gcp-spend-guardrailslisted

# GCP Spend Guardrails (APPLY) ## Overview Per project, applies three blast-radius controls — but only when each is genuinely safe per the safety matrix in `docs/superpowers/specs/2026-05-24-gcp-api-key-ironclad-skill-design.md` §6. Actions that fail the safety gate are demoted to "flag for review" and surfaced for the human, never auto-applied. ## When to Use - Triggered by `gcp-ironclad` as Phase 3a, after the read-only audits. - Or invoked standalone when you want only the spend-control half of the suite. ## Inputs - `SESSION_DIR` env var (must already contain `audit.json` and `anomalies.json` from prior phases when invoked by the driver). - `DRY_RUN` env var: if `1`, plan all actions but apply none. Default `0`. - `QUOTA_FLOOR_PER_DAY` env var: minimum daily request quota for Gemini API. Default `5000`. - `QUOTA_MULTIPLIER` env var: peak-multiplier for quota sizing. Default `5`. ## Outputs Writes `${SESSION_DIR}/guardrails-applied.json` matching `output.schema.json`. ## Safety matrix (excerpt) | Action | Auto-apply ONLY when | Demoted to "flag" when | |---|---|---| | Set Gemini API quota | API enabled + ≥7d usage + proposed > peak | No usage data; new project (<7d); export missing | | Quota sizing | `max(peak_30d × 5, 5000/day)` | Peak shows abuse signature → use floor only | | Create budget alerts | caller is `billing.admin` + no existing budget at threshold | viewer-only; budget already configured | | Recommend spend-cap budget | never auto-applied — console-o