Feed recording, sessions and cost through one input that does not depend on the Go listeners

Start with core/listener/internal/sessionevent, core/session/store.go, core/cost/settle/settle.go, and core/sessionapi/server.go; trace how events reach the recorder and how cost uses response headers. The proposal spans event construction, sink interfaces, cost calculation, ingestion, and schema versioning, with several open design questions. Done means meeting the listed parity and pricing tests and, if ingestion is included, matching replayed /v1/sessions and /v1/usage results.

Part of #1437 (assessment: laptop data plane on Praxis) · prep work, useful to Cortex on its own

Status: there is no Cortex–Praxis integration today, and the interim path is not decided (LLM traffic to praxis-ai as an inference server, or all traffic through Praxis via #1491). Nothing here depends on that choice: each item is useful to Cortex now, and makes an eventual move to Praxis easier whichever path is taken.

Problem

If Cortex's data plane ever moves to Praxis, the session store, archive, cost ledger, usage aggregator and agentop must keep working unchanged. Today they are fed only from inside Cortex's Go listeners, so nothing outside those listeners, Praxis included, has anything to plug into. Three things tie recording to the Go proxy:

1. Events are built in 11 places. Each listener builds pipeline.SessionEvent literals by hand, and they have drifted.
2. Cost is computed inside a plugin, from data the event does not carry.
3. There is no way to feed events from outside the process.

What Cortex does today

Event construction — 11 literals plus the Deny helpers:

• forward proxy: server.go:1234, :1523; transparent.go:246, :296
• reverse proxy: server.go:457, :634, :827
• ext_proc: server.go:355, :442, :478, :532
• shared: sessionevent.Deny, DenyResponse

Drift this has caused:

• ext_proc never sets requestedHost.
• Only the forward proxy's request row sets upgradeStripped.
• The forward proxy's request row carries no tls.

The back end is already clean. Every event goes through one choke point, Store.append → appendLocked, which then calls the Recorders (usage, ledger, archive). Each of those reads only the event.

Calls outside Append. Listeners also call the store directly:

• Rekey: reverseproxy:617, extproc:520
• Claim / ClaimProcess / TouchProcess
• AppendTrailing / AppendPair, which take an in-process *session.Bucket to pair a tunnel's open and close rows (transparent.go:296, server.go:2633)

Cost.

• Computed by settle.Settle(pctx, rates), called from inference-parser.
• It reads pctx.ResponseHeaders (LiteLLM cost headers), pctx.Host and the parsed inference.
• Publish puts the result in Extensions.Custom, which reaches the event as plugins["cost"].
• Response headers are not in the event, so cost can't be computed from an event alone.

No ingestion. The session API registers GET routes and two DELETEs only (sessionapi/server.go:199-209).

envoy-sidecar mode shows the cost of this.

• cortex-envoy builds a store but no ledger, usage aggregator or archive (warnCostLedgerInert).
• So /v1/usage answers 404 there.

Proposal

1. One set of event builders in core/listener/internal/sessionevent: Request, Response, TunnelOpen, TunnelClose, each taking (pctx, ListenerFacts{status, failure, bytes, reason, duration}). Replace all 11 literals. Fixes the drift above.
2. One sink interface the listeners write through — Append, AppendTrailing(requestID), Rekey, Claim* — so "feed the control plane" is one interface, not a struct and its methods. Pair tunnel rows by requestId instead of *Bucket.
3. Make cost computable from the event. Narrow settle.Settle to {host, inference, responseHeaders, isSSE} and record the cost-relevant response headers on the response event.
4. A loopback-only event-ingestion endpoint (e.g. POST /v1/events, NDJSON) into the same sink. Use the same guards as DELETE /v1/sessions: loopback Host, no Origin, gated like WithClearAllowed.
5. Version the event schema. sessionEventWire (session.go:493) has no version, and its JSON is already persisted by the archive. Add a version, plus golden fixtures. State in docs/session-api.md which fields only the store sets (sessionId, seq).

Items 1–3 and 5 benefit Cortex today. Item 4 can wait until a second producer exists (replay, tests, or another proxy).

Design questions

1. Does ingestion live on the session API port, or on a separate loopback-only listener?
2. Should the ingesting side recompute cost from the event, or trust a producer-supplied cost record?
3. Is ext_proc's lack of requestedHost a bug to fix in this change or separately?

Done when

• No pipeline.SessionEvent{ literal remains outside sessionevent.
• core/listener/parity asserts identical event fields across forward proxy, reverse proxy and ext_proc for the same exchange.
• settle has a unit test that prices from an event alone, with no pipeline.Context.
• (Item 4) A replayed NDJSON capture through the ingestion endpoint produces the same /v1/sessions and /v1/usage as the live run.

Evidence read at main @ e455a04 (2026-10-25); not built or run.