[IAmJSD]

Why

#243's last open item (finding 8, cross-repo): assembleLadderPlan added up each layer's gross ExistingUSDPerHour and wrote that total into the ladder plan, ladder_runs.existing_usd_hr and the approval email's Explain() output. Allocate, though, sizes the gap against net existing commitment (existing minus expiring). Take a layer with $8/hr OD existing, of which $4/hr expires, and a $10/hr target. The plan showed Existing $8/hr next to a $6/hr gap, so an approver could not get from target minus existing to the gap.

The go side landed in LeanerCloud/cloud-commitments-go#614: AllocateResult.NetExistingUSDPerHour. The platform's pkg pin (v0.0.0-20261020053130-ff6225d5ff04) was older than that change, so this PR bumps the pin and then reads the net figure.

The other #243 findings were fixed earlier: #1265 has the per-finding table and lists finding 8 as the only deferred item. I re-checked them on current main. So this PR closes the issue.

Closes #243

What

Commit 1: chore(deps). Moves pkg and providers/{aws,azure,gcp} to go main 80e9b8464d2a (v0.0.0-20261026081621-80e9b8464d2a) via go get <module>@<sha> and go mod tidy. It also includes the follow-ups the bump needs:

• go#575 removed the ctx argument from computeengine.NewClient. internal/purchase/gcp_history_cost_test.go now uses the new signature.
• go#603/fix(plans): a plan with no matching recommendations schedules zero-count purchases instead of failing #609 renamed provider.ProviderConfig to provider.Config and kept the old name as a deprecated alias. staticcheck SA1019 flagged all 40 uses, so they now use provider.Config. This is a type alias, so behaviour does not change. mock.AnythingOfType reports the real type name, so the zonal_recs_test.go expectation now matches "*provider.Config". Without that change, TestCollectAWSForAccount_AssumedRolePassesExternalID panics with "Unexpected Method Call". The test's intent is unchanged.
• The providerfactory bypass guard (TestNoRegistryBypassInProductionCode) only recognised a provider.ProviderConfig{Profile: ...} literal. It now recognises both names. I checked this by adding a temporary production file containing &provider.Config{Profile: "x"}: the guard flagged it, and the file was deleted afterwards.

Commit 2: fix(server). assembleLadderPlan now reports allocResult.NetExistingUSDPerHour (copied, not aliased) and no longer takes the layerStates parameter. Allocate sets this figure on every successful result, hold-only exits included. It covers only the configured layers, but Allocate already rejects a layer state outside them, so the scope is the same as before.

Behaviour changes pulled in by the bump

Everything in go that touches the four modules between the old pins and 80e9b846. The items the issue named come first:

go PR	Module	Change
#614	pkg/ladder	AllocateResult.NetExistingUSDPerHour (used here). Net existing is now computed before the baseline-unavailable hold, so an inconsistent snapshot (expiring above existing) is now an error on that path, where it used to be a Hold.
#441	pkg/ladder	New UsageBaseline.Basis (BaselineBasis). A residual baseline no longer has existing commitment subtracted a second time. Neither the platform nor the pinned AWS provider sets Basis yet, so runs keep the default total-demand basis and their behaviour is unchanged. An unknown basis value is now an error.
#471	providers/gcp	GCP pricing fails closed. A region-less Cloud Storage SKU matches only when it is GLOBAL. Cloud SQL, Memorystore and Cloud Storage now error with "ambiguous catalog" when two matching SKUs give the same price slot different prices; before, the last one in the catalog won.
#628	pkg + providers/gcp	1-year and 3-year commitment SKUs get separate slots, so a catalog with both terms prices correctly instead of failing closed as ambiguous after #471. An unknown term errors.
#491	pkg/recfilter + providers/azure	DuplicateChecker checks against GetCoveringCommitments when a client implements it. Azure savings plans billed to another subscription but applied to this one now suppress a matching recommendation, so they are not bought twice.
#627	providers/azure	Pins Azure's own pkg requirement to the #491 selector. Without it, a standalone build never consulted the covering list.
#439	providers/azure	VM reservations in a terminal state (cancelled, expired, failed, split, merged) skip the applied-scope check. Before, one such Shared reservation made GetExistingCommitments fail and blocked purchases for the subscription indefinitely.
#629	pkg/ladder	A buffer-only layer that also has a pending reshape gets an informational Hold instead of a purchase.

