[gantoine]

Problem

• The weekly CI digest in #alerts-devex leaves out Depot spend whenever Depot's usage API rejects its requests.
• Both manual runs on 2026-11-05 got 429s and 500s on every retry: dry run, real run.

Changes

• The digest sends one Depot GetUsage request at a time, not three at once.
• It reads the contract one calendar month at a time, not as one six-month range.
• The per-request timeout drops from 60s to 30s, so the longer sequence fits the 12-minute job limit.
• The Slack message does not change.

How did you test this code?

• Not run: a real Depot call. The next run with dry_run=false shows whether Depot accepts the new requests.

Test rationale: The existing contract test now fails if Depot requests overlap, or if the contract is read as one range. Both checks fail against the old script.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /writing-tests, /writing-pr-descriptions

More context for AI agents

• Session: Claude Code, local worktree; read the failing digest run logs with gh.
• Decisions: Monthly ranges, not a reused weekly total, so a contract that starts inside the last two weeks is not counted twice.
• Follow-ups: If monthly reads still fail, store closed months instead of re-reading them every week.
• Read closely: readSpend and contractSpend in .github/scripts/eng-analytics-weekly-digest.mjs.

🤖 Generated with Claude Code

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

🚨 Trunk lane — universal lane

This PR is assigned to the universal lane. It cannot merge in parallel with other PRs, so it can take longer to merge. Ask dev-ex if you think this is wrong.

[parameterai]

Risk: No findings

The weekly CI digest reads Depot usage sequentially, one calendar month at a time, with a 30s per-request timeout, to work around Depot API failures. The PR head is unchanged (71075d6, same two files, +50/-19); no attacker-reachable surface and no security issues.

_{Sentinel reviewed 71075d6 · Review settings}

[stamphog]

Not approved — escalated to a human reviewer.

Re-add the stamphog label to request another review once you have addressed this.

The CI automation change has test coverage but no qualifying independent assurance; the scanning bot comment is not a review. Request a current-head review from Raúl Negrón-Otero, another teammate, or an agent reviewer before re-requesting.

• Author wrote 0% of the modified lines and has 23 merged PRs in these paths (familiarity MODERATE).
• Risky territory without independent assurance: CI/deploy/build tooling — .github/scripts/eng-analytics-weekly-digest.mjs changes the weekly CI reporting job's request scheduling, timeout, and contract-usage aggregation; this enters CI automation territory even though it does not change builds or deployments.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	37L, 1F substantive, 69L/2F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1b-small (69L, 2F, single-area, chore)
stamphog 2.7.0		.stamphog/policy.yml @ 71075d6 · reviewed head 71075d6

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-11-06 15:25 UTC	Run
prod-us	✅ Deployed	2026-11-06 15:42 UTC	Run
prod-eu	✅ Deployed	2026-11-06 15:37 UTC	Run