Model explicit limit-window enforcement states (SOU-122)#44
Closed
tsouth89 wants to merge 3 commits into
Closed
Conversation
A known limit window can now be tracked, not-currently-enforced, or
unavailable, so surfaces never fabricate a percentage for a window that
is not actively metering. Previously a window that dropped out of an
otherwise-successful response simply vanished, indistinguishable from
one the provider deliberately lifted.
Model
- core: EnforcementState { Tracked, NotEnforced, Unavailable }. Add
`state` to InactiveRateWindow (serde default NotEnforced so existing
producers and any persisted snapshots keep their meaning) plus an
`unavailable` constructor and builder.
- bridge + TS: expose `state` on inactiveRateWindows to every surface.
Producer
- new EnforcementTracker: a process-local, per-scope (provider | source |
account identity) cross-snapshot tracker. When a first-class provider's
window drops out of a successful response, it appends an `unavailable`
row. Additive only — it never edits or removes a real window, and it
runs AFTER capacity-event detection so a synthetic row is never
mistaken for a lifted window. First read of each scope is a fresh
baseline (no false positives after launch); errored snapshots are
ignored. Gated to Claude/Codex/Cursor/Copilot/Gemini/Factory.
- reuses the capacity-event observer's scope + semantic-window helpers so
a window keeps one identity as it moves between states.
Rendering
- ProviderDetailView labels unavailable windows "Unavailable" (caution
tone) vs "Not currently enforced"; PlanStatusCard splits its inactive
summary so the two states are never lumped together. CEILING_UI.md
documents the state and the never-fabricate rule.
Tests cover enum serialization + legacy-JSON default, and the tracker's
absence/return/lift/error/scope-isolation/first-class behavior.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughProvider snapshots now carry explicit inactive-window states. A persistent tracker detects missing core windows in successful provider responses, annotates them as unavailable, and the desktop UI renders unavailable and not-enforced windows separately. ChangesEnforcement state tracking
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ProviderRefresh
participant EnforcementTracker
participant ProviderUsageSnapshot
participant DesktopUI
ProviderRefresh->>EnforcementTracker: annotate successful snapshot
EnforcementTracker->>ProviderUsageSnapshot: append unavailable windows
ProviderUsageSnapshot-->>DesktopUI: provide inactiveRateWindows states
DesktopUI-->>DesktopUI: render not-enforced and unavailable sections
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ceiling | 270d36f | Commit Preview URL Branch Preview URL |
Jul 18 2026, 01:24 AM |
…iew) Two correctness fixes from adversarial self-review of the tracker: - Sticky, not one-shot. The baseline was overwritten with only the present windows each refresh, so a window that stayed missing was flagged on the first post-drop refresh and then dropped from the baseline — the "unavailable" row would flash for one cycle and vanish, reintroducing the silent loss the feature prevents. The baseline is now an accumulating "expected" set: a missing window keeps being flagged every refresh until it reappears (bounded to the process session). - Track core subscription windows only. Previously every window, including conditional bonus pools (Codex Spark, Copilot additional budget, Factory premium, promos), was tracked, so a promo simply ending would be reported as "unavailable". Now only core windows (session/weekly/monthly/plan/auto/api/total) are tracked; conditional pools coming and going are never flagged. This also makes the first-class provider list safe regardless of their bonus-pool payloads. - Removed a dead dedup guard that compared a real row's raw id against a semantic id (never matched); present-set membership already prevents duplicating a lifted window. Adds regression tests: persistently-missing window flagged every refresh, conditional bonus windows never flagged, core window still flagged.
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/desktop-tauri/src-tauri/src/enforcement.rs`:
- Around line 74-75: Update observation_scope and its callers to include both
account_email and account_organization in the enforcement scope, ensuring
different organizations under the same email/provider/source produce distinct
baselines. Add a regression test covering same-email, different-organization
snapshots and verify organization-specific windows are not incorrectly marked
unavailable.
- Around line 115-159: Update present_window_identities to also record the
provider’s model_specific and tertiary windows, using their corresponding labels
and semantic window identity helpers. Preserve the existing core-window
filtering and inactive-window handling so these first-class windows are marked
unavailable when they disappear.
In `@apps/desktop-tauri/src/components/PlanStatusCard.test.tsx`:
- Around line 224-228: Update the test around the inactive plan rows to scope
state-label assertions to their corresponding row elements instead of using
global getByText checks. Locate the notEnforced and unavailable rows, assert
each contains its expected label, and require “Weekly” specifically within the
unavailable row while preserving the existing labels.
