M7: Cost guardrails — per-merchant render budget caps, GPU autoscale rules, spend kill switch

[ninan-versioning]

Milestone 7 — Cost Survival

Vertical: enterprise
Revenue-Signal: retention
Customer-Type: all

What

Build the spend control layer. Per-merchant render budget caps, GPU autoscale guards, and a hard kill switch that protects the $10K committed budget from a runaway render storm. Non-negotiable on a solo build.

Scope

• Per-merchant monthly cap: $99 tier = 100 image runs + 20 video runs; $299 tier = 500 image + 100 video. Hard reject above cap.
• AWS GPU autoscale: EC2 G5 instances scale 0→N on Temporal queue depth, scale back to 0 within 5 min of idle
• Cost-attribution tags: every render tagged merchant_id + sku_id + variant_id + tier for AWS cost explorer
• Spend alarms: CloudWatch alarms at 50/80/100% of $10K monthly committed budget
• Kill switch: SSM parameter shoploop/spend/kill — when true, all render queues drain to dead-letter and email founder
• Budget reservation per environment: dev=$200, staging=$300, prod=$9500
• Cold daily report: SES email summarising spend by merchant + variance vs budget

Why

$10K committed budget. One GPU misconfiguration burns it in a weekend. Decision Gate #5 ("monthly AWS cost") demands every architecture answer states cost — this ticket makes that policy enforceable in code.

Acceptance criteria

• CloudWatch alarms wired and tested (fire on stub spend)
• Kill switch verified — drains Temporal queues within 60s
• Per-merchant cap rejects synthetic over-cap render in test
• Daily cost email lands in founder inbox for 7 consecutive days

Affected repos

shoploop (primary), shoploop-core (renderer cap check), shoploop-growth (video cap check)

Cost

$10/mo CloudWatch + SES. Saves the other $9,990.