refactor(test): table-drive Copilot quota mapping and validation fixtures

[Nanako0129]

Summary

crates/tb_core_ffi/src/agent_copilot.rs implements a relatively small provider adapter with two quota rows—Premium and Chat—but its embedded test module is already roughly the same size as the production mapping code.

The current tests repeatedly construct complete provider JSON payloads and then restate the same row semantics across:

• premium/chat mapping and zero-entitlement placeholders;
• lossy quota_reset_date values;
• missing, malformed, negative, contradictory, and rounded quota fields;
• malformed-sibling isolation;
• calendar-month duration inference and observed fallback;
• complete UsageWindow wire fields and privacy sentinels;
• a historical stage4 end-to-end fixture.

The contracts are useful, but several cases verify the same decision at three layers: raw JSON decoding, CopilotRow classification, and the shared UsageWindow serializer. This makes a two-row adapter carry hundreds of lines of bespoke fixture text and duplicates wire guarantees already owned by the shared quota enrichment/serialization tests.

Goal

Keep Copilot's fail-closed row validation, sibling isolation, exact calendar-month duration, and privacy behavior while replacing copied provider payloads and repeated full-wire assertions with compact typed cases.

Contracts to retain

1. Credential-independent provider decoding

   • Premium and Chat use stable canonical identities;
   • a valid non-zero entitlement produces the expected remaining percentage;
   • a zero-entitlement row is a placeholder rather than a usable quota window;
   • an absent row remains distinct from a malformed row.

2. Row validation

   • entitlement and remaining values must be finite, non-negative, and coherent;
   • provider percentages must be finite, in range, and agree with the absolute quota within the documented rounding tolerance;
   • malformed fields fail closed.

3. Sibling isolation

   • one malformed row does not remove a valid sibling;
   • placeholder-only input remains accepted as the documented empty state;
   • invalid-only input remains terminal.

4. Reset handling

   • a valid first-of-month UTC reset uses the exact preceding 28–31 day calendar duration;
   • malformed or non-string reset fields are ignored without poisoning otherwise valid rows;
   • a non-calendar reset remains eligible for observed-duration learning rather than becoming a guessed 30-day window.

5. Privacy and integration

   • malformed reset objects or arrays cannot leak their contents into public output;
   • one representative end-to-end payload proves plan normalization, both canonical cards, reset serialization, and shared pace metadata.

Consolidate or remove

• Introduce a small typed QuotaRowCase table over entitlement, remaining, optional provider percentage, and expected CopilotRow classification.
• Build provider payloads through one fixture builder instead of copying complete JSON documents for each field mutation.
• Put malformed reset values in one table and assert the adapter-level result once; do not reassert every shared UsageWindow field for every malformed value.
• Keep one sibling-isolation table with Premium/Chat outcomes rather than separate full-payload scenarios for each malformed field class.
• Retain one end-to-end wire fixture. Detailed pace-state and serializer invariants remain owned by the shared enrichment/wire issue.
• Replace historical stage4 naming with the current observable Copilot contract.
• Remove assertions that merely repeat a lower-level row classification at the serializer layer.
• Do not merely move the inline JSON into another file; total fixture and test LOC must decrease.

Acceptance criteria

• Copilot Premium/Chat behavior, exact calendar duration, malformed-row isolation, and privacy remain unchanged.
• The Copilot test slice is reduced by at least 35% from the current baseline.
• Row validation and malformed-reset behavior are visibly table-driven.
• Only one complete provider-to-wire fixture remains.
• Shared quota pace and serializer fields are not exhaustively re-tested inside the provider adapter.
• cargo test, the cross-language quota fixture checks, and relevant CI gates pass.

Boundaries

• Generic Codex/Claude provider-window mapping remains owned by refactor(test): table-drive provider window mapping and remove stage baselines #167.
• Shared quota-history enrichment and public wire serialization remain owned by refactor(test): consolidate quota enrichment and wire serialization fixtures #171.
• Credential loading in opencode_integrations.rs is already compact and table-driven and is not part of this cleanup.

[Nanako0129]

Executable implementation plan

This should leave Copilot Premium/Chat behavior unchanged while making the two-row adapter tests proportional to the adapter itself. Provider-row decoding/validation belongs here; generic history enrichment and public wire coherence belong to #171.

