Summary

Fixes #70714 by preserving evals accounting from AWF's exported runner-visible AWF_TOKEN_USAGE_LOG, rather than only searching fixed firewall directories. Existing non-empty directory fallbacks remain available when the exported file is unavailable. Empty exports are preserved, missing files do not become zero-usage placeholders, and component coverage, conservative estimates, daily limits, and estimate expiration remain unchanged.

Adds generated-shell regression coverage for default and ARC/DinD topologies, exported-path precedence and spaces, empty exports, legacy paths, and unavailable accounting. Documents the transport contract and regenerates 168 affected workflow locks. Recompilation also refreshes one previously stale admission hash in the Caveman optimizer lock; no workflow Markdown, permissions, destinations, or budgets change.

ADR: ADR-70749: Prefer AWF-Exported Token Usage Log for Evals Accounting

Existing-run evidence

Smoke Copilot run 39522345151 counted 13 historical runs: five fully covered runs contributed 112.612865 recorded AIC, and eight unresolved runs each contributed the conservative 1,000-AIC maximum. All eight failures specifically reported missing evals/token_usage.jsonl despite successful evals jobs.

In run 39510857197, evals job 118936697463 exported AWF_TOKEN_USAGE_LOG=/tmp/api-proxy-logs-asbSi6/token-usage.jsonl, while the collector searched only fixed audit/log directories. The evals artifact contains results and execution evidence but no token usage. The pinned AWF v0.28.70 implementation exports this path through GITHUB_ENV for downstream consumers.

This is a prospective producer fix: it cannot recover missing historical files or certify the true usage of those eight runs. Unresolved historical estimates continue to be retried and expire through the existing rolling 24-hour window. No workflows were dispatched, budgets raised, conservative safeguards weakened, or historical results rewritten. Cache cold starts, AOAI pricing/budget reports, prompt optimization, and compiler performance remain separate investigations.

Validation

• make build and make fmt passed after restoring the missing pinned formatter dependencies.
• Focused TestDailyAICEvalsCollector* and accounting-transport tests passed, including 14 generated-shell scenario/topology cases.
• Downstream component-coverage and scan suites: 221 tests passed, covering conservative fallback and estimate lifecycle.
• Incremental Go lint (--new-from-rev=HEAD before commit) reported zero new issues; emitted collector ShellCheck passed.
• 345 workflows compiled successfully; make check-workflow-drift passed.
• Required make agent-report-progress was attempted: sampled impacted Go tests passed, but the aggregate gate failed on shared linter contention. A cache-isolated follow-up gate remained blocked by pre-existing modernize diagnostics in unchanged claude_engine.go, codex_engine.go, and comment_memory.go, plus existing unknown-nolint warnings. No unrelated lint fixes were bundled.
• Single read-only security review passed the source change. Same-reviewer generated-lock follow-up was unavailable because the runtime rejects followups to synchronous agents; direct byte-equivalence verification confirmed all 168 locks contain exactly the reviewed collector transformation, apart from the noted admission-hash refresh. This limitation is not represented as an additional reviewer PASS.
• Review follow-up finalized the ADR and linked it above. ADR structure, specification-link existence, and whitespace checks passed. The required publication gate was attempted again: build, schema checks, custom lint, and sampled impacted Go tests passed; shared parallel golangci-lint contention still blocked the aggregate gate. The follow-up changes documentation only.

The report_progress tool is not exposed in this session, so the checked changes were committed and pushed with Git. The shared packed-refs lock prevented branch renaming but did not prevent successful commit/push; shared Git state was not altered.