Skip to content

fix: clear governanceRejectedContextKey on decision allow of governance req so that fallbacks account for budgets/rate limits - #3645

Merged
akshaydeo merged 1 commit into
mainfrom
fix/05-21-fix_clear_governancerejectedcontextkey_on_decision_allow_of_governance_req_so_that_fallbacks_account_for_budgets_rate_limits
May 21, 2026
Merged

fix: clear governanceRejectedContextKey on decision allow of governance req so that fallbacks account for budgets/rate limits #3645
akshaydeo merged 1 commit into
mainfrom
fix/05-21-fix_clear_governancerejectedcontextkey_on_decision_allow_of_governance_req_so_that_fallbacks_account_for_budgets_rate_limits

Conversation

@danpiths

Copy link
Copy Markdown
Collaborator

Summary

When a primary LLM request fails and a fallback retry succeeds, the governance
plugin was leaving a stale rejection flag in the context. This caused
PostLLMHook to skip budget and rate-limit ID collection for the successful
fallback attempt, as it incorrectly treated the request as rejected.

Changes

  • Clear the governanceRejectedContextKey flag from the context whenever a
    DecisionAllow result is reached, ensuring that any rejection flag set during
    a prior failed attempt does not persist into a successful fallback retry.

Type of change

  • Bug fix

Affected areas

  • Plugins

How to test

Trigger a scenario where a primary provider attempt fails governance and a
fallback attempt succeeds. Verify that PostLLMHook correctly collects budget
and rate-limit IDs for the successful fallback response rather than skipping
collection due to the stale rejection flag.

go test ./plugins/governance/...

Breaking changes

  • No

Security considerations

No security implications. This fix ensures accurate budget and rate-limit
tracking, which could prevent unintended bypasses of usage accounting on
fallback paths.

Checklist

  • I read docs/contributing/README.md and followed the guidelines
  • I added/updated tests where appropriate
  • I updated documentation where needed
  • I verified builds succeed (Go and UI)
  • I verified the CI pipeline passes locally if applicable

@danpiths
danpiths requested a review from akshaydeo May 20, 2026 22:02
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

danpiths commented May 20, 2026

Copy link
Copy Markdown
Collaborator Author

@github-actions

Copy link
Copy Markdown
Contributor

🧪 Test Suite Available

This PR can be tested by a repository admin.

Run tests for PR #3645

@coderabbitai

coderabbitai Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d4e1312e-59e0-4797-b217-7849f7c7fcc9

📥 Commits

Reviewing files that changed from the base of the PR and between 81a9b2a and 268e30c.

📒 Files selected for processing (1)
  • plugins/governance/main.go

📝 Walkthrough

Summary by CodeRabbit

  • Bug Fixes
    • Resolved an issue where a leftover “rejected” marker from a prior failed attempt or fallback could cause post-request hooks to skip downstream logic (such as budget and rate-limit usage tracking) when a subsequent governance decision allows the request. Allowed retries now proceed with correct post-request processing and usage accounting.

Walkthrough

When governance returns DecisionAllow, the request context now clears governanceRejectedContextKey so downstream PostLLMHook/PostMCPHook do not see a stale "rejected" marker from prior failed attempts.

Changes

Governance Decision Context Cleanup

Layer / File(s) Summary
Stale rejection flag cleanup on allow decision
plugins/governance/main.go
When DecisionAllow is reached, governanceRejectedContextKey is cleared from the request context to remove residual rejection markers from earlier failed attempts, ensuring post-hooks observe the correct allowed state.
sequenceDiagram
  participant EvaluateGovernanceRequest
  participant PostLLMHook
  participant PostMCPHook
  EvaluateGovernanceRequest->>EvaluateGovernanceRequest: clear governanceRejectedContextKey (on DecisionAllow)
  EvaluateGovernanceRequest->>PostLLMHook: call PostLLMHook without rejected flag
  EvaluateGovernanceRequest->>PostMCPHook: call PostMCPHook without rejected flag
Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Suggested reviewers

  • akshaydeo
  • roroghost17

Poem

I’m a rabbit in code, with whiskers bright,
I nibble at flags that shadow the light.
When governance says yes, I hop and I clear,
No ghostly “rejected” shall linger near.
Hooray — fresh context, hopping with cheer! 🐇✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly describes the main change: clearing a governance rejection flag on decision allow to fix fallback budget/rate-limit tracking.
Description check ✅ Passed The description follows the template with all key sections completed: Summary, Changes, Type of change, Affected areas, How to test, Breaking changes, Security considerations, and Checklist.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/05-21-fix_clear_governancerejectedcontextkey_on_decision_allow_of_governance_req_so_that_fallbacks_account_for_budgets_rate_limits

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"


Comment @coderabbitai help to get the list of available commands and usage tips.

