/partner/' stack, MigrateAgent moving volumes between hosts, runtime contracts pinning images, centralized LLM billing. Docs: 'docs/dosclaw/partner-dc-edge-architecture.md' + report 'docs/recommendations/2026-09-16-dosclaw-onprem-heno.html'

Separate the DOSClaw chat path from Docker management permissions, keeping a unified public API at api.dos.ai and managing containers per VM. Phase 1 merged: https://github.com/DOS/DOS.AI/pull/2384. Core-service phase merged to dev via https://github.com/DOS/DOS.AI/pull/2387, merge commit b164c1df603713fcf21ee23fc2754f0cf2df5354. Ships per-org/agent/session admission, native OpenClaw/Hermes no longer calling Docker, SSE backpressure/heartbeat, a dedicated slot for Stop, cleanup on client disconnect and send-permission revocation. Local pass: 134 runtime-chat tests and 64 Hermes tests; CI admission on Linux Node 24, agent-infra and release-gate all SUCCESS. Gemini reviewed the final head ba1076c74. Traffic has not been switched and the new service not activated. Remaining limits to resolve before live acceptance: receipts are in-memory and size-capped; needs durable reconciliation keyed by proof of run completion or runtime removal so Stop is not lost on restart/incident. Still to wire: issuer, registry/secret broker, shared replay store, history/media, and network-isolation acceptance on Beta. The item stays In Progress and is not marked as rolled out. Update 13/09/2026: durable run journaling merged to dev via DOS-Me #753 (https://github.com/DOS/DOS.Me/pull/753, commit 335b29d21654105a28307da1769a87030a986419) and DOS-AI #2392 (https://github.com/DOS/DOS.AI/pull/2392, commit cce3be6a188fdbcc3efc3452740a598639137d35). Preview was unblocked through the normal pipeline plus a supplemental migration; no ledger resets or manual SQL. Preview confirmed the final function matches source, RLS enabled, RPC restricted to service_role. Pre-send retry with fencing for deterministic failures, duplicate-send protection kept on lost ACK, event-recovery limits, failing ACKs blocked from filling memory, and final-state write awaited on shutdown. Local pass: 166 runtime-chat tests, 80 Hermes tests, and PostgreSQL replay/concurrency/hosting-resume; final-head CI and review complete. The new Hermes history/reset IDs were kept on dev while resolving conflicts. The new chat path has not been deployed/activated and traffic not switched. Beta migrations not yet run: the dev pipeline stopped on a MiniMax provider identity mismatch error ahead of the chat migration. DOS-Me PR #749 was open, correctly describing this catalog blocker, and must be resolved under catalog release ownership. No provider/catalog changes were made within this task. After unblocking and verifying the Beta schema, remaining: authenticated broker, scheduler, reconciliation on lost ACK, retention and UAT restart/network isolation before rollout. The item remains In Progress. Further update 13/09/2026: JOY approved removing the catalog blocker and running all pending migrations to Beta. DOS-Me #749 merged to dev at b4bee4a4516626bffd4e632e2da83ea37b9cc24f. PostgreSQL regression (catalog/billing and run-journal) all pass; CI/Preview and review verified the final head c651a0e. The Beta ledger now holds all 8 migrations from 20260911060900 to 20260913093000. Read-back confirms M2.7 and three DeepInfra offerings enabled, M3 still off, MiniMax music unchanged in state/price. Function runtime_chat_receipt matches source (MD5 98e8ce81bf48c3129a7ca7a0c942ec63), RLS enabled, RPC restricted to service_role, and client roles cannot read the journal directly. Supabase Beta reports FUNCTIONS_DEPLOYED / ACTIVE_HEALTHY; the final GitHub check 103670353909 is SUCCESS on the exact merge SHA b4bee4a (the older check 103670257194 was superseded). Gateway Beta health HTTP 200. No manual SQL run, prod untouched, the new chat path not yet activated. The stale MiniMax country metadata was split into DOS-Me #754 for separate verification and left unchanged in this patch. Next: wire the authenticated broker and scheduler recovery, then UAT restart/network isolation before rollout. Broker progress 13/09/2026: DOS-AI PR #2403 (https://github.com/DOS/DOS.AI/pull/2403), head 747316bfc33064a6d6d5d7c3819e89616a4c6661, pushed the broker journal layer with workload/host authentication, HTTPS transport with time/size limits, sequential scheduler recovery and tests. Node runtime suite and Linux Go tests (including race detector for broker/identity) pass; CI contract pass, CI Gateway and Codex review running. Not merged, no live route registered, no traffic switched. Registry host/runtime-incarnation managed by the control plane and related deployment permissions remain a prerequisite for UAT. Item stays In Progress; this code is not production rollout. PR #2403 head update 354bef43516b6895d9e3373460fa87eb05003357: all three Codex review findings addressed (rejected async telemetry isolation, body-read deadline via ResponseController, relabeling recovered to attempted to avoid false success reporting). Full Node suite 180/180 pass; Linux Go broker tests with race detector and slow-body TCP pass. All three review threads replied and resolved. CI Gateway/agent-infra and review on the new head were not complete at update time; an extra review attempt reported quota limits. Not merged or promoted to prod. Still requires additional DOS-Me registry permissions and workload-identity deployment before wiring live chat/UAT. Registry 13/09/2026: JOY approved additional DOS-Me migrations. DOS-AI #2403 merged to dev at d8ccffdce46a6c703cdfd18b2f2921612e8b815a; final-head CI green and Codex summary confirms review complete on 354bef4. DOS-Me PR #757 (https://github.com/DOS/DOS.Me/pull/757), commit 90ec329e8, adds host/runtime registry metadata with CAS revision, non-reusable session UUIDs, retired-record retention, RLS and service_role-only RPC. No host/identity/route seeding, no token/prompt storage. PostgreSQL registry and run-receipt tests pass, 7/7 workflow tests pass. Technical docs and checklist continue in docs/specs/runtime-chat-registry.md within the PR. The registry PR awaits CI/Preview/review; registry not deployed to Beta, lifecycle/issuer not wired, no traffic switch or prod promotion. The overall feature remains In Progress.

