Repository navigation
fix(deps): adopt reviewed cloud-commitments-go purchase safeguards #452
Description
Confirmed release gap
Main go.mod still requires all four cloud-commitments-go modules (pkg, providers/aws, providers/azure, providers/gcp) at v0.0.0-20260928214714-ce9513612901, verified on 2026-09-30. The platform therefore does not select the subsequent GCP commitment-family dedupe, AWS reservation-state, ElastiCache engine-dedupe and purchase-cost fixes.
The coordinated old pins compile; this is an adoption gap, not evidence that current platform builds suffer the provider-only compile failure. Library merges do not update an existing platform binary or deployment.
References: library #154, merged provider pin/standalone CI PR #159, and P1 GCP duplicate-purchase issue #144.
Scope
Update the four requirements and corresponding sums together to published merged commit a32fd1a178e971ba48ae7469f5d472e6391c68e2, or a later independently reviewed canonical release containing it. Resolve each canonical public version and verify source hashes. No replacements, vendoring, unrelated dependency upgrades, schema migrations or speculative release automation. Consumer regression coverage is in scope; deployment and real purchases are not authorized by this issue.
Acceptance
- With the CI-pinned toolchain and GOWORK=off, capture all four resolved module versions with no replacements; build the actual server, run tidy-diff, vet and pinned lint.
- Run affected API, provider-integration and purchase-engine race/short tests. Use fake cloud boundaries and local database fixtures where the actual path persists purchase results.
- Trace the actual recommendation/purchase API through filtering and response/storage: recent matching GCP CUDs suppress repeat purchases; applicable AWS/ElastiCache ownership/engine safeguards remain active; nullable and explicit-zero costs preserve the platform's persistence/API behavior.
- Prove an applicable consumer regression fails on the old pins and passes after upgrade. Verify tenant/account boundaries remain intact. If UI-observable data changes, exercise the affected local UI path.
- Record exact reviewed SHA and evidence. No production deployment, cloud purchase, migration or live incident is implied by a successful dependency-update PR.
Triage
P2 / medium / this-sprint / few / medium effort: the stale dependency graph is confirmed and adoption crosses API/purchase/persistence boundaries. This tracking task has not established a deployed incident or reproduced a platform-specific duplicate purchase. The upstream P1 financial-risk fix makes adoption worthwhile; raise severity/priority if actual consumer-path reproduction establishes that exposure.
Activity
test(purchase): cover GCP purchase history recording no upfront
fix(deps): bump cloud-commitments-go providers/gcp to a32fd1a (#671)
cristim commentedon Oct 8, 2026
Reopened: PR #671 (merged as 5b68408) only bumps providers/gcp to a32fd1a and used
Refs #452; the issue was closed at merge time without a closing keyword in the commit message. The acceptance item 'recent matching GCP CUDs suppress repeat purchases' is not met because the platform never calls the duplicate checker; tracked in #682. Remaining here: the other acceptance items once #682 lands.IAmJSD commentedon Oct 16, 2026
Released: pin adoption already done; the rest is blocked on #682 (details below)
IAmJSD commentedon Oct 16, 2026
Released: the dependency-adoption part is already done on main, and what's left is #682.
go.mod(main 2ef2f5d) pinspkg,providers/aws,providers/azureandproviders/gcpall atv0.0.0-20261012205319-ad67030387e4, with noreplacedirectives.GOWORK=off go mod verifyreports all modules verified.git merge-base --is-ancestor a32fd1a ad67030387e4exits 0, so the pin includes the safeguards.ad67030is on the library's main.Two items are still unmet:
Outside tests, the platform never calls the library's
DuplicateChecker,recfilterorGetExistingCommitmentspaths, so a consumer regression can't be written yet. That's the work in #682. I'm leaving this issue open, per your reopen note.cristim commentedon Nov 4, 2026
Keeping this open, per the owner decision (2026-11-03, option A). The one acceptance item left is GCP duplicate suppression, which is tracked in #682 and will be implemented as a check at purchase execution that fails closed when
GetExistingCommitmentserrors. This issue closes when #682 lands.fix(purchase): refuse a GCP CUD when one for the same project, region…
cristim commentedon Nov 9, 2026
Claimed by claude-ui-fix-1 (coordinator-assigned).
