Repository navigation
aggregator: Phase 3 of #2576 — extractor and mapper boundaries on the shared primitives #2579
Description
Phase 3 of design #2576 (aggregator ingest, fail-closed). Design doc: files/designs/code-aggregator-ingest-contract.md in the keep-the-four-repos-healthy goal workspace. Gated on Phase 1 (the validate.ts primitives) — status/blocked until it lands. Independent of Phase 2.
Scope
Put the extractor and mapper boundaries on the shared primitives from Phase 1 of #2576:
quota-gather-map.ts:entryFromResult,entryFromFileExport,entryFromTursorange-check percents against their limit and reject negative/non-finite counts instead of publishing them as live data (aggregator(quota-gather-map): entryFromResult and entryFromFileExport never range-check percent — a window at -20% or 1e9% publishes as live ok data and appends as pct history against limit:100 #2571, aggregator(snapshot-records): recordsFromProviderUsage never range-checks used_percent — a Codex window at -20% or 1e9% is appended as measured pct history against its own limit:100 #2568, aggregator(quota-gather-map): entryFromTurso never range-checks usage — negative counts publish as live ok data and append negative snapshot records #2553); the file-export adapter's window check returns the retained unparseable outcome for a null window element or non-string window name instead of throwing (aggregator(token-adapter): file-export adapter's fail-closed window check throws on a null window element and accepts a non-string window name, instead of returning the retained unparseable outcome #2551).saas-extract.ts: the export document is type/range-checked — negativeused/limit/billedUsdrefused, a non-stringmeasuredAtcannot pass the freshness gate (aggregator(saas-extract): applySupabaseExport never range/type-checks the export doc — negative used/limit/billedUsd are stamped as live measured data, and an array measuredAt passes the freshness gate and corrupts the card #2508). Supabase addon pricing: an unpriced selected addon is unparseable, never measured $0; negative amounts refused (supabase-export: billedFromAddons silently zeroes unpriced selected addons (and accepts negative amounts) — a paid addon reports as measured $0 #2492).- Quota extractors validate their date anchors as real calendar dates (aggregator(quota-extract): Claude and Meta reset dates are never validated — an impossible date is emitted verbatim as resetsAt, and a Feb-30 Meta reset silently discards the pool's whole read #2470 Claude/Meta reset dates, aggregator(quota-extract): ClinePass extractor's measured-date anchor is never validated — an impossible measured date or a huge 'resets in' offset silently discards the pool's whole read, and a Feb-30 anchor rolls into March #2383 ClinePass measured-date anchor) — an impossible date marks the entry unparseable and retains the previous read, never discards or fabricates.
sources/github-billing.ts: items validated per element — one impossible date or negative amount drops that item, not the month (aggregator(github-billing): billing items never validated — an impossible date discards the whole month's collection, negative amounts are stored as usage #2493).sources/opencode.ts/sources/jules.ts: wire containers validated (dataarrays, keeper state); bad elements dropped and counted — no throw discarding the source, no fabricatedundefined-id rows (aggregator(opencode): mapServerSessions never validates the v2 wire containers — a non-array data on any endpoint, or one null session entry, throws out of the mapper and drops every session from that server; an id-less entry fabricates an undefined-sessionId row #2543, aggregator(jules): mapJulesItems never validates the keeper state — one null or mistyped item discards every Jules session for the run, a string items fabricates phantom sessions #2531); the fleet-feed registry check in aggregator(feed): isFleetFeed never checks registry — a non-array container crashes registry()/coverage(), and coverage()'s unfiltered .filter throws on a [null] entry that registry() handles fine #2539's path validates its containers the same way.cloudflare-export: bucket enumeration fails closed — a 500/malformed response produces an error document, neverstatus: okwithr2Buckets: []; pagination goes past 100 buckets (cloudflare-export: R2 bucket enumeration fails open — a 500/malformed buckets response publishes r2Buckets: [] in a status:ok document, and pagination past 100 buckets is silently dropped #2574).
Named scope rule (from the design)
For each of #2383 #2470 #2492 #2508 #2551 #2553 #2568 #2571 #2493 #2531 #2539 #2543 #2574: if still open when this phase starts, this phase closes it with evidence; if already closed per-site, verify its guard uses validate.ts (convert if it hand-rolled) — never re-fix a landed fix.
