docs: use nonblocking warnings for paid training workflows

AGENTS.md

@@ -33,31 +33,41 @@ Use the repository workflow's selected managed tests for the managed contracts.
 
 Dependency installation, network dataset downloads, credential prompts, or resource reads are not implied by an offline preflight. Explain them and obtain approval where needed.
 
-## Explicit approval before spend or mutation
-
-Approval is required before uploads, fine-tuning job creation/resume, deployment
-creation, session allocation, interactive recipes, sampling/inference, external
-tools, or cancellation/unload/deletion. Before the named operation, present:
-
-- Task, target tenant/subscription/project, exact model and region, and verified
-  access/role/quota prerequisites or unresolved checks.
-- Input provenance, license/privacy constraints, counts and hashes, and intended
-  upload destination. Do not expose populated endpoints or runtime identifiers.
-- Method, steps/epochs/tokens, evaluation/tool-call scope, timeouts, stop
-  conditions, and budget. State known pricing or unresolved cost uncertainty;
-  time and step limits are not dollar caps.
-- Expected artifacts, held-out evaluation and serving limitations, private
-  evidence retention, and cleanup responsibilities for every owned resource.
-
-Wait for explicit approval covering the operation and budget. "Help me fine-tune"
-is not blanket spend authorization. Do not provision or change permissions
-automatically. Obtain separate deletion confirmation; stopping monitoring is not
-cancellation, and closing a client is not remote unload.
-
-Recurring runs require explicit approval of frequency, models/data, evaluation
-scope, budget per run and over the approved period, expiry, owner, and disable/
-reconciliation procedure. Manual-run approval is not recurring-run authority.
-Follow [the paid smoke operator guide](PAID_SMOKE_TESTING.md); do not enable its
+## Paid execution: warn, then proceed
+
+When the user requests a training, evaluation, or sampling run, perform its
+required uploads, job/session creation or resume, checkpoint saves, and
+owned-resource cleanup without a separate spend-approval prompt. This applies
+to all users and environments, including Autopilot; it is not an internal-only
+exception.
+
+Before the first paid operation in the requested workflow, give one brief
+warning: **"This workflow uses paid cloud resources and may incur charges."**
+Include relevant cost information if readily available. Do not require a
+budget amount, cost acknowledgement, or pricing lookup, and do not block or
+repeatedly ask for approval because prices or a dollar budget are unknown.
+Respect any limits the user supplies; time, step, and token limits are not
+dollar caps.
+
+Keep the run scoped to the user's request and the selected recipe. Record the
+target, exact model/region, input provenance/counts/hashes, configuration, stop
+conditions, artifacts, and cleanup ownership in private runtime evidence.
+Explain meaningful scope choices briefly rather than turning them into a
+spending-approval handoff. Continue to validate data, eligibility, permissions,
+quota prerequisites, and required preview access; a cost warning does not
+replace those checks.
+
+Do not add unrequested deployments, resource provisioning, permission changes,
+external tools, or recurring work. Cancellation/unload within the requested
+run's stop and cleanup plan must target only its identified owned resources;
+save recoverable state first and verify the remote result. Obtain separate
+deletion confirmation. Stopping monitoring is not cancellation, and closing a
+client is not remote unload.
+
+Recurring runs require an explicit request naming the frequency, models/data,
+evaluation scope, expiry, owner, and disable/reconciliation procedure. A manual
+run request is not a request for recurring work. Follow
+[the paid smoke operator guide](PAID_SMOKE_TESTING.md); do not enable its
 workflow or change environment permissions automatically.
 
 ## Secrets and runtime state

PAID_SMOKE_TESTING.md

@@ -2,15 +2,17 @@
 
 The [smoke workflow](.github/workflows/smoke-testing.yml) runs real interactive
 training, not offline validation or held-out application-quality evaluation.
-It is opt-in. **Do not enable or dispatch it without named operation and budget
-approval.** Use [AGENTS.md](AGENTS.md) for the shared approval handoff.
+It is opt-in. **Enable or dispatch it only when explicitly requested.** Warn
+that the run uses paid cloud resources, include cost information if readily
+available, and proceed without a separate spending-approval or budget prompt.
+Use [AGENTS.md](AGENTS.md) for the shared execution policy.
 
