Close audit-engine gaps: KB writeback, billing enforcement, LLM retry, tests

[daemon-blockint-tech]

Summary

Reviewed the codebase against its own documented claims and found five gaps where behavior diverged from what the README/comments promise. This PR closes all five. Everything stays opt-in and degrades gracefully — a default hermetic run behaves exactly as before.

npm run typecheck, lint, build, and test all pass. Test suite grows 85 → 138.

The gaps and fixes

1. REMEMBER didn't write back to the knowledge base it claimed to

The README and persistence/store.ts both stated durable cross-audit knowledge is "persisted to the hybrid knowledge base during the REMEMBER phase." It wasn't — REMEMBER only wrote to the session-scoped in-process Crystalline store. The only writer to Supabase/Neo4j was the offline seed script.

• New persistence/knowledge-writer.ts (HybridKnowledgeWriter) persists each remembered fragment to Supabase (documents/chunks) and/or Neo4j (Document/Chunk/Entity) using the same doc_id/chunk_id scheme as scripts/ingest-solsec.ts, so runtime-learned knowledge joins the seeded corpus and survives restarts.
• Wired through GraphDeps.knowledge (optional) and index.ts. Never throws; unconfigured backends are skipped → Crystalline-only, as before.

2. Billing delivered the report before enforcing payment

index.ts printed the full report, then settled — so a failed charge gave the work away for free. createBilling() also minted a fresh full-allotment account every run, so on-demand overflow could never trigger and spend never accumulated. And createMppClient silently fell back to local settlement even with MPP_ENDPOINT set.

• Report is now released only after settlement succeeds; InsufficientCreditsError withholds it and exits non-zero.
• canAffordAudit() pre-flight warns when an account structurally can't pay.
• New billing/account-store.ts (InMemoryAccountStore + FileAccountStore) — a real persistence seam wired as the ledger sink; balances/on-demand spend persist across runs via BILLING_ACCOUNT_STORE_PATH.
• createMppClient now fails loudly when MPP_ENDPOINT is set but the HTTP-402 client is unwired; opt into hermetic settlement with MPP_ALLOW_LOCAL_FALLBACK=true.

3. No retry/backoff — a single transient LLM blip aborted the whole audit

The pipeline makes 6+ LLM calls; none were retried.

• New llm/retry.ts (withRetry + isTransientError) wraps chat.invoke with bounded exponential backoff + jitter. Retries 429/5xx/connection errors; propagates deterministic 4xx immediately. Sleep is injectable for tests.

4. Dead code: Neo4jRetriever.retrieve() was never called

The hybrid retriever only ever used .expand().

• Wired the standalone lexical-match path into stage 1 of HybridRetriever as its own graph source, alongside the Supabase-seed expansion (both share the Neo4j weight bucket).

5. Untested core logic

• Added direct unit tests for all new code plus previously-untested tools/retrievers: retry, account-store, mpp, create-billing, knowledge-writer, hybrid-retriever, REMEMBER writeback, semgrep, solana.

New/changed config (all optional, documented in .env.example)

• BILLING_ACCOUNT_STORE_PATH — durable account persistence
• MPP_ALLOW_LOCAL_FALLBACK — explicit opt-in to local settlement when an endpoint is configured

🤖 Generated with Claude Code

---

Generated by Claude Code