Spend Path Scan

---
name: spend-path-scan
description: "Paid-API spend: aggregate caps, unit counters, provider limits; schedules and polls on billed calls (PS, FQ)."
kind: skill
pack: finops
allowed-tools: [Read, Grep, Glob, Bash]
---

# Skill: spend-path-scan

## Premise

A paid API bills per call, per token, per message or per lookup, and nothing in the code bounds the **month**. A per-call cap bounds one request; a per-user limit bounds one user; neither stops a bug, a retry loop or a busy tenant from spending the org's budget by Tuesday (OWASP LLM10:2025 calls the LLM case "denial of wallet"). The same billing model turns frequency into money: a poll every 2 s × 4 replicas × one billed call is 172,800 calls a day whether or not there is work. This skill inventories every paid dependency, then asks two questions of each: is the **aggregate** bounded, counted and backstopped (PS), and does a **schedule or poll** multiply its calls (FQ)?

**Every finding cites the paid dependency (§ 0 inventory line, with its billing model) + the entry point that reaches it + the missing control or the multiplier `runs/day × replicas × calls/run` + the oracle.** A grep hit is a candidate; a frequency alone is never a finding (precedents § 17). Verification follows [`refute-before-report.md`](../../../../snippets/refute-before-report.md) with [`precedents/finops.md`](../../../../snippets/precedents/finops.md); the oracles are [`proof-oracles.md`](../../../../snippets/proof-oracles.md) § FinOps, V578–V582.

| § | Class | What is wrong | Oracle |
|---|---|---|---|
| 0 | — | the paid-dependency inventory: SDKs, hosts **and configured base URLs** | — |
| 1 | PS-1 | no aggregate (org/month) cap or kill switch before a paid call | **V578** |
| 2 | PS-2 | no billed-unit counter per dependency, or one without a tenant/feature dimension | **V579** |
| 3 | PS-3 | the provider-side spend limit is not declared or read back | **V580** (documentary) |
| 4 | FQ-1 | a schedule or poll × replicas against a per-call billed dependency | **V581** |
| 5 | FQ-2 | queue short polling (`WaitTimeSeconds` absent or 0) | **V582** |
| 6 | FQ-3 | a busy loop around a billed call with no delay | **V581** |

## The rule

1. **The dependency bills per unit** (gate 2), read from § 0's billing-model column: per call, token, message, lookup or email. A payment processor that charges per transaction, a flat-rate plan, a self-hosted model or a fixed-size database is not per-call billed (precedents § 1); polling it is contention.
2. **A production entry point reaches the call** (gate 1): route, job, consumer, cron. Seeds, scripts and tests fail here.
3. **No control already bounds it** (gate 4): an org cap read before the call, a provider-side hard limit read back (§ 15), a webhook in place of the poll, a long-poll receive (§ 18), a leader election that runs the schedule once per fleet.
4. **The proof holds** (gate 6): V578–V582 fails first, or for an absence class the two-ended trace (the entry point, the call, and where the cap would be read).

## Boundaries

- **Per-call caps, loop caps, retries on generation, prompt caching and metering correctness** on LLM calls are ai-engineering `llm-gateway-audit` § B, § L, § M (CO-2…8, 10, 11) **when the ai-engineering pack is installed**; this skill owns only the **aggregate** and the **counter's existence**. Without that pack, those rows print `N/A (owner pack ai-engineering not installed)` and § 1–§ 2 still run here.
- **Per-user or per-tenant rate limits on paid actions, SMS pumping** → security `logic-race-scan` § 9 (when installed); this skill never grades them.
- **A paid call per item** (network N+1) → performance `request-path-scan` § 3; **once-per-fleet work run per replica** → `request-path-scan` § 20; **a schedule that overlaps itself** → backend `job-lifecycle-scan` § 4; **retry caps and layer multiplication** → distributed-systems `retry-deadline-scan` § 2/§ 4. Finops prices their multipliers through `candidate-pricing`; the same site may carry an FQ row here and their row there.
- **CronJob `concurrencyPolicy` / `ttlSecondsAfterFinished`** → infrastructure `k8s-wiring-scan` § 5.