Status read: the four go pins on main are
52d66feb616b, pasta32fd1a; #682 closed today with the GCP recent-commitment check merged (#1842, #1848); the ElastiCache engine dedupe was split to #1863. So the owner's closing condition for this issue ("closes when #682 lands") has been met.Plan: verify each remaining acceptance bullet against current main with evidence (pins and
go mod verifywithGOWORK=off, no replacements, the consumer regressions that fail on the old pins, nullable and explicit-zero cost handling, tenant boundaries), then either close this with that evidence or file exactly what is missing. No production, deployment or purchase action involved.cristim commentedon Nov 9, 2026
Verification of the acceptance bullets against
mainat5544d25a(read-only; claude-ui-fix-1). Result: not closable yet. One bullet is unmet and is already tracked and claimed under #1863, so I am releasing my claim and leaving this open until that lands.a32fd1a, no replacements, verify passesgo.mod:91-94pinspkg,providers/aws,providers/azureandproviders/gcpall atv0.0.0-20261107024538-52d66feb616b;a32fd1ais an ancestor of52d66febin the library; 0replacelines;GOWORK=off go mod verifyprints "all modules verified". Pin PRs: #671, #826, #1796 and the bump to52d66feb.GO_VERSION 1.26.10(ci.yml:40); golangci-lint v2.10.1 pinned (ci.yml:64-66);make tidy-checkrunsGOWORK=off go mod tidy -diffthrough pre-commit. Notes:ci.ymlnever setsGOWORK=off(CI vet, test and lint run in workspace mode), and no job runsgo build ./cmd/serverexplicitly (go vet ./...compiles it).preSubmitChecks(internal/purchase/execution.go:1384-1394) runsgcpRecentCommitmentRefusalbeforePurchaseCommitment; a listing error fails closed (internal/purchase/gcp_recent_check.go:124-143); tests ingcp_recent_check_test.go, with call-site mutation probes recorded in #1848.recfilteruse in non-test code is the GCP check. Tracked in #1863 (claimed by claude-cc-platform-2). The AWS reservation-state and EC2/Redshift claim safeguards arrive with the pin bump and have no dedicated platform test of their own (a note, not a blocker).internal/api/nullable_purchase_cost_integration_test.go(TestNullablePurchaseCostPostgres, real Postgres: known, zero, unknown, mixed, empty through history, analytics and breakdown);TestSavePurchaseHistory_GCPRecordsNoUpfrontpins the GCP zero-upfront behavior.TestSavePurchaseHistory_GCPRecordsNoUpfrontfails on the old pin), #1796 (two reshape tests failed at the new pin until #1789), #1848 (probes). There is none for ElastiCache, because nothing is wired.TestGCPRecentRefusal_CommitmentsFromTwoProjectsFailClosed). No cross-tenant test for the dependency bump itself.What remains: only #1863 (wire the ElastiCache dedupe into the purchase path, with a fail-closed decision, an account- and region-scoped listing, and a real-path test that fails without the wiring). This issue closes when it lands. Optional follow-ups, not required for closing: set
GOWORK=offon a CI build step, and add a named platform test for the reservation-state and Redshift safeguards.cristim commentedon Nov 9, 2026
Closing as completed (claude-ui-fix-1, 2026-11-09). My verification table at 18:21 UTC (comment above) found one unmet bullet, the ElastiCache engine dedupe wiring, tracked in #1863. #1863 is now closed: the wiring landed in #1893 and its executor-level coverage in #1897 (merged 2026-11-09 21:42 UTC), so all #452 acceptance items are met on main. The optional notes from the table (CI GOWORK=off for the pin check, named tests for reservation-state and Redshift) remain nice-to-haves and are not blockers. Reopen if a pin or safeguard regresses.