Model policy and budgets
All billable calls run through backend model-policy admission, including secondary calls. A browser submits a product intent; it cannot select an upstream model/provider, options, budget, tool result or generated context.
Versioned operations
| Operation key | Purpose |
|---|---|
agent.respond | Agent response |
memory.extract | Structured memory extraction |
facts.resolve | Fact resolution/revision |
memory.summarize | Source/context summaries |
embedding.query / embedding.memory | Query and memory embeddings |
conversation.title | Retained conversation title |
artifact.text / artifact.code / artifact.sheet | Content generation |
artifact.suggestions | Version-bound proposed edits |
media.image.generate | Governed image generation |
media.video.generate | Reserved contract; asynchronous video generation unavailable and deferred |
Deployment policy establishes qualified bounds. Tenant and Agent/version policies narrow those rules. Trusted overrides are recorded with actor/change/authorization evidence; caller input cannot manufacture an override.
Policy checks include allowed models and native interfaces, capabilities, options, tool registry, input/context/output tokens, tool steps, timeout, operation/run/tenant budgets and concurrency. Prompt/schema/extraction/tool-registry/price/bound revisions are pinned. A model catalog listing does not establish compatible tools, structured output, embedding, image or video support.
Convex Gateway does not support asynchronous video generation and cannot enable it for an individual team or deployment. Video generation is explicitly deferred until official support, implementation compatibility qualification, real service outcomes and independent acceptance. Retaining the operation key or native interface does not make the capability available or permit a policy override. Image generation, private assets and existing video-file uploads remain in scope.
The observed image descriptor is text-prompt only with callbacks: false and requested-only model identity. It does not establish serving identity or known USD charges; cost admission and retained uncertainty still apply.
One operation identity
Semantic identity binds the request to scope, source revision, policy and model/interface version. Stable request IDs replay the same intent; changed input under the same identity conflicts. Reconnect and observation never create another paid operation.
Fallback requires its own qualified policy and admission/reservation. It remains under the original logical operation/run budget and cannot follow an unknown or already visible effect as a fresh attempt. Automatic titles share the actual parent Agent budget; explicit content jobs include their secondary title within one job budget.
Unknown costs and outcomes
Qualified cost ceilings cover all provider charges at the admitted caps. Missing charge information is conservative incurred uncertainty, not zero. An unknown upstream outcome can retain a liability and concurrency slot until terminal evidence supports settlement.
A local timeout, cancel or deadline alone does not establish upstream terminality. It cannot refund a reservation, free an uncertain slot or authorize a blind retry. Recovery reconciles the saved operation. Unsupported capabilities and policy/budget denial are explicit results.
See resilience, artifacts and media.