The per-call USD cost was computed at the adapter, emitted to the
cora.agent.llm.cost.usd histogram, and then discarded: the meter
existed, the ledger sink did not. Budget enforcement (unpaused
2026-07-11) needs a durable per-(agent, window) spend fact to sum, and
the inference entry is its natural home, since it already carries
agent_id, occurred_at, and the token counts the cost derives from.

Each LLM producer (RunDebriefer, CautionDrafter, regenerate slice) now
recomputes the cost via compute_cost_usd, the same pure function behind
the histogram, and carries it on AgentInferenceTrace through the
append_inferences slice onto a new nullable cost_usd column. Legacy
rows stay NULL ("not recorded then", distinct from a true $0 call).
Additive everywhere: command, REST body, MCP tool, migration, and the
regenerated OpenAPI snapshot.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The budget gate needs one question answered before it permits an LLM
call: how much has this agent already spent in the cap's window. This
adds the cross-BC port that answers it, in the exact shape of the
start_run lookup family: consumer-shaped Protocol + frozen result VO +
always-pass stub in cora.infrastructure.ports, production adapter
shipped by the BC that owns the data. Decision BC owns the durable
spend fact (entries_decision_inferences carries agent_id, occurred_at,
token counts, and now cost_usd), so PostgresSpendLookup lives in its
new adapters package and SUMs directly; a proj_agent_spend read model
stays deferred-with-trigger until the gate's read shows up in p95.

The port is window-agnostic (the consumer computes half-open bounds
per cap) so a future award-window allocation is a consumer-side change
only. NULL costs and missing token counts sum as zero, keeping the
coarse tier permissive rather than spuriously blocking. Kernel default
is AlwaysZeroSpendLookup, so declared caps cannot block tests that
don't exercise gating.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The declared AgentBudget caps were recorded-only: nothing read them at
invocation, and, worse, a Suspended agent kept making LLM calls, since
the subscribers checked only Access-level Actor deactivation. The
operator-pause story (suspend on cost overrun, tighten, resume) was a
recorded intention, not a control. Enforcement was unpaused by explicit
user decision on 2026-07-11; this is the coarse post-hoc tier of the
enforcement ladder for the two serialized subscriber agents.

Two per-apply gates in RunDebriefer and CautionDrafter, mirrored:

- Suspension gate (pre-lease): a Suspended agent takes no actions, no
  LLM call, no Decision, until resumed. One Agent fold serves both
  gates.
- Budget gate (post-lease, so only the lease winner pays the lookup):
  cora.agent._budget_gate sums recorded spend via SpendLookup over the
  cap's UTC calendar window (month for monthly_usd_cap, day for
  daily_token_cap), computed from the terminal event's occurred_at so
  replays gate identically. A breach skips the call and records the
  refusal as the Run's deferred Decision (DebriefDeferred / NoAction,
  failure_error_class AgentBudgetExhausted), preserving the
  one-Decision-per-terminal-Run invariant so operators see WHY.

Overspend is bounded to about one in-flight call per caller, the
documented coarse-tier bound. A zero cap now refuses every call,
making the AgentBudget VO's recorded no-spend intent real. The
per-call pre-estimate tier for the steering brain follows separately
(it needs a neutral port; Operation BC cannot import the Agent BC
gate).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Five-reviewer panel (3 baseline + security + test) on the four metering
slices surfaced MAJORs that all trace to one theme: the gate must be as
trustworthy as the caps it enforces.

- Cache-write pricing corrected to 2x base: producers pin 1h-TTL cache
  breakpoints and Anthropic bills 1h writes at 2x, so the old 1.25x
  tier under-metered exactly the calls CORA makes most.
- Lifecycle gate is Versioned-only (was Suspended-only): Defined means
  "not yet ready for invocation" and Deprecated is terminal per the
  AgentStatus contract, so both now skip, not just Suspended. The
  integration seeds gained an explicit bootstrap-then-promote step
  (promote_seeded_agent) mirroring the production ceremony the
  cost-overrun scenario already documented.
- Operator regenerate now refuses for a SUSPENDED agent
  (AgentSuspendedError): suspend means stop on every path, not just the
  subscriber path. Budget stays deliberately ungated there (an
  accountable human asked; the call is still metered and debited), now
  pinned by test.
- Spend SUM overflow-proofed (numeric cast + bigint clamp) and the
  append_inferences boundary bounded (token le=1e9, cost finite
  nonnegative) so one hostile row cannot poison a window.
- Migration CHECK rejects negative/NaN/infinite cost_usd at the ledger.
- Docstrings now carry the trust boundary (producer-supplied agent_id
  unbound to principal, follow-up owed), the fail-closed lookup-error
  posture, and the steering brain's ungated-and-unledgered deferral.

Test retrofit: versioned seeds throughout, factory wiring pins for
spend_lookup on both subscribers, half-open window boundary rows and
agentless-row exclusion on the Postgres lookup, deprecated-skip and
under-cap-proceeds parity on both subscribers.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>