Quota probes run only in the orchestrator process, so a pool whose credential lives on an executor cannot be metered - #487
Merged
Merged
Conversation
Per-pool probe location: OrchestratorDirect (default, probes in-process
as today) or ExecutorReported (executor holding the credential probes
locally and reports readings via POST /executors/{hostId}/quota-reports).
Reports carry pool, availability, reset, and observed time; the store
validates on arrival (holder allowlist exact match, ranges, reset-vs-kind,
clock skew) and rejects without mutating. Stale or missing reports read
as Transient unknown with standard unknown handling and fail-closed on a
non-zero floor; fresh explicit unknowns preserve their reason. The gate
stays orchestrator-side in both modes.
CodeyBox-Prompt-Revision: 1
Co-Authored-By: CodeyBox <noreply@codeybox.invalid>
- ReportQuotaAsync now requires a live worker-registry registration for the claimed host (404 otherwise); HolderHostIds remains the second check. - ValidateReading bounds resetting-window ResetAt to (ObservedAt-skew, now+maxRampHorizon+skew]; far-future/long-past resets rejected unstored. - Notes reject control characters; GetSnapshot null-safe on AvailablePct across pool-kind hot-reload; deduped snapshot/validation helpers. - Response echoes stored normalized pool name; config doc matches mapper (zero=default, negatives rejected). Adds 5 regression tests. CodeyBox-Prompt-Revision: 1 Co-Authored-By: CodeyBox <noreply@codeybox.invalid>
ReportQuotaAsync accepted any valid bearer asserting any host id, so one executor (or any API key holder) could forge another pool's meter: the registry existence check and HolderHostIds allowlist both keyed off the self-asserted path host. ApiClients entries now accept an optional ExecutorHostId binding; quota-report ingress rejects unbound tokens (including the shared operator key) and mismatched hosts with 403 before consulting the registry, keeping HolderHostIds as the second check. CodeyBox-Prompt-Revision: 1 Co-Authored-By: CodeyBox <noreply@codeybox.invalid>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated via CodeyBox — work item 874bab35bbf6414fb9ef119507f6c69f
Initiated by CodeyBox operator
Co-Authored-By: CodeyBox noreply@codeybox.invalid
🤖 Generated with CodeyBox