0. Baseline and dependency order

1. Start from current origin/main in an isolated branch/worktree such as refactor-copilot-quota-tests.
2. Read docs/knowledge/README.md, architecture.md, verification.md, workflow.md, and the provider-quota-pace plan.
3. Rebase after refactor(test): consolidate quota enrichment and wire serialization fixtures #171 so the adapter can rely on the final shared enrichment/serializer test boundary instead of rebuilding it locally.
4. Measure the complete #[cfg(test)] slice in crates/tb_core_ffi/src/agent_copilot.rs:
   • LOC and test count;
   • complete provider JSON documents;
   • row-classification cases;
   • reset/duration cases;
   • sibling-isolation cases;
   • complete public-wire assertions;
   • historical stage4 cases.
5. Run focused Copilot tests and full cargo test before editing.
6. Record the stable canonical identities for Premium and Chat and do not change them under this issue.

1. Create one typed row-classification table

Define a compact input/output model such as:

struct QuotaRowCase {
    name: &'static str,
    entitlement: JsonField,
    remaining: JsonField,
    provider_percent: JsonField,
    expected: ExpectedCopilotRow,
}

enum ExpectedCopilotRow {
    Usable { used_percent: f64, remaining_percent: f64 },
    Placeholder,
    Malformed,
    Absent,
}

JsonField should represent absent, null, valid number, and malformed value without needing a complete payload.

Cover each distinct validation rule once:

1. valid non-zero entitlement/remaining maps correctly;
2. zero entitlement is a placeholder, not a usable row;
3. absent row remains distinct from malformed row;
4. negative/non-finite/malformed entitlement or remaining fails closed;
5. remaining greater than entitlement follows current contradictory-input behavior;
6. provider percentage must be finite and in range;
7. percentage agrees with absolute quota within the documented rounding tolerance;
8. just-inside and just-outside tolerance boundaries;
9. valid rounded provider values remain accepted.

Assert the typed CopilotRow classification/result directly. Do not immediately rebuild a complete UsageWindow to reassert the same decision.

2. Build provider payloads through one fixture builder

Add one builder that owns the real provider JSON shape:

struct CopilotPayloadBuilder {
    premium: Option<RowFixture>,
    chat: Option<RowFixture>,
    reset: JsonField,
    plan: JsonField,
}

Requirements:

1. Default payload contains valid Premium and Chat rows.
2. A row can be omitted, malformed, or set to placeholder via typed overrides.
3. Reset can be valid string, malformed string, non-string scalar, object, array, null, or absent.
4. No complete provider document is copied into individual tests.
5. Keep one anonymized complete payload literal only if it represents a provider shape the builder cannot safely abstract; explain why.

3. Table-drive sibling isolation and aggregate outcome

Create a table over Premium/Chat row classifications and expected adapter result. Retain:

• both usable → both canonical cards;
• valid Premium + malformed Chat → Premium survives;
• malformed Premium + valid Chat → Chat survives;
• usable + placeholder → usable survives and placeholder follows current empty-row behavior;
• placeholder-only input is accepted as documented empty state;
• absent-only input follows current absent semantics;
• invalid-only input is terminal;
• one absent and one malformed remains distinguishable if the public/provider outcome differs.

Expected output should include retained canonical card IDs, overall provider outcome class, and cacheability/trust classification if owned by this adapter. Do not assert complete v3 wire fields here.

4. Consolidate reset handling

Use one reset-value table. Rows should include:

1. first-of-month UTC reset after a 31-day month;
2. first-of-month UTC reset after 30, 29, and 28 days;
3. valid but non-calendar reset;
4. malformed string;
5. number/bool/null;
6. object containing a distinctive secret sentinel;
7. array containing a distinctive secret sentinel;
8. absent reset.

Assert only adapter-owned results:

• exact preceding calendar duration for the first-of-month cases;
• non-calendar reset remains eligible for observed-duration learning rather than a guessed 30-day duration;
• malformed/non-string reset does not poison valid rows;
• malformed complex values contribute no public/loggable text.

Do not repeat every lifecycle, pace, or serialization field for every malformed reset value.

5. Keep privacy as one consolidated sentinel case

Build one payload with:

• malformed reset object/array values;
• distinctive plan/provider-local strings;
• a valid sibling row.

Run it through the adapter and the final public serialization boundary once. Assert:

1. valid canonical card output remains;
2. none of the sentinel strings appears in serialized output or safe diagnostics;
3. only allowlisted normalized plan/card/reset information is present.

Generic diagnostic privacy remains owned by #172; this case is specifically about Copilot provider values entering mapping/output.

6. Keep one complete provider-to-wire integration fixture

Retain exactly one end-to-end fixture proving:

• plan normalization;
• Premium and Chat stable canonical identities;
• valid reset serialization;
• exact calendar duration where applicable;
• one representative shared lifecycle/pace metadata result;
• compatibility with the canonical v3 public shape.

