feat(worker): self-trace the digest-summary LLM call

[GabrielDrapor]

notifications/digest-summary.ts calls pi-ai's complete() directly, unlike the judge which goes through tracedComplete. It is the one model call in the product with no trace at all — only a usage row in ai_messages.

Routes it through the worker's existing tracedComplete + withSelfTrace (the judge's path, already shipping) with root name digest-summary, trace id sha256(project:window_start:window_end)[:32], and metadata { kind: "digest", finding_ids }. source stays detector — source is derived from the authenticated caller, and this is the worker. No new emitter, no new secret.

A test asserts digest-summary.ts does not call complete() directly; re-adding it is the regression this exists to prevent.

Independent of the agent self-trace stack — tracedComplete and withSelfTrace are already on main, so this can land on its own.

Closes #2066. Related to #2058.

[trident-sentinel]

PR overview

This pull request routes digest-summary model calls through the worker’s self-tracing and traced-completion infrastructure while updating self-trace metadata types and callers.

No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

_{Scanned with Semgrep · TruffleHog · Trident review. View in Trident}

Fixed/addressed: 0 · PR risk: 0/10

[cubic-dev-ai]

All reported issues were addressed across 5 files

Architecture diagram

sequenceDiagram
    participant Scheduler as Digest Scheduler
    participant Processor as Worker Digest Processor
    participant Summary as digest-summary
    participant Config as Model and API Key Resolver
    participant Trace as withSelfTrace
    participant LLM as tracedComplete / LLM Provider
    participant TraceRoot as Traceroot
    participant DB as Trace and ai_messages Storage

    Note over Scheduler,DB: Current digest-summary runtime flow

    Scheduler->>Processor: Flush digest job for project and time window
    Processor->>Summary: generateDigestSummary(input, projectId, model config)
    Summary->>Config: Resolve provider config, model, and detector API key
    Config-->>Summary: Model and authenticated provider access

    Summary->>Summary: Compute trace id = sha256(projectId:windowStart:windowEnd)[0:32]
    Summary->>Trace: withSelfTrace(traceId, projectId, name=digest-summary, metadata)
    Note over Summary,Trace: Metadata includes kind=digest and digest finding/window context. Source remains detector because the caller is the worker

    Trace->>Trace: Establish self-trace scope
    Trace->>TraceRoot: Create trace root with digest-summary name and project attribution
    TraceRoot-->>Trace: Active trace scope

    Trace->>LLM: tracedComplete(model, prompt, messages, tools, timeout signal)
    LLM->>DB: Record LLM usage in ai_messages
    LLM->>TraceRoot: Emit model call span and response data
    LLM-->>Trace: Completion response
    Trace-->>Summary: Successful traced result

    Summary->>Summary: Parse submit_digest_summary tool result
    Summary-->>Processor: Digest summary or null
    Processor-->>Scheduler: Digest flush completed

    alt LLM timeout, abort, or self-trace setup failure
        LLM-->>Trace: Aborted/error response
        Trace-->>Summary: Error result or plain execution fallback
        Summary-->>Processor: null or digest failure
    else LLM/provider failure
        LLM-->>Trace: Error
        Trace-->>Summary: Propagate traced error
        Summary-->>Processor: Digest generation failure
    end

Loading

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>