[IAmJSD]

Summary

Issue #43 reports a second real-looking AWS account ID, 909626172446 ("CUDly host"), in tracked files. This PR handles the one non-frontend fixture/doc copy and lists the rest as follow-ups. It does not close the issue.

Changed: known_issues/23_ux_review_2026_04_22.md:576 quoted the AWS Accounts row as CUDly host (909626172446) [Self] …. It now uses the standard 123456789012 placeholder. The finding (an unexplained [Self] label) doesn't depend on the number.

Refs #43

What is left, and why

git grep 909626172446 on current main (a14dc8f2) finds 14 lines:

Location	Lines	Status
known_issues/23_ux_review_2026_04_22.md	576	fixed here
frontend/src/__tests__/approval-details.test.ts	122, 124, 130, 220, 230, 238, 272 (two on 272)	UI owner, see below
frontend/src/__tests__/settings-accounts.test.ts	1281, 1297	UI owner, see below
terraform/environments/aws/ci-cd-permissions/main.tf	15	owner decision, left unchanged
terraform/environments/aws/ci-cd-permissions/backend.hcl.example	13, 23	owner decision, left unchanged
terraform/environments/aws/ci-cd-permissions/README.md	52	owner decision, left unchanged

The Terraform occurrences are not fixtures. In 48ee47f ("fix(iac/aws): point ci-cd-permissions backend at the 909626172446 state bucket", Refs #2, 2026-10-04), a maintainer pointed this root's S3 backend at the real state bucket cudly-terraform-state-909626172446. That commit came after this issue was filed (2026-06-11). Swapping in a placeholder would point terraform init for this root at a bucket that doesn't exist and cut it off from its live state. That makes it an owner call, not hygiene. The possible routes are:

• (a) Keep it. The ID is public in git history anyway, both in that commit message and on main since 2026-10-04.
• (b) Move bucket to a partial backend config: drop it from main.tf, use -backend-config=backend.hcl (already gitignored), and use a cudly-terraform-state-<ACCOUNT_ID> placeholder in the example and README.

Option (b) changes how this root gets applied, so it isn't done here. backend.hcl.example and the README only mirror main.tf. Changing just those would leave the ID in main.tf and undo part of the maintainer's deliberate edit, so they were left alone too.

.gitallowed: no entry mentions 909626172446, so nothing needs removing. None of the current files that hold the ID are flagged by the current detectors. That covers main's version of this doc, the patched doc, both frontend tests and the three Terraform files. Each line passes without an allowlist entry: the frontend lines use external_id: or plain string arguments rather than an account_id-shaped key, so the AWS account detector doesn't fire. So no allowlist change has to go in alongside the frontend follow-up, and that change can't break CI on its own.

No new copies elsewhere: after git fetch fork, I diffed all 519 fork/* branches against their merge-base with origin/main. None adds a line containing the ID, and none adds a file containing it that main doesn't already have. Our open PR #1090 (fix/issue-716, head 65e2799e) only has the 14 copies it inherits from main. gh pr diff 1090 contains no match, and #1090 doesn't touch known_issues/23_ux_review_2026_04_22.md.

I made no AWS call to check who owns the ID.

Frontend follow-up for the UI owner

No edits under frontend/ in this PR. Suggested change: replace 909626172446 with 444444444444 in both files below. That value is in .gitallowed's synthetic placeholder set, and neither file uses it yet. The other IDs in these files are 111122223333, 123456789012, 555555555555 and 999988887777 in approval-details, and 111111111111, 123456789012 and 222222222222 in settings-accounts, so the two-account fixtures stay distinct. The issue suggested 210987654321. That would also scan clean, but it's not in the .gitallowed placeholder set.

• frontend/src/__tests__/approval-details.test.ts
  • 122, 130, 220, 230, 238: renderApprovalDetailsBody(..., new Map(), '909626172446') host-account argument
  • 124: toBe('CUDly host (909626172446)')
  • 272: formatAccountLabel(undefined, undefined, 'aws', '909626172446') and toBe('CUDly host (909626172446)') (two occurrences)
• frontend/src/__tests__/settings-accounts.test.ts
  • 1281: external_id: '909626172446' in the acc-b / CUDly host account fixture
  • 1297: the button[aria-label="Service overrides for CUDly host (909626172446)"] selector, which must change together with 1281

A plain replace-all inside each file is enough, because every assertion is derived from the same fixture value. No .gitallowed change is needed (see above).

Verification

Doc-only change, so there is no unit or integration test to fail before and pass after. The evidence is a grep and a scan.