All detailed lifecycle-state, collision, evaluator-validation, and serializer invariants must rely on #171/shared tests. Do not repeat a full public field list in every Copilot case.

7. Remove historical stage4 duplication

For each stage-named test:

1. identify whether it protects row classification, sibling isolation, reset handling, privacy, or the single integration fixture;
2. merge it into that current contract;
3. delete tests that only repeat shared v3 enrichment/serializer fields;
4. replace stage names/comments with observable Copilot behavior.

8. Commit structure

Recommended checkpoints:

1. test(copilot): add typed row and payload fixtures
2. refactor(test): table-drive Copilot row validation
3. refactor(test): table-drive Copilot sibling and reset behavior
4. refactor(test): collapse Copilot wire fixtures
5. refactor(test): remove stage baselines

Production behavior should not change. If a helper extraction is needed, isolate it from test deletion.

9. Verification and completion evidence

Run:

cargo fmt --all -- --check
cargo test
cargo clippy --workspace --all-targets
make build
make selftest
swift run TokenBar --smoke

Run the canonical v3 cross-language fixture checks unchanged. No live Copilot credentials or network request is required.

The final handoff must include:

• exact before/after Copilot test LOC and test counts;
• QuotaRowCase validation matrix;
• sibling-isolation matrix;
• reset-value table and calendar-duration evidence;
• the single retained end-to-end fixture;
• privacy sentinel result;
• all command exit statuses.

Completion requires at least a 35% reduction in the Copilot test slice, visibly table-driven row/reset behavior, and only one complete provider-to-wire fixture. Moving copied JSON to another file does not count. Stop after verified implementation and review; push, PR creation, merge, tag, release, and live credential smoke require separate authorization.

— GPT-5.6 Pro

[Nanako0129]

Executable implementation plan

Land this after #167 and #171 so Copilot can rely on the shared canonical mapping and serializer/enrichment ownership. This issue should retain Copilot-specific row validation, sibling isolation, reset interpretation, and one provider-to-wire proof—nothing more.

1. Establish baseline and boundaries

1. Start from current origin/main after the reviewed refactor(test): table-drive provider window mapping and remove stage baselines #167/refactor(test): consolidate quota enrichment and wire serialization fixtures #171 changes, in an isolated branch/worktree such as refactor-copilot-quota-tests.
2. Read docs/knowledge/README.md, plans/provider-quota-pace.md, architecture.md, verification.md, and workflow.md.
3. Inventory agent_copilot.rs tests by:
   • raw row validation/classification;
   • provider payload construction;
   • Premium/Chat sibling behavior;
   • reset handling;
   • privacy sentinels;
   • full UsageWindow/pace serializer assertions;
   • historical stage4 fixture.
4. Record selected test LOC, test count, complete provider JSON count, complete public-wire assertion count, and malformed reset/row matrix size.
5. Map each assertion to C1–C5 or to refactor(test): table-drive provider window mapping and remove stage baselines #167/refactor(test): consolidate quota enrichment and wire serialization fixtures #171. Detailed shared pace lifecycle and wire-shape assertions must move to their shared owner before deletion here.

The 35% target is measured against the Copilot adapter test slice.

2. Define typed row cases

Introduce a compact test representation:

struct QuotaRowCase {
    name: &'static str,
    entitlement: JsonNumberCase,
    remaining: JsonNumberCase,
    provider_percent: Option<JsonNumberCase>,
    expected: ExpectedCopilotRow,
}

enum ExpectedCopilotRow {
    Usable { remaining_percent: f64 },
    Placeholder,
    Absent,
    Malformed,
}

The raw-number wrapper must be able to express:

• missing;
• valid integer/float;
• negative;
• non-finite-equivalent/malformed JSON representation where applicable;
• string/object/array/wrong type;
• very large value;
• contradictory absolute/percentage data.

Expected values should compare using the documented tolerance only; do not copy production rounding code into the fixture.

3. Table-drive row validation

Use one table covering distinct decisions:

1. valid non-zero entitlement and coherent remaining;
2. zero entitlement placeholder;
3. absent row;
4. missing entitlement or remaining;
5. malformed/wrong-type field;
6. negative entitlement/remaining;
7. remaining greater than entitlement;
8. provider percentage below 0 or above 100;
9. provider percentage within documented rounding tolerance;
10. percentage just outside tolerance;
11. contradictory absolute and percentage values;
12. rounded boundary values that remain coherent;
13. non-finite/overflow input fails closed.

Assert only ExpectedCopilotRow. Remove serializer assertions from these rows; row validation owns classification.