Other changes in the range that alter behaviour:

• AWS purchase price guards: fix(api): scope-check listTargetOfferings on the deployment account #611 (EC2), fix(api): require unrestricted scope to refresh recommendations #615 (RDS), fix(plans): flag planned purchases with no recommendations instead of showing zeros #616 (MemoryDB, OpenSearch, Redshift). The purchase is refused when the offering's upfront exceeds the approved upfront by more than 5%, or when it is priced in a non-USD currency. EC2 also sends LimitPrice. A zero approved upfront is not checked.
• sec(azure): purchase spend caps and recorded Azure costs use lookback-window amounts (cap can be exceeded; stale rows after the fix) #612: ElastiCache now guards the offering lookup against a missing or wrong engine.
• fix(frontend): plan modal Azure service ids are stale; Azure compute prefills as GCP Compute Engine #608: AWS RI recommendations reject an unrecognized term, payment option or lookback instead of silently falling back to Cost Explorer's defaults.
• fix(api): require every plan account in scope for plan mutations #605: a nil reshape payment cap is now rejected rather than read as unlimited.
• fix(recommendations): scoped users see 'Recommendations refresh failed: permission denied' after the stale-data auto-refresh became scope-gated #619/fix(dashboard): upcoming purchases show zeros for plan steps with no recommendations #620: AWS savings plans with an unparseable or missing start or end date now error.
• fix(settings): a scoped admin's Settings Save shows 'Settings saved, but 17 services failed' after service-config PUTs became scope-gated #617: the OpenSearch STS account lookup retries after a transient failure.
• fix(plans): fail loudly on plan steps that carry no recommendations #618, fix(api): skip plan disable on planned purchase delete when the plan spans out-of-scope accounts #621, fix(api): resolve analytics and inventory accounts by provider and external id #622: more region display names are mapped.
• fix(ri-exchange): hide linked members' RI utilization from scoped users #625: Azure recommendations set CommitmentCurrency.
• fix(sec): percent-encode or quote the database password in remaining DSN builders #588: Azure savings-plan recommendations use a 730-hour month instead of 730.5.
• fix(api): return 422 from the Azure revoke quote when the refund amount or currency is missing #591: listing Azure Redis caches fails loudly when it hits the page cap.
• fix(auth): invalidate reset tokens on credential change and enforce expiry in SQL #562, fix(api): answer 4xx for bad approval tokens and a missing revoke execution #584: exchange reshape targets are capped at owned units and corrected for large and unoffered sizes.
• fix(api): GET /api/purchases/cancel/{id} cancels an execution on a side-effecting GET #578: exchange fails closed on an unknown mode or a cancel failure.
• fix(api): invalid or expired approval tokens and a missing revoke execution answer 500 instead of 4xx #564, fix(settings): a coverage edit typed during a pending service PUT is overwritten, and the post-save snapshot advance is untested #576: the recfilter duplicate guard now handles RDS size-family and Multi-AZ units and EC2 size flexibility.
• fix(api): stop approving a purchase on GET #577: the reservation-name uniqueness suffix is kept.
• fix(email): RI-exchange approve/reject email links hit POST-only API routes and return 401 #579: service-details payloads for untyped services are rejected.
• chore(ci): type-check integration-tagged tests in make test #580: jittered retry backoff is clamped to MaxDelay.
• refactor(api): remove unused authenticate and checkUserAPIKey helpers #599: the httpclient blocks NAT64 addresses that embed a metadata IPv4.
• The rest are refactors, lint or docs changes (chore(auth): follow-ups from the #567 review #568, fix(api): reject expired RIs and return 422 for bad marketplace terms #582, fix(api): expired-token status codes differ across approve, cancel, revoke and RI-exchange token actions #587, fix(api): validate the emailed approval token on the delayed-approval path #589, sec(api): delayed token approval validates the execution snapshot, not the token hash at the status change #590, fix(api): match history rows to scoped accounts by provider and external id #593, fix(auth): accept each TOTP code once #596, docs(api): reconcile RI-exchange approve and reject specs with observed behavior #603, fix(plans): a plan with no matching recommendations schedules zero-count purchases instead of failing #609, fix(frontend): keep edits made during a global save dirty #575 and others). fix(api): expired-token status codes differ across approve, cancel, revoke and RI-exchange token actions #587 removed common.Matches, pkg/errors and pkg/config; the platform uses none of them.

