[HemSoft]

Risk level: 4/10 (codexbar)
Worked on by: gpt-6.1-sol on Home, for Franz.

Closes #331.

Codex, Claude and Cursor accepted a provider percentage of -25 as a successful
0% reading. Reject negative percentages before collecting quota windows, keeping
valid siblings and Claude's structured-to-flat and weekly alias fallbacks.
All-invalid responses follow each parser's existing error path. Genuine zero and
the existing upper clamp remain compatible.

Validation

• Nine synthetic public-parser regressions: eight failed before the fix while
  the compatibility control passed; all nine passed after the fix.
• The combined tree with patched main passed the required local hook:
  cargo fmt --all --check, workspace Clippy with --locked -- -D warnings,
  and cargo test --workspace --locked (1,123 passed, six ignored, native fixture passed).
• Prerequisite PR334 merged normally at
  953579f after all seven CI and all three
  Package jobs passed. Mini and Home main were fast-forwarded to that revision
  with tracked-clean guards and the preexisting audit bytes preserved.
• Current head eea3858 includes that main merge
  without conflicts. All four parser/test blobs are identical to the original
  reviewed head 56f51ce.
• Authenticated SFL Round 1 PASS is reused under the
  charter's conflict-free main-update rule. No duplicate review was requested.
• All seven checks in current CI43090442975 passed. The
  prerequisite's main CI43089937291 also passed.
• Fresh review provenance and complete edit history show the SFL PASS remains
  unedited, with zero unresolved threads. Effective rules require no formal
  approval and preserve all seven strict checks without bypass actors.
  gh x status --refresh reports checks pass and AI - for the new commit ID;
  the documented main-update PASS reuse rule supplies review consent without
  manufacturing a current-SHA bot verdict.

Council: not required for bounded parser validation. Owner remains
chief-dispatch-8fcc69c4-codexbar-parser through review, checks, guarded merge,
main CI, actual source sync, cleanup and exact release. All validation used
synthetic inputs; no provider request, credential access, application or browser
launch occurred. Existing branches, worktrees and audit bytes remain retained.

[HemSoft]

@sfl review

[hemsoft-sfl-reviewer]

✅ Verdict: PASS • Round 1

Confidence: 9/10 · Project risk: 4/10 (codexbar)

Review done by claude-opus-5-5 (adversarial to codex)

The PR filters out negative usage percentages in the Codex, Claude (structured and flat) and Cursor parsers before they are clamped into windows. Responses with only invalid windows now return each parser's existing error, and new public-parser tests cover issue #331's acceptance criteria. I found no evidenced defect: each filter sits before the existing clamp, Claude's dedupe and fallback order now skip an invalid entry instead of being blocked by it, and zero and over-limit handling is unchanged.

🔨 Full-Spectrum Review Summary

Effort: high
Review time: 1m 13s
Token count: Unavailable

Pass	🔴 Critical	🟠 High	🟡 Medium	⚪ Low
🔒 Security	0	0	0	0
✅ Accuracy	0	0	0	0
🧰 Quality & Maintainability	0	0	0	0
Total	0	0	0	0

Key Findings

No material defects found.

Coverage

• Files reviewed:
  • crates/codexbar-providers/src/claude.rs
  • crates/codexbar-providers/src/codex.rs
  • crates/codexbar-providers/src/cursor.rs
  • crates/codexbar-providers/tests/usage_percentage.rs
• Context read:
  • crates/codexbar-providers/src/lib.rs
  • crates/codexbar-providers/Cargo.toml
  • Cargo.toml
  • crates/codexbar-core/src/lib.rs
  • crates/codexbar-core/src/account.rs
  • crates/codexbar-core/src/metric.rs
  • crates/codexbar-providers/tests/claude_quota_reset.rs
• Verified:
  • gh api user returned HemSoft under the per-process personal profile
  • Compare base_commit.sha is 899bf3fe7c589ce45ca7ca96c9684d43e1f956d1, the last commit is 56f51ce12c41ca43e056edb1e0abb208936cadbb, ahead 1 and behind 0
  • PR #332's API head and base match the reserved SHAs
  • Codex Window::from_json filter runs before the /100 clamp; parse_usage still errors with "no usage windows for this account" when every window is dropped
  • Claude's structured loop rejects a negative percent before the label dedupe, so a valid flat five_hour can still fill the session slot
  • Claude flat find_map falls through from a negative seven_day to seven_day_oauth_apps
  • Cursor filter_map drops a negative field, keeps its siblings and keeps the "no usage percentages" error when all are dropped
  • -0.0 >= 0.0 holds, so a JSON negative zero is still read as a genuine zero
  • The integration test uses only public items: claude/codex/cursor modules, parse_usage signatures, AccountSnapshot::metrics/messages, Metric::label/used_fraction
  • Expected labels in the tests (Weekly, 5-hour window, Auto, API) and the Claude session note text match the exact-SHA source
  • Workspace clippy lints are all = warn only, and existing integration tests already use unwrap
• Not verified:
  • Runtime and test results: the PR's claims of passing tests and gates were not reproduced because execution is forbidden
  • Whether the app keeps a previous good snapshot when a parser now returns Err: dashboard code outside the diff was not read
  • Other providers (Gemini, Copilot, Grok, OpenCode) were not checked for the same negative-percentage pattern; they are outside issue #331's scope
  • CI check status for the head was not read
• Tests run: None. Reviewer execution is disabled.

---

HemSoft full-spectrum review • 3 evidence-based passes • Reviewed head 56f51ce12c41ca43e056edb1e0abb208936cadbb • SFL v0