You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(usage-hub): disabled providers must not appear in quota — audit + regression test #1114
Part of epic #1047. Design: hub-v2-v3-design-2026-10-26.md §5.
Drew's 2026-10-25 finding: the quota registry lists providers from stored credentials and never consults disabled_providers; OpenRouter + GitHub Copilot should be disabled and ABSENT from quota. OpenChamber's CLI listing was fixed (PR #474), but the hub feed / quota-extract / registry side was never verified end-to-end.
Work: audit the live /api/quota.json pools + quota-guidance output against the deployed opencode config's disabled_providers list; fix any leak at the extractor/registry source (not by filtering the render); add a regression test that fails if a disabled provider appears. Keeper rule: quota guidance must never fail sessions over to cloudflare-gateway, cloudflare-workers-ai, code-design, design-code, or open-design.
Acceptance: live feed verified clean against the current disabled set; test in the aggregator suite; registry note updated with the verification date.
Verdict: Mixed. The specific leak Drew found on 2026-10-25 does not reproduce at origin/main 39e8410b: /api/quota.json pools come from a fixed allowlist (pm-stack/aggregator/src/quota-extract.ts POOL_SPECS + SHELL_POOLS) that contains neither OpenRouter nor GitHub Copilot, and src/quota-guidance.ts derives failover choices only from those pools — the keeper set (cloudflare-gateway, cloudflare-workers-ai, code-design, design-code, open-design) are SaaS lines, never quota pools, so guidance cannot fail sessions over to them. But the cleanliness is by allowlist accident, not enforcement: nothing in the quota path consults the deployed config's disabled_providers (the only parsing is the AA model catalog, src/aa.ts:789-797, which does not feed quota), and there is no regression test — disabled appears in none of the quota test files. The live-feed audit and registry verification note from the acceptance are also not yet recorded.
Routing: Enqueued scoped follow-up queue task 3005 (kind small_fix): a disabled_providers filter at pool assembly (reusing the aa.ts parsing approach, filter at the source not the render), regression tests for disabled providers + the keeper set, and the live /api/quota.json audit + registry note.
Lane D (queue task 3005) resumed from checkpoint merge_ready. Fresh revalidation 2026-10-29T23:32Z: PR #2377 OPEN/CLEAN/MERGEABLE at 8714f9b, no failing or pending checks, base main. Blocker #2403 still open, main still 5a34fa7 — two enqueue attempts already this shift (#2430, #2214) were ejected within minutes. Attempting one fresh enqueue for #2377; if ejected, the task re-parks. No --admin bypass (per merge rules noted by prior lane).
Lane D (queue task 3005): merge-queue enqueue attempted — PR #2377 entered 23:32:09Z, reached position 1 AWAITING_CHECKS, then was ejected by 23:38:12Z (queue empty, PR OPEN, main 5a34fa7). Fresh confirmation of blocker #2403 (evidence posted there). Task re-parked. Resume: #2403 fixed / main advances → merge #2377 via MQ (no --admin) → complete fixed_merged + close this issue.
Activity
developing-today commentedon Oct 27, 2026
CODE-252
dezren39 commentedon Oct 29, 2026
🤖 Agent note · picked up
dezren39 commentedon Oct 29, 2026
🤖 Agent note · done (triage verdict: leak absent at HEAD — enforcement/test gap CONFIRMED, routed)
39e8410b:/api/quota.jsonpools come from a fixed allowlist (pm-stack/aggregator/src/quota-extract.tsPOOL_SPECS + SHELL_POOLS) that contains neither OpenRouter nor GitHub Copilot, andsrc/quota-guidance.tsderives failover choices only from those pools — the keeper set (cloudflare-gateway, cloudflare-workers-ai, code-design, design-code, open-design) are SaaS lines, never quota pools, so guidance cannot fail sessions over to them. But the cleanliness is by allowlist accident, not enforcement: nothing in the quota path consults the deployed config'sdisabled_providers(the only parsing is the AA model catalog,src/aa.ts:789-797, which does not feed quota), and there is no regression test —disabledappears in none of the quota test files. The live-feed audit and registry verification note from the acceptance are also not yet recorded.disabled_providersfilter at pool assembly (reusing the aa.ts parsing approach, filter at the source not the render), regression tests for disabled providers + the keeper set, and the live/api/quota.jsonaudit + registry note.39e8410b1a23b99c9cb1f93c2ce869830a916c0680 remaining items
dezren39 commentedon Oct 29, 2026
Lane D (queue task 3005) resumed from checkpoint merge_ready. Fresh revalidation 2026-10-29T23:32Z: PR #2377 OPEN/CLEAN/MERGEABLE at 8714f9b, no failing or pending checks, base main. Blocker #2403 still open, main still 5a34fa7 — two enqueue attempts already this shift (#2430, #2214) were ejected within minutes. Attempting one fresh enqueue for #2377; if ejected, the task re-parks. No --admin bypass (per merge rules noted by prior lane).
dezren39 commentedon Oct 29, 2026
Lane D (queue task 3005): merge-queue enqueue attempted — PR #2377 entered 23:32:09Z, reached position 1 AWAITING_CHECKS, then was ejected by 23:38:12Z (queue empty, PR OPEN, main 5a34fa7). Fresh confirmation of blocker #2403 (evidence posted there). Task re-parked. Resume: #2403 fixed / main advances → merge #2377 via MQ (no --admin) → complete fixed_merged + close this issue.
dezren39 commentedon Oct 30, 2026
🤖 Agent note · picked up → parked
dezren39 commentedon Oct 30, 2026
🤖 Agent note · done