Multimodal stream governance: implement wrap_stream and time-windowed accrual (spec)

[tishachawla-jg]

Summary

Tracking issue for implementing the multimodal stream governance spec (design draft in PR #107). Extends cost governance from discrete model calls to continuous audio/video streams, provider-agnostic, cost only.

Why

Per-call token accounting cannot see a continuous stream. The runaway mode is a stream that runs too long or too fast (unbounded bandwidth / denial-of-wallet), which the current governor does not bound.

Approach (from the spec)

Reuse existing primitives, do not build a new engine:

• Governor.tick(now) is already the time-based moment; drive it on a fixed accrual window (default 500 ms).
• Cost accrues locally per frame and flushes to the ledger per window; budget checks run at flush time, not per frame, so overhead is bounded regardless of frame rate.
• Pricing generalizes to price(modality, direction, quantity, cached), covering both token-metered (e.g. per-token audio) and time-metered (e.g. per-second video) providers via a provider stream adapter.

Phasing

1. wrap_stream + accrual clock + tick-driven flush, audio modality.
2. CANCEL actuator with billing-at-teardown (Actuators: CANCEL is declared but unimplemented, and the two connectors disagree #67) — the streaming actuator.
3. Detectors: stream_duration_cap, then stream_spend_cap, then stream_rate_guard.
4. Video modality and resolution-scaled pricing.

Each phase is independently shippable and testable offline with a scripted frame source.

Security note

Frame ingress is untrusted-input-facing; it should be fuzzed and must not crash or hang the governor. The accrual clock must keep flushing even if frames stall, so a stalled-open stream still trips the duration cap. The accrual window bounds worst-case unmetered spend and is a security parameter.

Related: #67 (CANCEL).