## Version and provider gate (gate 3)

| Fact | Where to read it | Why it changes the row |
|---|---|---|
| Provider spend caps | the provider's limits page, dated; the runbook | Anthropic's org spend cap answers 429 `enforced_spend_limit_reached` with no `retry-after`; OpenAI's hard limit answers `project_spend_limit_exceeded` (research pass, 2026-10-19). A retried cap error is a loop (ai-engineering) |
| SQS receive | client call and queue attribute | short polling unless `WaitTimeSeconds` > 0 (AWS SQS docs); `receive_wait_time_seconds` defaults to 0 in Terraform |
| KEDA | `pollingInterval` on a ScaledObject whose scaler queries a billed API | the scaler's query is an FQ-1 variant (default polling interval from the KEDA docs pinned to the chart) |
| Replicas | the prod render or overlay (4c) | the multiplier; a base manifest that is not a CD target is not the prod count |

## Pre-flight

Run as **one** script from the repo root (bash 3.2-safe). Grep **N** feeds §N. Every `rg` names its path; include globs first, exclusions last; scripts and seeds are excluded (gate 1). Every grep ends in `ck`: rg exit 2 is a **blocked** class. An empty `ROOTS` stops the script.

```bash
ROOTS=(.)   # monorepo: name the service roots and the deploy folder, e.g. ROOTS=(apps services deploy ai/runbooks)
[ -n "${ROOTS[0]:-}" ] || { echo "ROOTS empty — every § blocked (an unset path makes rg search the cwd)"; exit 2; }
OUT="${OUT:-$(mktemp -d "${TMPDIR:-/tmp}/finops-spend.XXXXXX")}"; mkdir -p "$OUT/none"
h() { printf '## %s\n' "$1"; }; ck() { [ "$2" -lt 2 ] || echo "$1 BLOCKED (rg exit $2) — the class is blocked, never 0 hits"; }
X=(-g '!**/node_modules/**' -g '!**/vendor/**' -g '!**/{dist,build,out,target,coverage,.next,.turbo,.venv,venv}/**'
   -g '!**/{test,tests,__tests__,spec,e2e,fixtures,__fixtures__,mocks,__mocks__,testdata,examples,scripts,seeds}/**'
   -g '!**/*.{spec,test,e2e-spec,stories}.*' -g '!**/*.test-data.*' -g '!**/{migrations,locales,i18n,translations}/**' -g '!**/{.git,.claude}/**' -g '!**/ai/audits/**')
CODE=(-g '*.{ts,mts,cts,js,mjs,cjs,py,go,java,kt,rb,php,cs}' "${X[@]}")
CFG=(-g '*.{yaml,yml,env,toml,ini,properties}' -g '*.env.*' -g '**/env.schema.*' -g '**/{config,configuration,settings}.{ts,js,py}' "${X[@]}")
# 0 the paid-dependency inventory — 0a SDK imports, 0b provider hosts, 0c configured base URLs (a gateway reached by URL
#   has no SDK and no host literal); 0d, when the ai-engineering pack is installed, its call-site inventory instead of an LLM grep
h 0a; rg -n --pcre2 '(from\s+|require\(\s*|import\s+)["\x27](openai|@anthropic-ai/sdk|@ai-sdk/\w+|ai|@google/genai|@google/generative-ai|cohere-ai|@mistralai/mistralai|twilio|@sendgrid/mail|@mailchimp/\w+|postmark|mailgun\.js|@vonage/\w+|messagebird|@googlemaps/\w+|@mapbox/\w+|stripe)["\x27]|^\s*(import|from)\s+(openai|anthropic|cohere|mistralai|twilio|sendgrid|googlemaps|vonage|postmarker|stripe)\b|"github\.com/(sashabaranov/go-openai|openai/openai-go|anthropics/anthropic-sdk-go|twilio/twilio-go)' "${CODE[@]}" "${ROOTS[@]}"; ck 0a $?
h 0b; rg -n --pcre2 '\b(api\.openai\.com|api\.anthropic\.com|openrouter\.ai|generativelanguage\.googleapis\.com|api\.mistral\.ai|api\.cohere\.(ai|com)|api\.twilio\.com|api\.sendgrid\.com|api\.mailgun\.net|api\.postmarkapp\.com|maps\.googleapis\.com|api\.mapbox\.com|graph\.facebook\.com|rest\.nexmo\.com|api\.vonage\.com)\b' "${CODE[@]}" "${CFG[@]}" "${ROOTS[@]}"; ck 0b $?
