feat(budget): sliding-window cost accounting for agent exchanges - #1

Decision D5 of wayfinder #7 says only agent-triggered turns consume
budget. Implementing it surfaced a gap: the kind 44200 turn metric has
no field naming the author that caused the turn. Its payload is harness,
model, channel_id, session_id, turn_id, turn_seq, timestamp, turn,
cumulative, delta_reliable and stop_reason — nothing about the trigger.

TriggerLog recovers it without a wire-format change, using a property
buzz-acp already guarantees: turns are serialised per channel, and all
pending events for a channel drain into one batch. So the messages seen
in a channel since its last turn are that turn's trigger.

A batch mixing human and agent messages counts as human. D5 exists to
protect the case where a person is present and watching; charging that
turn risks muting an agent mid-conversation with its owner. Erring the
other way costs a runaway one extra turn before it trips.

Attribution is best-effort and fails open: an observation gap yields
None, which is not charged, so a dropped subscription disables the
budget rather than tripping it. The durable fix is a trigger field on
NIP-AM, which the spec's forward-compatibility rule already permits.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013okf5qYe8U8zja6wPBAL2y

Ledger charges a pair; TriggerLog attributes a turn. Held separately, a
caller has to remember to attribute before charging and to prune both on
the same schedule. Supervisor owns that sequencing so it cannot be got
wrong, and gives the crate one entry point instead of two loose halves.

Adds the integration coverage the pieces lacked. The end-to-end runaway
now has a test: two agents alternating at $0.30 a turn trip the $5
budget on the seventeenth charged turn. So does the failure this policy
must never cause — two hundred consecutive owner-driven turns at $1.50
each, none blocked, nothing charged.

Also covers a human joining a runaway mid-flight, which makes that turn
free because the mixed batch attributes to the human; separate pairs in
one channel not pooling budget; and an unobserved turn failing open.

Writing the runaway test caught a real arithmetic error in its own
expectation, not in the code: $5 at $0.30 a turn first exceeds budget on
the seventeenth charge, not the eighteenth.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013okf5qYe8U8zja6wPBAL2y

The crate could account and attribute, but nothing connected it to real
data. charge_from_metric decrypts a kind:44200 event with the owner's
keys and extracts channel, agent, cost and end-of-turn timestamp.

Kept in its own module because it is the only part of the crate that
knows about Nostr. Ledger and TriggerLog stay testable on plain values
with no keys and no events, which is why they have the coverage they do.

Tests build real signed events with buzz-core's own encrypt helper and
round-trip them, so this is checked against Buzz's actual wire format
rather than a hand-rolled fixture. A stranger's key fails closed, an
unrelated kind is rejected before any decrypt attempt, and missing or
malformed channel ids and timestamps are errors rather than silent
defaults.

Notable while writing it: decrypt_agent_turn_metric already rejects
negative and non-finite costUsd per NIP-AM, so the ledger's own guard
against a refund is defence in depth rather than the only barrier.

delta_reliable is surfaced on TurnCharge rather than swallowed — #7
OQ7.1 asks how often it is false, and that cannot be answered if the
ingest layer discards it.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013okf5qYe8U8zja6wPBAL2y

Two real bugs, one security and one correctness, plus the documented
standards this crate was skipping.

Security: charge_from_metric took turn_end from the agent's own
encrypted payload and never checked it. AgentTurnMetricPayload::validate
covers only the numerics, so a metric dated in the future moved the
ledger's eviction cutoff forward and wiped the pair's whole window — the
budgeted agent could zero its own budget at will. The payload timestamp
is now tied to the signed created_at within a 300s tolerance.

Correctness: TriggerLog consumed the batch per channel rather than per
agent, so with two agents in one channel whichever metric was processed
first ate the other's trigger and the second turn went uncharged. Relay
reordering alone disabled the budget. Consumption is now tracked per
(channel, agent) with independent cursors.