Verification

All commands were run from the worktree with AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true.

Fail before, pass after. The new test is TestExecuteLadderRun_ReportsNetExistingCoverage in internal/server/ladder_existing_units_test.go. It runs the real executeLadderRun → Allocate → plan pipeline with existing 4 and expiring 2 commitment at rate 0.5 (8 OD gross, 4 OD net). There are two cases: an allocating run and a baseline-unavailable hold.

• With origin/main's handler_ladder.go and the new pin, both cases FAIL: Max difference between 4 and 8 on existing_usd_hr and on the plan JSON, and gap reconciles with target - existing fails with 2 vs 6.
• With this PR, both cases PASS (-race).

Checks

• go build ./..., go vet ./..., go vet -tags integration ./... and (cd tests/e2e && go vet -tags e2e ./...): all clean.
• golangci-lint v2.10.1 on ./..., with and without --build-tags integration: 0 issues. Before the provider.Config rename it reported 40 SA1019 issues.
• gocyclo -over 10 on the changed non-test files: no output.
• go test -race -short -count=1 ./... (full unit suite): all 45 packages pass. Before the mock fix, internal/scheduler failed as described above.
• go test -race -tags integration -count=1 ./internal/{api,purchase,scheduler,server,config,providerfactory}/: purchase, scheduler and providerfactory passed on the first run. The host was heavily loaded by other agents (load average about 48), so the first api/server/config runs had testcontainers Postgres fail to start within its 30s startup timeout (wait until ready ... context deadline exceeded), and every failing test failed only there, before any test code ran. On rerun, internal/config passed as a full package (ok ... 636s). The server tests that had hit the container timeout (TestHealth_ConfigStoreAfterFailedReinitialization, TestEnsureDB_IsLambdaSingleSourceOfTruth, TestCheckConfigStore_DBFailureHidesRawError) passed when rerun with -run (ok). So did the api ones (TestApproveRIExchange_Integration_SessionMissingIs404, TestIntegration_HistorySummary_TotalsCoverAllInScopeRows, TestIntegration_HistorySummary_MatchesListedRowsUnderTheCap). All other server and api integration tests, including the ladder lock tests, passed in the full-package runs.
• Secrets scan on the changed files: clean; planted key flagged. scripts/test-git-secrets-allowlist.sh: 183 PASS, 0 FAIL.

Not verified: the go-side behaviour changes listed above were only exercised through the platform's tests, with mocks, fakes and testcontainers Postgres. No real cloud accounts were used.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 8b64a354ce1c8a6fb82bae44c93b55cc86049a2c

Blocking:

• none

Non-blocking:

• internal/config/store_postgres_ladder_amend_ceiling.go:30-35 and :116 (not in the diff): the tranche-amend ceiling reads the latest run's existing_usd_hr: C = LEAST(target, baseline*coverage/100) - existing_usd_hr. This PR changes that column from gross to net, so for every new run the ceiling grows by the expiring amount, and the comment's "existing is gross, so C errs low" becomes false. I think the new value is the right one: C now equals the room the engine itself sized the gap against, which is what the function's doc says it bounds. Under the gross figure, any config with expiring commitment refused every raise. But it is a looser cap on a money path, and the PR body doesn't mention it. Please update that comment, and say in the body that the amend ceiling moves with the column. Older ladder_runs rows keep the gross value, so their ceilings stay stricter until the next run.
• The bump pulls in about 30 go PRs. The ones that change money paths (fix(api): scope-check listTargetOfferings on the deployment account #611/fix(api): require unrestricted scope to refresh recommendations #615/fix(plans): flag planned purchases with no recommendations instead of showing zeros #616 refuse an AWS purchase whose offering upfront exceeds the approved rec.UpfrontCost by more than 5% or isn't in USD; fix: apply global filters to ambient recommendations #471/docs(api): reconcile the deployment-account status differences on the RI-exchange reshape endpoints (404 vs 403 vs empty list) #628 GCP pricing fails closed on an ambiguous catalog; fix(api): require unrestricted account scope to update service config #614 makes an inconsistent snapshot an error instead of a Hold) are fail-closed and are listed honestly in the body. I checked that the platform's approved figure is consistent with the new guard. execution.go:1168 passes rec.UpfrontCost. purchase_pricing.go:152 and planstep/resolve.go:418 scale it linearly by count, so a sized-down step still compares per-unit price times count. The recommendation side asks Cost Explorer for Convertible, which is the purchase default. So the guard should only fire on a real price move.