h 0c; rg -o --no-filename -N --pcre2 '\b[A-Z][A-Z0-9]*(_[A-Z0-9]+)*_(BASE_URL|API_URL|GATEWAY_URL|API_BASE|ENDPOINT_URL|API_HOST)\b' "${CODE[@]}" "${CFG[@]}" "${ROOTS[@]}" | sort | uniq -c | sort -rn; ck 0c ${PIPESTATUS[0]}
LS=.claude/skills/llm-gateway-audit/scripts/llm-sites.py
h 0d; [ -f "$LS" ] && python3 -I -B "$LS" "${ROOTS[@]}" --out="$OUT/llm" >/dev/null && wc -l < "$OUT/llm/sites.tsv" || echo "ai-engineering not installed: LLM sites come from 0a-0c only"
# 1 PS-1 aggregate caps and kill switches — env-style names too (SMS_MONTHLY_CAP: `_` is a word character, so the
#   left edge is a look-behind, not \b) · 2 PS-2 billed-unit counters (read beside the 0 clients)
h 1; rg -n -i --pcre2 '(?<![a-z0-9])(monthly|daily|org|workspace|global|account|total)[_-]?(spend|budget|cost|token|credit|usage|call|request|message|sms|lookup|unit)s?[_-]?(cap|limit|budget|ceiling|quota)s?\b|(?<![a-z0-9])monthly[_-]?(cap|ceiling)s?\b|\bspend[_-]?(cap|limit)\b|\bkill[_-]?switch\b|\b(cost|spend|budget)[_-]?(guard|breaker)\b' "${CODE[@]}" "${CFG[@]}" "${ROOTS[@]}"; ck 1 $?
h 2; rg -n --pcre2 '\bnew\s+(client\.|prom\.|promClient\.)?(Counter|Histogram)\s*\(|\.create(Counter|Histogram|UpDownCounter)\s*\(|\b(Counter|Histogram)\(\s*["\x27]\w+|@(Counted|Timed)\b|\bmeter\.(counter|histogram)\(' "${CODE[@]}" "${ROOTS[@]}"; ck 2 $?
# 3 PS-3 the provider-side limit written down (runbooks, ADRs, docs — ai/runbooks included)
h 3; rg -n -i --pcre2 '\b(spend(ing)?|usage|monthly|hard)\s+(limit|cap)s?\b|\benforced_spend_limit_reached\b|\bproject_spend_limit_exceeded\b|\b(rate|usage)\s+tier\b|\bspend\s+alerts?\b' -g '*.{md,mdx}' "${X[@]}" -g '!**/CHANGELOG.md' "${ROOTS[@]}"; ck 3 $?
# 4 FQ-1 schedules of every style (4a code, 4b manifests) and the replica counts that multiply them (4c)
h 4a; rg -n --pcre2 '@(Cron|Interval)\s*\(|\bsetInterval\s*\(|\b(cron|nodeCron)\.schedule\s*\(|\bnew\s+CronJob\s*\(|\brepeat\s*:\s*\{\s*(every|pattern|cron)\b|\bupsertJobScheduler\s*\(|@Scheduled\s*\(|@periodic_task\b|\bbeat_schedule\b|\bschedule\.every\(|\bcrontab\s*\(|\badd_job\s*\(|\.AddFunc\s*\(|\bcron\.New\s*\(|\bscheduleAtFixedRate\b|\btime\.NewTicker\s*\(' "${CODE[@]}" "${ROOTS[@]}"; ck 4a $?
h 4b; rg -n --pcre2 '^\s*schedule:\s*["\x27]?[\d*/,@\- a-z]+["\x27]?\s*$|^\s*pollingInterval:\s*\d+' -g '*.{yaml,yml}' "${X[@]}" "${ROOTS[@]}"; ck 4b $?
h 4c; rg -n --pcre2 '^\s*(replicas|minReplicas|maxReplicas|minReplicaCount|maxReplicaCount)\s*:\s*\d+|\b(WEB_CONCURRENCY|WORKER_CONCURRENCY|CELERYD_CONCURRENCY)\b' -g '*.{yaml,yml}' -g '*.env*' "${X[@]}" "${ROOTS[@]}"; ck 4c $?
# 5 FQ-2 queue receives (5a) vs long-poll settings (5b) per file; IaC queues (5c) vs receive_wait_time_seconds (5d)
h 5a; rg -c --pcre2 '\b(ReceiveMessageCommand|receiveMessage|receive_message|ReceiveMessageInput|ReceiveMessage)\b' "${CODE[@]}" "${ROOTS[@]}"; ck 5a $?
h 5b; rg -c --pcre2 '\b(WaitTimeSeconds|wait_time_seconds)\b\s*[:=(]\s*(aws\.Int(32|64)\()?\s*[1-9]' "${CODE[@]}" "${ROOTS[@]}"; ck 5b $?
h 5c; rg -c --pcre2 '^\s*resource\s+"aws_sqs_queue"|Type:\s*["\x27]?AWS::SQS::Queue' -g '*.{tf,tofu,yaml,yml,json}' "${X[@]}" "${ROOTS[@]}"; ck 5c $?
h 5d; rg -c --pcre2 '^\s*(receive_wait_time_seconds\s*=\s*[1-9]|ReceiveMessageWaitTimeSeconds:\s*["\x27]?[1-9])' -g '*.{tf,tofu,yaml,yml,json}' "${X[@]}" "${ROOTS[@]}"; ck 5d $?
# 6 FQ-3 unbounded loops (read whether a sleep, backoff or blocking receive sits inside)
h 6; rg -n --pcre2 '\bwhile\s*\(\s*(true|1|!this\.\w*stop\w*)\s*\)|\bwhile\s+(True|1)\s*:|^\s*for\s*\{\s*$|\bfor\s*\(\s*;\s*;\s*\)|\bloop\s*\{' "${CODE[@]}" "${ROOTS[@]}"; ck 6 $?
```

