Credit accounting can exceed zero without user-visible execution ledger or overdraft control

Summary

I am reporting a credit-accounting/auditability problem observed while using Work/Codex/Astra. This report does not claim that a known reconnect bug caused the incident; the goal is to get the behavior investigated with engineering-level telemetry.

OpenAI Support cases: #15167109 and #15222222.

Observed behavior

Support confirmed the following account-level facts:

• the account reached an approximately -1,883 credit balance;
• Support states a negative balance can occur when usage continues or completes after available credits reach zero;
• a separate voluntary purchase of 250 credits (R$55) was subsequently fully consumed;
• an automatic recharge created 500 credits (R$110) under the record "Auto recharge on enablement";
• the intended/expected target was 125 credits, but Support's records do not explain why 500 were selected;
• 36 of those 500 credits were recorded as consumed before the grant was voided; 464 were refunded;
• Support cannot provide execution-level metadata sufficient to reconcile the deductions to individual executions, retries, reconnects, or background processing.

Why this needs engineering review

The issue is not merely whether credits were consumed. The user-facing/account-support records currently do not provide a verifiable chain:

starting balance → execution/retry/reconnect → debit → ending balance

Without that ledger, an approximately -1,883 balance cannot be independently reconciled, and an automatic recharge discrepancy (125 expected vs. 500 created) cannot be explained from the available records.

Related public report

There is a separate public Codex report (#43045) describing purchased-credit consumption during WebSocket reconnection loops. I am not asserting that #43045 caused this incident. It is relevant only as a hypothesis engineering can confirm or rule out using internal telemetry.

Requested investigation

Please check, if telemetry is available:

1. how the approximately -1,883 balance accumulated;
2. execution/request timestamps and credit debit amounts;
3. retries, reconnects, duplicate/background executions, or delayed accounting;
4. why "Auto recharge on enablement" created 500 credits when the expected target was 125;
5. whether the 250-credit and 36-credit consumption can be tied to valid completed executions without exposing prompt content.

Product safeguards suggested

• explicit opt-in/limit for negative credit balances;
• a "never go below zero" option;
• visible negative balance and source executions;
• execution-level credit ledger;
• separate visibility for retries/reconnects/background/delayed accounting;
• auto-recharge history showing trigger, configured target, pre-recharge balance, and purchased amount;
• CSV/JSON export of timestamps, execution IDs and debits without prompt content.

I can provide additional private account evidence to OpenAI Support/engineering if needed.

No repository file, test, or entry point is named, and the report depends on account-level telemetry and private support records. Start by determining whether credit accounting and auto-recharge are implemented in this repository; done requires reconciling the reported balance, debits, executions, and recharge amount with an engineering-verifiable ledger.