fix(review): record unlinked-issue verifier's own AI spend into the shared budget counter

Review feedback on #4551: the shared-budget check added in this PR read
sumAiEstimatedNeuronsSince before running the verifier, but nothing wrote
this feature's own actual calls back into that counter -- a free rider that
respected every other feature's spend while never counting its own, so the
true aggregate could silently exceed AI_DAILY_NEURON_BUDGET by however much
this feature used. Record the same worst-case per-candidate estimate the
budget check itself uses, mirroring ai-slop.ts's pre-computed-estimate
recording convention.

Author: JSONbored

src/review/unlinked-issue-guardrail.ts

@@ -18,12 +18,13 @@ import {
   getFreshOfficialMinerDetection,
   mostRecentAuditEventForOtherTarget,
   listOpenIssues,
+  recordAiUsageEvent,
   recordAuditEvent,
   sumAiEstimatedNeuronsSince,
   upsertOfficialMinerDetection,
 } from "../db/repositories";
 import { fetchOfficialGittensorMiner } from "../gittensor/api";
-import { clampNumber, estimateNeurons, utcDayStartIso } from "../services/ai-review";
+import { BEST_REVIEW_MODELS, RELIABLE_FALLBACK_MODELS, clampNumber, estimateNeurons, utcDayStartIso } from "../services/ai-review";
 import { findUnlinkedIssueCandidates, MAX_CANDIDATES, type CandidateOpenIssue } from "../signals/unlinked-issue-candidates";
 import type { UnlinkedIssueGuardrailConfig } from "../types";
 import { DIFF_CHAR_BUDGET, MAX_TOKENS, verifyUnlinkedIssueMatch } from "./unlinked-issue-match";
@@ -62,6 +63,12 @@ const VERIFY_PROMPT_OVERHEAD_CHAR_ESTIMATE = 2_000;
 // verifyUnlinkedIssueMatch tries a primary model and, ONLY on a thrown error, a fallback -- two calls is the
 // real worst case per candidate, not the common case, but this budget check must size for the worst case.
 const VERIFY_MAX_MODEL_ATTEMPTS_PER_CANDIDATE = 2;
+// Review feedback on #4551: the budget check above reads sumAiEstimatedNeuronsSince, but without a writer
+// this feature's own real AI spend never contributed to that counter -- a free rider that respects every
+// OTHER feature's usage but never counts its own, so the true aggregate spend could silently exceed
+// AI_DAILY_NEURON_BUDGET by however much this feature actually used. recordUnlinkedIssueVerifyUsage (below)
+// closes that gap by recording into the SAME shared ai_usage_events table this check reads from.
+const UNLINKED_ISSUE_VERIFY_USAGE_FEATURE = "unlinked_issue_verify";
 
 /** Has this actor already run the AI verifier at or beyond the rate ceiling in the last window, across every
  *  repo/PR? Fail-safe: a read error resolves to "not rate-limited," so the pre-#4515 unconditional-
@@ -94,6 +101,25 @@ async function isUnlinkedIssueVerifyBudgetExceeded(env: Env, candidateCount: num
   return estimatedNeurons > remainingBudget;
 }
 
+/** Record ONE candidate's actual AI spend into the shared `ai_usage_events` ledger -- the SAME table
+ *  {@link isUnlinkedIssueVerifyBudgetExceeded} sums from, so this feature's own usage counts against the
+ *  budget it itself enforces on others (see the module-level comment on {@link UNLINKED_ISSUE_VERIFY_USAGE_FEATURE}).
+ *  Records the same worst-case per-candidate estimate the budget check itself uses -- a deliberate over-count
+ *  (verifyUnlinkedIssueMatch's common case is ONE model call, not the two this sizes for), not a precise
+ *  post-hoc token read, mirroring ai-slop.ts's own pre-computed-estimate recording convention. Best-effort: a
+ *  write failure is swallowed (telemetry must never block the gate). */
+async function recordUnlinkedIssueVerifyUsage(env: Env, repoFullName: string, pullNumber: number): Promise<void> {
+  const estimatedNeurons = estimateNeurons(DIFF_CHAR_BUDGET + VERIFY_PROMPT_OVERHEAD_CHAR_ESTIMATE, MAX_TOKENS, VERIFY_MAX_MODEL_ATTEMPTS_PER_CANDIDATE);
+  await recordAiUsageEvent(env, {
+    feature: UNLINKED_ISSUE_VERIFY_USAGE_FEATURE,
+    route: "github_app.unlinked_issue_verify",
+    model: [BEST_REVIEW_MODELS[0], RELIABLE_FALLBACK_MODELS[0]].join("+"),
+    status: "ok",
+    estimatedNeurons,
+    detail: `unlinked-issue-match verification for ${repoFullName}#${pullNumber}`,
+  }).catch(() => undefined);
+}
+
 /** Minimal cached miner-identity check, deliberately independent of processors.ts's getCachedOfficialMinerDetection
  *  (same cache table and TTLs, no audit-log side effect -- this call site doesn't need one). Fail-safe: any
  *  lookup failure resolves to "not a confirmed miner," never the reverse. */
@@ -202,6 +228,9 @@ export async function resolveUnlinkedIssueMatchDisposition(env: Env, input: Reso
   if (await isUnlinkedIssueVerifyBudgetExceeded(env, candidates.length)) return undefined;
   for (const candidate of candidates) {
     if (authorLogin) await recordUnlinkedIssueVerifyAttempt(env, input.repoFullName, input.pullNumber, authorLogin);
+    // Record spend regardless of authorLogin -- an AI call happens either way; only the PER-ACTOR rate
+    // ceiling above needs a known actor, this shared-budget accounting does not.
+    await recordUnlinkedIssueVerifyUsage(env, input.repoFullName, input.pullNumber);
     const verdict = await verifyUnlinkedIssueMatch(env, {
       prTitle: input.prTitle,
       prBody: input.prBody,