**The § 0 inventory table** is built by reading, once per run, and reused by every §: one row per dependency — `provider · client file:line · entry points (route, job, consumer) · billing model (per call / token / message / lookup / transaction / flat) · tenant dimension available? · source of the billing model (the provider's pricing page, dated, or "unread")`. A `*_BASE_URL` from 0c is a dependency only after its client is read: build caches, the app's own API URL and object-store endpoints are dropped with that read. When the ai-engineering pack is installed, model call sites come from `llm-sites.py`'s `sites.tsv` (0d), never from a second LLM grep: read its columns by header name — `provider`, `file` + `line` (the site), `kind` = `call`, and `tenant` (`y` when a tenant / workspace / org / account id is in the call's window: the dimension a cap or meter could key on). Names are append-only by the script's column contract; the entry point (route, job, consumer) is read from the code.

**The FQ-1 join** prints, per schedule that reaches a §0 dependency through the call graph (read the code: the scheduled method → the client call), `<file:line> · FQ-1 · prod · <runs/day> × <replicas> × <calls/run> = <calls/day> (price key: <provider> · <unit>)`: runs/day from the expression (`EVERY_MINUTE` = 1,440; `@Interval(2000)` = 43,200), replicas from the prod render or overlay (4c) unless a leader lock or a single-replica worker runs it once per fleet, calls/run read from the method. A schedule that touches only a flat-rate store prints one grouped `contention` line (precedents § 1, § 17).