Acceptance criteria
- Every function named above validates via
validate.tsprimitives; malformed input yields the contract outcome for its boundary (retain / drop-and-count / refuse), never a throw, a fabricated row, or live out-of-range data. - An impossible date in any extractor marks only its own entry unparseable; sibling pools' reads are unaffected.
- Probe-matrix tests cover each converted boundary with its issue's repro shape.
- Verification runs in CI per fleet policy (no builds on the sandbox).
🤖 Design-architect pass 18 — agent note: phase of design #2576; the decisions are recorded there and in the design doc. Do not re-derive them in triage; flag genuine blockers on #2576 instead.
Activity
dezren39 commentedon Oct 30, 2026
🤖 agent-note:v1 — design-architect pass 18 (2026-10-30): Phase 3 of design #2576, gated on Phase 1 (#2577), independent of Phase 2 (#2578) — status/blocked + queue/queued reflect the gate; when #2577 lands, triage confirms scope against current main (checking each named issue: still open → this phase closes it; already closed per-site → verify/convert its guard), settles what it can, and enqueues the implementation follow-up. Do not implement in the triage task.
85 remaining items
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: parked
task: 6900
lane: bf419306-c4ef-470f-a553-beabf93239de (openchamber scheduled lane)
worker: repo-worker-code
issue: #2579
kind: small_fix
state_checked: 2026-11-04T14:22Z — #2579 OPEN; no
held,user/owned,do-not-merge,do-not-auto-editlabels; no PR exists for this branch.branch: queue/6900-2579-implement-2579-aggregator-phas
worktree: /home/user/git/fleet/6900-task (laptop)
head: 1594f0e (merge of origin/main eb3e71c into the task branch)
verified:
bun test test/phase3-boundaries.test.ts→ 16 pass / 0 fail on the merged branch.remaining: (1) audit which named boundaries already landed on main —
src/sources/github-billing.tsalready importsisIsoDate/isNonNegativefrom validate.ts;jules.tsno longer exists under sources/; Cloudflare exporter ispm-stack/cloudflare-export/(separate mjs boundary, task 5387/#4902 merged). (2) close or convert the remaining named issues with evidence per #2576's named-scope rule. (3) open the PR only once the full named scope is covered.park_reason: openchamber scheduled lane run budget (~30 min) elapsed before the remaining boundary audit; no CI wait in progress.
resume: claim 6900,
git -C ~/git/fleet/6900-task pull --ff-only, audit the remaining boundaries, run the aggregator suite, then open the PR.dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
ses_e5e59054ba4ffezo4tdOZAn7UOdezren39 commentedon Nov 4, 2026
🤖 Agent note · picked up
8ac61616-3815-4e7b-b33d-840a3829154arepo-health-code-pilot96c43b5e86b6e05340231ba31287e4931ad8db35, passing tests, and PR creation rate limits; this shift will revalidate every issue, branch, PR, and the cloudflare-export: R2 bucket enumeration fails open — a 500/malformed buckets response publishes r2Buckets: [] in a status:ok document, and pagination past 100 buckets is silently dropped #2574 artifact before editing.dezren39 commentedon Nov 4, 2026
🤖 Agent note · done (PR opened)
8ac61616-3815-4e7b-b33d-840a3829154aqueue/6900-2579-implement-2579-aggregator-phasto headab2c1e12da9c14a83331c0c77309665860c0c850, including the saved ClinePass/Turso and OpenCode/snapshot fixes plus a merge of current main. PR is OPEN; aggregator: Phase 3 of #2576 — extractor and mapper boundaries on the shared primitives #2579 remains OPEN pending merge. No competing PR was created.git diff --checkpassed. The contract-corpus CI job passed.PM_AGG_SOURCE/PM_AGG_DEVsettings); the same failures were reproduced on primary main. CI typecheck was skipped after the test failure; localbunx tsc --noEmithits the same pre-existingGhKinderror atsrc/item-history.ts:58on main and branch. The aggregator workflow is manual-only, so no PR-triggered check ran. Codex review reported no findings; CodeRabbit was rate-limited/skipped.