Skip to content

deps: common-auth 0.22.0; skip our usage poll while insula is warming up or rate-limited - #416

Merged
ualtinok merged 4 commits into
mainfrom
deps/common-auth-0.22.0
Oct 21, 2026
Merged

ualtinok merged 4 commits into
mainfrom
deps/common-auth-0.22.0

Conversation

@antauth-alfonso

@antauth-alfonso antauth-alfonso Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Adopts @cortexkit/common-auth@0.22.0 (npm gitHead 52518f69, dist.shasum e8bd7d62, integrity sha512-02yOfdzA…; uncompressed tar identical to the candidate signed off) and uses its classified insula misses.

After insula restarted at about 19:10Z on 20 Oct, all five Claude accounts got 429 from Anthropic's usage endpoint at once: on any insula miss our vault quota sweep polled Anthropic itself, on top of insula's own first read. lookup() now says why a reading is missing:

  • Background sweep: cold (insula warming up) and upstream-failed (Anthropic is already rate-limiting insula for that account) make no usage GET, record no poll and arm no backoff; the stored reading stays. stale, credential, absent and unreachable keep exactly one GET, and a current reading makes none. A cold miss turns into unreachable after two minutes, so fallback can't be blocked indefinitely.
  • Request-time admission: keeps its single GET for every miss except upstream-failed, where it uses the attached dated reading or the existing unknown-quota rule (an enabled floor still refuses on unknown quota).
  • The quota-source log line records the miss kind.

Red-first on 0.21.1 for the cold and upstream-failed cases; mutation rows vault-insula-cold-skips-usage-poll and vault-insula-upstream-failed-skips-usage-poll CAUGHT. Closure guard and fixtures moved to 0.22.0.


Summary by cubic

Updates vault quota polling to skip redundant Anthropic usage GETs while insula is warming up or rate-limited, adopting @cortexkit/common-auth@0.22.0.

Previously any insula miss triggered a usage poll. Now lookup() classifies misses into cold, upstream-failed, stale, credential, absent, and unreachable, and:

  • Background sweeps skip polls on cold and upstream-failed misses, leaving stored quota and poll bookkeeping untouched; a cold miss becomes unreachable after two minutes so fallback can't block forever.
  • Request-time admission skips polls only on upstream-failed, using an attached dated reading when present, otherwise falling back to the existing unknown-quota rule (an enabled floor still refuses).
  • The quota-source log now records the miss kind, and two new mutation controls cover the cold and upstream-failed suppression paths.

Written for commit 398ab04. Summary will update on new commits.

View guided diff Turn on auto-fix

Use common-auth lookup miss reasons for vault background and admission reads. Cold and upstream-failed sweeps leave quota and poll bookkeeping untouched; admission only suppresses upstream-failed fallback and retains existing floor checks.

Split the old blanket stale/missing/failed fallback test because upstream_failed now deliberately defers instead of polling. Stale still polls and never publishes its attached dated reading. Both background suppression mutations were caught by the 34-test neighboring quota suites.

Verified against the supplied unpublished common-auth 0.22.0 overlay with a temporary build-only closure allowance. The committed dependency pin and closure guard remain 0.21.1 as requested; publication/pin advancement is a separate step.
Add separate cold and upstream-failed fallback controls, each with the Core broad command/report/id metadata required by the catalogue self-test. Replayed their exact named commands through run-mutation-bun on the common-auth 0.22.0 candidate: each mutant failed its intended assertion while the opposite state stayed green; clean and restored baselines passed.

Repair neighboring catalogue references affected by the preceding lookup rename and test split: update the account-id anchor and remove the now-deleted blanket fallback test from expected-red lists. Existing surviving assertions retain those rows' original claims.
Task: bg_e2eb76fa4a5324d1

These changes were saved automatically and have not been reviewed.

Skipped files (left on disk in /Users/ufukaltinok/.local/share/cortexkit/alfonso/worktrees/6c303ddb96b2e7ec/bg_e2eb76fa4a5324d1):
".cortexkit/internal-docs/investigations/common-auth-0220-52518f69/extracted/package/dist" (0 bytes; excluded cache directory (not enumerated))
".cortexkit/internal-docs/investigations/common-auth-0220-52518f69/original-0211/dist" (0 bytes; excluded cache directory (not enumerated))

Alfonso-Preserved: retry
Pin the published lookup API in Core and its declaration closure fixtures, resolving the prepare-build failure against 0.21.1. Preserve main's Unreleased sections and mutation catalogue, with the two suppression controls appended and existing insula anchors updated for per-state tests.

The earlier combined miss test is intentionally replaced by state-specific contracts: background cold and upstream-failed must defer instead of polling, while stale/credential/absent/unreachable retain fallback. Request-time upstream failure skips GETs and uses an attached dated reading or existing unknown-quota handling. Both restored fallback controls were caught by the named wrapper test and by the full 26-test insula file (one expected failure, 25 healthy companions each).
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​cortexkit/​common-auth@​0.21.1 ⏵ 0.22.083 +110082 +196 +1100

View full report

@ualtinok
ualtinok merged commit 398ab04 into main Oct 21, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant