[cristim]

Part of #1746 (slice A). This is the first of two stacked PRs; the second, A6a and A6b (show bound groups and bound_count in plan responses), follows when a slot frees.

Builds on #1774 (bound plan validation, merged).

What

• A2+A3: resolve a bound group from its selected recommendations (internal/planstep).

  • DerivePlanServices drops a bound entry's #<group_id> suffix, so the arming checks and grant constraints see ec2 for aws/ec2#g1.
  • resolveService keeps only the group's own bound identities from the strict read, before the existing plan-match, suppression and account checks. A matching recommendation that wasn't selected is never bought and never enters the frozen baseline.
  • Bound identities the strict read didn't return come back as Result.MissingBound and are logged at warn level. If some are missing, the rest are sized; if all are missing, the existing ErrNoMatch grace path runs.
  • On a bound plan, planServiceOf matches a baselined identity to the enabled group that bound it, so targetMet judges each group against its own coverage, including groups that differ only in payment. Unmarked plans keep today's first-entry match, with a regression test for the payment split.

• A5: re-check the arming grant when a bound plan's groups widen (internal/api). When the stored or new plan carries the bound_groups marker, these writes to an armed plan count as escalations, so the execute:purchases grant constraints are checked again:

  • a new group;
  • a bound set that isn't a subset of the old one;
  • a group cap raised or removed;
  • a group's term or payment changing;
  • a disabled group re-enabled;
  • the marker removed.

  Unmarked plans keep today's rules exactly, and a guard test pins that.

Tests

Unit tests for each rule above, including the unmarked-plan guards. The two feature commits ran every pre-commit hook available when they were written (cfn-lint was skipped by name before #1781; no CloudFormation is touched). The third commit (a gocritic rangeValCopy fix found after the rebase) ran every hook.

Verification

Local, macOS, on the branch rebased onto main 71b5e29:

• go build ./... OK.
• go test -p 2 on internal/planstep, internal/api, internal/purchase and internal/config: all pass.
• golangci-lint v2.10.1 on ./...: 0 issues.

This touches no money-moving call: A2+A3 narrow which recommendations a bound group may size, and A5 only adds escalation cases to the existing grant re-check. Integration suites run in CI.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: feat/1746-bound-groups-a
• File: .coderabbit.yaml
• Commit: fea2b01
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4efad1df-679c-46f8-beef-c9ed5410ddc5

Commits

Reviewing files that changed from the base of the PR and between 71b5e29 and fea2b01.

Files selected for processing: 7

• internal/api/auto_purchase_bound_escalation.go
• internal/api/auto_purchase_bound_escalation_test.go
• internal/api/auto_purchase_grant.go
• internal/config/purchase_plan_providers.go
• internal/config/purchase_plan_services_bound_test.go
• internal/planstep/bound_resolve_test.go
• internal/planstep/resolve.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn