fix(gcp): Cloud Storage prices a per-GiB-month SKU as hourly, inflating cost 730x

[cristim]

Summary

Google Cloud Storage SKUs are priced per GiB-month, but the pricing code multiplies the catalog unit price by 8760 hours per year, producing a term total 730 times too large per year and labelling a per-GiB-month figure as an hourly rate. Nothing on the path reads the SKU's usage unit. Unlike the sibling GCP clients this path is live: the storage pricing fill runs inside the recommendation conversion.

Location

providers/gcp/services/cloudstorage/client.go:356 at 3c0f8ac94048a2c36fce5ccddee54e6c4849a5cd

Failure scenario

GCS storage SKUs are denominated per GiB-month (unitOfMeasure "GiBy.mo"); none are per-hour. Multiplying the catalog unit price by 8760 * termYears therefore converts a monthly rate into a fictitious term total 730x too large per year. CommitmentPrice and OnDemandPrice both flow into common.OfferingDetails.TotalCost and into rec.CommitmentCost via fillStoragePricing, and HourlyRate labels a per-GiB-month figure as an hourly rate.

Evidence

hoursInTerm := 8760.0 * float64(termYears)
commitmentPriceTerm := commitmentPrice * hoursInTerm
savingsPercentage := calculateStorageSavingsPercentage(onDemandPrice, hoursInTerm, commitmentPriceTerm)

Suggested fix

Read PricingExpression.UsageUnit and scale by the unit the SKU actually uses (months for GiBy.mo), erroring when the unit is unrecognized rather than assuming hours.

---

Found by the 2026-09-02 codebase audit, finding A08b-014, reported by one reviewer and independently confirmed by a second. Full report: docs/audits/codebase-audit-2026-09-02.md.

[cristim]

Merged in PR #166, commit 28efbcd315e36c7de50716dd5b3043791c696756.

Verified the actual merged commit on macOS with Go 1.26.6. Its complete Git tree is 98c541020f5fa661da3d28dca2804e4114abd30a, identical to independently reviewed head f87771d9d2dfb32dae9a76eb88f817def7c1115a. The checkout was clean before and after verification.

Fresh post-merge command, from providers/gcp:

GOWORK=off GOTOOLCHAIN=go1.26.6 go test -race -count=1 ./services/cloudstorage -run 'TestStoragePricingUnits|TestSkuMatchesStorageClass|TestCloudStorageClient_PurchaseCommitment'

PASS (1.859s). The real Billing SDK decoded responses from a strictly confined local HTTP catalog endpoint. Public offering and recommendation paths produced the corrected monthly/hourly and one-/three-year costs; mixed units remained correct; same-class operations were ignored before and after valid prices; unknown/count units on capacity records still failed; unavailable advisory pricing stayed nil; capacity matching and unsupported purchase behavior passed.

Recommendation: keep #77 closed. The catalog data and commitment SKUs are synthetic, so this is local SDK consumer verification, not live cloud or purchase execution. The separate bucket-name-to-storage-class mapping problem remains tracked by existing #78; no duplicate follow-up was created. No cloud calls, source edits, or deletions were performed during post-merge verification.