aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins

Problem

isFleetFeed (pm-stack/aggregator/src/feed.ts:207-219) never validates the
optional chargesAttention section at all — it checks only version,
generatedAt, quota.pools being an array, and attention being an array.
But the live source dereferences every chargesAttention entry unguarded,
so one malformed entry in a feed that passes the gate crashes usage() —
and with it every route that awaits it.

Evidence (verified this run, main `5a34fa70`)

feed.ts:25-52: FleetFeed.chargesAttention?: UnmatchedCharge[], where
UnmatchedCharge (charges-match.ts:44-50) requires merchant: string,
amountUsd: number, at: string, source.
feed.ts:207-219: isFleetFeed contains no chargesAttention check of
any kind — not array-ness, not entry shape.

sources/live.ts:820-827: in usage()'s feed branch (taken whenever
feed.saas is non-empty), the entries are mapped verbatim:

const chargeFlags = (feed.chargesAttention ?? []).map((u) => ({
  label: `${u.merchant} — unrecognized SaaS/AI charge`,
  detail: `$${u.amountUsd.toFixed(2)} on ${u.at} via ${u.source === "plaid" ? "Plaid" : "Gmail alert"} …`,
  severity: u.amountUsd,
}));

There is no filter or per-entry guard — unlike the registry / projects /
snapshots consumers in the same file, which validate or filter first.

server.ts:486,492,656,669: /quota, /quota/service/<id>,
/api/quota.json and /api/quota/service.json all await source.usage()
with no catch, so the throw becomes a 500 for the whole usage hub — not
just a missing charge flag.

Laptop Bun probe (~/git/fleet/probe-2026-10-29-laneA-chargeattn/, real
feed.ts from main 5a34fa70, md5-identical, Bun 1.4.2; the map above
copied verbatim from live.ts:820-827):

`chargesAttention`	`isFleetFeed`	verbatim map
valid entry (control)	`true`	OK — 1 flag, `$12.50`
`[null]`	`true`	throws `TypeError: null is not an object (evaluating 'u.merchant')`
entry missing `amountUsd`	`true`	throws `TypeError: undefined is not an object (evaluating 'u.amountUsd.toFixed')`
`amountUsd: "12.50"` (string)	`true`	throws `TypeError: u.amountUsd.toFixed is not a function`
`"oops"` (non-array)	`true`	throws `TypeError: (feed.chargesAttention ?? []).map is not a function`

Why it matters

chargesAttention is the exactly-once surfacing channel for unmatched
SaaS/AI charges (#1057): the collector emits these entries from Plaid/Gmail
candidate data, so a single drifted or hand-edited feed entry takes down
/quota and both quota JSON twins entirely instead of dropping one flag.
This is the same failure class as #2427 (attention entries) and #2429
(quota pools) at the same gate — the fix should stay consistent with
whatever layer those two pin.

Acceptance criteria

A feed passing isFleetFeed can no longer crash usage(): either the
gate validates chargesAttention (array of entries with string
merchant/at and finite number amountUsd), or the live source
filters/defaults malformed entries before the map — the layer pinned
consistently with the aggregator(feed): isFleetFeed never checks attention entries — one null entry crashes /attention + /today, entries without a string sessionId silently collapse into one #2427/aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429 rulings.
Malformed entries are dropped individually; well-formed entries in the
same array still surface as attention flags.
Regression tests cover: [null] entry, entry missing amountUsd,
string amountUsd, non-array chargesAttention — each rendering the
valid remainder (or fixture fallback), never throwing; a well-formed
feed unchanged, and the collector still accepts its own emitted feed.

Dedup

gh searches (open + closed) for chargesAttention and isFleetFeed charges returned no covering issue. Siblings at the same gate: #2427
(attention entries), #2429 (quota pools) — distinct fields and consumers.
#2130/#2194 cover charges-match/charges-collect internals, not the feed
gate or the live usage() consumer.

CODE-1246

🤖 Agent note · filed

Agent: new-issue-creator job (lane A, new-issue-creator-code-a)
Session / ID: new-issue-creator-code-a run 2026-10-29T21:41Z
Found via: filed this run
Task: Triage the unvalidated chargesAttention section at the isFleetFeed gate — pin the validation layer (gate vs live-source filter, consistent with aggregator(feed): isFleetFeed never checks attention entries — one null entry crashes /attention + /today, entries without a string sessionId silently collapse into one #2427/aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429), then route a small_fix packet.
Expectation: effort/xs triage; done = layer pinned and fix packet routed with the named regression tests.
Links: probe ~/git/fleet/probe-2026-10-29-laneA-chargeattn/ (laptop, real feed.ts from main 5a34fa7)

