Comped friends-and-family tier is uncapped AI spend: no entitlement flag, no per-org attribution, no cap #50

New Issue

2026-08-23T17:58:33-04:00

logan commented

2026-08-23 17:58:33 -04:00

Filed by board minutes #42, owner ruling 2 of the "Owner rulings, 2026-08-23" comment. Depends on #45.

Owner ruling, verbatim: "Keep them full-featured" - friends and family keep today's live, undelayed, full-featured product. The board ruled this a comped tier distinct from BUSINESS_MODEL.md section 3.2 "Public" (which stays $0 / >=30 min delayed / no audio / no transcripts / no names, for unauthenticated visitors).

Why this is an issue and not just a policy note. A comped account runs the full Whisper -> Gemini pipeline. BUSINESS_MODEL.md section 4.2 models a Westchester-class node at ~$82/node-month and a busy urban one at ~$325. Today there is:

no entitlement flag distinguishing a comped account from a paying one;
no per-org, per-system or per-call cost attribution anywhere in drb-c2-core - a grep for cost_usd|token_count|usage_meter|per_call_cost|billing_usage|input_tokens|prompt_tokens returns zero hits (#45);
no cap, alarm or throttle that could stop a comped account from running up an unbounded bill.

So the cost of generosity is currently unknown and unbounded, and it lands on a personal credit card. Both the COO and the CTO raised this at the board; the owner's ruling was taken with the cost accepted knowingly, not because the cost was disputed.

This is the same failure mode BUSINESS_MODEL.md section 4.4 names outright: "it fails quietly, four months in, on a credit-card statement." Section 4.4's structural fix - run the AI pipeline on a system only when that county has a paying customer or active trial - is explicitly not applied to comped accounts by this ruling, which is exactly why they need a different control.

To close, in dependency order:

#45 first. Per-call cost attribution stamped with org_id and system_id. Nothing here is measurable, let alone cappable, until that exists.
plan: "comped" (or equivalent) as a first-class entitlement value on the org document, distinct from both the public tier and any paid plan. Comped accounts get full features; they are not "a paid plan with the invoice waived", because the cap in step 3 does not apply to paying customers.
A monthly AI-spend ceiling per comped org, with the behaviour on breach decided when the number is real - most likely degrade to ingest-and-store (audio kept, pipeline off) rather than cut access, matching section 4.4's contributor pitch.
Interim control until 1-3 land: the comped list is small and manually known. Keep it explicitly enumerated and reviewed rather than letting comped access accrete informally - an unlisted comped account is an untracked cost line.

Not a blocker on Gate A or Gate B - it does not gate publishing or charging, and padding those gates with adjacent work is how gates stop being believed. It is a blocker on inviting friends and family at any scale beyond the handful that exist today.

Owner: CTO (entitlement flag + cap), CEO (what the comped tier includes).
Related: #45, #42, BUSINESS_MODEL.md sections 3.2, 4.2, 4.4.