# fail-before / pass-after (grep evidence)
git grep -n 909626172446 origin/main -- . ':!frontend'   # 5 lines: known_issues/23_...md:576 + 4 Terraform lines
git grep -n 909626172446 HEAD        -- . ':!frontend'   # 4 lines: Terraform only (left on purpose, see above)

# allowlist self-test (git-secrets from scratchpad on PATH)
bash scripts/test-git-secrets-allowlist.sh               # exit=0, "137 PASS, 0 FAIL"

# targeted scan: throwaway repo with scripts/setup-git-secrets.sh + .gitallowed,
# `git add`ed copies of main's and the patched 23_ux_review doc, both frontend tests and the 3 Terraform files
git secrets --scan                                       # exit 0 (ID lines not flagged, before or after)
# same repo plus a planted 40-char aws_secret_access_key line
git secrets --scan                                       # exit 1, planted line caught (scanner is live)

# no new copies on other branches
git fetch fork
for b in fork/*: git diff $(git merge-base origin/main $b) $b | grep '^+.*909626172446'   # 0 of 519 branches
gh pr diff 1090 -R LeanerCloud/cloud-commitments-platform | grep -c 909626172446           # 0

No Go, shell, workflow or Terraform files changed, so build, vet, lint, gocyclo, shellcheck and terraform validate don't apply.

Combined-tree verification. This branch was tested together with the other queued branches on a local, never-pushed tree: queue/platform @ 936996ad = origin/main a14dc8f2 plus these heads, merged in this order:

Branch	Tested head
fix/issue-337	ff3420c
fix/issue-169	7d75eb5
fix/issue-342	66b221f
fix/issue-310	5e11c21
fix/issue-326	5f0ea59
fix/issue-243	365e959
fix/issue-343	6c94036
fix/issue-312	d2848a8
fix/issue-316	acd60dd
fix/issue-339	75ea9b9
fix/issue-339-commitment-type	73bdb19
fix/issue-353	5d25fcd
fix/issue-313	3156bc4
fix/issue-357	53d9e58
fix/issue-368	0ba727d
fix/issue-419	61648c9
fix/issue-111	b04c372
fix/issue-686	0ad90b7
fix/issue-674	793095d
fix/issue-1055	4ec96f1
fix/issue-559	dfa9525
fix/issue-558	034eed4
fix/issue-874	1720539
fix/issue-666	1e120da
fix/issue-668	fb26345
fix/issue-568	ce04173
fix/issue-311	e54f250
fix/issue-177	0cbb88a
fix/issue-151	c21377c
fix/issue-166	41fb77b
fix/issue-27	2d67622
fix/issue-323	69288ae
fix/issue-59	36463e8
fix/issue-43	35e4069
fix/issue-158	6f76f8a
fix/issue-104	bb00491
fix/issue-55	971ef1b
fix/issue-361	89ac220
fix/issue-120	b458719
fix/issue-36	42bac6e
fix/issue-525	57c97dd
fix/issue-712	e5bcda0
fix/issue-72	6cc63ed

fix/issue-72 and fix/issue-312 conflict on one line in internal/api/handler_dashboard.go (both change the calculateCommitmentMetrics call). The tree used #72's side with #312's validated provider variable; whichever PR merges second takes that same resolution.

Linux, Go 1.26.9, AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true; Docker Postgres via testcontainers:

• Passed at 936996ad: go build ./..., go vet ./..., go vet -tags integration ./... and the full go test -race -short -count=1 ./....
• Static checks at 936996ad: golangci-lint v2.10.1 found 0 issues on every changed package, with and without --build-tags integration. tests/e2e is a separate module, so it was vetted under its own e2e tag. gocyclo -over 10 is silent on the changed non-test files.
• Integration tests, every changed package, one package at a time (-tags integration -count=1, 60-minute local timeout because the VM was shared):
  • At 936996ad, these pass: internal/server, internal/credentials, internal/scheduler, internal/database/postgres/migrations, internal/purchase and internal/api.
  • internal/config passes except TestPostgresStoreDB_ResolveStaleRIExchange_ValidatesCloudCheck, which fails the same way on unmodified main (fixed by fix(config): compare resolve checked_at at the database's microsecond precision #1252).
  • These were run on the first build of this tree (26795376, same branches at earlier heads): internal/analytics, internal/auth, internal/commitmentopts, internal/database and cmd/lambda/clear-rate-limit all pass. The later fixes don't touch those packages.
• What the combined run caught, each fixed on its own branch before this PR opened:
  • a compile break between fix/issue-104's test and fix/issue-326's httpToLambdaRequest signature change;
  • fix/issue-316 rejecting legacy-keyed plans;
  • fix/issue-120 versus main's global-filter test.
• Secrets: git-secrets, using the repo's scripts/setup-git-secrets.sh patterns in a fresh repo with an isolated HOME, found nothing in the changed files, and a planted fake key was flagged. scripts/test-git-secrets-allowlist.sh: 137 PASS, 0 FAIL.
• Nothing was applied to any cloud.