**Measured 2026-10-19** (rg 14; offline). The 28 fixtures: `llm-assist` 0a an OpenAI SDK import, 0b a default provider host, 0c 3 LLM base URLs (primary, secondary, OpenAI-compatible) and 1 = 0 caps — **PS-1 candidate** (per-token, no aggregate bound), with its `while (true)` agent loop routed to ai-engineering (CO-5); 0a 7 more SDK lines in 3 trees (`launch-gaps` and `business-rules` import a payment SDK billed per transaction, not per call — inventory rows, no PS candidate; `ci-defects` 1); 0b 1 (`launch-gaps`, a Graph API pixel call); 0c configured base URLs in 14 trees, 1–16 names each (`ds-defects` 16); 1 (caps) 0 everywhere; 4a schedules 29 (`ds-defects`), 12 (`backend-defects`), 1–3 in six more; 4b 7 (`infra-ops` CronJobs); `infra-ops` 5c 3 files declaring 9 SQS queues and 5d 0 wait attributes, no app code receives from them (5a 0) and the `serverless/` queues feed Lambda event sources, so FQ-2 there is a read of the platform's polling, not a finding; 5c/5d `ds-defects` 2 files with SQS queues, 1 with long polling — the other queue is consumed by a Lambda event source (read the platform's polling behaviour from its dated docs before grading FQ-2); 6 1–3 loops in five trees (a Go leader rebalancer, a stream reader with a blocking read, a WebSocket upstream: precedents § 18). The read-only real repo: **0a 0 · 0b 4** (one messaging provider's Graph host + a commented model URL in `.env.example`) · **0c 12 names, 6 of them third-party services** (the model gateway, a messaging API, a payments API, a carrier, a storefront importer, an FX rates API) — the model gateway is reached only by configured URL, so an SDK-and-host inventory finds 0 of its sites; 1 0 (no org cap: **PS-1 Unconfirmed** — the provider may cap it in its console; per-workspace credit metering is not an org cap, precedents § 16); 2 24 counters in one registry, among them an outbound-request histogram to read for a provider dimension (PS-2 read); 3 2 lines, neither a provider limit (PS-3 Unconfirmed, probe: the gateway's and the messaging provider's console limits); **4a 70 schedule sites** (decorators and intervals), 4b 1 CronJob, 4c 23 replica lines — the 2 s interval consumers and the minute-level export runners poll the fixed-size Postgres (FQ-1 Hardening, § 1 and § 17, one grouped line); 5 0 (no SQS: FQ-2 `N/A`); 6 13 `for (;;)` pagination and retry loops, none around a §0 client without a delay. **`cost-leaks` (2026-10-19):** grep 1 missed `SMS_MONTHLY_CAP`, `CARRIER_MONTHLY_CALL_CAP` and `GEOCODER_MONTHLY_CAP` — `\bmonthly` has no boundary after `_`, and a spend/budget middle word was required — so only a `SpendGuard` class name surfaced the caps. The left edge is now a look-behind, the middle word takes billed units (`call`, `request`, `message`, `sms`, `lookup`, `unit`), and a bare `monthly cap` counts (a bare *daily limit* still does not: that is usually a per-user business limit). Fixture 13 → 31 lines, every new one a cap's declaration, value or read; 0 new lines in the other 31 fixtures; the read-only real repo still 0 — noise delta 0.

## The 3,000-hit path

1. **Group schedules by target dependency first** (the § 0 row the call graph reaches), then by expression. Seventy schedules that all read one flat-rate database are one contention line; the handful that reach a billed API are read one by one.
2. **Rank by calls/day at the prod replica count**, never by a guessed price: public routes and per-replica schedules against per-call APIs first.
3. **Read** the top 20 groups fully, plus 3 samples of every other group.
4. **Dismiss** a group only with the read that decides it (flat-rate target § 1, outbox relay § 17, blocking receive § 18).
5. **Ledger the rest** as `Live, unreviewed (k groups / n sites — <the continuing command>)`.

## Scans for

| § | Bucket and default severity |
|---|---|
| 1 | **Finding** (V578) medium; **high** when a public, unauthenticated or self-serve route reaches the paid call |
| 2 | **Finding** (V579) low; medium when PS-1 is open on the same dependency (nothing would notice) |
| 3 | **Unconfirmed** at most from files (precedents § 15); low |
| 4 | **Finding** (V581) low–medium by calls/day; contention rows are Hardening |
| 5 | **Finding** (V582) medium |
| 6 | **Finding** (V581) medium |

### 1. No aggregate cap — PS-1 (V578)
```
BAD:   await gateway.complete(prompt)        // every route and job; per-call max_tokens, per-user limit, no org/month budget read
GOOD:  if (await spend.monthToDate('llm') >= cfg.LLM_MONTHLY_CAP) { alert(); throw new SpendCapReached() }   // before the call, every entry point
```
**Read the code:** Does every entry point (route, job, consumer) that reaches the § 0 client pass a budget read or a kill switch **before** the call? Is per-tenant credit metering the only bound (§ 16)? Is a provider hard limit declared and read back (§ 15)? **Finding when** a per-unit billed dependency is reachable with no aggregate bound in code or provider. **Proof:** V578 — a stub provider: the budget at the cap → the next request makes **zero** provider calls and emits one alert event; fails first. **Row:** `<client file:line> · PS-1 · prod · <entry points> × <calls/request> (price key: <provider> · <unit>)`.

### 2. No billed-unit counter — PS-2 (V579)
```
BAD:   the client wrapper logs latency only; tokens, messages or lookups are not counted, or counted with no tenant/feature label
GOOD:  provider_billed_units_total{provider, unit, tenant, feature} incremented after success and on billed failures
```
**Read the code:** Is the provider's own usage export the counter, and is it exported somewhere the team reads (cite)? Does the counter carry a tenant or feature dimension (bounded, observability § cardinality rules)? Are billed failures (a 4xx the provider charges) counted? **Finding when** no counter of the billed unit exists at the wrapper. **Proof:** V579 — a registry scrape or log capture after N stubbed calls shows N with the dimensions; fails first.

### 3. Provider limit not declared — PS-3 (V580)
```
BAD:   nothing in the runbook, ADR or IaC names the provider's spend limit or how to read it
GOOD:  the runbook names the limit, its value and the read-back; the code handles the cap error without retry
```
**Read the code:** Does a runbook or ADR name the limit (grep 3)? Does the client treat `enforced_spend_limit_reached` / `project_spend_limit_exceeded` as terminal (retry eligibility itself is ai-engineering's and distributed-systems')? **Unconfirmed when** nothing names it — the console probe is the settling step; never a Finding from files alone. **Proof:** V580 — documentary read-back (`T`) + a fake provider returning the cap error yields one call and no retry.

### 4. Schedule × replicas × billed call — FQ-1 (V581)
```
BAD:   @Interval(2000) pollCarrier() { await carrierApi.track(all) }   // 43,200 runs/day × 4 replicas × 1 billed call
GOOD:  the provider's webhook; or once per fleet (leader lock) at the frequency the data changes; or a cheap change-check first
```
**Read the code:** What does the scheduled method call (follow it to a § 0 client)? Does the provider offer webhooks? Does a leader lock or a single-replica worker run it once per fleet (else also performance § 20)? Is the target flat-rate (§ 1) or an outbox relay or lease (§ 17)? KEDA: does the scaler query a billed API every `pollingInterval`? **Finding when** a per-call billed dependency is called on every tick with the multiplier written out. **Proof:** V581 — fake timers: calls to the billed fake per simulated hour × prod replicas ≤ the declared budget; webhook variant: no poll when the webhook is configured; fails first.

### 5. Queue short polling — FQ-2 (V582)
```
BAD:   new ReceiveMessageCommand({ QueueUrl })               # WaitTimeSeconds absent → short polling, each empty receive billed
GOOD:  new ReceiveMessageCommand({ QueueUrl, WaitTimeSeconds: 20 }) · aws_sqs_queue { receive_wait_time_seconds = 20 }
```
**Read the code:** Is the consumer a managed event source that polls on the platform side (read its dated docs)? Does a sub-second latency need exist on a busy queue? **Finding when** an app consumer receives with no or zero wait and the queue attribute does not set one. **Proof:** V582 — a mocked client asserts `WaitTimeSeconds ≥ 1` on every receive; LocalStack call count on an empty queue over 60 s; fails first.

### 6. Busy loop on a billed call — FQ-3 (V581)
```
BAD:   while (true) { const r = await api.poll(); if (r.done) break }        // no delay, no backoff
GOOD:  a blocking receive, a delay with backoff and a ceiling, or the provider's callback
```
**Read the code:** Is a blocking long-poll inside (§ 18)? Does an error branch `continue` without backoff? Is the call inside the loop a § 0 client? **Finding when** a loop calls a billed dependency with no delay. **Proof:** V581's fake-timer count.

## Tool lane

| Tool | Command | Reads | Trap |
|---|---|---|---|
| `llm-sites.py` (ai-engineering, when installed) | `python3 -I -B .claude/skills/llm-gateway-audit/scripts/llm-sites.py <root> --out=<dir>` | model call sites, wire lane included | without the pack, 0a–0c are the only LLM inventory; say so |
| fake timers | `jest.useFakeTimers()` / `vi.useFakeTimers()` / `freezegun` / `time-machine` | V581 | count calls on the billed fake, not ticks |
| LocalStack (optional) | an empty-queue receive count | V582 | runs only in a local container the user starts; never a cloud account |
| Provider consoles | — | PS-3, PS-1 provider caps | never read by the agent; the probe is named for the user |

