Execution: durable API-cost outbox and canonical usage tracking (PR #869)

[coderabbitai]

Parent and dependency

• Parent program: [PROGRAM][OWNER:Codex] Autonomous EventRelay delivery control plane #898
• Production-substrate prerequisite: Execution: prove durable API-cost production substrate (PR #906) #868 / PR fix(ci): remediate PR #877 rollout and verification gaps #906
• This issue owns the API-cost outbox state machine and canonical application instrumentation.

Current state — CODE COMPLETE, PROTECTED PROOF PENDING

• Canonical PR: fix: harden API-cost webhook outbox retries (MYX-79) #869 (draft; do not merge)
• Canonical branch: agent/harden-api-cost-outbox
• Exact head: fd7c82d268224709487cbf0f1c5865feeb77da2d
• Review state: 0 unresolved threads
• Competing implementation PRs: none found

Agent login

groupthinking

Agent run ID

eventrelay-outbox-session-scope-20260721-0415z

Acceptance criteria

• Durable outbox keyed by UTC date and alert type.
• Conflict-safe atomic usage persistence, budget recomputation, and outbox enqueue in one transaction.
• Bounded retry/backoff, token-fenced claims, stale/cancelled claim recovery, and stable idempotency headers.
• SQLAlchemy session management with supported worker-thread in-memory SQLite tests.
• Webhook networking remains asynchronous and does not block accounting.
• Only successful conditionally finalized deliveries are counted.
• Production delivery is kept out of FastAPI lifespan and uses the dedicated worker substrate.
• Gemini provider token metadata is preserved.
• The canonical v1/HybridProcessor path emits durable track_api_call telemetry without allowing telemetry failure to discard a paid result.

Exact-head evidence

• CI 29810092858: passed
• API cost PostgreSQL 29810092890: passed
• Coverage 29810092885: passed
• CodeQL 29810092856: passed
• Security Scan 29810092921: passed
• Secret Scan 29810092855: passed
• Dependency Review 29810092888: passed
• E2E 29810092846: repository-skipped
• Focused Gemini/HybridProcessor tests: 248 passed locally
• Review threads: 0 unresolved

Remaining gates — execute in this order

1. Complete Execution: prove durable API-cost production substrate (PR #906) #868 / PR fix(ci): remediate PR #877 rollout and verification gaps #906 protected staging proof: the deployed database is at migration head and a pending row survives worker revision A → B and is visible to a distinct reader.
2. Against the exact final fix: harden API-cost webhook outbox retries (MYX-79) #869 head, attach production-shaped evidence for overlapping workers, crash boundaries, timeouts, ordering, retry exhaustion, and multi-batch delivery.
3. Review and pin the webhook secret/config change separately; prove rollback while delivery remains disabled until approval.
4. Reverify the exact head, mark fix: harden API-cost webhook outbox retries (MYX-79) #869 ready, merge with authority, then close this issue.

There is no remaining known code blocker in #869. If protected proof exposes a defect, patch the same canonical branch; do not open another implementation.

Execution receipt

• Agent login: groupthinking
• Run ID: eventrelay-outbox-session-scope-20260721-0415z
• Canonical PR/branch: fix: harden API-cost webhook outbox retries (MYX-79) #869 / agent/harden-api-cost-outbox
• Claimed: 2026-07-21T04:15:00Z
• Latest verified heartbeat: 2026-07-21T07:43:50Z
• Exact head: 45edc01037d72e7d2d9a56e18b2d5c2f6bb4ba76
• Artifact: green exact-head workflows, canonical Gemini tracking commits, and zero unresolved threads

Safety boundary

Keep #869 draft until the protected staging and production-shaped proof gates are attached. Do not expose secrets or mutate production from this issue.

