Add Muse Code subscription metrics to the Rust app and widget feed #273

Description

Franz's October 26 request asks for Muse Code usage across metrics projects. The Rust Provider registry and adapter registry have no Muse Code provider. widget_feed::build publishes account metrics into the existing display-ready Windows widget snapshot. No standalone CodexBar CLI/export-to-Pi dependency was established; inventory actual serialization consumers before changing a contract.

Vendor-advertised contract: the official changelog describes non-inference muse usage in 1.4.13, MSP usage/read and usage/changed for last-seen five-hour/weekly windows, and run.usage with per-model tokens separately from allowance. These capabilities do not prove a current account reading.

Observed by the authorized fleet owner on Home at 05:34 EDT, October 26: pinned Muse Code 1.4.13-R6996.1; one usage --help, then one usage --json with login/auto-update disabled and environment META_API_KEY excluded. Exit 0; allowlisted payload {"schemaVersion":1,"allowance":null}. The observed schema also has reason:string and hint:string; their free-form values were omitted and raw output was not retained. This proves the command ran, not zero usage, entitlement, subscription billing or inference. Tier, billing type, pool/model scope, used/remaining units/values and reset times remain unknown. Native stored credential context can differ from an exported PAYG key. No login, auth-file read, credential transfer, config change or inference occurred; no repeat probe is authorized by this issue.

Sources: Meta subscriptions, Wonder Full availability, authentication precedence, and CLI changelog. Chief coordination: https://github.com/hemsoft-dev/chief/issues/22. This is issue intake only. Fleet CLI/provider installation, settings, authorization and inference verification belong to the existing fleet worker. No host setup, secret extraction, private endpoint discovery, purchases or implementation dispatch is authorized by this issue. Preserve existing priorities and protected work. In particular, leave PR #272 with its owner.

Shared contract peers: hemsoft-dev/hs-pi-dashboard#70 and hemsoft-dev/codexbar-mac#199. These are independent readers, not a proven CodexBar-to-Pi feed.

Why

The app and its widgets cannot report this subscription, and substituting model tokens would misstate the remaining allowance.

Goal

Read supported Muse Code allowance without inference and carry truthful account-scoped metrics through the Rust dashboard, history, alerts and existing widget snapshot consumers.

Acceptance Criteria

• Accept schema version 1 with nullable allowance. allowance:null with exit 0 is unavailable quota, distinct from genuine numeric zero. Handle reason/hint as untrusted diagnostics with safe allowlisting/redaction, never raw identity-bearing text. Preserve unknown billing/tier/scope/unit/reset fields and handle unsupported schema versions safely.
• Use the subscription name Muse Code. Preserve returned tier, billing mode, observation time, units and pool/model scope. Show Wonder Full only where the source identifies it; a catalog model listing alone proves neither inference nor entitlement. Keep OpenCode Muse Spark and PAYG Meta API pools separate.
• Preserve supported short-window and weekly used/remaining values and reset timestamps, including independent model-specific windows if returned. Verify fraction versus percentage and used versus remaining direction from the pinned contract. Never derive absolute caps from plan multipliers, token totals or the published prompt range; monthly renewal is not a quota reset.
• Missing, stale, malformed or unsupported readings, expired authorization, wrong billing mode, insufficient entitlement, rate limits and transport failures remain distinguishable and unavailable. Missing data never becomes zero, unlimited, a healthy state or spare capacity. Keep valid neighboring windows and last-good timestamps without claiming freshness.
• Keep consumed tokens and model/session activity separate from remaining paid-subscription quota. Any projection, alert or SUS requires the corresponding verified quota, duration, scope and reset; otherwise show unavailable and exclude that score. Never sum the same subscription across machines or models.
• Register the provider in settings, refresh and rendering. Preserve history/metric identity across reset and account switches. Audit persistence, widget serialization and all real consumers; add compatible fields or a documented version transition without breaking old snapshots/providers.
• Use a bounded noninteractive CLI/MSP read through the existing contained command infrastructure, preserve errors and cancellation, and launch no console windows or sign-in flow during background refresh. An unavailable CLI remains unavailable.

Definition of Done

• Add sanitized contract fixtures for measured usage, genuine zero, exhausted allowance, reset rollover, partial/missing fields, malformed units/values, stale cache, PAYG, denied entitlement, expired auth, timeout and rate limiting. Prove token/activity-only data cannot become quota.
• Document the pinned CLI/schema version, field mapping, source freshness and scope, acquisition limits and known unsupported states. Include backward-compatibility coverage for old persisted data and existing providers.
• Complete the repository's applicable quality gates and current-head review. Do not claim live account compatibility from fixtures.
• Exercise sanitized producer-to-widget-consumer round trips and document any additional discovered export consumers before closing.

Validation

• Run cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo test --workspace --locked, and the declared security gate on the eventual implementation.
• Feed the sanitized cases through the production adapter, account serialization and widget reader. Confirm units/direction, separate scope, retained timestamps and null unknowns at every step; compare existing provider snapshots before/after.
• In the eventual PR, embed current-head screenshots uploaded as GitHub attachments with CLI --attach, proving measured, partial, exhausted, unavailable/auth-error and stale states. Include a short recording for setup/refresh interaction when practical, or state the concrete reason it is omitted. No runtime UI was started for this issue-only research; the provider is absent and protected owners remain active.