The spec axis found a third defect that per-agent cursors do NOT fix:
the metric's timestamp is end-of-turn and the payload carries no start,
so a message arriving mid-turn is attributed to the turn it did not
trigger, and one owner message can free two turns. It errs toward
under-charging like every other approximation here, and the durable fix
is a turn-start or trigger field on NIP-AM. Documented rather than
papered over — it is a second argument for #7 OQ7.5.

Both reviewers independently flagged Verdict::Allow{spent_usd: 0.0} on
human and unattributed turns as a lie: the pair may hold $4.90, and a
caller logging spend would see a sawtooth already collapsed to zero.
Replaced with an explicit Unbudgeted variant.

Standards: adds deny(unsafe_code) and warn(missing_docs) per
CONTRIBUTING.md, documents the public API those lints then surfaced, and
registers the crate in the AGENTS.md crate map.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013okf5qYe8U8zja6wPBAL2y

The spec-review agent cited agent_turn_metric.rs:107 for the end-of-turn
timestamp and I carried that into origin.rs without opening the file.
Line 107 is turn_seq documentation; the RFC 3339 end-of-turn line is 111.

Every other cross-crate citation in the crate was re-checked by opening
the cited line: buzz-acp/src/lib.rs:192 (is_owner_or_sibling),
buzz-acp/src/queue.rs:1-7 (per-channel serialisation),
agent_turn_metric.rs:86 (forward-compatibility rule) and :1-5 (NIP-44
addressing). All four hold.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013okf5qYe8U8zja6wPBAL2y

Two gaps the spec review found, both now closed.

D4 justifies a self-healing window by the sawtooth it leaves in the
logs — "a diagnosable signature rather than a silent drain" — but the
crate had no tracing dependency and emitted nothing, so the signature
the decision rests on did not exist. Exhaustion now logs at warn with
the pair, spend and budget; ordinary charges log at debug.

delta_reliable was populated by the ingest layer and read by nobody, so
D2 charged unreliable deltas at face value with no seam for the fallback
OQ7.1 asks about. on_turn_charge takes a wire-decoded TurnCharge, warns
when the publisher lost its cumulative baseline, and still charges —
because OQ7.1 is genuinely undecided and its suggested fallback needs
cumulative, which TurnCharge does not yet carry. Explicit and logged
beats silent, and it lets the question be answered from real data.

Both behaviours are tested rather than left accidental.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013okf5qYe8U8zja6wPBAL2y

…sing

The verification gate is right that tests are not runtime evidence. This
example launches the supervisor with a real tracing subscriber and shows
what an operator would actually see.

Two of D4's claims hold under observation. Forty consecutive
owner-driven turns at $2.50 each: zero blocked, zero charged. After the
window slides, spend resets and the verdict returns to Allow with no
reset step.

The third does not. D4 justifies the design by predicting "a runaway
stops within minutes and restarts only to stop again, producing a
sawtooth in the logs — a diagnosable signature rather than a silent
drain." Running it produces no sawtooth: spend climbs monotonically from
$5.40 to $18.00 across 22 consecutive WARN lines, because nothing acts
on the verdict.

The sawtooth is a property of enforcement, not of accounting. Until an
enforcer exists the signature is a continuous alarm, which is arguably
worse for diagnosis than the silent drain it was meant to replace. That
is a flaw in the decision's reasoning rather than in this code, and it
is recorded on the ticket.

spent_usd is logged raw rather than rounded. The float noise is real
data and these are structured events meant for machine aggregation;
rounding at the emit site would lose precision for no gain.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013okf5qYe8U8zja6wPBAL2y

The spec-review agent flagged it as unrequested; spot-checking that
claim found exactly one caller, and it was the test asserting on it.
A public accessor whose only consumer is its own test is not API, it is
speculative generality.

The test it existed for still matters — both argument orders must reach
one budget — so it now asserts that directly by hashing both keys into a
set, which is closer to how PairKey is actually used.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013okf5qYe8U8zja6wPBAL2y

… field addition