Repository navigation
aggregator(feed): isQuotaWindow accepts any string as resetsAt and any finite used/limit/percent — an impossible reset date is clocked as Mar 2 in guidance, a -50% window reads healthy and a 15000% window walls a pool #3427
Description
Problem
isQuotaWindow — the feed boundary guard behind sanitizeQuotaView / loadFeed (#2429) in pm-stack/aggregator/src/feed.ts:286-296 — checks only types, never values:
resetsAtpasses as any string (feed.ts:293:v.resetsAt === null || typeof v.resetsAt === "string")limitpasses as any finite number, including negative (feed.ts:291)usedpasses as any finite number, including negative (feed.ts:292)percentpasses as any finite number, including negative or ≫100 (feed.ts:294)
The sister boundary for the same fields already refuses exactly these shapes: isSnapshotRecord (src/snapshots.ts:313-316) requires isNonNegative(limit) and isIsoDate(resetsAt), with the comment that downstream code dereferences them (pct-of-limit, reset comparisons). The feed gate does not, and the shared strict primitive (isIsoDate / parseIsoDate, src/validate.ts) is already imported by feed.ts for other sections.
Evidence (verified this run, main 574c04a)
Laptop probe ~/git/fleet/probe-2026-11-01-laneA-feedquota/ (copies of the real src/ tree, feed.ts md5 e564f17aea918d5281fd37d433a01017, identical to main; run with bun 1.4.2 against the real isQuotaWindow, windowPercent, poolState, computeChoices, sanitizeQuotaView). Control: a well-formed window passes. Every malformed case below also passes (isQuotaWindow=true) and survives sanitizeQuotaView with droppedWindows=0:
| case | result |
|---|---|
resetsAt: "2026-02-30T05:00:00Z" |
kept; Date.parse rolls it to 2026-03-02T05:00:00Z |
resetsAt: "banana" / resetsAt: "" |
kept verbatim |
percent: -50, limit: null |
windowPercent = -50, pool reads healthy |
percent: 15000, limit: null |
windowPercent = 15000, pool reads walled |
used: -500, limit: 1000 |
windowPercent = -50, pool reads healthy |
limit: -5, no percent |
windowPercent = 100 (the limit <= 0 fallback in derive.ts:156), pool reads walled with zero usage |
Guidance effect, same probe: a healthy pool whose only window carries resetsAt: "2026-02-30T05:00:00Z" is returned in computeChoices(...)'s burnBeforeReset list at 2026-03-01T12:00Z — a burn-it-before-reset recommendation clocked from a day that never existed (the Mar 2 rollover is 17h out, inside RESET_SOON_MS). quota-guidance.ts:18 (soonestReset) filters only non-finite Date.parse results, so impossible-but-parseable dates sail through, while derive.ts:839 prints resetsAt.slice(0, 10) verbatim in attention flags and render.ts fmtDate renders the rolled-over March date as the reset date.
Why it matters
The ingest contract (src/validate.ts header) is that every ingested document is validated once at its boundary — shape, element types, value ranges, and real calendar dates — before any consumer sees it. The quota section is the one section whose gate stops at types: a corrupt or buggy collector write (or a hand-edited feed) injects windows that flip pools between healthy and walled and fabricate reset timing in the guidance every session-placement decision reads, instead of being dropped-and-counted by the sanitizer like every other malformed element in the same view.
Acceptance criteria
isQuotaWindowrefuses: aresetsAtthat is not null and not a real ISO calendar date (isIsoDate); a negativelimit; a negativeused; apercentoutside[0, 100]— or, if a percent above 100 is considered legitimate for over-limit windows, the bound is stated in a comment and pinned by a test (the snapshot boundary'sisPercentOf(limit)vocabulary is the precedent).- Malformed windows drop individually in
sanitizeQuotaViewwithdroppedWindowscounting them (existing aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429 behaviour for shape failures) — the pool and feed survive. - Regression tests in
test/feed.test.tsnext to the existing aggregator(feed): isFleetFeed checks only that quota.pools is an array — burn/choices, pool entries and windows unvalidated, one malformed pool crashes /quota #2429 gate tests: impossible/garbage/emptyresetsAt, negativeused/limit, out-of-rangepercentall drop; the well-formed window fixture is unchanged. - No change to
windowPercent/poolStatesemantics for windows that pass the gate.