Filed by board minutes #42, **owner ruling 2 of the "Owner rulings, 2026-08-23" comment**. Depends on **#45**. **Owner ruling, verbatim:** *"Keep them full-featured"* - friends and family keep today's live, undelayed, full-featured product. The board ruled this a **comped tier distinct from `BUSINESS_MODEL.md` section 3.2 "Public"** (which stays $0 / >=30 min delayed / no audio / no transcripts / no names, for unauthenticated visitors). **Why this is an issue and not just a policy note.** A comped account runs the full Whisper -> Gemini pipeline. `BUSINESS_MODEL.md` section 4.2 models a Westchester-class node at **~$82/node-month** and a busy urban one at **~$325**. Today there is: - **no entitlement flag** distinguishing a comped account from a paying one; - **no per-org, per-system or per-call cost attribution** anywhere in `drb-c2-core` - a grep for `cost_usd|token_count|usage_meter|per_call_cost|billing_usage|input_tokens|prompt_tokens` returns zero hits (#45); - **no cap, alarm or throttle** that could stop a comped account from running up an unbounded bill. So the cost of generosity is currently **unknown and unbounded**, and it lands on a personal credit card. Both the COO and the CTO raised this at the board; the owner's ruling was taken **with the cost accepted knowingly**, not because the cost was disputed. This is the same failure mode `BUSINESS_MODEL.md` section 4.4 names outright: *"it fails quietly, four months in, on a credit-card statement."* Section 4.4's structural fix - run the AI pipeline on a system only when that county has a paying customer or active trial - is **explicitly not applied to comped accounts** by this ruling, which is exactly why they need a different control. **To close, in dependency order:** 1. **#45 first.** Per-call cost attribution stamped with `org_id` and `system_id`. Nothing here is measurable, let alone cappable, until that exists. 2. `plan: "comped"` (or equivalent) as a first-class entitlement value on the org document, distinct from both the public tier and any paid plan. Comped accounts get full features; they are not "a paid plan with the invoice waived", because the cap in step 3 does not apply to paying customers. 3. A **monthly AI-spend ceiling per comped org**, with the behaviour on breach decided when the number is real - most likely degrade to ingest-and-store (audio kept, pipeline off) rather than cut access, matching section 4.4's contributor pitch. 4. **Interim control until 1-3 land:** the comped list is small and manually known. Keep it explicitly enumerated and reviewed rather than letting comped access accrete informally - an unlisted comped account is an untracked cost line. **Not a blocker on Gate A or Gate B** - it does not gate publishing or charging, and padding those gates with adjacent work is how gates stop being believed. It *is* a blocker on inviting friends and family at any scale beyond the handful that exist today. Owner: **CTO** (entitlement flag + cap), **CEO** (what the comped tier includes). Related: #45, #42, `BUSINESS_MODEL.md` sections 3.2, 4.2, 4.4.

logan referenced this issue

2026-08-23 23:21:45 -04:00

Board 2026-08-23 — Operating cadence — FINAL MINUTES #53

logan referenced this issue

2026-08-23 23:44:46 -04:00

Board 2026-08-23 — Owner goals — FINAL MINUTES #54

logan commented

2026-08-23 23:47:11 -04:00

Re-framed by board minutes #54, 2026-08-23, decision 6. Read this before working the issue.

The cost unit in this issue is wrong. It treats a comped account as the thing that spends. BUSINESS_MODEL.md §4.2 prices the pipeline per call ingested, not per viewer: an extra comped viewer costs Firestore reads (pennies), while an extra comped node costs $33-325/month. Ten friends watching node-002 is approximately free. One friend standing up a busy urban node is not.

Rulings, all enactable today without #45:

Comped accounts: uncapped. Marginal cost is near zero and capping them buys nothing.
Comped nodes: hard cap of 3 fleet-wide until #45 ships per-org cost attribution. A fourth comped node needs a CEO decision recorded in an issue.
EMS/medical exclusion applies to comped nodes exactly as everywhere else (#43). No carve-out.
BUSINESS_MODEL.md §4.4's demand-gated pipeline is not applied to comped nodes — that would break the owner ruling on #42 ("Keep them full-featured"). The node cap is the substitute for it.

Why this got sharper, not softer. The owner's goal answers of 2026-08-23 (minutes #54, and now GOALS.md) are revenue as the definition of success and customers first as the tiebreaker. That removes any strategic claim the comped tier had — it is now a pure cost centre that survives because the owner wants it, which is a legitimate reason and not a business one. A cost centre that directly consumes the stated goal has to be bounded now rather than after #45.

Owner: CTO. Date: 2026-09-30, or before a fourth comped node is enrolled, whichever comes first.

Note for whoever closes this: decision 6 rests on the claim that cost is per node and not per account. That is falsifiable by #45. Re-check it when #45 lands — if per-org attribution shows meaningful per-viewer cost, this comment is wrong and the cap belongs somewhere else.

