[rnegron]

Problem

• The weekly CI digest in #alerts-devex posted without Depot spend on 2026-11-09: GetUsage answered 500 to every 7-day request (run).
• Origin context: Depot thread.

Changes

• The digest shows Depot spend and the contract sentence again, because it asks GetUsage for one UTC day per request.
• The contract total reuses the two weeks it already read.
• After 20 minutes of Depot reads, the digest posts without spend instead of reaching the job limit.
• The job timeout rises from 12 to 30 minutes.

How did you test this code?

• Not run: a real Depot call. A dry_run dispatch after merge confirms it.

Test rationale: The contract test now fails if a Depot request spans more than one day. New cases catch a contract total that counts pre-contract days, and a time-budget stop that drops all spend.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Opus 5.5 (claude-opus-5-5)

Skills: /authoring-ci-workflows, /writing-tests, /writing-code-comments, /writing-pr-descriptions, /code-review, /simplify

More context for AI agents

• Decisions: Depot requests stay serial, as set in read depot usage one request at a time.
• Decisions: Adaptive range splitting was rejected, because a 7-day range already fails.
• Follow-ups: The same run lost PR workflow durations; read stored ci flags as booleans fixes that.
• Follow-ups: The digest gives no note when a section is missing.
• Read closely: the per-run day cache in spend, which lets the contract range reuse both weeks.
• No open PR fixes this.

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

🚨 Trunk lane — universal lane

This PR is assigned to the universal lane. It cannot merge in parallel with other PRs, so it can take longer to merge. Ask dev-ex if you think this is wrong.

[parameterai]

Risk: No findings

This PR changes the weekly CI digest to read Depot usage one UTC day at a time (working around Depot GetUsage 500s on 7-day ranges), caches day reads so the contract range reuses the two weeks already read, adds a 20-minute time budget after which the digest posts without spend, and raises the job timeout from 12 to 30 minutes. I traced the Depot response parsing, the day cache for races, the time-budget overshoot math, and the secrets/log handling, and found no security issue: all inputs are validated numeric aggregates from authenticated APIs, spends run serially so no double-read race exists, and error paths degrade to posting without the section rather than leaking data.

_{Sentinel reviewed 52672cf · Review settings}

[parameterai]

 Scanning this PR for security issues

[veria-ai]

PR overview

No security issues were found in this pull request.

Reviews

• 52672cf — No new issues

[stamphog]

Approved.

The CI changes have owning-team authorship, and trusted context reports a current-head automated review with no findings, though its review state is unspecified. No substantive review concerns or other refusal grounds were found.

• Author wrote 26% of the modified lines and has 148 merged PRs in these paths (familiarity MODERATE).
• PostHog Review (Standard) reviewed the current head: no findings.

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	56L, 2F substantive, 110L/3F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1c-medium (110L, 3F, single-area, fix)
stamphog 2.7.0		.stamphog/policy.yml @ 52672cf · reviewed head 52672cf

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-11-09 17:33 UTC	Run
prod-us	✅ Deployed	2026-11-09 18:04 UTC	Run
prod-eu	✅ Deployed	2026-11-09 18:06 UTC	Run

_{This table shows the posthog release only. Hogstation shows every service that this PR reaches, Kargo services included.}