Attacked:

• Ladder change: read Allocate at the new pin. NetExistingUSDPerHour is set on every successful return, hold-only exits included, and is a copy. The plan copies it again, so there is no aliasing. A nil existing is unreachable on success. Other readers of existing_usd_hr: the timeline (display only) and the amend ceiling (above).
• Fail-before: put main's internal/server/handler_ladder.go back in the scratch tree, at the new pin. TestExecuteLadderRun_ReportsNetExistingCoverage fails in both subtests (Max difference between 4 and 8 on the run and on the plan JSON; gap 2 vs 6). Restored, it passes.
• Bump hygiene: go mod tidy -diff is clean, go mod verify passes, and go.sum changes only the 8 cloud-commitments-go lines (no transitive bumps). The provider.ProviderConfig -> provider.Config rename is a type alias. The bypass guard now matches both names.
• Ran: go build ./...; go vet ./..., with and without -tags integration, plus e2e; go test -race -short -count=1 ./... (every package ok); go test -race -tags integration -count=1 on server, scheduler, providerfactory, purchase, api and config (all ok); golangci-lint v2.10.1 on the changed packages, with and without the integration tag (0 issues); gocyclo -over 10 on the changed non-test files (clean). For Closes chore(purchase/ladder/exchange): medium/low findings from the 2026-07-28 full review [platform part] #243, I spot-checked the other items on main (ctx-aware finalize sleep and its test, the PlanID == "" short-circuit, the findAWSAccount Enabled filter, 503 on a validation error, positive confirmation in the Azure probe). All are present, and fix(purchase,commitmentopts): close out the open #243 review findings #1265 is merged.

Body-stale:

• none

_{Reviewer: rE2. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 8b64a354ce1c8a6fb82bae44c93b55cc86049a2c

Blocking:

• none

Non-blocking:

• The upstream behaviour list says it covers "everything in go that touches the four modules between the old pins and 80e9b846", but it's incomplete. The old azure/gcp pin 3def3f89 (go#506) is an ancestor of 80e9b846, and git log 3def3f898617..80e9b8464d2a -- providers/azure providers/gcp shows about 30 more commits the table doesn't mention. The ones that change platform-visible behaviour:
  • gcp#493: Cloud SQL and Memorystore no longer produce CUD recommendations. Their GetRecommendations now returns ErrCommitmentPurchaseNotSupported, and the all-services fan-out calls only Compute Engine. The platform will stop showing those GCP recommendations.
  • gcp#433, docs: trim RuFlo boilerplate from CLAUDE.md #424, sec(auth): MFA recovery-code regeneration and enabled-path disable still do whole-row writes #527, test(purchase): 4-eyes and approver matching are never tested with a case-differing email #307: pricing and currency now fail closed.
  • azure#423: Shared-scope VM reservations count toward the duplicate guard for their billing subscription.
  • azure#503: Azure SP purchases send Compute_Savings_Plan as sku.name.
  • azure#523: the accounts fetch fails if the credential changes mid-flight. Retail Prices OData filter values are allowlisted.
  • azure#529 (non-USD benefit recs skipped), fix(history): history scope matching uses the external account id without the provider (cross-provider collision) #550 (blank ResourceType refused on every purchase), sec(ri-exchange): session approve does not check the caller's account scope #519, ci(azure): smoke test fails during revision rollout before the auth store is initialized #513, fix(config): Settings Save from a stale tab reverts the global default term, payment and coverage #539, and the chore(frontend): updateConfig is typed Promise<Config> but the backend returns a status object #540-fix(settings): Save sends Azure/GCP payment values the service-config handler rejects #545 shared purchase-helper refactor.
  • On the AWS side, chore(frontend): kill-switch toggle and global-save retry paths have no tests #573 (pagination caps) and fix(frontend): the plan form still offers a Cloud Storage service that has no commitment product #574 (EC2 prices the offering class the purchase uses) are also missing from the list.
    I checked none of these as a regression for the platform (see Attacked), but a money-path bump should list them so the approver knows what ships.
• AWS price guards (fix(api): scope-check listTargetOfferings on the deployment account #611/fix(api): require unrestricted scope to refresh recommendations #615/fix(plans): flag planned purchases with no recommendations instead of showing zeros #616): approved is rec.CommitmentCost, which execution.go:1168 fills from rec.UpfrontCost. That's consistent wherever the platform changes Count: priceFromStored scales UpfrontCost by the count ratio, and plan steps don't rescale. Recommendations are priced as Convertible (go ec2RecommendationOfferingClass), and the purchase defaults to Convertible too. A Standard purchase is cheaper, so it can't trip the 5% ceiling. A recommendation more than 5% stale on price will now be refused with "re-approve at the current price". That's intended, but worth a line in the release notes.

Attacked:

• Code: assembleLadderPlan now reads AllocateResult.NetExistingUSDPerHour. In go pkg/ladder/allocate.go:175 that is set on every successful result, so it's never nil after a nil error, and it's copied rather than aliased. Dropping the layerStates parameter loses nothing, because Allocate already rejects out-of-scope layer states.
• Fail-before: with main's handler_ladder.go and the new pin, both subtests of TestExecuteLadderRun_ReportsNetExistingCoverage FAIL (4 vs 8 on existing_usd_hr and the plan JSON, 2 vs 6 on gap reconciliation). With the PR they PASS. Restored afterwards.
• Bump fallout I checked against the platform's callers:
  • fix(frontend): plan modal Azure service ids are stale; Azure compute prefills as GCP Compute Engine #608: scheduler params %dyr, %dd and lookback are validated to 7/30/60, which the stricter converters accept.
  • fix(api): require every plan account in scope for plan mutations #605: no platform caller of ReshapeBuffer. The platform's exchange caps are its own.
  • sec(api): refuse createPlan target_accounts outside the caller's allowed_accounts #441: Basis is never set, so it uses the default.
  • fix(api): require unrestricted account scope to update service config #614: the hold path now errors on expiring > existing, as disclosed.
• Ran: go build ./..., go vet ./..., go vet -tags integration ./..., tests/e2e vet with -tags e2e, go mod verify (all verified), go mod tidy (no diff). golangci-lint v2.10.1 on ./... and with --build-tags integration on the changed packages: 0 issues. Full go test -race -short -count=1 ./...: all ok. go test -race -tags integration -count=1 on internal/server, purchase, scheduler and providerfactory, plus -tags integration ./internal/api/: all ok.

Body-stale:

• "Everything in go that touches the four modules between the old pins and 80e9b846" is false for providers/azure and providers/gcp (see above). The table lists only the commits after roughly docs(api): reconcile the RI-exchange approve spec (no 401 documented) with the handler comments, and stale 'authenticate' comments in router.go #600.

_{Reviewer: rE6. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 8b64a354ce1c8a6fb82bae44c93b55cc86049a2c

Addendum to my review above. After posting, I skimmed the earlier reviews and found one point I had missed. It comes from an earlier review, and I confirmed it in the code:

Blocking:

• none

Non-blocking:

• (from an earlier review) internal/config/store_postgres_ladder_amend_ceiling.go:30-35 and :116: the tranche-amend raise ceiling is LEAST(target, baseline*coverage/100) - existing_usd_hr, taken from the latest run. This PR changes that column from gross to net of expiring, so on new runs the ceiling is looser by the expiring amount, and the comment "existing is gross, so C errs low" is now wrong. I agree the net value is the consistent one, because it's the room Allocate sized the gap against. Still, it's a cap change on a money path. The comment should be updated, and the PR body should say the amend ceiling follows the column. Older ladder_runs rows keep the gross value, which is stricter, until the next run.

Attacked: read checkLadderConfigCeiling / loadLadderCeiling at this head to confirm they consume existing_usd_hr.

Body-stale: as in my review above. Also, the body doesn't mention the amend-ceiling change.

_{Reviewer: rE6. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}