resource-control/docs/evidence/RESOURCE-WP-0002-T07-control-loop-2026-08-14.md

RESOURCE-WP-0002-T07 — fin-hub feed and optimization loop — 2026-08-14

Result

The backup resource is live and proven, so the loop it exists to feed can now run on real evidence instead of a model. T07 closes the cycle: observation → thresholds → normalized fin-hub evidence → decided optimization case.

Artifact	Purpose
data/actuals/2026-08.json	First real monthly observation for platform:audit-storage
data/thresholds/platform-audit-storage.json	Budget variance, abnormal growth, stale backup, and unused-commitment thresholds
tools/thresholds.py, make thresholds PERIOD=…	Fail-closed threshold evaluation
tools/financial_exchange.py usage, make exchange-usage	Normalized technical-usage evidence to fin-hub
data/optimization/platform-audit-storage-2026-08.json	The A/B/C case, now approved and executed
data/resources/platform-audit-storage.json	ordered → active, commissioned 2026-08-14

The first period is honest about being four hours long

The bucket was created 2026-08-14T16:21:56Z and the first backup completed at 18:14:21Z. The 2026-08 row therefore covers about four hours of operation, and says so. What is measured:

Proxy	Value	Source
database_gb	0.6365	PGDATA 636 485 632 B
stored_gb	0.0066	8 objects, 6 604 031 B in platform-pg/
backup_success_pct	100	1 of 1 completed backups
restore_rto_minutes	1.08	65 s full restore; PITR the same

Five proxies are null, each with a named owner in measurement_gaps: WAL is not separable from the base backup in the archive, restore egress bytes were not recorded, no request metric is exposed to the scoped key, no invoice exists, and no time record was kept for the procurement and drill work.

internal_labor_hours being null deserves a note: real operator hours were spent this period on procurement, credential custody, and two restore drills. Recording zero would have been false, and estimating would have been invention. It is null with the reason attached, and the next period starts a time record.

Why August produces no variance

make variance ACTUAL=data/actuals/2026-08.json returns no-forecast for the period. The decision forecast begins at 2026-09, because the resource was not expected to exist in August. This is the correct answer, not a defect: August is a commissioning baseline and 2026-09 is the first comparable month.

The threshold run reflects the same thing without pretending. Of nine thresholds: two within, one not_applicable, six unmeasured, zero breaches.

• within — stale-backup (100%) and restore-rto-regression (1.08 min against a 3.24 min limit). These are the two things that were actually proven.
• not_applicable — unused-commitment. Scaleway Multi-AZ is usage-based with no commitment, so there is nothing to under-use. Distinguished from passing.
• unmeasured — everything requiring an invoice, a request metric, a WAL split, or a forecast row.

unmeasured is deliberately not within. A threshold that silently passes on absent evidence is worse than no threshold: it reports safety it never checked.

Thresholds set

Budget variance at 10% on infrastructure and 1 hour on labour; abnormal growth at 20% on stored bytes and WAL; any egress not explained by a recorded drill; backup success below 100% on any single run, not averaged across a month; WAL archive gap above 15 minutes, three times the 5-minute archive_timeout beyond which the RPO requirement fails; restore RTO above 3.24 minutes, three times the measured baseline.

Two are declared rather than active. wal_archive_gap_minutes needs an archive health metric from rapp-postgres. No euro budget ceiling exists: Scaleway has no hard spend stop, the founder's email alert is the accepted backstop, and an authoritative ceiling belongs to fin-hub.

Feed to fin-hub

financial_exchange.py usage emits technical_usage records under the contract's resource-control-to-fin-hub direction: resource, service, workload, attribution key, period bounds, usage proxies, service evidence, and valued internal labour — with measurement_gaps carried through so fin-hub sees why a field is empty.

Infrastructure cost is absent by design. fin-hub owns the booked fact; an uninvoiced period has no amount to send, and a null is never normalized to 0.00.

The optimization case is now decided

opt:platform-audit-storage:2026-08 moved from blocked_on_evidence to approved, approver "founder (human financial authority)", 2026-08-14.

The schema gained excluded / exclusion_reason on an option, because the real decision exposed a modelling gap: Host Europe never supplied written terms, and the deciding authority chose to exclude it rather than delay recovery capability indefinitely. Before this, an unevaluable alternative blocked its case forever, which would have left the record claiming no decision had been made while the bucket was in production. An excluded option no longer blocks, keeps its recorded unknowns, and must state what would bring it back.

Hetzner remains a fully costed reject at €29.14/month dearer. The rationale records two accepted risks at decision time: no euro hard-stop at Scaleway, and the independent second copy required by the correlated-failure rule still outstanding as T06.

Boundary held

No booked cost was originated. The resource record moved to active on operational fact — production backup enabled, ContinuousArchivingSuccess, both restores verified — not on the purchase. Implementation of anything the case approves is delegated to railiance-platform and rapp-postgres.

Standing dependency

Total cost stays unknown until Scaleway invoices and fin-hub books it under FIN-WP-0004. The loop runs monthly regardless; 2026-09 is the first period that will produce real variance.