fix: deterministic audit metrics via run_summary.json cache and workflow-logs/ exclusion

[Copilot]

audit returned inconsistent token_usage and turns on repeated calls for the same run (observed: 9 turns / 381k tokens vs 22 turns / 4.7M tokens) due to two compounding issues.

Root Cause

The inconsistency had two causes:

1. Re-processing on every call: AuditWorkflowRun always re-processed local log files even when a valid run_summary.json was on disk.

2. Double-counting via workflow-logs/: The .log file walk in extractLogMetrics was not excluding the workflow-logs/ directory. When audit is called with a full URL (owner+repo), downloadWorkflowRunLogs successfully downloads GitHub Actions step-output into workflow-logs/. These step captures include the agent's full stdout, so the same token-usage JSON blocks already present in agent-stdio.log appeared again (~12 times) and were summed into metrics.TokenUsage — causing the ~12× inflation.

Changes

• Cache-hit early path in AuditWorkflowRun: before any API calls or log processing, check loadRunSummary. On a hit, reconstruct processedRun from the cached summary and return immediately — no re-download, no re-parse, no API calls.

• renderAuditReport helper: extracted the shared render + finalization logic (comparison snapshot, JSON/console output, --parse handling, success message) into a new function called by both the cache-hit path and the fresh-download path.

• Save summary before rendering: in the fresh-download path, saveRunSummary is now called before renderAuditReport so the cache is persisted as early as possible.

• Skip workflow-logs/ in log walk: extractLogMetrics now returns filepath.SkipDir when the walk visits a directory named workflow-logs, preventing GitHub Actions runner captures from being counted alongside the dedicated agent artifact logs.

Cache invalidation is unchanged — loadRunSummary already rejects summaries whose CLIVersion doesn't match the running binary, so improvements in log parsing are picked up automatically after upgrades.

// New early-return in AuditWorkflowRun (cache hit path)
if summary, ok := loadRunSummary(runOutputDir, verbose); ok {
    processedRun := ProcessedRun{
        Run: summary.Run, /* ... all fields from summary */
    }
    return renderAuditReport(processedRun, summary.Metrics, summary.MCPToolUsage, ...)
}
// Fresh-download path: process → saveRunSummary → renderAuditReport

// workflow-logs/ is now skipped in the log walk
if info.IsDir() {
    if info.Name() == "workflow-logs" {
        return filepath.SkipDir
    }
    return nil
}

Testing

Added TestExtractLogMetricsExcludesWorkflowLogsDir as a regression test: creates a run directory with agent.log (1000 tokens) plus copies of the same data under workflow-logs/, and asserts the total remains 1000 — confirming workflow-logs/ files are ignored.

[pelikhan]

@copilot review why different code paths return different number, refactor and fix, add tests

[Copilot]

@copilot review why different code paths return different number, refactor and fix, add tests

Root cause identified and fixed in commit d63e3be:

Why the two paths returned different numbers:

extractLogMetrics has two code paths:

1. events.jsonl path – single authoritative source (Copilot session events) → deterministic
2. .log file walk fallback – sums TokenUsage across every matched .log/*log*.txt file

The inconsistency came from workflow-logs/: when audit was called with a full URL (owner+repo), downloadWorkflowRunLogs successfully downloaded GitHub Actions step-output into workflow-logs/. These step captures include the agent's full stdout, so the same token-usage JSON blocks already present in agent-stdio.log appeared again (and again) in the step files — each copy was summed, inflating token_usage ~12×.

Call 1 (run ID only) → downloadWorkflowRunLogs may fail/skip when owner/repo isn't in the URL → workflow-logs/ absent → only agent.log counted → 381k tokens ✅
Call 2 (full URL) → downloadWorkflowRunLogs succeeds → workflow-logs/ populated → same data counted ~12 more times → 4.7M tokens ❌

Fixes:

• logs_metrics.go: return filepath.SkipDir when the walk visits workflow-logs/, since those are GHA runner logs that duplicate agent artifact content
• audit.go: serve repeated audit calls from run_summary.json cache (PR commit 1) so even if the walk were non-deterministic, the first correctly-computed result is always reused
• copilot_metrics_fix_test.go: regression test TestExtractLogMetricsExcludesWorkflowLogsDir that asserts workflow-logs/ copies are ignored