[gantoine]

Problem

• The weekly digest's Depot contract line sums every day since the contract started, one request per day since fix(devex): read depot usage one day at a time in the weekly digest #131885.
• That count grows every week until the 20-minute budget drops the line, and it leaves out cache storage.

Changes

• The contract line now starts from Depot's credit balance, current as of the last invoice, and subtracts this month's usage.
• A run makes at most about 31 one-day usage requests.
• The sentence now says "not counting this month's cache storage".
• A failed or non-USD balance read drops only the contract sentence.

How did you test this code?

• Not run: the real Depot API, which needs an organization token. A dry-run dispatch after merge checks it.

Test rationale: the contract test now fails if the month-to-date subtraction is dropped. New cases cover a failed or non-USD balance.

Release status

• No feature flag controls this change

Docs update

• None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)

Skills: /writing-tests, /writing-pr-descriptions

More context for AI agents

• Decisions: built on fix(devex): read depot usage one day at a time in the weekly digest #131885 and kept its one-day reads and time budget; the budget test now trips during the weekly reads.
• Read closely: contractUsed in the digest script. The balance may lag until Depot finalizes the month's invoice.

🤖 Generated with Claude Code

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

🚨 Trunk lane — universal lane

This PR is assigned to the universal lane. It cannot merge in parallel with other PRs, so it can take longer to merge. Ask dev-ex if you think this is wrong.

[parameterai]

Risk: No findings

The digest's Depot contract line now derives usage from Depot's credit balance (a new GetCreditBalance API call) minus month-to-date spend, instead of summing every day since the contract started; failed or non-USD balance reads drop only the contract sentence. The only new network surface is a hardcoded HTTPS call to api.depot.dev with strict response validation, fixed-text errors, and a 30-second timeout, so no user-controlled data reaches any dangerous sink.

_{Sentinel reviewed abfbc9e · Review settings}

[veria-ai]

PR overview

No security issues were found in this pull request.

Reviews

• ecb4e1a — No new issues
• abfbc9e — No new issues

[gantoine]

/trunk merge

[gantoine]

/trunk merge

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-11-09 22:20 UTC	Run
prod-us	✅ Deployed	2026-11-09 22:40 UTC	Run
prod-eu	✅ Deployed	2026-11-09 22:44 UTC	Run

_{This table shows the posthog release only. Hogstation shows every service that this PR reaches, Kargo services included.}