test/unit/unlinked-issue-guardrail.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from "vitest";
 import { createTestEnv } from "../helpers/d1";
-import { countRecentAuditEventsForActor, recordAuditEvent, upsertIssueFromGitHub, hasRecentAuditEvent } from "../../src/db/repositories";
+import { countRecentAuditEventsForActor, recordAuditEvent, sumAiEstimatedNeuronsSince, upsertIssueFromGitHub, hasRecentAuditEvent } from "../../src/db/repositories";
 import {
   resolveUnlinkedIssueMatchDisposition,
   UNLINKED_ISSUE_MATCH_AUDIT_EVENT_TYPE,
@@ -425,6 +425,44 @@ describe("resolveUnlinkedIssueMatchDisposition", () => {
       expect(await countRecentAuditEventsForActor(env, "contributor-a", UNLINKED_ISSUE_VERIFY_ATTEMPT_AUDIT_EVENT_TYPE, "2000-01-01T00:00:00.000Z")).toBe(1);
     });
 
+    it("records this candidate's actual spend into the SAME shared ai_usage_events counter the budget check reads (review feedback on #4551)", async () => {
+      const run = vi.fn(async () => ({ response: JSON.stringify(aiVerdict()) }));
+      const env = createTestEnv({ AI: { run } as unknown as Ai });
+      await seedIssue(env, 7, "webhook retry duplicate bug", "retries duplicate events under load, needs a dedup key");
+
+      const usedBefore = await sumAiEstimatedNeuronsSince(env, "2000-01-01T00:00:00.000Z");
+      expect(usedBefore).toBe(0);
+
+      await resolveUnlinkedIssueMatchDisposition(env, { ...BASE_INPUT, config: config() });
+
+      const usedAfter = await sumAiEstimatedNeuronsSince(env, "2000-01-01T00:00:00.000Z");
+      expect(usedAfter).toBeGreaterThan(0);
+    });
+
+    it("records spend even when the author login is unknown (unlike the rate ceiling, this does not need a known actor)", async () => {
+      const run = vi.fn(async () => ({ response: JSON.stringify(aiVerdict()) }));
+      const env = createTestEnv({ AI: { run } as unknown as Ai });
+      await seedIssue(env, 7, "webhook retry duplicate bug", "retries duplicate events under load, needs a dedup key");
+
+      await resolveUnlinkedIssueMatchDisposition(env, { ...BASE_INPUT, prAuthorLogin: null, config: config() });
+
+      expect(await sumAiEstimatedNeuronsSince(env, "2000-01-01T00:00:00.000Z")).toBeGreaterThan(0);
+    });
+
+    it("swallows a usage-recording write failure without affecting the verification result", async () => {
+      const run = vi.fn(async () => ({ response: JSON.stringify(aiVerdict()) }));
+      const env = createTestEnv({ AI: { run } as unknown as Ai });
+      await seedIssue(env, 7, "webhook retry duplicate bug", "retries duplicate events under load, needs a dedup key");
+      const realPrepare = env.DB.prepare.bind(env.DB);
+      env.DB.prepare = ((sql: string) => {
+        if (/INSERT INTO.*ai_usage_events/i.test(sql)) throw new Error("d1 down");
+        return realPrepare(sql);
+      }) as typeof env.DB.prepare;
+
+      const result = await resolveUnlinkedIssueMatchDisposition(env, { ...BASE_INPUT, config: config() });
+      expect(result?.kind).toBe("hold");
+    });
+
     it("fails open (verification still runs) when the rate-ceiling read itself errors", async () => {
       const run = vi.fn(async () => ({ response: JSON.stringify(aiVerdict()) }));
       const env = createTestEnv({ AI: { run } as unknown as Ai });