amadan
pricing: rule that store egress charges only observed usage
The only affordable source for per-tenant object-store transfer is S3 access logging, and AWS may omit a record permanently. Duplicates can be removed and unreadable days refused, but an omission is undetectable by construction. Pauls ruling (2026-09-10): charge only what we verifiably observed, and publish that we do. Store egress may undercount, it errs the customers way, and no page claims it is a complete measurement. It is the one meter whose stated contract is at least this much happened. CloudTrail stays rejected for now and the plan corrects my earlier claim that it is exactly-once; it is at-least-once. Plan two is marked as needing a fourth design round, and plan one is executed first.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2 files changed,
+41
−0
docs/superpowers/plans/2026-09-10-store-egress-and-durability-meters.md+17 −0docs/superpowers/specs/2026-09-07-carloku-pricing-plans-design.md+24 −0
CI passed — run details
diff --git a/docs/superpowers/plans/2026-09-10-store-egress-and-durability-meters.md b/docs/superpowers/plans/2026-09-10-store-egress-and-durability-meters.md| index b85fba70f..7b1445864 100644 |
| --- a/docs/superpowers/plans/2026-09-10-store-egress-and-durability-meters.md |
| +++ b/docs/superpowers/plans/2026-09-10-store-egress-and-durability-meters.md |
| @@ -12,6 +12,23 @@ |
| **Depends on:** `docs/superpowers/plans/2026-09-08-invoice-grade-statements.md` (plan one), for `usage.MeterSource`, `SourceDays`, statement closure, and the daily census this plan reuses for replica ownership. Do not start until it has landed. |
| +> **STATUS: needs a fourth design round before execution (2026-09-10).** |
| +> Three review rounds closed most findings but left contracts unsettled: |
| +> collection scheduling and finalisation, concurrency on a rewritten day, the |
| +> classification policy, and the exact set of replication operations a write |
| +> means. Those are contracts, not code, and writing them is the next step. |
| +> |
| +> **Two rulings now fixed, which that round starts from.** Paul, 2026-09-10: |
| +> store egress **charges only verifiably observed usage and the books say so** |
| +> — see the spec's "Object-store egress is measured best-effort" section; it |
| +> may undercount, it errs the customer's way, and no page claims it is |
| +> complete. And **plan one is executed first**, both because it ships value |
| +> alone and because doing it will teach us things this plan should absorb. |
| +> |
| +> A correction carried from round three: CloudTrail is **at-least-once**, not |
| +> exactly-once. Anywhere this plan offers it as an upgrade path, it is a more |
| +> complete source that still needs its own deduplication design. |
| + |
| ## Global Constraints |
| - **Access logs are customer-shaped.** They carry object keys, client IP addresses and user agents. `infra/modules/deployment-buckets/main.tf:8-10` states the deployment bucket holds "routing metadata only — nothing customer-shaped rests here". Logs therefore land in a **dedicated log bucket in the deployment's own region**, and only aggregates — bytes and counts — reach the deployment bucket. No console view ever renders a raw log line. |
diff --git a/docs/superpowers/specs/2026-09-07-carloku-pricing-plans-design.md b/docs/superpowers/specs/2026-09-07-carloku-pricing-plans-design.md| index ff148d8bf..715bde211 100644 |
| --- a/docs/superpowers/specs/2026-09-07-carloku-pricing-plans-design.md |
| +++ b/docs/superpowers/specs/2026-09-07-carloku-pricing-plans-design.md |
| @@ -612,6 +612,30 @@ revenue. Estimates are labelled estimates. Following Eleven: *the formulas are |
| the contract; the numbers are re-derived whenever prices or input rates |
| change.* |
| +### Object-store egress is measured best-effort, and says so (Paul, 2026-09-10) |
| + |
| +The only affordable source for per-tenant object-store transfer is S3 server |
| +access logging, and AWS states plainly that it may omit a record permanently. |
| +Duplicates can be removed and unreadable days can be refused, but an omission |
| +is undetectable by construction — there is nothing to detect. |
| + |
| +The ruling: **charge only what we verifiably observed, and publish that we do.** |
| + |
| +- Store egress may undercount. It errs in the customer's favour, always. |
| +- The books page says so in those words. It never claims store egress is a |
| + complete measurement, and no page presents it as one. |
| +- This is the one meter whose stated contract is "at least this much |
| + happened", rather than "this is what happened". |
| + |
| +The alternative was CloudTrail data events, rejected for now: it is more |
| +complete but still at-least-once, costs $0.10 per 100k events, and would need |
| +its own deduplication and reconciliation design. If the requirement ever |
| +becomes complete accounting rather than verified observation, this ruling is |
| +what changes first, and that is a different spec. |
| + |
| +Edge egress, compute and storage are unaffected — they are measured from our |
| +own collectors, not from a best-effort log stream. |
| + |
| ## The review promise |
| The 2026-08-13 spec committed only to re-deriving numbers whenever inputs |