refactor: delete the LLM-key cost exclusion down to the column

The key list is gone from the code paths; take out what only existed to
feed it. `trials.llm_key_hash` had exactly one reader — the exclusion
probe — so with the probe gone the column, the fingerprinting module, and
both stamping sites are dead weight.

Removes `core/llm_key_fingerprint.py` and its test, the `llm_key_hash`
column and ORM field, the settlement-time stamp in `trial_handler`, the
local-runner stamp, and the `carl_tools` field allowlist entry. BYOK's
own `key_hint` is a different feature and is untouched.

`costexcl02` now drops the column alongside the table, under a short
`lock_timeout` — dropping a column is catalog-only in Postgres but still
takes a brief ACCESS EXCLUSIVE lock on a hot table, and failing fast beats
queueing behind a long read with every writer stacked up behind us.

One subtlety at the claim site: the conditional UPDATE there was never
really about the hash. Its rowcount is the "this attempt is still ours"
check that aborts a stale or reassigned worker before it does any
expensive work. Kept as an UPDATE with the same predicate so the check
stays atomic against a concurrent finish, now writing `updated_at`, since
an UPDATE needs a SET.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017zmdrcCqnkVM6hWjhPu2T9

Author: claude

backend/carl_tools.py

@@ -44,7 +44,6 @@
     "trial_s3_key",
     "harbor_result_path",
     "orig_s3_src",
-    "llm_key_hash",
     "trajectory_summary",
     "trajectory_graph",
     "analysis",

oddish/alembic/versions/costexcl02_model_and_experiment_exclusions.py

@@ -10,14 +10,16 @@
 capacity, free preview tiers) and an **experiment** that was comped.
 
 Both correlate on columns ``trials`` already indexes -- ``trials.model`` and
-``trials.experiment_id`` -- so neither needs a new index on that hot table,
-and neither migration step touches it. ``deleted_at`` is the soft-delete
-tombstone; the partial UNIQUEs keep one live row per model / per experiment so
-a removed entry can be re-added.
+``trials.experiment_id`` -- so neither needs a new index on that hot table.
+``deleted_at`` is the soft-delete tombstone; the partial UNIQUEs keep one live
+row per model / per experiment so a removed entry can be re-added.
 
-``trials.llm_key_hash`` is deliberately left in place: dropping a column off
-``trials`` is a separate, riskier change, and the column is inert once nothing
-reads it.
+``trials.llm_key_hash`` goes too. It existed only to correlate the key list,
+nothing else ever read it, and the exclusion lists that replace it correlate
+on columns ``trials`` already has. Dropping a column is a catalog-only change
+in Postgres, but it still needs a brief ACCESS EXCLUSIVE lock on a hot table,
+so it runs under a short ``lock_timeout``: failing fast and retrying beats
+queueing behind a long read and stalling every writer behind us.
 """
 
 from typing import Sequence, Union
@@ -70,14 +72,18 @@ def upgrade() -> None:
         ON cost_excluded_experiments (experiment_id) WHERE deleted_at IS NULL
         """
     )
-    # The key-hash list is gone from the code paths above; drop it last so a
-    # failed create leaves the old feature's data intact for a re-run.
+    # The key-hash feature is gone from the code paths above; drop its table
+    # and the trials column last, so a failed create leaves nothing half-done.
     op.execute("DROP TABLE IF EXISTS cost_excluded_llm_keys")
+    op.execute("SET LOCAL lock_timeout = '5s'")
+    op.execute("ALTER TABLE trials DROP COLUMN IF EXISTS llm_key_hash")
 
 
 def downgrade() -> None:
-    # Recreates the key list's shape only. Its rows are not recoverable --
-    # nothing else stored the hashes.
+    # Recreates the key feature's shape only. Neither the exclusion rows nor
+    # the per-trial hashes are recoverable -- nothing else stored either.
+    op.execute("SET LOCAL lock_timeout = '5s'")
+    op.execute("ALTER TABLE trials ADD COLUMN IF NOT EXISTS llm_key_hash VARCHAR(64)")
     op.execute(
         """
         CREATE TABLE IF NOT EXISTS cost_excluded_llm_keys (

oddish/src/oddish/core/llm_key_fingerprint.py

@@ -1144,10 +1144,6 @@ class TrialModel(TimestampedMixin, Base):
     tool_counts: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
     cost_usd: Mapped[float | None] = mapped_column(Float, nullable=True)
 
-    # SHA-256 of the platform provider API key this trial ran on, stamped at
-    # settlement (forward-only; NULL for pre-rollout / unresolved keys).
-    llm_key_hash: Mapped[str | None] = mapped_column(String(64), nullable=True)
-
     # Per-phase timing breakdown (from Harbor's TrialResult TimingInfo)
     phase_timing: Mapped[dict | None] = mapped_column(JSONB, nullable=True)
 

