[luvs01]

Summary

Hard-lock fallback profiles now check their first ranked destination against the model/provider fallback settings before final authentication or dispatch. With provider fallback enabled and model fallback disabled, selecting a different model on the same provider returns 429 fallback_refused; enabling model fallback continues to allow that selection.

Declaration-level pre-admission is unchanged. Handler regressions use a synthetic caller-owned credential and a strict fetch stub. The branch was reconciled with dev@c4d4bb2da2162e23c314befafc5ec104292902a0 through a normal merge, preserving the landed combo first-dispatch guard and replay-principal changes. The remaining profile delta is seven files.

Verification

• Current source HEAD: 2d601aabc5b0021056af39a1d3cd11df97eb93dd; parents are the prior profile head and the dev commit above. The original model-off regression returned 200 before the guard and 429 after it; the model-on control remains allowed.
• After reconciliation, the related 11-file selection produced 184 passes and one missing-inventory-document failure. Materializing the exact tracked document from dev and rerunning only that failed check produced 1 pass. No assertion or validator was relaxed, and this is not claimed as a complete suite rerun.
• TypeScript, structure, privacy, file-size ratchet and the dev-relative diff check passed using pinned Bun 1.4.3. The fetch fixture checks the selected model and exact caller-credential ownership.
• Current-head CI completed SUCCESS for 2d601aabc5b0021056af39a1d3cd11df97eb93dd. No live provider request, billing, full local suite or native service operation was tested.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes
  • Profile routing after a main-account hard lock now respects both model and provider fallback settings. If the profile’s first selected destination is not allowed, the request is refused before reaching it.
• Documentation
  • Clarified how fallback settings apply to a profile’s first destination, when refusals can occur, and what fallback events indicate.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: dev
• File: .coderabbit.yaml
• Commit: 4731614
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 20a7ca20-f998-45d3-af83-e1b2117a591e

Commits

Reviewing files that changed from the base of the PR and between 29d63fd and ceef0a0.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: dev
• File: .coderabbit.yaml
• Commit: c4d4bb2
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d31bbcf7-33e9-4f8f-976f-13f9a3a50d8f

📥 Commits

Reviewing files that changed from the base of the PR and between 11b5a0a and 2d601aa.

📒 Files selected for processing: 3

• src/server/responses/request-prepare.ts
• structure/fallback-policy.md
• tests/fixtures/test-layout-expected.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

Request preparation now checks the first destination selected by a routing profile after a main-account hard lock against the original model under fallback policy. Documentation describes the admission rules. Integration tests cover refusal and dispatch outcomes.

Changes: Hard-lock profile fallback

Layer / File(s)	Summary
Guard the selected profile destination src/server/responses/request-prepare.ts, structure/fallback-policy.md, structure/transports/policy-fallback.md, docs-site/src/content/docs/guides/fallback-off.md	Request preparation checks the profile’s first-ranked destination against the original model under the hard_lock trigger. It returns a refusal response when the hop is denied and commits an allowed hop. The documentation describes how model and provider fallback settings apply and when the admission check occurs.
Verify refusal and dispatch tests/codex-integration/main-account-hard-lock-profile-dispatch.test.ts, scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json	Integration tests verify a 429 refusal with no provider dispatch when model fallback is disabled. With model fallback enabled, they verify a successful dispatch using the caller’s credential and account, with no stored Codex auth file. The test-layout mappings assign the test to codex-integration.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Possibly related issues

• [Design] Minimum safe Desktop composer compatibility across client updates #7587 describes using an alternate route with its own credentials and limits after the main account is exhausted. This PR covers the hard-lock admission decision and tests caller-credential dispatch, but does not establish that it verifies alternate-route limits.

Merge Risk: Minimal · up to 2d601

No actionable behavior risk was established. The reported conflict with dev still needs to be resolved before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely identifies the main change: checking the first destination selected by a hard-lock fallback profile. It matches the implementation, documentation, and regression tests.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[Ingwannu]

Reviewed the complete diff at 11b5a0ab1a40d2b0d924e82885bb42842736d154. The first ranked profile destination is guarded against the original locked model before authentication/dispatch; admitting a declared provider hop no longer silently admits a same-provider model hop. The positive control uses a synthetic independent caller credential, preventing the stored-main hard lock from masking a missing check. Both test-layout owners and the relevant structure/user contracts are updated.

Independent capped Linux/Bun 1.4.3 with fresh private homes: bun test tests/codex-integration/main-account-hard-lock-profile-dispatch.test.ts — 2 pass / 0 fail / 12 assertions. Current-head hosted CI 39901473620, including the gates/Typecheck step, succeeded. The current review-thread snapshot has no unresolved findings or standing maintainer objection.

The full local suite/typecheck were not repeated on the shared capped host; the completed hosted Ubuntu run supplies broader validation. Approval is bound to this source head and diff, and does not certify a later dev union, native platforms or live provider/client behavior. All external sends in the focused behavior fixtures were stubbed; no real account, runtime configuration, service or OS trust state was changed.

[lidge-jun]

Maintainer sweep: squash-merge blocked by conflict with dev after #7588 (shared structure/fallback-policy.md). Needs a rebase onto current dev; no force-push from maintainers.

[lidge-jun]

Integration evidence for exact head ceef0a0 (a dev merge on top of the reviewed change; owner decision D1 approved merging):

• Review: APPROVED by @Ingwannu; triage verdict MERGE-READY (first hard-lock profile destination guard; src/server/responses/request-prepare.ts).
• Hosted Ubuntu CI was green on the earlier head 2d601aa (34 success / 8 skipped, aggregate ci and four test shards).
• Overlap with dev since its base is limited to test-registration files (layout.json, test-layout-expected.json); the merge is clean and the static checks below pass.

Static merge simulation on current dev a564487 (this Mac): dev=a564487c2eb2b72362f01f0cbf801278d2010711 base=47316142fe06171a94de02d63f1727dbed4c0382 pr_files= 7 overlap=[scripts/test-layout/layout.json tests/fixtures/test-layout-expected.json ]; merge clean; install exit=0; gui install exit=0; tsc exit=0; tsc doctor exit=0; structure:check exit=0; privacy:scan exit=0;

Merged by the triage manager as maintainer integration (MAINTAINERS.md, dev only) under the owner's static-judgment rule while GitHub Actions is degraded; dev push CI will be checked when Actions recovers.