**Re-framed by board minutes #54, 2026-08-23, decision 6.** Read this before working the issue. **The cost unit in this issue is wrong.** It treats a comped *account* as the thing that spends. `BUSINESS_MODEL.md` §4.2 prices the pipeline **per call ingested, not per viewer**: an extra comped viewer costs Firestore reads (pennies), while an extra comped **node** costs $33-325/month. Ten friends watching node-002 is approximately free. One friend standing up a busy urban node is not. **Rulings, all enactable today without #45:** - **Comped accounts: uncapped.** Marginal cost is near zero and capping them buys nothing. - **Comped nodes: hard cap of 3 fleet-wide** until #45 ships per-org cost attribution. A fourth comped node needs a CEO decision recorded in an issue. - EMS/medical exclusion applies to comped nodes exactly as everywhere else (#43). No carve-out. - `BUSINESS_MODEL.md` §4.4's demand-gated pipeline is **not** applied to comped nodes — that would break the owner ruling on #42 (*"Keep them full-featured"*). The node cap is the substitute for it. **Why this got sharper, not softer.** The owner's goal answers of 2026-08-23 (minutes #54, and now `GOALS.md`) are **revenue** as the definition of success and **customers first** as the tiebreaker. That removes any strategic claim the comped tier had — it is now a pure cost centre that survives because the owner wants it, which is a legitimate reason and not a business one. A cost centre that directly consumes the stated goal has to be bounded now rather than after #45. Owner: CTO. Date: **2026-09-30**, or before a fourth comped node is enrolled, whichever comes first. Note for whoever closes this: decision 6 rests on the claim that cost is per node and not per account. That is falsifiable by #45. **Re-check it when #45 lands** — if per-org attribution shows meaningful per-viewer cost, this comment is wrong and the cap belongs somewhere else.

logan commented

2026-08-23 23:54:51 -04:00

Owner ruling, 2026-08-23: comped node cap defaults to 3, and is configurable in the UI — not a hardcoded constant.

So the shape is a platform setting with a default of 3, editable by a platform admin, rather than a literal in source. Per the board's re-framing on #54 decision 6, the cap is on comped nodes (the pipeline bills per call ingested, so cost follows nodes) and not on comped accounts, which stay uncapped.

Implementation notes for whoever picks this up:

Store alongside the other platform settings rather than inventing a new home for one value; the config collection already holds ai_features for exactly this kind of global.
The admin surface is /admin, which today has no org-aware section at all (ADMIN_BILLING_AUDIT.md §1) — this is one more reason that page needs one.
Enforcement point matters more than the setting: the cap has to be checked where a comped node is enrolled/activated, not only rendered in the UI, or it is decorative.
Still blocked on #45 (per-org/per-node cost tracking) for the reporting half — you can cap without it, but you cannot tell anyone what the comped tier actually costs until #45 lands.

**Owner ruling, 2026-08-23:** comped node cap defaults to **3**, and is **configurable in the UI** — not a hardcoded constant. So the shape is a platform setting with a default of 3, editable by a platform admin, rather than a literal in source. Per the board's re-framing on #54 decision 6, the cap is on comped **nodes** (the pipeline bills per call ingested, so cost follows nodes) and not on comped accounts, which stay uncapped. Implementation notes for whoever picks this up: - Store alongside the other platform settings rather than inventing a new home for one value; the `config` collection already holds `ai_features` for exactly this kind of global. - The admin surface is `/admin`, which today has no org-aware section at all (`ADMIN_BILLING_AUDIT.md` §1) — this is one more reason that page needs one. - Enforcement point matters more than the setting: the cap has to be checked where a comped node is enrolled/activated, not only rendered in the UI, or it is decorative. - Still blocked on #45 (per-org/per-node cost tracking) for the reporting half — you can cap without it, but you cannot tell anyone what the comped tier actually costs until #45 lands.

logan referenced this issue

2026-08-25 21:30:50 -04:00

Per-system correlation_enabled=false is ignored: the call still correlates, with empty tags, down the thin/recency path #75

logan referenced this issue

2026-08-25 21:30:50 -04:00

Two AI spend paths escape config/ai_features entirely, so "AI is off" is not true and #45 cannot measure spend #76

logan referenced this issue

2026-08-26 09:31:22 -04:00

Any signed-in viewer can trigger OpenAI summary spend: incident summary routes use require_service_or_firebase_token, not require_admin_token #81

logan referenced this issue

2026-08-27 02:51:08 -04:00

Any signed-in viewer can trigger OpenAI summary spend: incident summary routes use require_service_or_firebase_token, not require_admin_token #81