4. Build provider payloads through one fixture builder

Create a builder for the two canonical rows and optional reset:

struct CopilotPayloadSpec {
    premium: RowSpec,
    chat: RowSpec,
    reset: ResetSpec,
    plan: Option<String>,
    extra: serde_json::Value,
}

Defaults should yield a valid Premium + Chat payload. Every sibling/reset case overrides one field. Do not copy full JSON documents.

The builder must allow unknown extra fields and ordering changes so forward compatibility is represented without asserting raw object spelling.

5. Table-drive sibling isolation

Create one table whose input is expected Premium/Chat row classifications and whose output is the adapter-level result:

• both usable;
• Premium malformed, Chat usable;
• Chat malformed, Premium usable;
• usable + placeholder;
• placeholder + placeholder as documented empty state;
• absent + placeholder;
• invalid-only terminal;
• absent-only result according to current contract;
• malformed sibling with extra unrelated fields.

Assert:

• retained canonical cards and order;
• terminal/accepted-empty classification;
• valid sibling percentages unchanged;
• malformed row contributes no identity or values.

Do not rerun every malformed field class through both sibling positions. Row validation already proves classification; the sibling table proves composition.

6. Table-drive reset handling

Define ResetSpec rows for:

• valid first-of-month UTC resets preceded by representative 28-, 29-, 30-, and 31-day months;
• malformed date string;
• non-string scalar;
• object/array containing secret/path sentinels;
• missing reset;
• valid non-calendar reset.

Expected adapter result should state:

• exact duration/source for valid calendar resets;
• ignored reset with otherwise valid rows preserved;
• observed-duration learning eligibility for non-calendar/missing reset;
• no terminal poisoning solely from malformed optional reset.

If all 28–31 cases share one pure calendar-duration helper, table-drive that helper compactly and retain one adapter integration row. Do not repeat complete wire assertions for every month.

7. Retain one privacy sentinel

Place distinct sentinels in malformed reset objects/arrays, unknown fields, plan text, and malformed row values where the parser may inspect them. Serialize the complete public result and assert no internal sentinel appears in JSON keys or scalar leaves.

The test may expose the canonical plan/card labels allowed by the product, but must not print raw malformed objects, paths, credentials, account identifiers, or provider response fragments. Failure output should identify only the sentinel class.

8. Keep one provider-to-wire integration fixture

Retain exactly one complete Copilot fixture through the real adapter, enrichment, and serializer. It should prove:

• plan normalization;
• stable Premium and Chat cardId/windowKey identities;
• one valid calendar reset/duration;
• zero-entitlement/placeholder behavior only if it is part of the selected representative payload;
• shared pace metadata is attached through the existing refactor(test): consolidate quota enrichment and wire serialization fixtures #171 path;
• public wire omits internal/provider-only fields.

Assert a canonical public tuple or the shared provider-v3 fixture shape. Do not reassert every PaceStatus/HistoricalPace field that #171 owns.

9. Remove historical stage4 ownership

Map every stage4 assertion to a current observable contract:

• Copilot row mapping;
• stable identity;
• reset duration;
• shared enrichment/wire.

Retain the smallest current fixture for each unique Copilot behavior, then delete the historical baseline name and duplicate serializer assertions. Historical rationale belongs in the issue/PR description.

10. Suggested commit sequence

1. test(copilot): add typed row and payload fixtures
2. refactor(test): table-drive Copilot row validation
3. refactor(test): consolidate sibling and reset cases
4. refactor(test): reduce Copilot wire integration
5. refactor(test): remove stage4 baseline

Keep focused/full Rust tests and the cross-language fixture check green after each conversion.

11. Verification

Run:

cargo fmt --all -- --check
cargo test -p tb_core_ffi agent_copilot
cargo test
cargo clippy --workspace --all-targets
make build
make selftest

Run the shared provider-v3/cross-language fixture check from #171. No live Copilot credentials or network calls are required.

12. Completion evidence

The PR summary must include:

• before/after Copilot test LOC, test, full-provider-JSON, and full-wire assertion counts;
• row-validation and sibling-isolation tables;
• reset table and calendar-duration ownership;
• the single retained provider-to-wire fixture;
• shared assertions removed with refactor(test): table-drive provider window mapping and remove stage baselines #167/refactor(test): consolidate quota enrichment and wire serialization fixtures #171 owners;
• stage4 replacement map;
• privacy sentinel result;
• confirmation that Premium/Chat behavior, plan normalization, reset semantics, and public wire are unchanged;
• verification results.

The Copilot test slice must be at least 35% smaller. Stop after verified implementation and review; push, PR creation, merge, live provider smoke, tag, and release require separate explicit authorization.

— GPT-5.6 Pro