[johnnyeric]

Summary

Attach a receipt consumer to the same usage-ingest Worker in production and
staging. Valid messages log only their supplied usage ID, queue message ID,
delivery attempts, and event age before acknowledgement. Malformed messages log
a categorical invalid receipt and are discarded without exposing their bodies.

The consumer has no mode flag: it always acknowledges and removes received
messages, providing neither persistence nor billing. Current direct usage writes
remain authoritative. A successful console call before acknowledgement does not
guarantee durable log storage.

Verification

• Exercised local synthetic FRA/SFO finalized usage through installed Next
  background lifetime, the actual HTTP helper, configured Worker, local Queue,
  and shipped receipt consumer in both environments, including accounting after
  earlier cleanup had drained. Supplied usage IDs appeared in safe receipts and
  queue backlog reached zero.
• Checked disabled sending, actual HTTP 401, and bounded timeout controls
  with mocked billing unaffected and the background lifetime tracked.
• Checked invalid HTTP input without enqueueing and malformed queue input
  producing a safe invalid receipt and removal.
• Verified synthetic secrets/prompts/user metadata were absent from captured
  logs and fixture ports were released. No hosted rollout was exercised.

Visual Changes

N/A

Reviewer Notes

Stacked on #7296. This layer changes only the usage-ingest service;
the prerequisite gateway integration keeps sending default off. Deploy and verify
the receipt consumer before enabling sending. Attaching it can drain an existing
backlog. Replace receipt-only handling with successful usage persistence before
making the queue authoritative.

Logging failure throws before acknowledging that message. Hosted Queues preserve
earlier explicit acknowledgements; unacknowledged messages use bounded retries
(three retries by default, then discard without a DLQ). Local Miniflare differs
on a thrown batch, so partial-failure acknowledgement order is covered by unit
spies and the platform contract rather than claimed as hosted-equivalent local
proof. At-least-once duplicates remain possible.

Automated validation: 26 Worker tests, 214 composed gateway/helper tests, and 43 selected usage-processing tests passed (22 DB-backed cases excluded), plus Worker typecheck, lint, formatting,
generated Env, and both environment dry-run builds. The composed proof uses real
Next lifetime, helper HTTP transport, Worker validation and shipped consumer;
provider stats/request stores are synthetic and database/billing, regional writer
transport, bouncer, analytics and provider policy are mocked. It is not a deployed
gateway/Vercel or billing E2E.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Scoped to the 8 changed files in this stacked usage-ingest shadow-receipt layer; reviewed the new queue consumer, its Worker wiring, wrangler consumer registrations, tests, fixture, and README for correctness, security/data-leak, and memory concerns.

Notable verification: receipt-usage.ts only logs the validated usage ID, queue message ID, delivery attempts, and non-negative event age, and logs a categorical invalid receipt for malformed bodies with no body leakage; per-message ack() runs only after the log call. The added consumers entries match the existing producer queues and follow the producer+consumer pattern used by other services. Low-confidence observations (runtime-test brittleness from asserting an empty log buffer and a fixed 500ms wait; a slightly broad absolute phrase in the README that the same paragraph qualifies) were considered but are not actionable defects.

Files Reviewed (8 files)

• services/usage-ingest/README.md
• services/usage-ingest/src/index.runtime.test.ts
• services/usage-ingest/src/index.test.ts
• services/usage-ingest/src/index.ts
• services/usage-ingest/src/receipt-usage.test.ts
• services/usage-ingest/src/receipt-usage.ts
• services/usage-ingest/src/usage.test-fixture.ts
• services/usage-ingest/wrangler.jsonc

---

_{Reviewed by deepseek-v4.1-flash · Input: 52.4K · Output: 14.3K · Cached: 524.8K}

_{Review guidance: REVIEW.md from base branch johnnyeric/usage-shadow-after}