 ## Configure and authorize
 
 An authorized repository/environment administrator must:
 
 1. Confirm the tenant/subscription/project, exact models and region, authorization,
-   capacity, and current prices. Successful sign-in or a listed region does not
+   and capacity. Successful sign-in or a listed region does not
    establish training eligibility. Follow the [access checklist](interactive_training/docs/auth.md).
 2. Review the [runner](interactive_training/scripts/run_recipe_smokes.py) and the
    [Tulu3 SFT](interactive_training/interactive_training/recipes/tulu3_sft/README.md)
@@ -27,23 +29,24 @@ An authorized repository/environment administrator must:
    secrets. Never print their values or place them in source, public logs, or
    issue/PR comments. This workflow requires both; do not silently switch its
    authentication method.
-5. Approve either a single manual execution or recurring authority naming the
-   cadence, models/data, evaluation/tool scope, budget per run and total period,
-   expiry, responsible operator, alerts, evidence storage, and cleanup plan.
-   The workflow does not enforce a monetary cap or approval expiry; an operator
-   must arrange spending alerts and disable it when authority expires.
+5. Configure the requested single manual execution. For explicitly requested
+   recurring runs, record the cadence, models/data, evaluation/tool scope,
+   expiry, responsible operator, evidence storage, and cleanup plan.
+   Respect any supplied spending limits; missing prices or a dollar budget do
+   not block a requested run. The workflow does not enforce a monetary cap or
+   expiry; disable it when the requested schedule expires.
 
 Keep repository variable `ENABLE_DAILY_TRAINING` unset or `false` until all
 prerequisites, including evidence retention, are satisfied. Setting it to exactly
 `true` enables **both** manual and scheduled jobs. The daily cron is `0 0 * * *`
-(00:00 UTC on the default branch; scheduling can be delayed). An approved manual
+(00:00 UTC on the default branch; scheduling can be delayed). A requested manual
 run uses Actions > Smoke testing > Run workflow on an approved ref and still
 requires the gate and environment approval.
 
-For single-run authority, enable the gate only for the approved dispatch window,
+For a single-run request, enable the gate only for its dispatch window,
 reject any unrelated scheduled/queued run at the environment review, and turn the
 gate off again immediately afterward. The current workflow has no manual-only
-enable switch; do not leave it enabled on the basis of one manual approval.
+enable switch; do not leave it enabled on the basis of one manual run request.
 
 ## What the bounds mean
 
@@ -59,7 +62,7 @@ enable switch; do not leave it enabled on the basis of one manual approval.
 
 The runner stops on child failure, timeout, or failed status verification.
 It uses unique log directories and rejects reuse. Check the current workflow
-and runner before approving changed commands; these limits describe today's code.
+and runner before changing commands; these limits describe today's code.
 
 ## Preserve private evidence before enabling
 
@@ -96,11 +99,13 @@ storage, grant permissions, or provide a finished exporter.
    to inspect primary, reference, and staged sessions from private run metadata.
    If metadata is missing, reconcile approved project state and ownership with
    the operator; never guess IDs or clean up shared resources.
-4. Obtain named approval for remote cancellation/unload and separate confirmation
+4. Cancel/unload only identified owned resources within the requested run's stop
+   and cleanup plan, after saving required state. Obtain separate confirmation
    for checkpoint/resource deletion. Verify terminal state and retained artifacts.
    Local client closure, training completion, unload, and deletion are distinct.
 5. Document remaining sessions/checkpoints/deployments and uncertain cost exposure.
-   Retry only after reconciliation, with fresh approval if scope/budget changed.
+   Retry only after reconciliation, within the requested scope and any supplied
+   limits. Do not expand the workload or schedule automatically.
 
 Neither green Actions status nor a `succeeded` session demonstrates held-out
 quality, serving readiness, or complete resource release.

README.md

@@ -60,9 +60,9 @@ See the [model and region registry](interactive_training/docs/supported_models.m
 | [Interactive training](interactive_training/README.md) | Interactive cookbook, recipes, and SDK guidance. |
 | [Interactive training docs](interactive_training/docs/README.md) | Setup, training concepts, checkpoints, and troubleshooting. |
 | [Interactive training recipes](interactive_training/interactive_training/recipes/) | Runnable SFT, reinforcement learning, preference, and distillation recipes. |
-| [Paid smoke operations](PAID_SMOKE_TESTING.md) | Opt-in workflow approval, spending bounds, private evidence, and recovery. |
+| [Paid smoke operations](PAID_SMOKE_TESTING.md) | Opt-in workflow setup, execution bounds, private evidence, and recovery. |
 
-**For coding agents:** start with [AGENTS.md](AGENTS.md) for source precedence, offline preflight, approvals, and secret handling. The two training paths are not interchangeable.
+**For coding agents:** start with [AGENTS.md](AGENTS.md) for source precedence, offline preflight, paid-run warnings, scope safeguards, and secret handling. The two training paths are not interchangeable.
 
