E13: Cost read-overlay

[gnanirahulnutakki]

Goal. give the fleet a cost dimension by reading OpenCost per cluster and rolling it up at the hub into per-workspace/team views (with GPU columns) — filling the documented OSS fleet-cost gap without building a metering or optimization engine.

Phase / depends. fast-follow (P3) · Depends on: E2 (cost is another fleet-fact kind). This is a read integration; it never meters, bills, or mutates clusters.

Capabilities: cost analyzer — OpenCost fleet rollup + GPU columns (read overlay).

Features

• F13.1 — OpenCost per-cluster read adapter
• F13.2 — hub fleet rollup
• F13.3 — GPU cost columns
• F13.4 — freshness + non-goal guard

Exit criteria

• Per-cluster OpenCost is read into cost facts; a per-workspace/team fleet rollup exists with coverage + freshness; GPU columns appear where DCGM exists.
• The overlay never writes, meters, or optimizes — cost is a read dimension of the fleet model.

---

Source: docs/EPICS.md, docs/SITH-NOTION.md · part of the Sith implementation backlog (see the master roadmap issue).

[gnanirahulnutakki]

F13.1a is now tracked in #282: a bounded, offline, USD-only namespace allocation projector grounded in OpenCost v1.120.2. It performs no network access, hub rollup, billing, optimization, mutation, or GPU-efficiency inference; #31 remains open for F13.2-F13.4 and the transport layer.

[gnanirahulnutakki]

F13.1a landed through PR #283 at dev merge 3d45529624a275652d4c6793271859dfe5add152.

The landed scope is deliberately limited to the bounded, deterministic, offline OpenCost namespace-allocation projector. The signed feature head remains preserved as the second merge parent. Exact post-merge CI run 29670633887 and CodeQL run 29670633755 are green; hosted CodeRabbit has 0 review threads; final Dependabot/code/secret-scanning queues are 0/0/0.

This does not complete F13.1 or E13. F13.1 still needs an authorized read-only transport/integration boundary and explicit coverage reconciliation. F13.2 workspace/team rollup, F13.3 GPU efficiency/DCGM/MIG, and F13.4 freshness objectives remain open and dependency/design gated.

[gnanirahulnutakki]

F13.1 live-transport design escalation — 2026-07-18

The bounded projector in #282 is landed, but a live per-cluster adapter cannot choose an access or
authentication path truthfully from the current contract.

Primary-source evidence:

• OpenCost documents the API at localhost:9003 and recommends an operator-run
  kubectl port-forward; it also says an installation may instead expose a Service or Ingress:
  https://opencost.io/docs/integrations/api/
• The installation guide likewise uses a Service port-forward:
  https://opencost.io/docs/installation/install/
• Sith has three materially different environments: local kubeconfig mode, the Hub, and the
  security-held OCM path (P1: Implement pinned OCM ClusterGateway snapshot transport #103/P0: Block ClusterGateway transport until upstream strips inbound Authorization before MSA proxying #104). No repo contract selects which environment owns OpenCost
  discovery, endpoint construction, or authorization.

Options:

1. Recommended: keep the normalization/rollup core transport-free. Define one explicit
   per-scope read-transport boundary, then implement operator-initiated local port-forward access
   separately from a brokered Hub implementation after P0: Block ClusterGateway transport until upstream strips inbound Authorization before MSA proxying #104 is resolved. The core never accepts
   arbitrary URLs or owns credentials.
2. Accept a caller-configured URL and HTTP client. Flexible, but this creates an SSRF, redirect,
   credential-forwarding, TLS, and endpoint-provenance boundary that the current repo does not
   authorize.
3. Use the Kubernetes API Service proxy. This requires additional services/proxy RBAC, is not
   the documented local access path, and does not solve the held OCM transport.

GR confirmation is needed on the owning runtime and authentication model before a live client is
committed. F13.1 transport remains design/security blocked; no endpoint, credential, RBAC grant, or
network path will be guessed.

Per the blocker protocol, work pivots to the next independent seam: a bounded workspace-only
rollup over explicit successful per-scope snapshots. That slice will distinguish a successful
empty allocation set from a missing cluster and surface coverage without adding transport,
persistence, team attribution, or a stale-time objective.

[gnanirahulnutakki]

F13.2a is landed and child #284 is complete through #285.

The landed slice preserves successful-empty per-scope OpenCost reporting and computes one deterministic exact-decimal workspace USD rollup with explicit expected, reported, empty, missing, and complete coverage. It is an offline value-only core.

Proof is bound to merge commit f3e00f4: exact-head CI 29672331770 and CodeQL 29672330956 passed; exact post-merge dev CI 29672650029 and CodeQL 29672649903 passed; hosted CodeRabbit has 0 review threads; final security queues are 0/0/0.

No F13.2 or E13 completion claim: the live F13.1 access path still needs the owner/security choice recorded above, and the repo still lacks accepted runtime composition, persistence, canonical team attribution, UI/API, freshness, F13.3 GPU, and F13.4 stale-data contracts. No endpoint, credential, RBAC grant, transport, or team mapping was guessed.