feat(worker): S3 3b härda UPDATE_USER_MEMORY — budget, kostnad, anti-påhitt, GDPR-regression

apps/worker/src/processors/maintenance.ts

@@ -5,6 +5,12 @@ import { deriveMemoryUpdates } from "@app/memory-client";
 import { getLocaleContext } from "../locale.js";
 import type { WorkerContext } from "../context.js";
 import { cancelTimedOutCookingSessions } from "@app/database";
+import { recordAiUsage } from "../lib/ai-usage.js";
+
+/** Pessimistisk kostnadsuppskattning för UPDATE_USER_MEMORY (text-only). */
+const COST_ESTIMATE_PER_MEMORY_SYNC_USD = 0.001;
+/** Maxkonfidens för ai_inferred-minnen (R1: låg startkonfidens). */
+const AI_INFERRED_MAX_CONFIDENCE = 0.7;
 
 export { processProactiveTips } from "./proactive-tips.js";
 
@@ -237,6 +243,8 @@ export async function processMealBoxReminders(ctx: WorkerContext): Promise<numbe
  * förslag skrivs till memory_items där användaren äger dem.
  */
 export async function processMemorySync(ctx: WorkerContext): Promise<number> {
+  const dailyBudgetUsd = Number(process.env.GEMINI_DAILY_BUDGET_USD ?? 0);
+
   const users = await ctx.db
     .select({ userId: schema.userConsents.userId })
     .from(schema.userConsents)
@@ -250,7 +258,12 @@ export async function processMemorySync(ctx: WorkerContext): Promise<number> {
   let updates = 0;
   for (const { userId } of users) {
     const events = await ctx.db
-      .select()
+      .select({
+        id: schema.domainEvents.id,
+        type: schema.domainEvents.type,
+        occurredAt: schema.domainEvents.occurredAt,
+        payload: schema.domainEvents.payload,
+      })
       .from(schema.domainEvents)
       .where(
         and(
@@ -267,6 +280,16 @@ export async function processMemorySync(ctx: WorkerContext): Promise<number> {
       .limit(100);
     if (events.length < 3) continue;
 
+    // BUDGET: spegla skanningen — över budget får inget AAMOS-anrop göras.
+    if (dailyBudgetUsd > 0 && ctx.budgetStore) {
+      const currentSpend = await ctx.budgetStore.getDailySpendUsd();
+      if (currentSpend + COST_ESTIMATE_PER_MEMORY_SYNC_USD > dailyBudgetUsd) {
+        // eslint-disable-next-line no-console
+        console.log(`UPDATE_USER_MEMORY: skippar ${userId}: daglig budget förbrukad.`);
+        continue;
+      }
+    }
+
     const existing = await ctx.db
       .select({ key: schema.memoryItems.key })
       .from(schema.memoryItems)
@@ -279,11 +302,12 @@ export async function processMemorySync(ctx: WorkerContext): Promise<number> {
     const has = (kind: string) => consents.find((c) => c.kind === kind)?.status === "granted";
 
     const localeContext = await getLocaleContext(ctx, userId);
-    const proposals = await deriveMemoryUpdates(ctx.aamos, {
+    const { proposals, usage } = await deriveMemoryUpdates(ctx.aamos, {
       scope: "user",
       scopeId: userId,
       localeContext,
       events: events.map((e) => ({
+        id: e.id,
         type: e.type,
         occurredAt: e.occurredAt.toISOString(),
         payload: e.payload,
@@ -296,7 +320,35 @@ export async function processMemorySync(ctx: WorkerContext): Promise<number> {
       },
     });
 
+    // Bokför AI-kostnad/tokens så total dagskostnad inkluderar minnes-AI:n.
+    if (usage) {
+      await recordAiUsage(ctx.db, userId, {
+        costUsd: usage.costUsd,
+        inputTokens: usage.inputTokens,
+        outputTokens: usage.outputTokens,
+      });
+    }
+
+    const eventIdSet = new Set(events.map((e) => e.id));
+
     for (const proposal of proposals) {
+      // R1: varje förslag måste vara grundat i faktiska events.
+      const hasEventSupport =
+        proposal.sourceEventIds.length > 0 &&
+        proposal.sourceEventIds.every((id) => eventIdSet.has(id));
+      if (!hasEventSupport) {
+        // eslint-disable-next-line no-console
+        console.log(`UPDATE_USER_MEMORY: avvisar ${proposal.key} för ${userId}: saknar event-stöd.`);
+        continue;
+      }
+
+      // R1: ai_inferred ska ha låg konfidens.
+      if (proposal.origin === "ai_inferred" && proposal.confidence > AI_INFERRED_MAX_CONFIDENCE) {
+        // eslint-disable-next-line no-console
+        console.log(`UPDATE_USER_MEMORY: avvisar ${proposal.key} för ${userId}: ai_inferred med för hög confidence.`);
+        continue;
+      }
+
       // Skriv aldrig över användarverifierade poster (spec §30: user_stated vinner).
       const [current] = await ctx.db
         .select()