feat: token cost observatory — ET metric + JSONL logging

.github/workflows/dev-lead-reusable.yml

@@ -51,6 +51,8 @@ jobs:
       GEMINI_CLI_TRUST_WORKSPACE: "true"
       DEV_LEAD_SCRIPTS: .dev-lead/scripts
       DEV_LEAD_PROMPTS: .dev-lead/prompts/dev-lead
+      TOKEN_LOG_FILE: /tmp/token-usage-${{ github.run_id }}.jsonl
+      TOKEN_WORKFLOW: dev-lead
 
     steps:
       - name: Checkout caller repo
@@ -255,6 +257,15 @@ jobs:
           REPO: ${{ github.repository }}
         run: bash .dev-lead/scripts/dev-lead-fix-reviews.sh
 
+      - name: Upload token usage log
+        if: always()
+        uses: actions/upload-artifact@6f51ac03d0773f2457e7b1f7c5a4f48b5965c01 # v4.6.2
+        with:
+          name: token-usage-${{ github.run_id }}
+          path: /tmp/token-usage-${{ github.run_id }}.jsonl
+          if-no-files-found: ignore
+          retention-days: 30
+
   # ── ci-relay ──────────────────────────────────────────────────────────────────
   # Handles check_run completed failure events. No LLM — resolves PR number and
   # fires repository_dispatch dev-lead-ci-failure back to the calling repo.

.github/workflows/issue-triage-runner.yml

@@ -27,7 +27,8 @@ jobs:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
       - name: Install Python dependencies
-        run: pip install "pyyaml==6.0.3" --only-binary=":all:" --quiet
+        run: |
+          pip install "pyyaml==6.0.3" --only-binary=":all:" --quiet
 
       - name: Run issue-triage (staged)
         id: run
@@ -62,7 +63,8 @@ jobs:
           persist-credentials: false
 
       - name: Install Python dependencies
-        run: pip install "pyyaml==6.0.3" --only-binary=":all:" --quiet
+        run: |
+          pip install "pyyaml==6.0.3" --only-binary=":all:" --quiet
 
       - name: Apply triage output (safe-output)
         env:

.github/workflows/pr-review.yml

@@ -163,14 +163,16 @@ jobs:
       CLAUDE_CODE_VERSION: ${{ vars.CLAUDE_CODE_VERSION || 'latest' }}
       # Mention-triggered reviews always force a re-review; all other triggers
       # respect the idempotency check (no double-reviews on the same head SHA).
+      TOKEN_LOG_FILE: /tmp/token-usage-${{ github.run_id }}.jsonl
+      TOKEN_WORKFLOW: pr-review
       FORCE_REVIEW: ${{ github.event_name == 'repository_dispatch' && 'true' || inputs.force_review || 'false' }}
 
     steps:
       - name: Checkout agent repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Cache claude-code CLI
-        uses: actions/cache@v5.0.5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.npm-global
           key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
@@ -255,3 +257,12 @@ jobs:
 
       - name: Review each PR (cascade)
         run: bash scripts/review-batch.sh
+
+      - name: Upload token usage log
+        if: always()
+        uses: actions/upload-artifact@6f51ac03d0773f2457e7b1f7c5a4f48b5965c01 # v4.6.2
+        with:
+          name: token-usage-${{ github.run_id }}
+          path: /tmp/token-usage-${{ github.run_id }}.jsonl
+          if-no-files-found: ignore
+          retention-days: 30

.github/workflows/test-dev-lead.yml

@@ -4,6 +4,7 @@ on:
     paths:
       - 'scripts/dev-lead*'
       - 'scripts/engine.sh'
+      - 'scripts/lib/**'
       - '.github/workflows/dev-lead*.yml'
       - '.github/workflows/test-dev-lead.yml'
       - 'tests/dev-lead/**'
@@ -13,6 +14,7 @@ on:
     paths:
       - 'scripts/dev-lead*'
       - 'scripts/engine.sh'
+      - 'scripts/lib/**'
       - 'tests/dev-lead/**'
       - 'prompts/dev-lead/**'
   workflow_dispatch: {}

docs/dev-lead/spec.md

@@ -184,7 +184,7 @@ The engine is selected once per workflow run. Handler scripts do not hardcode en
 | Function | Tool access | Use |
 |---|---|---|
 | `run_triage <prompt_file>` | No tools | Fast classification, cheap model |
-| `run_agentic <prompt_file> <model>` | Bash, Read, Grep, Glob | Analysis with file access |
+| `run_agentic <prompt_file> <model> [tier]` | Bash, Read, Grep, Glob | Analysis/action/audit with file access |
 | `run_duck <prompt_file> <model>` | Bash, Read, Grep, Glob | Cross-engine adversarial check |
 
 ### 6.3 New engine function: `run_writer()`