[rolaniyia]

Summary

Resolves #17 — add cost anomaly detection (day-over-day spend spike alerting).

Every existing check finds persistent waste. This adds the complementary "something changed suddenly" signal: a service/resource whose daily spend jumps to 3x or more of its own trailing 7-day average, reading from the normalized billing export (fact_cost) rather than live inventory/metrics.

What's included

Piece	Path
SQL policy	policies/cost_anomaly.sql
Live pipeline	cloudcost.cost-anomaly-real.yml
Unit tests	tests/policies/test_cost_anomaly.py

No new source plugin is needed: the check reads from azure.cost_export + focus.normalize, both of which already exist — that's the documented reason the source file is absent from the four-file pattern in CONTRIBUTING.md.

Policy logic

• Groups fact_cost into per-resource/per-service daily totals.
• Computes a trailing 7-day average with a window frame (ROWS BETWEEN 7 PRECEDING AND 1 PRECEDING).
• Requires a full 7-day baseline (COUNT(...) >= 7) so short histories can't false-positive on a single-day "average".
• Flags days where daily_cost > 3.0 * trailing_avg_7d.

Testing

PYTHONPATH=src pytest -q                                       # 79 passed (6 new)
PYTHONPATH=src pytest tests/policies/test_cost_anomaly.py -q   # 6 passed

The 6 new tests cover: spike above 3x, spike below 3x, steady spend, full-baseline requirement, per-resource isolation, and empty input.

Verification note

I don't have access to the test Azure account, so I could not run the live azure.cost_export pipeline end-to-end; the SQL was verified against in-memory fact_cost tables via the tests above. The finding amount is the spike day's daily spend (billed_cost), with trailing_avg_7d and spike_multiplier included in the evidence for review.