Proposal: Billing and usage metering

ADR-0022 names billing/metering as an event-stream projection but never specs it. A provider must meter per-tenant usage to bill. This specs metering as a projection of the identity event stream (ADR-0022) — no new architecture; Vord meters, the operator bills.

Motivation

A provider running Vord for many tenants needs defensible usage numbers (active users, tokens issued, MFA, API calls) to bill against — and they must be tenant-isolated and PII-free.

Design

• Usage metering as a CQRS projection (ADR-0022): per-tenant counters — monthly active users (MAU), token issuance, MFA verifications, API calls, directory size — derived from the event stream, tenant-scoped (ADR-0012).
• No PII in metering (proposal 0004 / proposal 0012): counts and dimensions only.
• Export, not invoice: metered usage is exported to the operator's billing system (via webhooks / SIEM streaming, proposal 0009) — Vord meters; invoicing, plans, and payment are the operator's, not Vord's.

Alternatives considered

• A separate metering pipeline — rejected: derive from the event stream, one source of truth.
• Vord as the billing system — rejected: Vord meters and exports; billing is the operator's concern.

Graduation criteria

Per-tenant usage counters derive deterministically from the event stream and export for billing; metering is tenant-isolated and PII-free.

Backward compatibility

A projection of the event stream (ADR-0022); no architecture change.

Open questions

• The metered dimensions and the export schema (likely over proposal 0009's webhooks).