In `@rust/src/core/usage_snapshot.rs`:
- Around line 53-63: Restrict the enforcement state stored by InactiveRateWindow
to inactive states only: replace the public field’s use of EnforcementState with
a dedicated type permitting only NotEnforced and Unavailable, while preserving
the existing active Tracked handling in normal RateWindow. Update the related
constructors or serialization paths around InactiveRateWindow to use the
narrowed type without expanding downstream bridge contracts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7bf1304e-6e42-4517-bdbc-b4b89c47bac2
📒 Files selected for processing (14)
apps/desktop-tauri/src-tauri/src/capacity_events.rsapps/desktop-tauri/src-tauri/src/commands/bridge.rsapps/desktop-tauri/src-tauri/src/commands/providers.rsapps/desktop-tauri/src-tauri/src/enforcement.rsapps/desktop-tauri/src-tauri/src/main.rsapps/desktop-tauri/src-tauri/src/state.rsapps/desktop-tauri/src/components/PlanStatusCard.test.tsxapps/desktop-tauri/src/components/PlanStatusCard.tsxapps/desktop-tauri/src/styles.cssapps/desktop-tauri/src/surfaces/ProviderDetailView.test.tsxapps/desktop-tauri/src/surfaces/ProviderDetailView.tsxapps/desktop-tauri/src/types/bridge.tsdocs/CEILING_UI.mdrust/src/core/usage_snapshot.rs
Comment on lines
+74
to
+75
| let scope = observation_scope(snapshot); | ||
| let present = present_window_identities(snapshot); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Include organization in the enforcement scope.
observation_scope prefers account_email and ignores account_organization when both exist. Switching organizations under the same email/provider/source reuses the prior baseline and can falsely mark organization-specific windows unavailable. Include both identities and add a same-email/different-organization regression test.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/desktop-tauri/src-tauri/src/enforcement.rs` around lines 74 - 75, Update
observation_scope and its callers to include both account_email and
account_organization in the enforcement scope, ensuring different organizations
under the same email/provider/source produce distinct baselines. Add a
regression test covering same-email, different-organization snapshots and verify
organization-specific windows are not incorrectly marked unavailable.
Comment on lines
+115
to
+159
| /// The semantic id -> title of every window the provider is currently | ||
| /// reporting, whether metered (primary/secondary) or explicitly inactive. | ||
| /// Mirrors the capacity-event observer's identity scheme so a window keeps the | ||
| /// same id as it moves between tracked and not-enforced. | ||
| fn present_window_identities(snapshot: &ProviderUsageSnapshot) -> HashMap<String, String> { | ||
| let mut out = HashMap::new(); | ||
| let mut record = |id: String, title: &str| { | ||
| if is_core_window(&id) { | ||
| out.insert(id, title.to_string()); | ||
| } | ||
| }; | ||
|
|
||
| let primary_label = snapshot.primary_label.as_deref().unwrap_or("Plan"); | ||
| record( | ||
| semantic_window_id(primary_label, snapshot.primary.window_minutes), | ||
| primary_label, | ||
| ); | ||
|
|
||
| if let Some(secondary) = snapshot.secondary.as_ref() { | ||
| let label = snapshot.secondary_label.as_deref().unwrap_or("Secondary"); | ||
| record(semantic_window_id(label, secondary.window_minutes), label); | ||
| } | ||
|
|
||
| for extra in &snapshot.extra_rate_windows { | ||
| if ignored_capacity_window(snapshot, &extra.id, &extra.title) { | ||
| continue; | ||
| } | ||
| record( | ||
| semantic_inactive_window_id(&snapshot.provider_id, &extra.id, &extra.title), | ||
| &extra.title, | ||
| ); | ||
| } | ||
|
|
||
| for inactive in &snapshot.inactive_rate_windows { | ||
| if ignored_capacity_window(snapshot, &inactive.id, &inactive.title) { | ||
| continue; | ||
| } | ||
| record( | ||
| semantic_inactive_window_id(&snapshot.provider_id, &inactive.id, &inactive.title), | ||