Dedup
Distinct from #2470 (quota-extract emitting unvalidated resetsAt upstream — this is the feed-ingest gate that must refuse them regardless of source), #3365 (snapshot rollup guard re-admitting shapes), #2416 (parseQuotaCurrent window entries in the gatherer overlay), and #3396/#3393/#3379 (tier-items / actions / snapshot-records date gates). Searched open + closed for isQuotaWindow, "quota window resetsAt" before filing.
Activity
developing-today commentedon Nov 1, 2026
CODE-1309
dezren39 commentedon Nov 1, 2026
🤖 Agent note · filed
dezren39 commentedon Nov 1, 2026
Cross-link: sibling feed-gate gap filed in the same run — #3428 (isBurnSegment accepts negative tokens, non-date from/to and inverted ranges).
7 remaining items
dezren39 commentedon Nov 2, 2026
Progress checkpoint (queue task 6079): tightened
isQuotaWindowto require real ISO reset dates, non-negative finitelimit/used, andpercentin 0–100. Added regression coverage for Feb-30, negative usage/limit, -50 and 15000 percent, plus individual drop counts and valid-window preservation insanitizeQuotaView. Running targeted aggregator feed tests now; no PR yet.dezren39 commentedon Nov 2, 2026
Queue task 6079 done: implemented the guard fix, tests pass, PR opened.
pm-stack/aggregator/src/feed.ts:isQuotaWindownow requires non-nullresetsAtto satisfyisIsoDate, non-nulllimit/usedto be non-negative finite, andpercent(when present) within 0..100. Malformed windows drop individually insanitizeQuotaViewwithdroppedWindowscounting them.pm-stack/aggregator/test/feed.test.ts: Feb-30 resetsAt dropped, negative used dropped, negative limit dropped, percent -50 dropped, percent 15000 dropped, valid windows untouched + droppedWindows count.bun test test/feed.test.ts— 54 pass, 0 fail (run on laptop).dezren39 commentedon Nov 2, 2026
🤖 Conductor binding · manual dispatch wave (Drew-ordered queue unblock) 2026-11-02
small_fix— "Fix aggregator(feed): isQuotaWindow accepts any string as resetsAt and any finite used/limit/percent — an impossible reset date is clocked as Mar 2 in guidance, a -50% window reads healthy and a 15000% window walls a pool #3427: isQuotaWindow must refuse non-ISO resetsAt, negative limit/used, out-of-range percent") ↔ issue aggregator(feed): isQuotaWindow accepts any string as resetsAt and any finite used/limit/percent — an impossible reset date is clocked as Mar 2 in guidance, a -50% window reads healthy and a 15000% window walls a pool #3427ses_e5e6324c51bffeUEteFInQoIyr(laptop OpenChamber, agent build)opencode-route/workhorse(route id only; pooled route, no single-plan direct seat). Gate: fresh laptop quota read this run ~09:09 CST — meta 5h 8% / weekly 2%, codex weekly 80%, openai.alternate 5h 0% / weekly 0% — Workhorse OPEN; plan quotas only, never PAYG.~/git/fleet/6079-3427-quota-window-guardon the laptop, branchqueue/6079-3427-quota-window-guard(from origin/main d1de7ee)queuedin the fleet queue (there is no targeted claim/binding verb yet — code#1337 / openchamber#1272); the dispatch is recorded in the task's progress. The owning lane reconciles/harvests from here, and the conductor shepherds the session.dezren39 commentedon Nov 2, 2026
🤖 Agent note · picked up
repo-health-code-pilotses_e5e6324c51bffeUEteFInQoIyralready produced open PR fix(quota): guard isQuotaWindow against impossible resetsAt, negative values, out-of-range percent #4423 on the task branch. I made no edits.dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked
dezren39 commentedon Nov 2, 2026
🤖 Agent note · done — PR merged
4547db65c)isQuotaWindownow requires non-nullresetsAtto satisfyisIsoDate, non-nulllimit/usedto beisNonNegative(finite, >= 0), andpercentto be withinisPercentOf(100); the validators were read insrc/validate.tsand have exactly those semantics. Regression tests cover every packet-named case (Feb-30 resetsAt, negative used, negative limit, percent -50, percent 15000, valid windows untouched, combineddroppedWindowscount).bun test test/feed.test.ts— 54 pass, 0 fail. Zero review threads on the PR; no Codex findings to disposition.4843f2e21061d87df52f41c2973c2f40cd42e2d3; issue aggregator(feed): isQuotaWindow accepts any string as resetsAt and any finite used/limit/percent — an impossible reset date is clocked as Mar 2 in guidance, a -50% window reads healthy and a 15000% window walls a pool #3427 closed by the PR. Queue task 6079 completedfixed_merged.