Restore classifier cost attribution in routed-run audits

[Copilot]

Routed audits could report zero classifier cost when unified token-usage events lacked purpose, and incorrectly include classifier credits in per-agent reconciliation.

• Unified usage metadata: Preserve xInitiator alongside purpose and path in firewall.token_usage and usage.report; document the payload and missing-purpose semantics.
• Legacy audit fallback: Fill missing fields from raw proxy records matched by requestId; when unavailable, identify classifier requests using model-routing stages, timestamps, and request IDs. Existing unified values remain authoritative.
• Reconciliation: Exclude classifier credits and use only non-classifier endpoints in mismatch warnings; report unknown endpoint when none is available.

{
  "type": "firewall.token_usage",
  "data": {
    "purpose": "routing_classification",
    "path": "/responses",
    "xInitiator": "router",
    "requestId": "classifier-request",
    "aic": 0.323
  }
}

• Fixes audit: model_routing.classifier_cost is 0 and per-agent credit reconciliation warns on routed runs (regression from #66961) #67079

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[SivaKesava1]

Verified 7d9ea620:

• Old runs (fallback path): model_routing.classifier_cost is back on all four: 37859425051 0.776, 37813733289 0.323, 37813720288 0.060 and 37505153056 0.039 credits, 1 request each. Before this PR, main reported 0. The false reconciliation warnings are gone on 37859425051, 37813733289 and 37505153056.
• Fresh run at this head (37886511291, Copilot t01, routed): the unified firewall.token_usage events now carry purpose (routing_classification), path (/responses) and xInitiator, and audit reads a classifier cost of 0.032 from them.
• The remaining warning, on /responses runs only (per-agent AI credits (0.886) differ from non-classifier proxy total (0.750), and 2.743 vs 2.576 on 37813720288), is the real Copilot-vs-proxy cache-write difference described in audit: sub-agent rows hide failures, ignore model aliases and dated ids, and have no per-agent spend (follow-up to #66740) #66960, now with the right total and endpoint.

@copilot /pr-finisher

[Copilot]

Verified 7d9ea620:

• Old runs (fallback path): model_routing.classifier_cost is back on all four: 37859425051 0.776, 37813733289 0.323, 37813720288 0.060 and 37505153056 0.039 credits, 1 requ...

No code changes were needed. Current-head checks for 7d9ea62 are green; the separate Copilot check is still in progress. PR #67092 remains blocked pending human review/approval, so it is not yet merge-ready.

[SivaKesava1]

Ready for review. Sandbox-verified at 7d9ea620: model_routing.classifier_cost is restored on four older routed runs (fallback path), and a fresh routed run compiled at this head shows purpose/path/xInitiator in the unified firewall.token_usage events, with the classifier cost read from them. The false per-agent reconciliation warnings are gone. The only remaining warning, on /responses runs, reflects the real Copilot-vs-proxy cache-write difference noted in #66960. No review threads.

[SivaKesava1]

@copilot resolve merge conflicts

[Copilot]

@copilot resolve merge conflicts

Merged main and resolved the conflict in pkg/cli/model_routing_test.go, retaining tests from both branches. Merge commit: 07420f0.

[gh-aw-bot]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Fix failing check JS Tests (shard 1/4) (FAILURE): https://github.com/github/gh-aw/actions/runs/37892178270/job/113696291033.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 07420f0
Sous-chef work: 70ff6ecd06af00e89084076feec51e0a21386ffd2b0d8da88d896c1bf1a06518
Sous-chef state: c68102c5c11d4d71611d804cf39bde1e79fc79c95ba87bfc379e0b8dbe245e7f

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 4.93 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

[Copilot]

@SivaKesava1 I've opened a new pull request, #67230, to work on those changes. Once the pull request is ready, I'll request review from you.