| &inactive.title, | ||
| ); | ||
| } | ||
|
|
||
| out | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
# Inspect where these ProviderUsageSnapshot fields are populated and whether
# first-class providers use them for core subscription limits.
rg -n --type rust -C4 \
'\b(model_specific|tertiary)\s*:' \
rust/src apps/desktop-tauri/src-tauri/src
rg -n --type rust -C4 \
'\.(with_model_specific|with_tertiary)\s*\(' \
rust/src apps/desktop-tauri/src-tauri/srcRepository: tsouth89/ceiling
Length of output: 25067
🏁 Script executed:
#!/bin/bash
set -eu
# Inspect the relevant provider usage and enforcement wiring around these fields.
sed -n '120,190p' rust/src/providers/opencodego/mod.rs
printf '\n---\n'
sed -n '220,290p' apps/desktop-tauri/src-tauri/src/commands/bridge.rs
printf '\n---\n'
sed -n '150,230p' apps/desktop-tauri/src-tauri/src/enforcement.rs
printf '\n---\n'
rg -n --type rust -C3 '\bwith_model_specific\b|\bwith_tertiary\b|\bmodel_specific:\s*Some\b|\btertiary:\s*Some\b' rust/src apps/desktop-tauri/src-tauri/srcRepository: tsouth89/ceiling
Length of output: 17767
🏁 Script executed:
#!/bin/bash
set -eu
sed -n '1,260p' apps/desktop-tauri/src-tauri/src/enforcement.rs
printf '\n---\n'
sed -n '200,320p' rust/src/core/usage_snapshot.rs
printf '\n---\n'
rg -n --type rust -C3 'present_window_identities|inactive_rate_windows|extra_rate_windows|model_specific|tertiary' apps/desktop-tauri/src-tauri/src/enforcement.rs apps/desktop-tauri/src-tauri/src/capacity_events.rs rust/src/core/usage_snapshot.rsRepository: tsouth89/ceiling
Length of output: 36790
🏁 Script executed:
#!/bin/bash
set -eu
# Read the enforcement logic and the snapshot definitions that describe the roles of these fields.
sed -n '1,260p' apps/desktop-tauri/src-tauri/src/enforcement.rs
printf '\n---\n'
sed -n '190,320p' rust/src/core/usage_snapshot.rs
printf '\n---\n'
sed -n '1,220p' apps/desktop-tauri/src-tauri/src/capacity_events.rsRepository: tsouth89/ceiling
Length of output: 22477
Track model_specific and tertiary here too. apps/desktop-tauri/src-tauri/src/enforcement.rs:119-149 Several first-class providers populate those windows, so omitting them from present_window_identities means a disappearance will never be marked unavailable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/desktop-tauri/src-tauri/src/enforcement.rs` around lines 115 - 159,
Update present_window_identities to also record the provider’s model_specific
and tertiary windows, using their corresponding labels and semantic window
identity helpers. Preserve the existing core-window filtering and
inactive-window handling so these first-class windows are marked unavailable
when they disappear.
Comment on lines
+224
to
+228
| expect(screen.getByText("not currently enforced")).toBeTruthy(); | ||
| expect(screen.getByText("unavailable")).toBeTruthy(); | ||
| // The unavailable window must not be lumped under "not currently enforced". | ||
| expect(screen.getByText("Weekly")).toBeTruthy(); | ||
| }); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '180,260p' apps/desktop-tauri/src/components/PlanStatusCard.test.tsx && printf '\n---\n' && sed -n '1,260p' apps/desktop-tauri/src/components/PlanStatusCard.tsxRepository: tsouth89/ceiling
Length of output: 10582
🏁 Script executed:
sed -n '260,360p' apps/desktop-tauri/src/components/PlanStatusCard.tsxRepository: tsouth89/ceiling
Length of output: 1062
Assert the state labels within each inactive row. Weekly is only checked globally here, so the test can still pass if it’s rendered under the wrong state. Scope the assertion to the notEnforced and unavailable rows and require Weekly only in the unavailable row.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/desktop-tauri/src/components/PlanStatusCard.test.tsx` around lines 224 -
228, Update the test around the inactive plan rows to scope state-label
assertions to their corresponding row elements instead of using global getByText
checks. Locate the notEnforced and unavailable rows, assert each contains its
expected label, and require “Weekly” specifically within the unavailable row
while preserving the existing labels.
Comment on lines
+53
to
+63
| pub enum EnforcementState { | ||
| /// The provider is actively metering this window; it carries a real | ||
| /// percentage and appears as a normal `RateWindow`, not here. | ||
| Tracked, | ||
| /// The provider responded successfully and explicitly reported no active | ||
| /// limit for this window (e.g. a lifted five-hour cap). | ||
| NotEnforced, | ||
| /// A window we were tracking is absent from an otherwise-successful | ||
| /// response. We do not know whether it was lifted or merely omitted, so we | ||
| /// surface honest uncertainty instead of a made-up value. | ||
| Unavailable, |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Prevent Tracked from being stored in InactiveRateWindow.