oddish/src/oddish/db/models.py

@@ -45,7 +45,6 @@
 from oddish.core.harbor_artifacts import cache_write_tokens_from_trajectory
 from oddish.core.task_browse_summary import refresh_task_browse_summaries
 from oddish.core.cost_basis import CANCELLED_HARBOR_STAGE
-from oddish.core.llm_key_fingerprint import platform_key_hash_for_provider
 from oddish.db.models import WorkerJobKind, WorkerJobModel, WorkerJobStatus
 from oddish.db.storage import resolve_task_directory
 from oddish.model_pricing import is_native_cost_trusted, settle_cost_usd
@@ -867,7 +866,6 @@ async def _upload_task_dir(event: TrialHookEvent) -> None:
             # Local-mode trials land in the same cost accounting as queue
             # trials, so stamp the platform key hash here too (see
             # workers/queue/trial_handler settlement).
-            trial.llm_key_hash = platform_key_hash_for_provider(provider)
             log_unpriced_trial_if_needed(
                 cost_usd=trial.cost_usd,
                 trial_id=trial.id,

oddish/src/oddish/worker/local_runner.py

@@ -39,7 +39,6 @@
     get_session,
     utcnow,
 )
-from oddish.core.llm_key_fingerprint import trial_llm_key_hash
 from oddish.core.task_browse_summary import refresh_task_browse_summaries
 from oddish.db.storage import get_storage_client, resolve_task_directory
 from oddish.model_pricing import is_native_cost_trusted, settle_cost_usd
@@ -516,9 +515,6 @@ async def _prepare_trial_run(
         trial.total_tool_calls = None
         trial.tool_counts = None
         trial.cost_usd = None
-        # llm_key_hash deliberately survives this reset: it is the last
-        # attempt's funding key and the best prediction for the retry.
-        # Settlement overwrites it with the actual key.
         trial.phase_timing = None
         trial.has_trajectory = False
         trial.attempts += 1
@@ -706,8 +702,6 @@ def _settle_trial_metering(
     if preserve_checkpointed_cost and prev_cost_usd is not None:
         if trial.cost_usd is None or trial.cost_usd < prev_cost_usd:
             trial.cost_usd = prev_cost_usd
-    # Attribute spend to the BYOK overlay or platform key that funded the run.
-    trial.llm_key_hash = trial_llm_key_hash(provider, byok_env)
     return prev_cost_usd, provider, native_cost_trusted
 
 
@@ -1526,22 +1520,20 @@ async def run_trial_job(
             agent=prepared_trial.trial_agent,
         )
     byok_env = byok_resolution.env if byok_resolution else None
-    funding_key_hash = trial_llm_key_hash(
-        settings.get_provider_for_trial(
-            prepared_trial.trial_agent, prepared_trial.trial_model
-        ),
-        byok_env,
-    )
-    stamp = update(TrialModel).where(
+    # Claim guard: re-assert that this attempt is still ours before doing any
+    # expensive work. A conditional UPDATE (not a SELECT) so the check is
+    # atomic against a concurrent finish or reassignment; ``updated_at`` is
+    # simply the column it writes, since an UPDATE needs a SET.
+    claim = update(TrialModel).where(
         TrialModel.id == trial_id,
         TrialModel.finished_at.is_(None),
         TrialModel.attempts == prepared_trial.trial_attempt,
     )
     if worker_id is not None:
-        stamp = stamp.where(TrialModel.current_worker_id == worker_id)
+        claim = claim.where(TrialModel.current_worker_id == worker_id)
     async with get_session() as session:
-        stamped = await session.execute(stamp.values(llm_key_hash=funding_key_hash))
-    if not getattr(stamped, "rowcount", 0):
+        claimed = await session.execute(claim.values(updated_at=utcnow()))
+    if not getattr(claimed, "rowcount", 0):
         return
 
     # Determine task path: download from S3 if needed, or use local path

oddish/src/oddish/workers/queue/trial_handler.py

@@ -1627,7 +1627,6 @@ def test_store_trial_results_settles_metering_after_quota_cancel(monkeypatch):
         cache_write_tokens=None,
         output_tokens=None,
         cost_usd=0.25,
-        llm_key_hash=None,
         phase_timing=None,
         has_trajectory=False,
         current_worker_id=None,
@@ -1645,11 +1644,6 @@ async def _fake_trial_session(
         yield SimpleNamespace(), trial
 
     monkeypatch.setattr(trial_handler, "_trial_session", _fake_trial_session)
-    monkeypatch.setattr(
-        trial_handler,
-        "trial_llm_key_hash",
-        lambda *_args: "settled-key-hash",
-    )
 
     outcome = harbor_runner.HarborOutcome(
         reward=1.0,
@@ -1691,7 +1685,6 @@ async def _fake_trial_session(
     assert trial.cache_write_tokens == 10
     assert trial.output_tokens == 50
     assert trial.cost_usd == 0.25
-    assert trial.llm_key_hash == "settled-key-hash"
     assert stored == (True, False)
 
 
@@ -1703,7 +1696,6 @@ def test_store_trial_results_ignores_stale_cancelled_attempt(monkeypatch):
         superseded_by_trial_id=None,
         input_tokens=7,
         cost_usd=0.25,
-        llm_key_hash="current-key",
     )
 
     @asynccontextmanager
@@ -1733,11 +1725,7 @@ async def _fake_trial_session(*_args, **_kwargs):
     )
 
     assert stored == (True, False)
-    assert (trial.input_tokens, trial.cost_usd, trial.llm_key_hash) == (
-        7,
-        0.25,
-        "current-key",
-    )
+    assert (trial.input_tokens, trial.cost_usd) == (7, 0.25)
 
 
 @pytest.mark.asyncio