[IAmJSD]

Root cause

Two drift hazards from the 2026-09-02 audit (A06-020, A09-012):

• Cache-Control (A06-020): setCacheHeaders (container spaHandler) in internal/server/static.go had a byte-identical copy of the extension switch in cacheControlForExt (Lambda serveStaticForLambda). If you added .avif or .map to only one of them, the same asset got a different cache policy depending on whether the deployment was a container or a Lambda Function URL.
• Confidence thresholds (A09-012): confidenceBucketFor in internal/api/handler_recommendations.go inlined 200 / 3 / 50, the same cut-offs that pkg/exchange uses for the reshape ranking.

Fix

• setCacheHeaders now calls cacheControlForExt(strings.ToLower(path.Ext(urlPath))), as the issue suggested. There is now one extension-to-policy table.
• confidenceBucketFor now uses the named constants confidenceHighSavingsUSD, confidenceHighMinCount and confidenceMediumSavingsUSD. Their doc comment says they must equal exchange.ConfidenceHighSavingsUSD, exchange.ConfidenceHighMinCount and exchange.ConfidenceMediumSavingsUSD.
• Count 0 is reconciled by documenting it, not by changing behavior. The badge still clamps count < 1 to 1, so savings alone decide between medium and low. This differs on purpose from the exchange ranking, which returns a neutral 0.5 on a zero count: a badge must always show a bucket, while a ranking score should stay neutral when data is missing. The go side documents the same split (refactor(exchange): export confidence bucket thresholds as named constants cloud-commitments-go#522 godoc). Tests now cover this, including negative counts.

There is no behavior change: every served Cache-Control value and every bucket is the same as before.

Refs #343

Why Refs, not Closes: the import is left out on purpose

The issue's second acceptance criterion asks this repo to import the exported constants from pkg/exchange. Those constants landed in cloud-commitments-go d11bdde (LeanerCloud/cloud-commitments-go#522). go.mod pins cloud-commitments-go/pkg v0.0.0-20261018003623-541e05e5fd29, which is older, so the import needs a pkg bump. I left the bump out of this PR because:

• Even the smallest bump (to d11bdde) also brings in 7 unrelated go commits, including pkg/scorer (fix(scorer): distinguish an explicit 0% savings floor from unset cloud-commitments-go#516, explicit 0% savings floor vs unset), pkg/common/drop_summary.go (fix(common): panic on a negative DropSummary count cloud-commitments-go#518, panics on a negative count) and pkg/config/load.go. That would break this PR's "no behavior change" guarantee.
• Open PRs feat(ri-exchange): pass offered instance types to reshape analysis #1246 and fix(onboarding): flag aws-cn accounts and refuse their Savings Plans purchases #1248 already bump the same pkg line, each to a different pseudo-version. A third bump here would conflict with both.

Once one of those bumps merges, the follow-up is mechanical: replace the three literals in the const block with exchange.Confidence* (the pinned test table stays the same and keeps guarding the values). After that, #343 can be closed.

Verification

Unit tests only. This is a pure refactor with no DB or integration surface, so no integration test was needed.

Environment: AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true, Go 1.26.9.

gofmt -l internal/                                  # clean
go build ./...                                      # ok
go vet ./...                                        # ok
go vet -tags integration ./...                      # ok
gocyclo -over 10 -ignore "_test\.go" internal/server/static.go internal/api/handler_recommendations.go   # none
golangci-lint run --allow-parallel-runners ./internal/server/ ./internal/api/   # 0 issues (v2.10.1)
go test ./internal/server/ -count=1                 # ok
go test ./internal/api/ -count=1                    # ok
go test ./internal/mocks/ -count=1                  # ok

New and extended tests:

• internal/server/static_test.go:
  • TestCachePolicyPinned pins the exact header for every listed extension, plus upper- and mixed-case variants and default fall-through cases (.json, .avif, .js.map, .txt, no extension). It checks both setCacheHeaders and cacheControlForExt.
  • TestCachePolicyParity_ContainerAndLambda serves the same files through spaFileServer and serveStaticForLambda and requires the same header from both.
• internal/api/handler_recommendations_test.go TestConfidenceBucketFor adds cases at and just below each threshold, and for count 0 with high and low savings and a negative count.