Out of scope

• The Terraform backend bucket name (owner decision, above).
• Frontend fixtures (UI owner, above).
• Git history still contains the ID, including the 48ee47f commit message. Rewriting history isn't proposed.

Maintainer: please mirror the issue's triage labels onto this PR: priority/p2, severity/medium, impact/internal, triaged, urgency/this-quarter, effort/s, type/security.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

Or wait 59 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: 503eb2e
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8548e12d-7015-4612-ac6a-eda495354706

Commits

Reviewing files that changed from the base of the PR and between 503eb2e and 5937286.

Files selected for processing: 1

• known_issues/23_ux_review_2026_04_22.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 5937286c6f98d7a759ecec60c44afdca87382679

Blocking:

• none

Non-blocking:

• In the body's follow-up table and the frontend list, the frontend line numbers are stale. At this head, approval-details.test.ts has the ID at 143, 145, 151, 241, 251, 259 and 293 (not 122/124/130/220/230/238/272), and settings-accounts.test.ts has it at 1284 and 1300 (not 1281/1297). The count of 14 lines is still right. The suggested replace-all per file is unaffected.

Attacked:

• Scope: the one-line doc change swaps 909626172446 for 123456789012 in a UX-evidence quote, and the finding does not depend on the number. "Refs Second non-placeholder AWS account ID 909626172446 (CUDly host) in tracked test fixtures and docs #43" (not Closes) is correct, because the 9 frontend lines and the 4 Terraform lines stay. I confirmed this with git grep -n 909626172446 on origin/main (14 lines) and HEAD (13 lines).
• The Terraform claim holds: terraform/environments/aws/ci-cd-permissions/main.tf:15 is the live backend bucket name, so changing it would detach that root from its state. That is an owner call, not hygiene, and the body says so correctly.
• bash ~/learnercloud/scratchpad/queue/secrets-scan.sh on the changed file printed "clean; planted key flagged". bash scripts/test-git-secrets-allowlist.sh gave 137 PASS, 0 FAIL. Docs only, so there is nothing to build or test and no fail-before applies. markdownlint isn't installed here, and the change is a one-token swap inside an existing line.

Body-stale:

• The frontend line numbers, as above.

_{Reviewer: rB8. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE 5937286c6f98d7a759ecec60c44afdca87382679

Blocking:

• none

Non-blocking:

• This is a partial fix of Second non-placeholder AWS account ID 909626172446 (CUDly host) in tracked test fixtures and docs #43, and the PR correctly says Refs, not Closes. Of the issue's three files, the two frontend tests (9 occurrences) are still open, as is the Terraform backend bucket name. The bucket is an owner decision, as the body says: the ID is part of a real state bucket name, so a placeholder would break terraform init for that root.

Attacked:

• git grep 909626172446 on origin/main finds 14 lines. At the head, 13 remain: 9 frontend and 4 Terraform, which matches the body's table. The replacement 123456789012 is the standard allowlisted placeholder, and the [Self] finding the doc quotes doesn't depend on the number.
• Ran secrets-scan.sh on the changed file ("clean; planted key flagged"), scripts/test-git-secrets-allowlist.sh (137 PASS, 0 FAIL) and git diff --check (clean). PR checks are green. It is a doc-only change, so there is no build or test surface and no fail-before applies.

Body-stale:

• The frontend line numbers in "What is left" and in the follow-up list are from older main. On current main the occurrences are approval-details.test.ts 143, 145, 151, 241, 251, 259 and 293, and settings-accounts.test.ts 1284 and 1300. The counts and files are unchanged.

_{Reviewer: rB12. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at 5937286c6f98d7a759ecec60c44afdca87382679 merged onto main (51957bcf), together with #1100, #1108, #1147, #1149, #1276, #1292 in that order (combined tree bc575de3, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 2 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 2 approving independent review(s) on 5937286c (two required: money, auth or security path), green CI, and the combined-tree verification above. Squash-merged at exactly 5937286c6f98d7a759ecec60c44afdca87382679.