[luvs01]

Summary

When main-account hard lock selects a random combo, its admission preview and actual first pick can differ. A previously admitted provider hop could therefore allow a same-provider model hop even when model fallback is disabled.

Check the actual first destination, after aliases and redirects resolve, against the locked source before child dispatch. Keep the existing send budget and account-limit checks, and clarify that a taken event records guard admission rather than a physical or billed send.

Verification

• Focused regression: 2 failures before the guard; 7 tests passed after it.
• Related 28-file Bun 1.4.3 run: terminal log reports 922 passed, 0 failed, 5,710 assertions. The original process and its parents exited; its OS exit status was not captured.
• TypeScript, structure, privacy, file-size ratchet and diff checks passed.
• Tests use a fetch stub; no live provider acceptance is claimed.
• Hosted Ubuntu CI run 39898754531 passed for source HEAD ce11e67e8a52291e6a9342ce7ded3b0df787f013. The checkout log records refs/pull/7588/merge at fad50002a9c063f29962c4eaab8458579634edc8, with base parent c51b0b4c875469548e70219a1be276a2395490d2 and source parent ce11e67e8a52291e6a9342ce7ded3b0df787f013; its Git tree matches the source tree. All four Ubuntu test shards, gates, structure, storage policy, API usage, Docker smoke and the final CI aggregate succeeded. The macOS/Windows jobs were skipped under PR policy.
• No inline review findings or submitted change requests were present at the readiness check. CodeRabbit skipped this draft; automatic review may follow the Ready transition.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes
  • Combo fallback requests now respect hard-lock restrictions based on the destination actually selected for the first dispatch.
  • When model fallback is disabled, a same-provider model switch is refused. When permitted, eligible provider fallbacks can proceed.
  • Fallback records reflect when a request passes the site’s admission checks; they do not indicate that an upstream request was sent or billed.
• Documentation
  • Clarified when hard-lock refusals occur and what an admitted fallback signifies.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: dev
• File: .coderabbit.yaml
• Commit: c51b0b4
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 28094e34-7c49-42b7-b4d3-bd49c7f8d7f0

📥 Commits

Reviewing files that changed from the base of the PR and between c51b0b4 and ce11e67.

📒 Files selected for processing: 4

• src/routing/fallback-policy.ts
• src/server/responses/core-combo.ts
• structure/fallback-policy.md
• tests/codex-integration/main-account-hard-lock-fallback-off.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

📝 Walkthrough

The combo’s first dispatch now checks its resolved destination against the hard-lock fallback policy. The policy documentation describes refusal timing and hop recording. Integration tests cover same-provider refusal and admitted same-provider and cross-provider destinations.

Changes: Hard-lock combo fallback

Layer / File(s)

Summary

Guard the combo’s first destination structure/fallback-policy.md, src/routing/fallback-policy.ts, src/server/responses/core-combo.ts, tests/codex-integration/main-account-hard-lock-fallback-off.test.ts

core-combo.ts checks the resolved first destination with guardFallbackHop when the hard-lock override applies. A denied hop returns the guard response; an allowed hop’s commit is combined with any pending proactive-hop commit after dispatch admission. The policy documentation clarifies refusal timing and when allowed-hop events are recorded. Integration tests cover same-provider refusal when model fallback is disabled, same-provider admission when enabled, and cross-provider dispatch when model fallback is disabled.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant CoreCombo as core-combo
  participant FallbackGuard as guardFallbackHop
  participant ResponsesDispatch
  CoreCombo->>FallbackGuard: Check Codex source against resolved destination
  alt Guard denies
    FallbackGuard-->>CoreCombo: Return refusal response
  else Guard allows
    FallbackGuard-->>CoreCombo: Return allowed-hop commit
    CoreCombo->>ResponsesDispatch: Continue first dispatch
  end

Loading

Possibly related issues

• Issue 7587: The change checks the combo’s resolved first destination and blocks a same-provider model hop when model fallback is disabled, addressing the routing distinction described in the issue.

Merge Risk: ⚪ Minimal · up to ce11e

The reviewed fallback paths preserve the model-fallback restriction. No merge-blocking issue was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: checking the first hard-lock combo destination to prevent an invalid same-provider model fallback.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[Ingwannu]

Reviewed the complete diff at ce11e67e8a52291e6a9342ce7ded3b0df787f013. The actual first combo destination is now checked against the original locked OpenAI source after concrete alias/redirect resolution, independently of the random representative selected during pre-admission. The positive and refusal controls distinguish same-provider model fallback from provider fallback and assert the refused destination receives no send. Documentation now correctly describes taken as guard admission rather than upstream contact or billing.

Independent capped Linux/Bun 1.4.3 with fresh private homes: bun test tests/codex-integration/main-account-hard-lock-fallback-off.test.ts — 7 pass / 0 fail / 31 assertions. Current-head hosted CI 39898754531, including the gates/Typecheck step, succeeded. The current review-thread snapshot has no unresolved findings or standing maintainer objection.

The full local suite/typecheck were not repeated on the shared capped host; the completed hosted Ubuntu run supplies broader validation. Approval is bound to this source head and diff, and does not certify a later dev union, native platforms or live provider/client behavior. All external sends in the focused behavior fixtures were stubbed; no real account, runtime configuration, service or OS trust state was changed.