Before/after evidence. This is a behavior-preserving refactor, so the pins are meant to pass both before and after:

• The tests pass on this branch and pass with origin/main's static.go / handler_recommendations.go swapped back in.
• Drift probe on main: adding .avif to only the Lambda switch makes TestCachePolicyPinned/hero.avif fail on the cacheControlForExt assertion while the setCacheHeaders assertion still passes (the copies diverge). TestCachePolicyParity_ContainerAndLambda/hero.avif also fails. With the fix, the same one-line edit moves both paths together.
• Mutation probes on confidenceBucketFor, each killed by TestConfidenceBucketFor: 200→199, 3→2, 50→51, >=→> on high savings, and removing the count clamp.

Combined-tree verification. This branch was tested together with the other queued branches on a local, never-pushed tree: queue/platform @ 936996ad = origin/main a14dc8f2 plus these heads, merged in this order:

Branch	Tested head
fix/issue-337	ff3420c
fix/issue-169	7d75eb5
fix/issue-342	66b221f
fix/issue-310	5e11c21
fix/issue-326	5f0ea59
fix/issue-243	365e959
fix/issue-343	6c94036
fix/issue-312	d2848a8
fix/issue-316	acd60dd
fix/issue-339	75ea9b9
fix/issue-339-commitment-type	73bdb19
fix/issue-353	5d25fcd
fix/issue-313	3156bc4
fix/issue-357	53d9e58
fix/issue-368	0ba727d
fix/issue-419	61648c9
fix/issue-111	b04c372
fix/issue-686	0ad90b7
fix/issue-674	793095d
fix/issue-1055	4ec96f1
fix/issue-559	dfa9525
fix/issue-558	034eed4
fix/issue-874	1720539
fix/issue-666	1e120da
fix/issue-668	fb26345
fix/issue-568	ce04173
fix/issue-311	e54f250
fix/issue-177	0cbb88a
fix/issue-151	c21377c
fix/issue-166	41fb77b
fix/issue-27	2d67622
fix/issue-323	69288ae
fix/issue-59	36463e8
fix/issue-43	35e4069
fix/issue-158	6f76f8a
fix/issue-104	bb00491
fix/issue-55	971ef1b
fix/issue-361	89ac220
fix/issue-120	b458719
fix/issue-36	42bac6e
fix/issue-525	57c97dd
fix/issue-712	e5bcda0
fix/issue-72	6cc63ed

fix/issue-72 and fix/issue-312 conflict on one line in internal/api/handler_dashboard.go (both change the calculateCommitmentMetrics call). The tree used #72's side with #312's validated provider variable; whichever PR merges second takes that same resolution.

Linux, Go 1.26.9, AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true; Docker Postgres via testcontainers:

• Passed at 936996ad: go build ./..., go vet ./..., go vet -tags integration ./... and the full go test -race -short -count=1 ./....
• Static checks at 936996ad: golangci-lint v2.10.1 found 0 issues on every changed package, with and without --build-tags integration. tests/e2e is a separate module, so it was vetted under its own e2e tag. gocyclo -over 10 is silent on the changed non-test files.
• Integration tests, every changed package, one package at a time (-tags integration -count=1, 60-minute local timeout because the VM was shared):
  • At 936996ad, these pass: internal/server, internal/credentials, internal/scheduler, internal/database/postgres/migrations, internal/purchase and internal/api.
  • internal/config passes except TestPostgresStoreDB_ResolveStaleRIExchange_ValidatesCloudCheck, which fails the same way on unmodified main (fixed by fix(config): compare resolve checked_at at the database's microsecond precision #1252).
  • These were run on the first build of this tree (26795376, same branches at earlier heads): internal/analytics, internal/auth, internal/commitmentopts, internal/database and cmd/lambda/clear-rate-limit all pass. The later fixes don't touch those packages.
• What the combined run caught, each fixed on its own branch before this PR opened:
  • a compile break between fix/issue-104's test and fix/issue-326's httpToLambdaRequest signature change;
  • fix/issue-316 rejecting legacy-keyed plans;
  • fix/issue-120 versus main's global-filter test.
• Secrets: git-secrets, using the repo's scripts/setup-git-secrets.sh patterns in a fresh repo with an isolated HOME, found nothing in the changed files, and a planted fake key was flagged. scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL.
• Nothing was applied to any cloud.