After the MiniMax/DeepInfra batch, evaluate current gaps: Mistral Medium/Small/Codestral for coding; Cohere Command, Embed and Rerank for RAG; Perplexity Sonar for grounded search. Credentials, model entitlement and the pricing contract must be verified before enabling. Sonar must also account for search fees beyond tokens. Do not mark available based on docs alone. Sources: https://docs.mistral.ai/models , https://docs.cohere.com/docs/rerank , https://docs.perplexity.ai/docs/sonar/models . Tracked in the existing launch audit; not included in the MiniMax/DeepInfra batch.

P2 proposal, dependent on measurement and benchmarking. Extend the existing router: mandatory filters first (model capability, provider pin, BYOK, budget, region), then route selection by expected cost, latency and health. Keep provider affinity for conversations when it benefits prompt caching, but allow controlled failover. Policies are versioned with reason codes, canary and rollback. Pilot per-agent tiering gradually, and only after benchmarks prove task success does not drop beyond the agreed threshold. Acceptance: callers cannot spoof identity/plan; pins and privacy constraints are never bypassed by fallback; route decisions are reconstructible; retry/deadline limits enforced; rollout and rollback tested. Input price alone must not define "cheapest route". Sources: https://docs.router.com/strategies/switchyard-routing ; https://openrouter.ai/docs/guides/best-practices/prompt-caching ; https://developers.cloudflare.com/ai-gateway/features/dynamic-routing/ .

P1 proposal from the 10/09/2026 Router research. Start with a Vietnamese workload suite covering customer support, coding/tool use and extraction with ground-truth answers/task-success metrics. Compare cost per successful task, p95 latency and tool/schema correctness before changing model routing. Then shadow a small allow-listed percentage of traffic, run asynchronously, with a hard budget, timeouts, redaction and clear retention. Shadow never returns results to the user and never changes routes by itself. Acceptance: fixed baseline, published sample size and uncertainty; cost limits enforced; shadow failures never fail the main request; promote/rollback decisions based on quality and latency. Shadow provider costs must be accounted for, not assumed free like Router's program. Sources: https://docs.router.com/strategies/shadow-models ; https://docs.router.com/strategies/switchyard-routing .

P1 proposal from the 10/09/2026 gateway research. Extends the shipped Streaming L1 Cache Replay item; L1 is not being redone. Scope: distinguish exact response cache, provider prompt cache and semantic cache in API/docs; measure hit/miss/bypass, upstream cost, retail price and estimated savings per project/model/provider; reconcile with the ledger; design server-side tenant namespace and policy versioning. Deploy L2 only if measured hit loss from replicas/restarts and the benefits exceed operating costs. Acceptance: hits never call upstream; entitlements enforced; tenant/BYOK isolation; correct TTL/invalidation; dashboard separates real cost from the estimated baseline. No committed savings percentage before benchmarking. Sources: https://portkey.ai/docs/product/ai-gateway/cache-simple-and-semantic ; https://nexos.ai/features/llm-caching/ ; https://docs.litellm.ai/docs/proxy/caching .

Azure OpenAI API v1 code merged to dev via https://github.com/DOS/DOS.AI/pull/2262, with independent review and full Gateway tests/CI pass. Supports deployment mapping, a dedicated api-key, blocking redirects/hosts outside Azure, streaming and snapshot billing. Provider not yet activated: waiting on a new subscription to verify resources, deployments, quota, pricing, secrets and the live ledger.