 > [!NOTE]
 > **Before production:** evaluate quality and safety on held-out data and review model/data licenses. Samples are for experimentation. Training, tools, and serving may incur separate charges; clean up unused resources.

interactive_training/README.md

@@ -11,7 +11,7 @@ Examples and reusable training loops for the **Azure AI Fine-Tuning Sessions pub
 
 | Your goal | Start here | What you need |
 |---|---|---|
-| First end-to-end workflow check | [Quickstart](./docs/quickstart.md) | Python 3.11+, project access, model capacity, and a budget for a remote run |
+| First end-to-end workflow check | [Quickstart](./docs/quickstart.md) | Python 3.11+, project access, model capacity, and configured run limits |
 | Teach a model from good example responses (SFT) | [Tulu3 recipe](./interactive_training/recipes/tulu3_sft/README.md), then [your own data](./docs/custom-data.md#supervised-chat-data) | Labeled conversations and a separate evaluation set |
 | Optimize a measurable task reward (RL) | [Recipe chooser](./docs/recipes.md#choose-a-path), then [custom rewards](./docs/custom-data.md#reinforcement-learning-data-and-rewards) | Prompts, a trustworthy grader, and held-out tasks |
 | Learn from preferred/rejected responses | [DPO recipe](./interactive_training/recipes/preference/dpo/README.md) | Preference pairs |
@@ -24,7 +24,7 @@ Examples and reusable training loops for the **Azure AI Fine-Tuning Sessions pub
 > [!WARNING]
 > Training, evaluation, and sampling allocate or use remote compute and may incur charges. Package/tokenizer/dataset downloads also need network access. Code-execution, retrieval, and MCP recipes have additional prerequisites; read their guides before starting sidecars or tools. A successful smoke run is not proof of model-quality improvement or a production deployment.
 
-For coding agents, the repository's [execution contract](https://github.com/johnwu0604/fine-tuning/blob/main/AGENTS.md) identifies the safe verification path and operations that require explicit approval.
+For coding agents, the repository's [execution contract](https://github.com/microsoft-foundry/fine-tuning/blob/main/AGENTS.md) defines the offline verification path, nonblocking paid-run warning, and scope/cleanup safeguards.
 
 Shared text recipes default to **`Qwen/Qwen3.8-27B`**. Unless overridden,
 tokenization follows `model_name` and the renderer is selected for that model.

interactive_training/docs/README.md

@@ -9,7 +9,7 @@ Follow a complete learning journey, or use the reference pages for an existing r
 | Is this the right approach for my task? | [Concepts](./concepts.md) and [recipe chooser](./recipes.md#choose-a-path) | You can identify SFT, RL, preference learning, or distillation and its prerequisites |
 | How do I get one run working? | [Quickstart](./quickstart.md) | Imports/help pass, a bounded remote run writes metrics/checkpoints, cleanup is checked |
 | Does my project have the right access? | [Authentication](./auth.md), [models and regions](./supported_models.md) | Correct project endpoint, credential, model eligibility, and capacity |
-| How do I use my own data and rewards? | [Custom data](./custom-data.md) | JSONL renders locally with valid masks; the programmatic SFT launch reuses validated data only after approval; RL grader checks pass |
+| How do I use my own data and rewards? | [Custom data](./custom-data.md) | JSONL renders locally with valid masks; the programmatic SFT launch warns before paid execution and reuses validated data; RL grader checks pass |
 | Did training help, and how do I use the result? | [Evaluation and inference](./evaluation-and-inference.md) | Comparable held-out measurements and sampling from a saved checkpoint |
 | Where are my artifacts? | [Storage](./storage.md) and [dashboard](./dashboard.md) | Config, metrics, ledger, and sensitive artifacts can be located and interpreted |
 | How do I recover or free resources? | [Recovery](./training.md#resuming-after-an-interruption), [continual training](./continual-fine-tuning.md), [session management](./session-management.md) | The intended checkpoint/cursor is loaded; owned sessions are inspected and explicitly closed |

