Trustworthy multi-device agent-usage attribution

[Brams-s]

As agent usage becomes available from multiple machines, the panel should distinguish combined usage from usage observed on this device. A trustworthy sync design could use the following invariants:

1. Stable source identity
   Each snapshot should carry a stable, user-controlled source ID, such as a generated device identifier stored beside the usage data. Hostnames alone are mutable and can collide; machine-specific hardware identifiers may be undesirable for privacy.

2. Newest-wins deduplication
   Snapshots should include a monotonically increasing revision or a trustworthy updatedAt value. For the same source and provider, merge only the newest valid snapshot. Do not add repeated copies of the same snapshot, or token totals will inflate after every sync.

3. Explicit timezone schema
   Store timestamps in UTC and include the source timezone/IANA zone used for local-day bucketing. The UI can render in the current timezone, but daily totals must retain enough metadata to explain why a usage event belongs to a particular day.

4. Staleness and TTL
   Every remote snapshot should expose its age and source update time. Expired or excessively old data should be marked stale and excluded from live-limit claims. Local usage may remain visible, but the UI should not present an old remote snapshot as current.

5. Bounded validation
   Treat synced files as untrusted input. Validate schema version, source ID, provider ID, timestamps, numeric ranges, collection sizes, and maximum history length before merging. Invalid files should be ignored with a visible diagnostic, not abort the entire usage refresh.

A first implementation could keep local records authoritative, merge only validated remote snapshots keyed by (sourceId, providerId), and expose source labels plus freshness in the panel. This would make cross-device totals auditable without requiring a new backend or silently changing the meaning of existing local statistics.

[Brams-s]

Here is a live local prototype using real Codex and Hermes usage:

For this proposal, the useful part is the explicit split: BY DEVICE answers where usage was observed, while BY SOURCE answers which collector or runtime produced it. In this snapshot, Arrakis reports 551.7M tokens, split into 474.5M from Codex clients and 77.2M from Hermes.

The Edgepod 0 also sharpens an important semantic: a genuine zero must remain distinguishable from a missing or stale snapshot. Source labels alone are not enough; freshness and absence semantics still need to travel with the record.

This is a local prototype, not an upstream implementation. The model-colored charts also have a separate known partial-attribution limitation on older days, so I am sharing this here specifically as visual evidence for the device/source distinction.