Repository navigation
meta-exporter: window_duration_secs is never validated — a missing/junk duration exports a 'window-NaNs' window as a successful reading #1566
Description
Bug
pm-stack/meta-exporter/meta-quota-export.mjs — parseSubscriptionQuota never validates window_duration_secs, even though the module's contract is fail-closed: "Parse a subscription-quota payload into export windows. Throws on any shape drift — fail-closed, never partial zeros." (meta-quota-export.mjs:67-68)
The parser carefully validates window_weighted_used/limit, weekly_weighted_used/limit, and both *_resets_at fields for finiteness and non-negativity (:76-87), and rejects zero limits (:88-90) — but durationSecs is read at :79 and used unchecked at :91 to name the short window:
const shortName = durationSecs === 18_000 ? "5h" : durationSecs === 3_600 ? "1h" : `window-${durationSecs}s`;Verified this run (node, against the real module on main db6f7d0)
With an otherwise-valid payload (the captured fixture shape from meta-quota-export.test.mjs):
window_duration_secs |
Result |
|---|---|
| missing | OK — windows ["window-NaNs", "weekly"] |
"abc" |
OK — windows ["window-NaNs", "weekly"] |
-5 |
OK — windows ["window--5s", "weekly"] |
0 |
OK — windows ["window-0s", "weekly"] |
So a single drifted field in the console API response produces a success document (status: "ok") carrying a garbage-named window with a real used-percent — exactly the "partial/fake reading" outcome the fail-closed design exists to prevent.
Why it matters
The aggregator's file-export mapper passes window names through verbatim and only knows durations for the names "5h" and "weekly" (pm-stack/aggregator/src/quota-gather-map.ts: FILE_EXPORT_WINDOW_SECONDS = { "5h": 18_000, weekly: 604_800 }, and the window loop at :144-155 pushes any named window with windowSeconds: FILE_EXPORT_WINDOW_SECONDS[w.name] ?? null). A window-NaNs window therefore lands in quota-current as a live "ok" window with a nonsense name and no duration, instead of the export failing closed with an unparseable failure document that consumers can alert on. Pool/quota consumers keying on the 5h window silently lose the real short window while the service still reports healthy.
Parent feature: #1301 (Meta adapter Phase 1 — this exporter).
Acceptance criteria
parseSubscriptionQuotavalidateswindow_duration_secslike the other numeric fields: it must be a finite number> 0; a missing, non-numeric, zero, or negative value throwsExportError("unparseable", 6, …)naming the field.- Well-formed payloads are unchanged:
18000→5h,3600→1h, any other positive duration →window-<n>s(the forward-compatible naming for a genuinely new window length stays). - Tests in
meta-quota-export.test.mjsadd the missing /"abc"/0/ negativewindow_duration_secscases to the existing "shape drift fails closed" test family, asserting they throw. - No change to the success/failure document shapes or exit codes.
Activity
developing-today commentedon Oct 28, 2026
CODE-610
dezren39 commentedon Oct 28, 2026
🤖 Agent note · filed
parseSubscriptionQuotain pm-stack/meta-exporter/meta-quota-export.mjs validates every numeric quota field exceptwindow_duration_secs(:79 read, :91 used unchecked). Missing duration → windows ["window-NaNs","weekly"], "abc" → "window-NaNs", -5 → "window--5s", 0 → "window-0s" — all returned as a successful parse, contradicting the module's fail-closed contract (:67-68). The aggregator's file-export mapper (quota-gather-map.ts FILE_EXPORT_WINDOW_SECONDS + :144-155) passes unknown window names through with windowSeconds null, so the bogus window reaches quota-current as a live ok window. Enqueued as a triage packet to repo-health-code-pilot.26 remaining items
dezren39 commentedon Oct 28, 2026
🤖 Agent note · picked up
window_duration_secsfail-closed inpm-stack/meta-exporter/meta-quota-export.mjs(parseSubscriptionQuota) + drift cases in its test file. Laptop SSH is back, so the earlier park reason no longer applies.queue/1833-1566-window-duration-validation(to create on laptop)Merge pull request #1694 from developing-today/queue/1833-1566-window…
dezren39 commentedon Oct 28, 2026
🤖 Agent note · done
window_duration_secsfail-closed inparseSubscriptionQuota(meta-quota-export) + drift tests, per the verified triage brief.211aa58fwith CI green; laptop test run 6/6 (missing/'abc'/0/negative all throw ExportError unparseable/6 naming the field; valid naming 5h/1h/window-s unchanged).queue/1833-1566-window-duration-validation