The fleet's daily build budget

The fleet's daily build budget

The default ceiling is three native build jobs per UTC day. The canonical registry holds both the count and the ceiling, so all submitters use the same fenced document. A verified user approval can authorize a scoped exception without raising that ceiling.

stado queue budget
stado queue budget --json
stado queue budget --limit 6

budget without --limit reads: the UTC day, the build jobs already submitted on it, the ceiling and what is left. --limit declares a different ceiling deliberately and keeps the count already spent, so raising the ceiling never erases what the day has cost.

Every path that submits a build is charged: stado build submit, stado build newest, a release submitted from source, and a raw stado submit carrying a compile. An already charged run is not charged again on ordinary resubmission. Without a recorded exception, an exhausted budget refuses a new build:

the fleet's daily build budget is spent: 3 of 3 build job(s) submitted on <date> (UTC), and
a release build asks for 1 more. The count resets at <next midnight UTC>. Read it with
`stado queue budget`, and declare a different ceiling — deliberately, once — with
`stado queue budget --limit <N>`.

The count rolls over on its own: a count recorded on an earlier day is history, and the day starts at zero without anybody resetting it.

A recorded user exception

The user must explicitly approve exceeding the daily count for the product or a batch containing it. A normal request to build, or a request to implement an approval mechanism, is not that permission. Record the actual captured message through Tama before submitting:

tama-cli build record --kind build --target PRODUCT --revision FULL_SHA --repository SOURCE \
  --reason "Build this committed change with the user's explicit daily-limit exception" \
  --approval-session SESSION_ID --approval-quote 'VERBATIM_USER_MESSAGE' --json
tama-cli build approval --target PRODUCT --revision FULL_SHA --json
stado build submit --source SOURCE --commit FULL_SHA --json
stado queue budget --json

These are placeholders, not approval supplied by this page. Tama must have captured the real current message for the session. It checks the exact quote and asks Brama to verify its meaning. Missing capture, a changed message, an unavailable verifier, or a refusal stops recording.

Tama Desktop exposes the same writer, refusal and audit history in Policy → Build registry. Recording does not start a build. Closing an entry removes permission for subsequent approval reads but preserves its history and does not cancel jobs already accepted by Stado.

When its budget is spent, native build submission invokes tama-cli build approval for the exact product and source revision. The entry must be open and match Tama's retained audit evidence. Stado then stores the complete evidence with the run ID, platform and recording time in the canonical registry's build_approvals map, in the same fenced write as the charge. stado queue budget --json exposes these records as approvals; its used count may exceed its unchanged limit.

In Stado Desktop, open Releases and choose Read daily build allowance and retained user approvals. This read-only operation runs the same queue budget --json command and shows its complete receipt, including refusal details. It does not raise the ceiling or submit a build.

Each approval can charge one run per product and platform. The same captured message cannot create another Tama intent for that product. Another run cannot reuse the platform receipt; a retry needs new consent and must still satisfy the unchanged source and minimum-change rules. An already approved run remains charged when its worker starts after a UTC-day rollover.

The exception does not bypass source validation, host admission, build checks, expiry, or publication permissions. Raw queue submissions have no product-and-revision approval context and cannot claim an exception. Both Tama's approval reader and Stado's approval consumer must be installed; an older Tama reporting unknown action approval or a missing tama-cli is a refusal, not permission.