@danpiths danpiths changed the title fix: clear stale rejection flag on fallback allow decision fix: clear governanceRejectedContextKey on decision allow of governance req so that fallbacks account for budgets/rate limits May 20, 2026
coderabbitai[bot]
coderabbitai Bot previously approved these changes May 20, 2026
@greptile-apps

greptile-apps Bot commented May 20, 2026

Copy link
Copy Markdown
Contributor

Confidence Score: 5/5

The change is a single, well-scoped addition inside a mutually exclusive branch; it cannot interfere with the rejection-setting path and uses a thread-safe, nil-guarded API call already established across the codebase.

The fix clears a stale boolean flag in an Allow-only branch that could never conflict with the flag-setting logic above it. ClearValue is mutex-protected and sets the map entry to nil rather than deleting it, so the type-assertion check in PostLLMHook correctly falls through. No correctness, security, or data-loss risks are introduced.

No files require special attention.

Important Files Changed

Filename Overview
plugins/governance/main.go Adds ClearValue call in DecisionAllow branch to remove stale governanceRejectedContextKey set by a prior failed primary attempt, guarded with ctx != nil. Fix is minimal, correct, and consistent with how ClearValue is used elsewhere.

Reviews (3): Last reviewed commit: "fix: clear `governanceRejectedContextKey..." | Re-trigger Greptile

Comment thread plugins/governance/main.go
Comment thread plugins/governance/main.go
@danpiths
danpiths force-pushed the fix/05-21-fix_clear_governancerejectedcontextkey_on_decision_allow_of_governance_req_so_that_fallbacks_account_for_budgets_rate_limits branch from 915f2d4 to 81a9b2a Compare May 20, 2026 22:22
@coderabbitai
coderabbitai Bot requested a review from roroghost17 May 20, 2026 22:24
…ance req so that fallbacks account for budgets/rate limits
@danpiths
danpiths force-pushed the fix/05-21-fix_clear_governancerejectedcontextkey_on_decision_allow_of_governance_req_so_that_fallbacks_account_for_budgets_rate_limits branch from 81a9b2a to 268e30c Compare May 21, 2026 14:26

akshaydeo commented May 21, 2026

Copy link
Copy Markdown
Contributor

Merge activity

  • May 21, 3:07 PM UTC: A user started a stack merge that includes this pull request via Graphite.
  • May 21, 3:07 PM UTC: @akshaydeo merged this pull request with Graphite.

@akshaydeo
akshaydeo merged commit 3183ded into main May 21, 2026
14 of 15 checks passed
@akshaydeo
akshaydeo deleted the fix/05-21-fix_clear_governancerejectedcontextkey_on_decision_allow_of_governance_req_so_that_fallbacks_account_for_budgets_rate_limits branch May 21, 2026 15:07
This was referenced May 21, 2026
Vaibhav701161 pushed a commit that referenced this pull request May 26, 2026
…ce req so that fallbacks account for budgets/rate limits

 (#3645)

## Summary

When a primary LLM request fails and a fallback retry succeeds, the governance
plugin was leaving a stale rejection flag in the context. This caused
`PostLLMHook` to skip budget and rate-limit ID collection for the successful
fallback attempt, as it incorrectly treated the request as rejected.

## Changes

- Clear the `governanceRejectedContextKey` flag from the context whenever a
  `DecisionAllow` result is reached, ensuring that any rejection flag set during
  a prior failed attempt does not persist into a successful fallback retry.

## Type of change

- [x] Bug fix

## Affected areas

- [x] Plugins

## How to test

Trigger a scenario where a primary provider attempt fails governance and a
fallback attempt succeeds. Verify that `PostLLMHook` correctly collects budget
and rate-limit IDs for the successful fallback response rather than skipping
collection due to the stale rejection flag.

```sh
go test ./plugins/governance/...
```

## Breaking changes

- [x] No

## Security considerations

No security implications. This fix ensures accurate budget and rate-limit
tracking, which could prevent unintended bypasses of usage accounting on
fallback paths.

## Checklist

- [x] I read `docs/contributing/README.md` and followed the guidelines
- [x] I added/updated tests where appropriate
- [x] I updated documentation where needed
- [x] I verified builds succeed (Go and UI)
- [x] I verified the CI pipeline passes locally if applicable
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants