feat(codex): add quota-aware switching and resumable pool waits

[y2ambition-ai]

Summary

• Add opt-in codexAccountStrictQuota admission for the shared Codex account pool. Fresh, identity-bound observations must confirm remaining quota in every relevant window; a measured 100% window blocks admission. Partial responses, credits-only updates, and elapsed reset predictions do not establish recovery.
• Treat the configured threshold as a switching preference. At 95%, switch to a genuinely usable below-threshold account when available; otherwise retain the current account's remaining 5%. Existing credential, pause, reauthentication, cooldown, model, priority, and independent main hard-lock policies remain in force. Spark/Reserve selection retains its own quota scope.
• Refresh WHAM metadata on real selection/recovery demand, including reset/top-up changes, with coalesced reads, a 10-second selection cache, and five-minute failure backoff. Manual main selection or strict enablement primes owned main evidence; cold/stale caller-owned main requests recover through a separate owned metadata read at the pending-request boundary, with the same live policy as admission.
• On an authoritative pre-output quota refusal, try remaining eligible accounts within the existing replay budget. When quota is exhausted or unknown, retain the request and resume after verified recovery. Streaming waits emit heartbeats and preserve continuation history, cancellation/drain cleanup, and exactly-once boundaries. Uncertain outcomes and partially emitted responses do not authorize replay.
• Use the existing auto-switch management API; no warmup model requests, idle polling, or automatic reset-credit redemption. Local runtime pinning and the separate context patch are not included in this PR.

Verification

Current head: 4e7ea19036e1ce52f5f54b18b38c5b35a3703e3e.

• bun scripts/test.ts --changed=dev: 16,068 passed, 12 skipped, 0 failed across 805 files on macOS. Comparison resolved to upstream/dev merge base af344a2.
• tsc --noEmit, privacy scan, and git diff --check: passed. Docs build: 425 pages.
• Initial import-connected run had 10 subprocess failures because bun was absent from PATH. With the project's existing node_modules/.bin added for that test process only, all 62 affected-file tests and the full import-connected selection passed.
• Regression coverage includes remainder retention/no churn, top-ups/reset evidence, independent-scope routing, main selection and cold/stale evidence, live-policy wait recovery, failed reads, cancellation, and safe replay. Independent local review covered auth ownership and wait cleanup.
• This is scoped/import-connected validation, not a new full-suite or production-exhaustion claim. The previous head's full-suite result is not used as this head's readiness gate.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

This remains a draft. Upstream auth-sensitive maintainer review/sponsorship and the full review-readiness gates are still outstanding. The latest-dev synchronization checkbox has not been independently signed off.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-api.ts, src/codex/auth-context.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/codex/auth-api.ts, src/codex/auth-context.ts.
• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@y2ambition-ai Tick the boxes once your local CI is green, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[lidge-jun]

리뷰 · 우선순위 42 / 80

이 PR은 Codex 공유 계정 풀에 옵트인 codexAccountStrictQuota 입학(admission)과, 전 계정이 막혔을 때 재개 가능한 대기(wait) 를 넣습니다. 창마다 신선한 관측 쿼터가 임계값 아래여야 하고, 리셋 시각만 지나거나 부분 스냅샷·크레딧만으로는 막힌 계정을 조용히 되살리지 않습니다. fill-first면 고른 계정을 임계까지 유지하고, 권위 있는 쿼터 거절이 출력 전에 오면 남은 적격 계정을 최대 한 바퀴 돌며, 전부 막히면 heartbeat로 기다렸다가 검증된 회복 후 이어갑니다. 변경 파일이 많고(+약 2000/−60) src/codex/auth-api.ts·auth-context.ts·quota.ts·새 strict-quota*.ts·src/server/responses/core.ts·wait/response 헬퍼·config 타입까지 한꺼번에 건드립니다.

지금 dev의 풀 라우팅·쿼터 자동 갱신·리셋 크레딧 경로는 이미 있지만, 이 “엄격 입학 + 스트리밍 대기” 스택은 없습니다. release-244의 070_quota_proxy는 Windows 쿼터 네트워크 경로 증거/문서 쪽이고, 이 PR과는 겹치는 sor가 다릅니다. 테스트 면적은 넓지만(통합·서버 wait·auth-context), checklist는 0/4이고 hygiene가 unsponsored_surface로 막혀 intake: hygiene-blocked입니다(인증 표면: auth-api/auth-context). enforce-target도 실패·draft 유지입니다.

우선순위 42인 이유다. 아이디어(관측 신선도·부분 스냅샷 거부·출력 전만 재시도·불확실 실패 미재현)는 풀 운영에 도움이 될 수 있으나, 한 번에 너무 크고, 로드맵 급한 칸(task-input 등)도 아니며, 스폰서·Ready·CI도 안 됐습니다. 인증/쿼터 표면이라 메인테이너 보안·동작 리뷰 없이 Ready로 올리면 안 됩니다. types/config에 플래그 한두 줄이 들어가지만 “대분할로 무효화” 수준의 PR은 아닙니다. 다만 큰 서버/코어 겹침이 있어 task-input·WS 픽스와 동시에 랜딩하면 충돌 비용이 큽니다.

경로/심볼 - codexAccountStrictQuota (src/types/config.ts / src/config.ts) - 옵트인 플래그. 기본 off여야 함
경로 - src/codex/auth-context.ts / auth-api.ts - unsponsored_surface 원인. 스폰서 필수
경로/심볼 - src/server/responses/strict-quota-wait.ts - 스트리밍 heartbeat·취소/drain 정리. 부분 emit 재현 금지 계약이 핵심
경로 - src/server/responses/core.ts - 응답 코어에 wait/재시도 삽입. 리뷰 면적 큼
경로 - hygiene intake: hygiene-blocked + checklist 0/4 - 머지 게이트 미충족

메인테이너의 판단이 필요한 지점

• 이 기능을 release-244 이후 별도 에픽으로 받을지, 조각을 더 쪼개 달라고 할지(admission vs wait vs refresh)
• maintainer-sponsored 전에 요구할 최소 증거(적대적 스냅샷·취소·drain·이중 재생 테스트)
• 기존 reset-credit auto-redeem·quota auto-refresh와의 상호작용을 같은 PR에서 증명할지

너의 추천
지금 머지하지 마세요. draft 유지 + 스폰서 리뷰 + checklist/CI를 먼저 채우게 하세요. 가능하면 admission/wait를 더 작은 PR로 나누길 권합니다. release-244의 task-input·kiro 칸이 끝날 때까지는 뒤로 미루는 편이 dev에 안전합니다.

이 댓글은 grok-bot이 작성했습니다