[JacobStephens2]

Summary

GitHub adapter failures / quota checks
  └─ ~/.thirdshift/github-quota.json
       ├─ waits keyed by host, authenticated user and resource
       └─ Inbox quota pause

Command wait planner: reset + 60s + random 0–60s; cumulative cap 2h

Writes are locked and atomic; expired waits are ignored. Credentials are never stored. Pass and running Command execution stays unchanged until the following Tickets.

Closes #1995

Evidence

Execution evidence

• Before: cargo test --bin thirdshift github::execution_tests::primary_quota_failure_records_a_shared_wait -- --exact failed: primary quota failure left no shared Quota wait.
  After: the same command passed: 1 passed; 0 failed.
• Before: cargo test --bin thirdshift github::execution_tests::quota_failure_uses_repository_host_instead_of_comment_url -- --exact --nocapture failed: host was docs.example.net, expected github.com.
  After: the same command passed: 1 passed; 0 failed. Regression retained.
• Before: cargo test --bin thirdshift github::execution_tests::quota_failure_does_not_treat_a_close_comment_as_a_host_selector -- --exact failed: the actual GitHub host had 0 waits, expected 1.
  After: the same command passed: 1 passed; 0 failed. Close comments that look like flags are treated as payload.
• Before: cargo test --test status merged_pull_request_takes_its_ready_row_into_resolved_saying_so -- --exact --nocapture failed at the read-only call assertion, which rejected api user --hostname github.com.
  After: the same command passed: 1 passed; 0 failed. The assertions retain the read-only guarantee and permit that exact identity lookup.
• Before: cargo test --bin thirdshift github::execution_tests::a_rest_quota_failure_in_a_repository_named_graphql_keeps_the_core_resource -- --exact failed its REST core resource assertion.
  After: the same command passed: 1 passed; 0 failed. Repository names in REST error URLs no longer select the GraphQL resource.
• cargo clippy --all-targets -- -D warnings and cargo fmt --check passed.
• cargo test --test status passed: 78 tests, 1 intentionally ignored helper. Its primary-quota recovery case now verifies no reads before reset and recovery after the shared reset expires.
• scripts/affected-tests main passed on b8334db8: 4,194 Rust tests passed under nextest; all 190 Console browser tests passed; site, Go, Python, TypeScript and release-generator checks passed too.

Test seams: the GitHub adapter through fake gh; shared-record observation/read on a real temporary filesystem; wait planning with injected clock and random source; existing status and Console Inbox seams.

Review coverage

Reviewed against refs/remotes/origin/issue-1994 at 960513a91e3ca30df2dbfce46b625e91833d0e7c using thirdshift-code-review. Standards: 0 findings. Spec: 2 findings, both reproduced, fixed and retained as tests. Each reviewer read all 12 changed files. Generated-output exclusions: none. Changed files left unread: none.

Unaddressed findings

Standards

None.

Spec

None. Both findings were addressed.

Security

None.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

The change adds a local record and replaces Inbox quota storage; it can be rolled back without migrating GitHub data.

Blast Radius: GitHub

Failure recording and Inbox quota pauses share machine-local state. Passes and running Commands do not wait or skip on this record yet.

Built with codex codex-cli 0.167.1 · gpt-6.1-sol · xhigh