Scope Guardrails

• work in the sibling ECC-Tools repo, not in everything-claude-code
• start read-only unless the user clearly asked for a fix
• do not mutate unrelated billing, checkout, or UI flows while tracing analysis burn
• treat app-generated branches and app-generated PRs as red-flag recursion paths until proved otherwise
• separate three things explicitly:
  • repo-side burn root cause
  • customer-facing billing impact
  • product or entitlement gaps that need backlog follow-up

Workflow

1. Freeze repo scope

• switch into the sibling ECC-Tools repo
• check branch and local diff first
• identify the exact surface under audit:
  • webhook router
  • queue producer
  • queue consumer
  • PR creation path
  • usage reservation / billing path
  • model routing path

2. Trace ingress before theorizing

• inspect src/index.* or the main entrypoint first
• map every enqueue path before suggesting a fix
• confirm which GitHub events share a queue type
• confirm whether push, pull_request, synchronize, comment, or manual re-run events can converge on the same expensive path

3. Trace the worker and side effects

• inspect the queue consumer or scheduled worker that handles analysis
• confirm whether a queued analysis always ends in:
  • PR creation
  • branch creation
  • file updates
  • premium model calls
  • usage increments
• if analysis can spend tokens and then fail before output is persisted, classify it as burn-with-broken-output

4. Audit the high-signal burn paths

PR multiplication

• inspect PR helpers and branch naming
• check dedupe, synchronize-event handling, and existing-PR reuse
• if app-generated branches can re-enter analysis, treat that as a priority-0 recursion risk

Quota bypass

• inspect where quota is checked versus where usage is reserved or incremented
• if quota is checked before enqueue but usage is charged only inside the worker, treat concurrent front-door passes as a real race

Premium-model leakage

• inspect model selection, tier branching, and provider routing
• verify whether free or capped users can still hit premium analyzers when premium keys are present

Retry burn

• inspect retry loops, duplicate queue jobs, and deterministic failure reruns
• if the same non-transient error can spend analysis repeatedly, fix that before quality improvements

5. Fix in burn order

If the user asked for code changes, prioritize fixes in this order:

1. stop automatic PR multiplication
2. stop quota bypass

…

santa-method

通过双评审智能体对结果进行对抗式校验，提升输出发布前的可靠性

finance-billing-ops

帮助核实收入、定价、退款与团队计费的真实情况并定位异常