docs(compass): design message fan-out cost estimate and confirm gate (RIG-1713)

[rigel-mintaka]

Moved

• Moved from docs(agent): design message fan-out cost estimate and confirm gate (RIG-1713) compass#2120: design records now live in this repo, under docs/designs/compass/.
• Links to compass records that have not moved point at compass main blob URLs.

Summary

Design record for RIG-1713: a server-side cost estimate for agent posts, and a hold-and-confirm gate when the estimate is over an operator threshold. It also adds hard limits that a confirm cannot bypass. Human posts are never gated.

Record: docs/designs/agent/compass-message-cost-gate/design.md

Decisions

Row	Decision	Status
DL-459	The gated cost is fanout_tokens: per placed recipient, m + turnOverhead (2000), or just m when the recipient is mentioned and WORKING (a steer). Batched messages are not counted. Context re-load is reported as reload_tokens and never gated.	proposed (the parts Matt ruled are applied)
DL-460	Computed server-side in PostAsAccountByName over fan-out's recipient set. The mention body moves into package comms.	Active
DL-461	COMPASS_MESSAGE_COST_THRESHOLD, compared to fanout_tokens. Default 100000 (proposed); 0 turns it off. A gate outcome counter.	proposed (OQ1)
DL-462	Each held post needs its own confirm, bound to the confirmed estimate (×1.1). Keeps client_request_id and restamps turn_sequence.	Active (Matt: option A)
DL-463	New fields on the post arm (estimate_only, confirmed_estimate_tokens) and MessageCostEstimate. Every agent post is gated; no accepts_hold.	Active (Matt)
DL-464	Pre-checks before the gate: dedup with a non-empty key, membership, topic, OWNER_ONLY.	Active
DL-465	Last-active comes from the newest transcript entry's timestamp. Warm window 5 min.	Active (Matt: 5 min)
DL-470	Length cap of 8000 tokens on agent posts. ResourceExhausted, cannot be confirmed past.	proposed (OQ1)
DL-471	Fan-out ceiling of 10 × the threshold. ResourceExhausted. A separate row, so it can be dropped alone.	proposed (OQ1)

Matt's review (7 inline comments, all answered in thread)

• Cold agents must not stop sending: re-load is no longer gated.
• "Is 600k a different count?": yes, it is a sum across recipients. The units are now stated with worked examples.
• Option A without accepts_hold: taken.
• Backstops: the length cap is added; the fan-out ceiling is optional.
• 5 min / lgtm / batched messages don't count: applied.

Open question for Matt

OQ1 (load-bearing): default numbers on the new fanout_tokens unit.

• (a) 100000, the length cap 8000, and the fan-out ceiling;
• (b) the same without the ceiling (recommended, following your length-only lean);
• (c) 250000 with the length cap only.

The Plan builds (a), and OQ1 lists exactly what to drop for (b) or (c). This PR must not merge until OQ1 is ruled and folded in.

Review

• design-critic pass: 2 forks and 7 improvements, folded in. The context now comes from observed usage, the confirm is bound to cost, pre-checks run before the gate, and there is no new package.
• review-correctness, first round: 15 findings, all fixed, including the attribution, the WORKING discount, the empty dedup key, threshold 0, text bytes and tool counts.
• Re-review: two items remained (the Plan vs OQ1 note, and DL-459's status). Both are fixed at the current head.

Checks

• rumdl is clean on the record and all nine rows.
• design-ledger gate: OK, 421 decision files, 195 records.

Spec-impact: none
Ledger-impact: adds DL-459 to DL-465, DL-470, DL-471 (docs/designs/decisions/agent/)

Refs RIG-1713

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-1713

[github-actions]

Rigel public design docs preview: https://compass-comms-rig-1713-messa.docs-2ui.pages.dev

Deployed from compass-comms/rig-1713-message-cost-design at 550437f.

[rigel-mintaka]

Head note at 550437fb73a3d9fa5d8af9aae8953c457ca961ae (base main b752ded3).

• Rebased onto main; the design commit rebased with no conflicts.
• 550437fb points four compass blob links at in-repo records, since those records moved here and the compass URLs 404. A delta review found 0 findings; every new link resolves.
• The record's content matches the review at compass#2120 6217aa74: 0 high, 0 medium, 0 low.
• Local: rumdl, biome, the design-ledger gate and ref-gate are clean. CI check is green.
• OQ1 (default numbers) is still open for Matt in RIG-5108.