feat: prepare default-disabled fleet budget admission ledger

[jaywedgeworth22]

Scope

Prepares the server-side foundation for #1602. This draft does not close the issue or activate a Kody caller. Shared workflow PR congress-trading-shared#336 and caller #1603 are unchanged.

• Add one durable SQLite/Prisma fleet ledger with integer micro-USD accounting. SQLite write acquisition, reservation and counters form one atomic transaction across concurrent clients.
• Preserve the issue's Chicago-day policy: DeepSeek primary below $0.50, MiniMax primary afterward with DeepSeek fallback, and a $1.50 DeepSeek ceiling. Configuration may lower these limits, never raise them.
• Add default-disabled GET/POST /api/ingest/fleet-budget with dedicated server-bound client identities, explicit price provenance/freshness, bounded bodies and no inherited ingest/read/session authority.
• Split reservation from one-shot dispatch. Replayed/expired/lost dispatch responses never grant a second call. Recheck time after acquiring the lock and after commit; leases end at Chicago midnight.
• Retain timeout/crash/missing-usage liabilities, make reconciliation idempotent, and permit cancellation only before dispatch. Overruns persist actual observations and latch new DeepSeek work off across midnight.
• Separate MiniMax's zero routing weight from estimated costs, unverified provider-reported amounts, unresolved exposure and coverage.

Assumptions and remaining gates

Policy values come from #1602 and are code defaults for review, not an activation approval. Calls and late settlements are attributed to the admission day. Outstanding reservations count toward the soft transition. No model price is preconfigured.

FLEET_BUDGET_ENABLED and FLEET_BUDGET_ADMISSION_ENABLED both default off. Admission can be stopped while settlement continues. No provider call, credential/protected-environment setup, permission change, merge or deployment was performed.

A trusted shared proxy must still enforce the actual payload/input/output ceiling and obtain a separate permit for every provider request/retry. It must validate the receipt's expiry immediately before upstream invocation and map cache/reasoning/streamed usage correctly. The server cannot enforce a caller that bypasses this contract. Pricing verification, client/security setup, existing usage-telemetry integration, operational recovery, reviewed rollout and rollback remain gates before activation. Do not automatically reclaim ambiguous liabilities.

Verification

• 33 focused synthetic tests pass, including 19 independent SQLite clients, exact thresholds, duplicate calls, one-shot dispatch, late/uncertain settlement, global overrun latch, cost coverage and DST.
• Scoped ESLint, full TypeScript and production build pass on the final candidate.
• Startup configuration and migration-safe harness pass all five scenarios. Independent base-to-candidate populated migration/rerun preserves existing data with clean integrity/foreign keys.
• Independent review additionally exercised cancel/dispatch races, concurrent/conflicting settlements, post-commit response loss, 20,000 bounded-cost cases and 730 day boundaries. Its expired/midnight dispatch finding was fixed and repro-tested.
• Full local verify reached 2,397 passing tests but 39 existing database suites require the missing sqlite3 CLI. Two unrelated Datadog environment-sensitive failures pass in an isolated rerun (35 tests) with the cloud's DD_SERVICE unset. This is not a claimed full aggregate pass; exact-head hosted checks remain required.

Coordination

Board 93ce23c98f8944bbb9d9750876a1e47c is in progress. App and agent-sync reservations were posted. Only relevant code/schema/test and visual-fixture files are included; task notes are here. SDK #1611, reporter #1612 and iOS #1614 remain separate. Keep this PR draft and keep #1602 open until the remaining integration and rollout work is complete.

Read-only monitoring and review follow-up

Current head adds a session-only Money-page Fleet Daily Budget card, explicit read timestamp, disabled/paused/blocked states, exact micro-USD formatting and per-provider unknown/estimated/unverified-report coverage. No activation controls are exposed. A ten-second read deadline clears stale figures and leaves a working Retry action. Cookie auth is checked with the existing verified helper; middleware and dedicated mutator authentication are unchanged.

The HTTP helper now has an explicit server-only marker and typed public test port. Static test SQL uses tagged APIs. Persisted price snapshots and stored bounds are revalidated, and SQLite retry time has a monotonic total budget. Dedicated budget tokens grant trusted gateway/settlement authority, including the ability to fail closed for the fleet after a reported overrun. They must never be issued to ordinary telemetry producers, end users or untrusted model inputs. A lower-trust settlement path needs independently verified provider evidence or separate authority; clamping genuine overruns would hide spend and is not used. Requests that do not fit the selected provider fail explicitly; they do not silently select an unchecked paid fallback.

48 focused tests, full TypeScript, scoped lint, production build and an independent exact-delta review pass. Backend checkpoint e496c40 passed all hosted verify/coverage, Docker, E2E, CodeQL, gitleaks and pin gates. The changed Money layout and new mobile/desktop fixtures still require runner-generated visual baselines and screenshot inspection; that is pending and is not claimed as passed. New UI board reservation:33a735da221040e8aac60ce4a44bed4a.

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[kody-ai]

Public API boundary omission in src/index.ts leaves the intended fleet-budget HTTP, ledger, and policy surface undefined, while the Vitest suites do not validate the same package-entry imports. Re-export the fleet-budget HTTP, ledger, and policy APIs from src/index.ts, or remove exports not intended to be public, and make the Vitest suites import the public surface through that same package entry point.

Kody rule violation: Every exported schema or utility ships with tests and must typecheck

[kody-ai]

❌ Error processing validation

An error occurred while processing the system response. Please try again.

Details

• Analyzer execution failed: Timeout after 120000ms in business-rules-analyzer-attempt-1

---

💡 This validation runs automatically only on the first review of a pull request. To run it again, comment @kody -v business-logic.

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[kody-ai]

NBSP policy violation in SENTENCE_GAP: the sentinel combines \u00a0 with a space despite Rule 6’s explicit prohibition on NBSP in source files. Replace it with two literal ASCII spaces and preserve the visible gap with appropriate whitespace styling if the browser would otherwise collapse it.

Kody rule violation: Use two spaces between sentences in every human-facing string and agent-written paragraph

[kody-ai]

❌ Error processing validation

An error occurred while processing the system response. Please try again.

Details

• Analyzer execution failed: Timeout after 120000ms in business-rules-analyzer-attempt-1

---

💡 This validation runs automatically only on the first review of a pull request. To run it again, comment @kody -v business-logic.

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[kody-ai]

❌ Error processing validation

An error occurred while processing the system response. Please try again.

Details

• Analyzer execution failed: Timeout after 120000ms in business-rules-analyzer-attempt-1

---

💡 This validation runs automatically only on the first review of a pull request. To run it again, comment @kody -v business-logic.