A cost ledger per delivery: tokens, compute and time per run, hash-chained in git and signed, shown per pull and acted on by autonomy #1386

The owner, 2026-10-14: "we will start getting tight with costs too. I want a blockchain backing this thing and I'm not just using a buzzword. We have good numbers on token cost. There is no reason we can't have compute cost tracked with high detail so we can act on it with economical reason. Bringing in time is huge too. This is for humans to build things for humans."

Today the forge knows what a run cost in tokens (costUsd on every run, the spend ledger per org) and nothing about what it cost in compute or in time: a check that held the only lane for 25 minutes, a builder's container-seconds, a pull that waited 19 hours. Decisions (autonomy slots, check concurrency, bursting to a free tier, what to chop) are made on feel.

What "a blockchain backing this" means here, and no more than this: an append-only, hash-chained ledger of cost events, one entry per unit of work, each entry naming its parent hash, signed by the forge that wrote it, kept in git (git is truth; the DB is derived), so any forge — a child, a client's, a reader with the repo — can verify the economics without trusting the pages. Not a token, not consensus, not a network. The chain is what makes the numbers something a client can be billed on and a steward can act on.

Done looks like:

• [ ] Every run (agent, check, deploy, snapshot) writes one cost entry when it ends: {run, kind, repo, issue/pull, startedAt, endedAt, wall_s, cpu_s, mem_gb_s, lane_wait_s, tokens_in, tokens_out, usd_tokens, usd_compute}. cpu and memory come from the cgroup of the run's container (the cells already have one); compute's dollar rate is a setting per forge (what the owner pays per vCPU-hour and GB-hour on this node).
• [ ] Entries are hash-chained (prev, hash over the canonical entry) and committed to a ledger repo the forge owns (forge/ledger, or a branch of the forge's own repo), one commit per batch, signed with the forge's key; bun scripts/ledger-verify.ts walks the chain and says the first break, if any.
• [ ] Roll-ups the pages show: on a pull, "cost: $0.42 tokens · 31 lane-min · 2.1 h waiting · ask→live 4.3 h"; on an issue, the sum of its pulls; on the home and /metrics, the day's totals and the median ask→live. Lead time is a first-class cost beside dollars.
• [ ] Acted on, not just shown: autonomy's slots and the lane's concurrency read the ledger (a check that would wait longer than it runs is a reason to burst; a builder's third rework on one pull is a reason to park); the decider's log says which number moved it.
• [ ] A child forge writes its own chain and the parent can read it (the client list shows what each child costs); a client's forge can be handed its chain as the bill.
• [ ] Tests: an entry per run with cgroup numbers in a cell; a tampered entry breaks verification at the right link; roll-ups equal the sum of entries; a day with no runs writes nothing.

Files: src/core/runs.ts, src/apps/contain.ts (cgroup read), src/crew/spend*.ts, src/core/ledger* (new), src/web/pages/pull.ts, src/kernel/vitals.ts, scripts/ledger-verify.ts, test/ledger*.test.ts. Related: #1279/#1242 (what the lane spends), #1354 (what a wasted pull costs).

Parked by the crew: the check stayed red through 2 automatic tries (pull #1391 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Deferred behind the Later gate (#595). It serves no pillar today. The direction now is the stranger-to-forge path (#2914) and the website specification (#2915), and this can wait until the owner opens the gate.