Tickessa 0.9.0
Published on the reference installation and public documentation on 4 September 2026.
Version 0.9.0 adds optional paid AI through a separate gateway. It starts fully disabled after installation/migration, sends no email, enables no tasks and connects to no provider without a separately issued entitlement.
Revocable instance access
The installation stores an encrypted instance ID and once-issued token. Provider keys remain only in the gateway. Tokens can be rotated/revoked and grant only contracted function/model profiles. The gateway is not an open proxy.
Quota, warnings and hard limit
Each organisation has monthly included units, a warning threshold and a hard limit. Additional budget requires explicit approval. Atomic reservation before provider execution prevents calls after exhaustion. The interface shows included, extra, used, reserved and remaining units separately from actual USD provider costs.
No duplicate charges
Each logical run uses a stable request ID across transport retries. Briefly encrypted cached responses avoid a second call or charge. Changed content under the same ID is rejected.
Ambiguous provider outcomes retain reservations without automatic retries. Administrators reconcile content-free evidence against provider billing and explicitly charge or release it.
Cleanup safely handles crashes: expired pre-provider reservations are released; post-start runs remain reserved for manual reconciliation. Requests rejected at the hard limit before provider execution may retry the same ID after explicitly approved extra budget.
Privacy and boundaries
Persistent logs contain organisation, instance, function, model, quantities, costs, states and times, excluding prompts, ticket text, email addresses and answers. Successful output is encrypted only for the retry window and then deleted.
Sales/licensing manages entitlement, not lasting ticket/email content. Customer installations cannot access provider keys or other organisations and quotas.
Safe failure and fallback
Revocation, missing entitlements, rate limits and hard limits leave manual work available. BYOK fallback occurs only after provider, task, fallback and data-category approvals; otherwise the task stays off. Gateway pairing never activates automatic email sending.
Technical changes
- Migration
027_tickessa_ai_gateway.sql: project mode, encrypted provider pairing, local usage snapshots and gateway references in runs. - Separate central service: instance permissions, quotas, rate/size limits, idempotent billing, actual costs and content-free reconciliation.
- Release packaging includes migration 027 and a separate gateway operations guide.
- MariaDB tests cover organisation isolation, allowed functions, once-only billing, warnings, hard limits, ambiguous outcomes, reconciliation, cache expiry and revocation. A synthetic load test verified 50 billable requests and 20 retries without duplicate calls/charges, real providers or emails.