interactive_training/docs/auth.md

@@ -21,7 +21,12 @@ tenant, subscription, resource, project, model, and region:
 | Authorization | Applicable role permissions and scope for session creation, training, sampling, checkpoint access, and cleanup | A generic Reader grant or successful token acquisition |
 | Model and region | Current interactive eligibility for the exact base model and project region | A renderer existing in the cookbook or a historical benchmark |
 | Capacity and quota | The project's applicable training tier and model capacity/quota | A supported-region table or an assumption that retries will create capacity |
-| Spend and cleanup | Approved operation/budget, stop conditions, and who can unload the owned session | A local step limit or closing the HTTP client |
+| Run scope and cleanup | The requested workflow, stop conditions, and who can unload the owned session | A local step limit or closing the HTTP client |
+
+Spending is not a separate approval gate for a requested run. Warn that it uses
+paid cloud resources, include cost information if readily available, and proceed
+without requiring a dollar budget. This does not grant project permissions or
+replace required preview access.
 
 This preview guide does not specify a universal built-in role, quota amount,
 or read-only capacity check. Those must be confirmed for the actual project;
@@ -53,8 +58,8 @@ Then skip to [Option 1](#option-1--api-key-easiest-for-local-runs) or [Option 2]
 4. Finish the wizard and wait for deployment to complete.
 5. Create or select the project under that resource; copy its project endpoint.
 6. If using a key, retrieve it through the resource's **Keys and Endpoint** page.
-7. Confirm project authorization, selected-model capacity, and
-    budget before creating a training session. Resource creation may incur costs
+7. Confirm project authorization and selected-model capacity before creating
+    a training session. Resource creation may incur costs
     and is separate from the local cookbook installation.
 
 ## Option 1 — API key (easiest for local runs)

interactive_training/docs/benchmarks.md

@@ -135,7 +135,8 @@ accuracy.
 Each Interactive Training row references a recipe with its original
 hyperparameters and context. A recipe command is not a guarantee that current
 capacity, dependencies, model eligibility, and service behavior can reproduce
-the historical run. Check current support and explicit spend approval first.
+the historical run. Check current support and warn that a reproduction uses
+paid compute; no separate spending approval is required.
 For a new comparison, record the code/SDK version, dataset and evaluation
 contract, hardware/tier when known, timing boundary, failures, and actual
 artifacts; do not substitute a historical table for new measurements.

interactive_training/docs/contributing.md

@@ -73,7 +73,7 @@ when unavailable. The automated suite must not launch paid Azure training.
 Live examples and deployment checks require a separate, explicitly configured
 environment. Validate the cookbook against its pinned published SDK.
 
-For a documentation-only change, keep source, dependencies, tests, CI, and notebook code unchanged. Review the diff for scope, validate relative links **and anchors** (the existing link test checks paths), compile fenced Python examples, and bind command arguments to the actual `CLIConfig` without calling the launcher. Mock remote calls for helper contract/cleanup tests; never run a paid example to check syntax. Use the [repository execution contract](https://github.com/johnwu0604/fine-tuning/blob/main/AGENTS.md) for coding-agent safety boundaries. Report exactly what was tested and what still needs authorized live validation; neither mocked helpers nor an existing environment prove a fresh PyPI install or quality improvement. Keep temporary score reports, audits, and validation harnesses outside the repository; the public guides document supported workflows, not an agent's private analysis.
+For a documentation-only change, keep source, dependencies, tests, CI, and notebook code unchanged. Review the diff for scope, validate relative links **and anchors** (the existing link test checks paths), compile fenced Python examples, and bind command arguments to the actual `CLIConfig` without calling the launcher. Mock remote calls for helper contract/cleanup tests; never run a paid example to check syntax. Use the [repository execution contract](https://github.com/microsoft-foundry/fine-tuning/blob/main/AGENTS.md) for coding-agent safety boundaries. Report exactly what was tested and what still needs authorized live validation; neither mocked helpers nor an existing environment prove a fresh PyPI install or quality improvement. Keep temporary score reports, audits, and validation harnesses outside the repository; the public guides document supported workflows, not an agent's private analysis.
 
 Clear notebook outputs before sharing: they can contain session IDs, prompts,
 dataset text, and results from an older configuration. Do not relabel historical