Module savings_summary 

GET /v1/savings/summary — the team savings roll-up (the customer-facing “team usage visibility” surface, powering the account ROI dashboard).

The savings store holds one append-only JSONL file per signer (savings_<pubkey>.jsonl); each line is a SignedSavingsBatchV1 snapshot of that signer’s whole local ledger (period = "all"). Successive batches from the same signer are therefore cumulative re-snapshots, not increments — so the honest team total is the sum of each signer’s latest batch, never the sum of every batch (which would multiply-count). Integrity is enforced at ingest (super::savings_ingest verifies the Ed25519 signature before storing), so this read path trusts the stored snapshots and parses defensively.

Because every snapshot carries its own created_at, the cumulative history can be replayed into a daily time series: for each signer, the value on a given day is its most recent snapshot on or before that day (carry-forward); summing across signers yields the team’s cumulative ROI curve over the trailing window. This is real reported data — no interpolation, no synthetic points.

Authorisation: gated by TeamScope::Audit in the team auth middleware (owner/admin only) — aggregate savings is sensitive team data.

Structs

MemberDrilldown

Per-member drilldown (GL #389) — one signer’s full picture: latest totals, model/tool breakdowns from the latest batch, and a 90-day cumulative series replayed from that signer’s snapshot history alone.

MemberSavings

ModelRow

SavingsTotals

SeriesPoint

One day of the cumulative team series. Values are team-wide cumulative totals as of the end of date (UTC), reconstructed by carrying each signer’s latest snapshot forward.

TeamSavingsSummary

Team-wide savings roll-up, aggregated from each member’s latest signed batch.

ToolRow

Functions

v1_savings_member

GET /v1/savings/member/{signer} — drilldown for one member (GL #389). signer is the truncated public key from by_member[].signer. Audit-scoped like the summary (same sensitivity class). 404 when the signer has never reported; 400 when the id can’t be a signer prefix (defense-in-depth: the id is also used to derive a store filename).

v1_savings_summary