I3661 — Which funding sources the owner holds, and their caps, are the owner's local declaration and never projected

!CANCELLED wave 1 · p2 · implementation profile · parallel safe

Part of every-model-call-is-paid-from-a-declared-source — How a model call Majordomus starts can be paid is declared by the vendor with evidence, and each call names the source it was declared to draw on.

Objective

Read the owner's holdings (which declared sources they hold, and an optional monthly cap per source) from a record under .ai/local and from the environment, resolve each against the vendor sources of I3660, and refuse a holdings record written under .ai/repo; no generated, projected or published file carries a holding.

Why

Whether the owner claimed the Max plan's credits, and how much they will spend, is personal state, like permission modes and model choice (ADR 0140, ADR 0145): the distribution declares what a vendor offers, the owner declares what they hold. The same holding is also the named reporter I3292's billing_mode lacks.

Current state

No record of held sources exists; I3292 plans billing_mode as a declaration through the consented I3289 step.

Desired state

A holding is local, resolved against the catalogue, and absent from every projection; I3292's billing_mode reads it.

Scope

• apps/majordomus-cli/src/models
• share/schemas/majordomus
• docs/MODELS.md

Out of scope

• Reading any credential's value

Dependencies

• I3660○READY A vendor declares its funding sources in the model catalogue, each with dated, quoted vendor evidence

What waits on this

• I3662!CANCELLED models.route names the funding source a route would draw on, as an inference with its basis, in the declared source order
• I3664!CANCELLED doctor and the brief tell the owner a held funding source no credential reaches, with the vendor's claim link

Acceptance criteria

• A holding naming a source the catalogue does not declare is reported with the vendor and source it names
• A holdings record placed under .ai/repo is refused (test)
• No file majordomus generate writes contains a holding (test over the generated tree)
• A holding whose credential variable is unset reads held-but-unusable

Validation

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml models::

Evidence required

• test_a_holding_under_the_repository_layer_is_refused

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Completion report

Cancelled 2026-10-21 on feature/intent-funding-sources by the plan's critique (findings two-reporters-for-one-billing-fact and holdings-are-per-checkout-not-per-owner): I3292's billing_mode, declared through I3289, already is the one reporter of how a call was paid, and a second store in .ai/local would fork that truth and differ per worktree. I3665 carries the declared kind on runs and consultations in the catalogue's vocabulary instead.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3661.yaml. Read it back with majordomus plan show I3661.