[ZacxDev]

Follow-up to #577: the per-account Claude usage poller can now push its readings to an external dashboard after each cycle, instead of only being pulled.

Env contract

Variable	Default	Notes
MUSTER_CC_USAGE_PUSH_URL	off	Absolute https URL (plain http only to loopback); no userinfo. Refused without MUSTER_CC_USAGE_POLL.
MUSTER_CC_USAGE_PUSH_TOKEN	—	Required with the URL; sent as Authorization: Bearer. Never logged.
MUSTER_CC_USAGE_PUSH_INSTANCE	MUSTER_PUBLIC_URL host, else muster	≤64 chars.

The token or instance set without the URL is refused too (a knob that does nothing).

Behaviour

• After each poll cycle (Poller.AfterPass, once per pass, inline in the loop): PUT {"source_instance", "read_at", "poll_interval_seconds", "accounts": [...]} (poll_interval_seconds is the API's own field: the configured interval in whole seconds, 0 with the poller off); 10s timeout; expects 204.
• accounts comes from the same ccUsageAccounts the GET /api/cc-accounts/usage handler uses, for the admin owner, so the entries are byte-for-byte the API's, used_by included.
• Failure: logged as status/class only, counted in muster_cc_usage_push_failures_total{reason} (build|timeout|transport|http_4xx|http_5xx|http_other|canceled), and not retried until the next cycle. Redirects are not followed. On a 4xx the dashboard's answer (first 512 bytes) is logged as one line: control characters stripped, cut at 200 runes, the token redacted. A push cut short by shutdown counts as canceled.
• Not forwarded by Compose (the poller isn't). The NOT_FORWARDED ledger, configuration.md, the jobs.md "Pushing the readings" section and the metric ledger are all updated.

Tests

• Golden: poll_interval_seconds equals the API's value, and reads 420 / 0 for a 7m / off interval. The pushed accounts equals the API's accounts byte-for-byte, with a positive control showing the fixture has attribution and extra windows.
• Boot refusal matrix: 8 refusal cases plus 4 accepts, and no refusal carries the token.
• 204 → success. 401/422 → http_4xx, 500/503 → http_5xx, 200 and redirect → http_other, slow → timeout, closed port → transport, store error → build with no request. Each makes exactly one request and counts under exactly its own reason.
• Logs never carry the token or body, even when the dashboard echoes the token. Positive control: the failures are logged.
• Run calls AfterPass exactly once per pass, after the pass.
• Mutation sweep: 35 mutants. Every one was killed, and each kill came from its own guard's assertion.

🤖 Generated with Claude Code

[ZacxDev]

Round 0 (requirements and deletion): proceed. D1 is kept: the instance label is cheap, and it names the source on the dashboard.

D1 — MUSTER_CC_USAGE_PUSH_INSTANCE: the default (MUSTER_PUBLIC_URL's host) already labels a single muster; the knob could go until a second sender exists

Round 1 (nine-axis checklist) at e58c882f: 0 🔴, 1 🟡, 1 🟢. That ends the ladder. The 🟡 is fixed without a re-audit.

• 🟡 When the receiver rejects a push for hitting a cap, muster logs only the status code.
• 🟢 A push interrupted by shutdown is counted as a timeout.

1. a 4xx push failure logs the receiver's answer sentence (truncated, never the request or token)