Agent test runs return 402 on exhausted balance; model_override tier check enforced

Every agent test-run endpoint admits the run against the workspace’s remaining credit and its spending limits before the run is created, and documents 402 for a depleted balance or an exhausted spend limit:

  • POST /v1/agents/tests/{test_id}/runs
  • POST /v1/agents/{agent_id}/tests/runs
  • POST /v1/agents/tests/runs/batch
  • POST /v1/agents/tests/suite-runs/{suite_run_id}/resubmit

The behavioural change is on the single-run path, POST /v1/agents/tests/{test_id}/runs, which previously skipped the admission check its three sibling paths already applied - so a run started on a zero balance, past a tripped per-key spend cap, or past a workspace spend budget. The other three already refused; their 402 is now documented.

Model access is enforced on every run path. An explicit override - the per-test model_override or the run-level config_override.model - must name a catalogued model the workspace’s plan includes, and returns 402 before any run is queued when it does not. Previously an explicit override was passed through with no catalog check and no plan-tier check, so a test could run on a model above the plan. An over-tier model stored on the agent itself is clamped to the platform default rather than refused, matching what a live call does, so a test still predicts production. A resubmit re-checks the parent suite’s stored override against today’s plan instead of replaying it.