Truth-gate reconciliation — 2026-07-21

• Added the machine-readable Agent login and Agent run ID fields without fabricating a snapshot.
• Normalized the existing verified checklist as Acceptance criteria.
• Added copilot-rabbit authorization and triggered an exact-head reevaluation.
• Replaced the generic invalid_payload failure with explicit evidence on run 29821174570.
• Pre-dispatch intent snapshot exists: no.
• Declared file scope and focused-test contract existed before implementation: no; do not backfill as historical intent.
• Trusted terminal result from groupthinking / eventrelay-outbox-session-scope-20260721-0415z: pending.
• Current-head Copilot review: pending.

Controller receipt

• Controller login/run: groupthinking / eventrelay-blocker-watch-20260721-1005z
• Canonical PR: fix: harden API-cost webhook outbox retries (MYX-79) #869
• Claimed: 2026-07-21T10:05:35Z
• Latest verified heartbeat: 2026-07-21T10:10:42Z
• Exact head: 45edc01037d72e7d2d9a56e18b2d5c2f6bb4ba76
• Artifact: truth-gate run 29821174570 with valid identity projection and explicit provenance/scope/review reasons

Next executable action

Keep #869 draft. If the accepted Copilot trigger opens a valid finding, patch the same branch. Do not invent retroactive intent, scope, test, or agent-result evidence. Protected deployment verification and an authorized legacy-provenance disposition remain the only later human boundaries.

Current controller reconciliation — 2026-07-22T10:23Z

• Detected new intermediate PR head 1fd74ffc6fb791797428a071f75f12b0afa2a013 and unsafe ready state.
• Returned canonical PR fix: harden API-cost webhook outbox retries (MYX-79) #869 to draft.
• Diagnosed authoritative Coverage failure 29909459928: the branch synchronized main before fix(ci): make coverage and gh-aw canary authoritative #927 landed, retaining the obsolete 90% floor and pre-repair harness.
• Fast-forwarded the same branch to fd7c82d268224709487cbf0f1c5865feeb77da2d using current main@5da61c595aa9dc848786e9e1fe99e40ad2a4fce0 plus exactly the eight declared implementation/test files.
• CI 29911281817, Coverage 29911282072, PostgreSQL 29911282046, CodeQL 29911282154, Security 29911282064, Secret Scan 29911281875, and Dependency Review 29911282177 pass.
• Coverage artifact 8526104756: 7,774 passed; 88.2371%; 2,033,370 bytes; exact-head bound.
• Zero unresolved review threads.
• Current-head Copilot review.
• Protected staging migration and A→B durability proof.
• Production-shaped overlap/crash/timeout/order/exhaustion/multi-batch proof and separately reviewed webhook activation/rollback.

Execution receipt

• Agent login: groupthinking
• Run ID: eventrelay-blocker-watch-20260722-1011z
• Canonical branch/PR: agent/harden-api-cost-outbox / fix: harden API-cost webhook outbox retries (MYX-79) #869
• Claimed: 2026-07-22T10:11:32Z
• Latest heartbeat: 2026-07-22T10:23:12Z
• Exact head: fd7c82d268224709487cbf0f1c5865feeb77da2d
• Machine artifact: draft-state mutation, new fast-forward head, completed workflow suite, and exact coverage artifact.

Next executable action

Keep #869 draft. Obtain current-head automated review; patch only a verified finding on this branch. Protected staging/worker proof remains the later human boundary.

[linear-code]

MYX-79

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

🔗 Related PRs

#277 - Vercel remediation complete: waitUntil adoption + active middleware + @vercel/functions package (resolves three user-defined outcomes; 16-agent verification-gate consolidated PASS on full matrix) [closed]
#404 - fix(web): sync package-lock with @vercel/functions (unblocks #277 auto-merge) [merged]
#411 - ci: add agentic verification loop workflow and refactor state log [merged]
#872 - ci: enforce deterministic agent completion truth gate [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[google-labs-jules]

Jules is on it. When finished, you will see another comment and be able to review a PR.

[google-labs-jules]

Ready for a review! A PR has been created.