[SivaKesava1]

@copilot Please push a single git revert ac24247d00 commit directly to this PR's branch (copilot/fix-classifier-cost-issue). Don't open a new pull request, and don't make any other work-queue changes. That's all this needs: the revert restores safe_output_handler_manager.cjs, safe_outputs_handlers.cjs, work_queue_claim_scope.cjs and work_queue_claim_scope_checks.cjs to exactly what's on main (unchanged there since #66024), so this PR touches no work-queue files.

@pelikhan FYI: #67230 (opened by Copilot to do this revert) is an exact inverse of ac24247 (verified with a diff), but it's blocked by a bot review that read it as a partial revert, and gh-aw-bot is now asking it for more work-queue changes. If the revert above doesn't land here, merging #67230 into this branch has the same effect. Without the revert, this PR would ship an unrelated work-queue authorization change (ac24247, made to satisfy a test that's failing on main). The classifier-cost changes themselves are verified at 7d9ea620.

[Copilot]

@copilot Please push a single git revert ac24247d00 commit directly to this PR's branch (copilot/fix-classifier-cost-issue). Don't open a new pull request, and don't make any other work-queue chan...

Done. Reverted ac24247d00 directly on this branch in commit fa1e804.

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: fa1e804
Sous-chef work:
Sous-chef state: 1416e9730b62beee255d8df8a21c050ccb3c7d00d0bf0a4b0174a1cf9d64f3e0

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 2.92 AIC · ⌖ 5.99 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Fix failing check impacted-go-tests (FAILURE): https://github.com/github/gh-aw/actions/runs/37968998659/job/113953562540.
3. Fix failing check JS Tests (shard 4/4) (FAILURE): https://github.com/github/gh-aw/actions/runs/37968999275/job/113953608723.
4. Fix failing check lint-go-custom (FAILURE): https://github.com/github/gh-aw/actions/runs/37968998659/job/113953563151.
5. Fix failing check verify-integration-build (FAILURE): https://github.com/github/gh-aw/actions/runs/37968998659/job/113953562423.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 458ffc0
Sous-chef work: 31f7e812d45f0792093269b7b90445aa9803225a204ec130694b9ceb0227d7cc 41c633c50467b0f2dc87116833139ebf287e1ad59f1a015d8d1dfedd9d1b23f1 42e5d572d9d75b7168fe7d0aeda0717cc07e65ed240f6d299e6fec661214f1ac cabafb2817b103330ac0d1e2e098f214c40c4ca2be128895a8b14391f7e3306f
Sous-chef state: e37e1f817ce05c3660accaa5990306d2fb608d368843545193b8b6144044e3f1

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 5.91 AIC · ⌖ 7.1 AIC · ⊞ 1K · ◷
_{Comment /souschef to run again}

[Copilot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

make merge-main merged latest main at 9c56e2e in commit b2d26bd; classifier-cost changes are preserved.

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes....

Merged latest main in b2d26bd. The remaining reported failures reproduce on unchanged main code: the Go compact-workqueue test fails on origin/main, custom lint flags three ignored JSON errors in pkg/workqueue/replay.go, the JS failures are in untouched work-queue tests, and integration build reports the undefined parseMaintenanceJobs helper. I kept this PR scoped to classifier-cost attribution rather than adding the unrelated work-queue fixes; changed-file validation passes. No CI was triggered.

[SivaKesava1]

@pelikhan #67092 is back to its verified scope: fa1e804e reverts the unrelated work-queue change, and the PR now touches only the classifier-cost files (unified_session_payload.cjs, token_usage_*, model_routing_test.go, schema and spec). The remaining CI failures are the work-queue failures on main (pkg/workqueue/replay.go lint, undefined parseMaintenanceJobs, work_queue_*.test.cjs). Closing #67230, which isn't needed now.

[pelikhan]

@copilot merge main and fix conflicts

@SivaKesava1 LGTM

[Copilot]

@copilot merge main and fix conflicts

...

Merged the refreshed latest main (7745f43) in fd3504f0. The merge had no conflicts; make merge-main and final impacted tests passed.