Merge pull request #3435 from developing-today/queue/5328-2439-charge…

🤖 Agent note · done

Agent: repo-worker-code (Lane D scheduled shift)
Session / ID: task 5328
Found via: atomic queue claim
Task: Complete. PR fix(aggregator): gate + sanitize feed chargesAttention (#2439) #3435 merged (merge commit ba2e97dd1b89843a0ef47597c6303c26916bb607); aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439 closed.
Verification: Laptop bun — feed.test.ts + charges-feed-gate.test.ts 27/27 at the original head; after merging current main (which had landed the sibling aggregator(feed): isFleetFeed never checks subscriptions — one null row crashes /quota #2446 subscriptions sanitizer in the same loadFeed), conflicts in feed.ts/feed.test.ts were resolved keeping both sanitizers, and the full aggregator suite passes 817/817. Codex posted no findings on the PR in the full poll window.
Links: fix(aggregator): gate + sanitize feed chargesAttention (#2439) #3435

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), Lane E shift
Session / ID: queue task 3653 (triage)
Found via: queue claim
Task: Triage aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439 — verify chargesAttention crash at current main, pin the validation layer consistent with sibling aggregator(feed): isFleetFeed never checks attention entries — one null entry crashes /attention + /today, entries without a string sessionId silently collapse into one #2427/aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429 rulings, route a small_fix packet
Expectation: effort xs; done = findings comment posted on aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439 with file:line evidence + follow-up fix task enqueued
Links: n/a yet

🤖 Agent note · done (triage)

Agent: queue worker (repo-worker-code), Lane E shift
Session / ID: queue task 3653 (triage) → follow-up fix task 5328
Found via: queue claim
Task: Triage aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439 — CONFIRMED at current main, layer pinned, small_fix routed
Expectation: met — findings below; fix = queue task 5328
Links: fix packet: hidden_files/packets/task-2439-fix.json (goal workspace)

Verdict: CONFIRMED at current main a17ae136 (2026-11-01).

Evidence (fresh, this run):

pm-stack/aggregator/src/feed.ts:398-414 — isFleetFeed checks version / generatedAt / quota pools+burn+choices / attention array only. chargesAttention is unchecked in any form. loadFeed (feed.ts:422+) sanitizes ONLY the quota section via sanitizeQuotaView.
pm-stack/aggregator/src/sources/live.ts:893-900 — (feed?.chargesAttention ?? []).map(...) dereferences u.merchant, u.amountUsd.toFixed(2), u.at, u.source unguarded; computed before every usage() return path (fix(aggregator): live source consumes auto-matched charges only inside the saas gate, so a quota-view failure hides them all (PR #2149) #3124), so /quota, /quota/service, /api/quota.json and /api/quota/service.json all inherit the crash.
Laptop Bun probe (real feed.ts from origin/main + the verbatim live.ts map): control OK (1 flag, $12.50); [null] → TypeError on u.merchant; missing amountUsd → TypeError on u.amountUsd.toFixed; string amountUsd → toFixed is not a function; non-array chargesAttention → .map is not a function — all with isFleetFeed=true.

Layer pinned — the landed #2429 pattern in the same file (gate + loadFeed sanitizer, PR #3070), NOT a live-source filter:

Gate (isFleetFeed): section-level shape only — chargesAttention present-but-non-array rejects the feed (mirrors the burn/choices treatment); absence stays valid (optional section).
Sanitizer (loadFeed): new isUnmatchedCharge element validator + arrayOf drop-and-count, count surfaced on the feed (mirroring quotaDropped). Element contract = exactly the fields live.ts dereferences: string merchant, finite number amountUsd, string at. (source/normalized are not gate-required: the consumer tolerates any source value.)
Malformed entries drop individually; well-formed siblings still surface as /quota attention flags. The live.ts map itself is not touched — the fix lives at the feed boundary, like aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429.

Regression tests named in the fix packet: test/feed.test.ts ([null], missing amountUsd, string amountUsd, non-array, mixed valid+malformed, well-formed unchanged, collector-emitted feed still accepted) + an end-to-end live usage() case in test/charges-feed-gate.test.ts.

Sibling note: #2427 (attention entries) is a different section/consumer — its triage (task 3640) is in flight separately; this ruling does not preempt it.

🤖 Agent note · picked up

Agent: repo-worker-code (Lane D scheduled shift)
Session / ID: task 5328 (small_fix, follow-up of triage task 3653)
Found via: atomic queue claim
Task: Implement the pinned aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439 fix: isFleetFeed chargesAttention array gate + loadFeed isUnmatchedCharge drop-and-count sanitization in feed.ts, with regression tests.
Expectation: Branch + PR this shift; merge when tests pass and Codex is dispositioned.
Links: aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439

Navigation Menu

Repository navigation

aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439

Problem

Evidence (verified this run, main `5a34fa70`)

Why it matters

Acceptance criteria

Dedup

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

aggregator(feed): isFleetFeed never checks chargesAttention — one malformed entry crashes usage() and takes down /quota + the quota JSON twins #2439

Description

Problem

Evidence (verified this run, main 5a34fa70)

Why it matters

Acceptance criteria

Dedup

Activity

developing-today commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (verified this run, main `5a34fa70`)