The public field accepts EnforcementState::Tracked, which the bridge will emit as "tracked", but apps/desktop-tauri/src/types/bridge.ts only permits "notEnforced" | "unavailable". Use an inactive-only enum here, or extend every downstream contract and renderer to handle tracked.
As per coding guidelines, “Prefer small, typed structs and enums, focused modules, and local changes.” <coding_guidelines>
Also applies to: 88-89
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@rust/src/core/usage_snapshot.rs` around lines 53 - 63, Restrict the
enforcement state stored by InactiveRateWindow to inactive states only: replace
the public field’s use of EnforcementState with a dedicated type permitting only
NotEnforced and Unavailable, while preserving the existing active Tracked
handling in normal RateWindow. Update the related constructors or serialization
paths around InactiveRateWindow to use the narrowed type without expanding
downstream bridge contracts.
Source: Coding guidelines
observation_scope preferred account_email and ignored account_organization when both were present, so the same email across a personal vs business workspace (distinct limits) shared one baseline — the enforcement tracker could then falsely mark org-specific windows unavailable, and the reset observer could cross-contaminate. Fold both identifiers into the scope. Also hardens the capacity-event observer against the same collision. Adds a same-email/different-organization regression test.
tsouth89
added a commit
that referenced
this pull request
Jul 18, 2026
…es (#46) Collapses three reviewed passes onto current `main` (1.0.0-rc.1) as one clean merge, per the plan. Supersedes #43, #44, #45 (each fully reviewed by adversarial subagents + CodeRabbit; all findings addressed). Only conflict was the English-only `.ftl` removals, resolved by accepting the deletion. ## What's included - **Codex banked resets (#43):** explicit "0 avail" chip (Codex-only, all 3 surfaces); backend records `Some(0)` instead of hiding it. **Send test notification** button that runs the real Windows toast pipeline and reports success/failure. - **Explicit enforcement states — SOU-122 (#44):** `EnforcementState { Tracked, NotEnforced, Unavailable }` exposed to every surface without fabricating a %. A process-local, per-scope `EnforcementTracker` flags a core subscription window `unavailable` when it drops out of a successful response — sticky until it returns, core-windows-only (bonus pools never false-flag), scoped by provider|source|email|org, ignores errors. - **Exact & Calm floatbar modes — SOU-178 (#45):** `float_bar_information_mode` (Exact default, safe migration). Calm leads with a trustworthy pace state + next reset; exact % on keyboard/click expand. Pace claimed only when live and actually supported. ## Verification (against this main) - Rust `codexbar` lib **621**, desktop crate **372** — 0 failures - Frontend **246** (48 files); `tsc` clean; locale-drift OK (English-only) ## Review fixes folded in Sticky/core-only tracker (one-shot bug), org-scoped observations, compact-density calm layout, calm aria-label matching visible state. --------- Co-authored-by: tsouth89 <tsouth89@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #43 (reset-notif + Codex banked resets). Base retargets to
mainonce #43 merges.Implements SOU-122: a known limit window can now be tracked, not currently enforced, or unavailable — without ever fabricating a percentage. Before this, a window that dropped out of an otherwise-successful response just vanished, indistinguishable from one the provider deliberately lifted.
Model
core:EnforcementState { Tracked, NotEnforced, Unavailable }.InactiveRateWindowgains astatefield (serde defaultNotEnforced, so existing producers and any persisted snapshots keep their meaning) plus anunavailableconstructor/builder.stateoninactiveRateWindowsto every surface.Producer — cross-snapshot
EnforcementTrackerprovider | data source | account identity(shared scheme with the capacity-event observer, so accounts/sources/providers never bleed together).unavailablerow. Additive only — never edits or removes a real window, so it can't regress metered display or event detection.unavailablerow is never mistaken for a lifted window.Rendering
ProviderDetailView: unavailable windows read "Unavailable" in a caution (amber) tone vs "Not currently enforced".PlanStatusCard: inactive summary split so the two states are never lumped together.CEILING_UI.mddocuments the state and the never-fabricate rule.Verification
codexbarlib: 632 passed (incl. enum serialization + legacy-JSON default).pub(crate).tscclean; locale-drift OK.Summary by CodeRabbit
New Features
Bug Fixes
Documentation