Out of scope

• Bumping cloud-commitments-go/pkg and importing exchange.Confidence* (see above).
• The RecommendationDetailResponse / confidenceBucketFor comments still say the heuristic "previously lived" in frontend/src/recommendations.ts. That is historically accurate (the copy no longer exists), so I left them.

No frontend change is needed.

Maintainer: please mirror the issue's triage labels on this PR: impact/internal, type/chore, triaged, priority/p3, severity/low, urgency/eventually, effort/xs.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 4 billable files and costs up to $1.00.}

Or wait 59 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 503eb2e
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: a5f72301-cf10-472c-82b2-1d207f855004

Commits

Reviewing files that changed from the base of the PR and between 503eb2e and b9505e7.

Files selected for processing: 4

• internal/api/handler_recommendations.go
• internal/api/handler_recommendations_test.go
• internal/server/static.go
• internal/server/static_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE b9505e74296287d7a4db411ea7c0988865635cf3

Blocking:

• none

Non-blocking:

• internal/api/handler_recommendations.go:380-384: the three constants are local copies with a "must stay equal" comment. Nothing fails if pkg/exchange changes its values after the pin is bumped: the test table pins literals, not the exchange constants. That's why the PR uses Refs #343 rather than Closes, and the deferral reasons hold. I checked that the pinned pkg (v0.0.0-20261018003623-541e05e5fd29) has no exported Confidence*, and that go d11bdde (fix(settings): saving the Settings page reverts backend coverage propagation and an empty coverage field saves as 0 #522) defines them as 200.0 / 3 / 50.0, matching here. When the follow-up aliases them, a test asserting confidenceHighSavingsUSD == exchange.ConfidenceHighSavingsUSD (etc.) would close the loop.
• internal/server/static_test.go: the pin table holds both logo.png and LOGO.PNG, and the parity test writes both into one temp dir. On a case-insensitive filesystem (default macOS) they collide. The test still passes because both have the same content and policy, but the two rows don't test what they claim there.

Attacked:

• Checked that serveStaticForLambda lower-cases the extension before calling cacheControlForExt, so both paths now share one table with identical normalization. That makes the change behavior-preserving for every extension, including upper case.
• Ran go build ./..., go vet (with and without -tags integration) on internal/server and internal/api, go test -race -short -count=1 on both (ok), golangci-lint v2.10.1 on both, with and without integration tags (0 issues), and gocyclo on the two changed non-test files (silent). go test -race -tags integration ./internal/server/ is ok. My full -tags integration ./internal/api/ run failed only on Postgres testcontainer startup ("database system is ready ... matched 0 times") at load average ~38 from other jobs on the VM, with no assertion failures. A bounded rerun, -run 'Recommendation|Confidence', passed.
• Refactor proof: with origin/main's static.go and handler_recommendations.go swapped in, the new pins and the threshold table pass unchanged, so there's no behavior change. Drift probe: on main's code, adding .avif to only the Lambda switch fails TestCachePolicyPinned/hero.avif and TestCachePolicyParity_ContainerAndLambda/hero.avif. With this PR there's a single table, so that drift can no longer happen. I restored everything afterwards.

Body-stale:

• none. The combined-tree section tests fix/issue-343 at 6c94036, an earlier head than b9505e7. That's historical, not false.

_{Reviewer: rB4. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at b9505e74296287d7a4db411ea7c0988865635cf3 merged onto main (5aa3df5b), together with #1155, #1219, #1221, #1223, #1224, #1225, #1226, #1227, #1256, #1262, #1266, #1270, #1272, #1275, #1283, #1286, #1293, #1297, #1299, #1300, #1301, #1304, #1307, #1311, #1313, #1325 in that order (combined tree f3a3331f, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 1 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 1 approving independent review(s) on b9505e74, green CI, and the combined-tree verification above. Squash-merged at exactly b9505e74296287d7a4db411ea7c0988865635cf3.