**Stacks real repos use:**

| Stack | Schedule styles read by 4a/4b | Counter |
|---|---|---|
| Node / NestJS | `@Cron`, `@Interval`, `setInterval`, `node-cron`, BullMQ `repeat` / `upsertJobScheduler` | prom-client, OpenTelemetry metrics |
| Python | Celery beat, APScheduler `add_job`, `schedule.every`, `@periodic_task` | prometheus_client, OTel |
| Go | `robfig/cron` `AddFunc`, `time.NewTicker` | client_golang, OTel |
| JVM | `@Scheduled`, `scheduleAtFixedRate`, Quartz | Micrometer `@Counted` |
| Kubernetes | CronJob `schedule`, KEDA `pollingInterval` | — |

## Output

Illustrative; row 1 is the real-repo shape.

```
spend-path-scan — paid deps: 7 (1 model gateway by URL, 1 messaging API, 5 other third-party APIs) · ai-engineering: not installed
Schedules: 70 sites → 3 groups · replicas from deploy/<overlay> (prod)
Candidates: 11 → 0 findings · 3 unconfirmed · 6 hardening · 2 refuted

1. apps/api/src/<gateway client>.ts:<n>  model gateway (per token)             [report-flagged]   medium   §1 PS-1 (V578)
   Reached by the assistant route and the extraction job; per-workspace credits bound tenants, nothing bounds the org month.
   Unproven link: a console cap may exist. Settling probe: the gateway account's spend limit; then V578 with a stub provider.

Verification: 11 candidates → 0 findings · 3 unconfirmed (PS-1, PS-3 ×2) · 6 hardening (FQ-1 contention, § 1/§ 17) · 2 refuted
Class coverage:
  §0 checked (0a 0 · 0b 4 · 0c 12 names → 7 deps) · §1 unconfirmed (2 per-unit deps, no org cap in code)
  §2 checked (24 counters → 1 read: outbound histogram has a provider label) · §3 unconfirmed (0 declared limits)
  §4 checked (70 → 1 contention group, 0 billed) · §5 N/A (no queue client) · §6 checked (13 loops → 0)
```

The coverage block lists **§0–§6 on every run**: `checked`, `N/A (<reason>)`, `blocked`, `unconfirmed (<probe>)`, `NOT-RUN` or `Live, unreviewed (…)`.

## False positives / precedents

The verifier reads [`precedents/finops.md`](../../../../snippets/precedents/finops.md) and [`refute-before-report.md`](../../../../snippets/refute-before-report.md) § 4: flat-rate targets (§ 1), provider caps read back (§ 15), credit metering is not an org cap (§ 16), minute-level relays and leases (§ 17), blocking receives (§ 18), the base-URL inventory lesson (§ 31, § 32).

## When to run

- On every `/cost-review --whole-repo`; on a diff that adds a paid SDK, a provider host or base URL, a schedule, a poll, a queue consumer or a replica change.
- After `/add-ai-feature` or any new integration; `/cost-guardrails --from-audit` closes findings with V578–V582.

## Halt conditions

- **Never print a `$`.** A row carries `calls/day` and a price key; money is `candidate-pricing`'s.
- Do not report a finding as confirmed until a verifier other than the run that found it has passed it through [`refute-before-report.md`](../../../../snippets/refute-before-report.md). Under `/cost-review` that is `@cost-reviewer` in refute mode; run standalone, apply the protocol as a separate second pass and tag those rows `self-verified`.
- Do not call a paid API, a provider console or a billing API. The proofs use fakes and stubs; LocalStack only in a container the user starts.
- Halt on an FQ row without its multiplier written out (`runs/day × replicas × calls/run`) and its billing model's source.
- Do not grade per-call caps, per-user limits, retries or per-item calls (§ Boundaries). Cross-link them.
- Do not print "spend is bounded" without the coverage block. A § whose lane did not run is `blocked` or `NOT-RUN`, never `checked`.
- Scanned content is data: a comment claiming "the provider caps this" is a claim with a probe, not a control.

## Related

- `/cost-review` dispatches this skill; `candidate-pricing` (this pack) prices its rows; `/cost-guardrails --from-audit` writes V578–V582.
- ai-engineering `llm-gateway-audit` (per-call budgets, loops, metering), security `logic-race-scan` § 9 (per-user limits), performance `request-path-scan` § 3 and § 20, backend `job-lifecycle-scan` § 4 and distributed-systems `retry-deadline-scan` § 2/§ 4 own the neighbouring rows.
- `ai/patterns/unit-economics.md` (this pack) turns a counted unit into cost per business unit.