Following the shared-channel fallback: split the draft executor from the native delivery contract per runtime/account/conversation/thread. Preview may only be confirmed after the full caption and images are sent; a failed send receipt must not recreate the draft. OpenClaw/Hermes may only be enabled after verifying real authentication and runtime callbacks; pre-auth hooks never grant write access.

Both runtimes must expose the same management features inside DOS.AI; any unsupported difference must be surfaced and reported explicitly. The Hermes version-picker portion merged to dev and deployed to Beta via PR https://github.com/DOS/DOS.AI/pull/2243 (commit a70a6b566f0727f02bc7aa7e13092356e50ad11c). Pre/post-merge CI and review passed. Gateway Beta revision beta-api-01205-vuf Ready at 100% traffic; workflow https://github.com/DOS/DOS.AI/actions/runs/34260132563 succeeded. MCP Playwright confirmed the dropdown lists 4 Hermes releases, pinning v2026.9.7 returns 200 and persists after reload, switching back to latest returns 200 and GET confirms latest. Agent Preview still Running; no live image switch attempted this round. Not yet promoted to production. Remaining gaps: Chat history, real streaming and Stop, restore/migrate, Model Auth diagnostics, native pairing management. Full parity remains In Progress and is not marked complete merely because the UI shipped.

Provide verified per-customer memory while keeping agent-owner-managed knowledge bases shared within the agent scope. Prefer the runtimes' native memory/profile/provider features. Whatever must be built uses official interfaces and one shared backend for storage, retrieval and identity policy, with a thin adapter per runtime. Acceptance criteria: data isolated before entering model context; memory survives new sessions and restarts; fact updates work; shared KB accessible from both OpenClaw and Hermes. Update 09/09/2026: the Telegram beta suite passed. A fresh round confirmed 4/4 fact A/B updates on OpenClaw 2026.9.3 and Hermes 2026.9.7; the DB marks the old fact inactive and links to the new fact with an embedding. After /new, all four chats called real tools and recalled the new preferences without mixing A/B namespaces. Hermes recovered the old marker through real Telegram messages after restart. Earlier minutes confirmed 37 days of shared KB ORBIT, A/B isolation and OpenClaw 2026.9.2 recreate. Full lifecycle repetition on 2026.9.3 is not claimed. Stays In Progress for moving the mechanism from the limited Telegram trial to real channel scope and rollout. Em Huyen production has no customer_memory_identity opt-in; no production changes. Limits and ops reports are recorded in docs/recommendations/2026-09-09-em-huyen-cs-status.html. Tool-discovery fix: https://github.com/DOS/DOS.AI/pull/2246 Deployment evidence: https://github.com/DOS/DOS.AI/pull/2247 Pre-update A/B evidence: https://github.com/DOS/DOS.AI/pull/2249 Architecture correction 10/09/2026: provider choice is reopened; the limited A/B result does not default to the DOS backend. Honcho has integrations on both OpenClaw and Hermes and is the priority candidate to verify alongside its native profile. Peer mapping has not self-demonstrated per-customer ACL; tool peer checks, shared profile/bootstrap, migration and lifecycle need review. Hermes can disable built-in memory while keeping an external provider, but the current DOS adapter uses MCP/middleware and is not yet a full memory provider. A source-read audit pinned to the Beta RPC: DOS has hybrid search and reconciliation but gaps remain in replay/concurrent correction, embedding fallback, lifecycle and consolidation. Next step is a conformance lab with identical synthetic data; do not write a DOS engine before proving what native lacks. Per-customer memory and agent-owner KB remain two independent scopes. Stays In Progress, no production changes. The report and RPC definitions are committed, independently reviewed, HTML-checked on desktop/mobile and merged to dev: https://github.com/DOS/DOS.AI/pull/2261

Connect MISA inbound e-invoices, meInvoice, ASP, AMIS Accounting, WeSign, and eSign through DOS-Me-managed authorization and reusable product-scoped access. DOSClaw and other DOS products can bind the same connection without receiving provider credentials. The initial capability is read-only; authenticated Beta sandbox UAT remains required. Crove ecosystem - deferred, not implemented Per JOY's decision on 08/09/2026, the MISA connection for Crove is deferred as there is no current need. Crove is an ecosystem of multiple Crove-* apps, not a single backend, and does not default to Crove Post. When needed, identify each app and Beta workload to integrate; reuse the DOS-Me broker with proper caller authentication and consent, keeping MISA credentials in DOS-Me/Vault. Implement only after JOY requests it; acceptance via real provider reads and isolation checks on Beta. The existing caller-registration portion does not mean the Crove integration is done. Backend consumer, Crove consent and positive provider UAT remain outstanding. Deferring Crove does not change the In Progress status of the six-product MISA goal.