Merge pull request #49 from runcycles/claude/admin-tenant-update-endpoint-iTR5Q

Add tenant-level configuration for reservation policies and TTL

Author: amavashev

AUDIT.md

@@ -25,6 +25,7 @@
 | Overdraft/Debt Model | — | 0 |
 | Grace Period Handling | — | 0 |
 | Test Coverage | — | 0 |
+| Tenant Default Config | — | 0 |
 
 **All previously identified issues have been fixed. No remaining spec violations found.**
 
@@ -149,15 +150,33 @@ Two-pass audit covering:
 ### Test Coverage (above 98%)
 - JaCoCo line coverage threshold raised from 90% to **95%** (enforced in parent pom.xml)
 - **API module**: 209/209 lines covered — **100%** line coverage (93 unit tests)
-- **Data module**: 770/782 lines covered — **98.5%** line coverage, 76% branch coverage (205 unit tests)
+- **Data module**: 770+ lines covered — **98.5%+** line coverage, 76%+ branch coverage (215 unit tests)
   - Branch gaps: defensive null-check ternaries and unreachable `&&` short-circuit branches in `RedisReservationRepository`
+  - Tenant default resolution: 10 unit tests covering all fallback paths, TTL capping, max extensions, malformed JSON recovery
 - **Model module**: Coverage skipped (POJOs only, no business logic)
-- Total unit test count: 93 (API) + 205 (Data) + 5 (Model) = **303 unit tests**
-- **Integration tests**: 26 nested test classes covering all 9 endpoints, including:
+- Total unit test count: 93 (API) + 215 (Data) + 5 (Model) = **313 unit tests**
+- **Integration tests**: 27+ nested test classes covering all 9 endpoints, including:
+  - Tenant Defaults (9 tests): overage policy resolution (ALLOW_IF_AVAILABLE, ALLOW_WITH_OVERDRAFT, REJECT), explicit override vs tenant default, TTL capping, max extensions enforcement, default TTL usage, no-tenant-record fallback
   - Expiry Sweep (7 tests): end-to-end expire.lua execution, grace period skip, orphan TTL cleanup, multi-scope budget release, already-finalized skip
   - Budget Status (2 tests): BUDGET_FROZEN and BUDGET_CLOSED enforcement on reserve
 - All unit tests pass without Docker/Testcontainers (integration tests excluded by default)
 
+### Tenant Default Configuration (correct)
+- `default_commit_overage_policy`: resolved at reservation/event creation time
+  - Resolution order: request-level `overage_policy` > tenant `default_commit_overage_policy` > hardcoded `REJECT`
+  - Tenant config read from Redis `tenant:{tenant_id}` JSON record (shared with admin service)
+  - Graceful fallback to `REJECT` on tenant read failure or missing record
+- `default_reservation_ttl_ms`: used when request omits `ttl_ms` (was hardcoded to 60000ms)
+  - Resolution order: request `ttl_ms` > tenant `default_reservation_ttl_ms` > hardcoded 60000ms
+- `max_reservation_ttl_ms`: caps requested TTL to tenant maximum (default 3600000ms)
+  - Applied after default resolution: `Math.min(effectiveTtl, maxTtl)`
+- `max_reservation_extensions`: stored on reservation at creation, enforced in extend.lua
+  - `extension_count` tracked and incremented atomically in extend.lua
+  - Returns `MAX_EXTENSIONS_EXCEEDED` (HTTP 409) when count reaches max
+  - Default: 10 (spec default)
+- Request model fields (`overagePolicy`, `ttlMs`) changed from hardcoded defaults to `null`
+  to allow tenant config resolution when client omits them
+
 ### Overdraft/Debt Model (correct)
 - `ALLOW_WITH_OVERDRAFT` policy supported on both commit and event
 - Debt tracked per-scope, `is_over_limit` flag set when `debt > overdraft_limit`
@@ -199,6 +218,19 @@ Two-pass audit covering:
 - **Fix:** Added LIMIT of 1000 per sweep cycle via `zrangeByScore(key, 0, now, 0, SWEEP_BATCH_SIZE)` — backlog drains naturally across subsequent sweeps
 - **Location:** `ReservationExpiryService.java:31,45`
 
+### Issue 8 [FIXED]: Tenant default configuration not honored by protocol server
+- **Was:** `default_commit_overage_policy`, `default_reservation_ttl_ms`, `max_reservation_ttl_ms`, and `max_reservation_extensions` were set via admin API but ignored by the protocol server. The request models hardcoded `overagePolicy = REJECT` and `ttlMs = 60000L` as field defaults, so when clients omitted these fields they always got hardcoded values — never the tenant's configured defaults.
+- **Fix:**
+  1. Removed hardcoded defaults from `ReservationCreateRequest.overagePolicy` (was `REJECT`), `ReservationCreateRequest.ttlMs` (was `60000L`), and `EventCreateRequest.overagePolicy` (was `REJECT`) — now `null` when omitted
+  2. Added `getTenantConfig()` to read tenant JSON from `tenant:{id}` Redis key
+  3. Added `resolveOveragePolicy()`: request > tenant `default_commit_overage_policy` > `REJECT`
+  4. Added `resolveReservationTtl()`: request > tenant `default_reservation_ttl_ms` > 60000ms, then `Math.min(ttl, max_reservation_ttl_ms)`
+  5. Added `resolveMaxExtensions()`: reads tenant `max_reservation_extensions` (default 10), stored on reservation, enforced in extend.lua
+  6. extend.lua: tracks `extension_count`, returns `MAX_EXTENSIONS_EXCEEDED` when limit reached
+  7. reserve.lua: accepts `max_extensions` as ARGV[14], stores on reservation hash
+  8. Added `MAX_EXTENSIONS_EXCEEDED` error code (HTTP 409)
+- **Location:** `RedisReservationRepository.java`, `ReservationCreateRequest.java`, `EventCreateRequest.java`, `reserve.lua`, `extend.lua`, `Enums.java`
+
 ### Issue 7 [FIXED]: Clock skew between Java and Redis in expiry sweep candidate query
 - **Was:** Java `System.currentTimeMillis()` used for the `zrangeByScore` query; all Lua scripts use `redis.call('TIME')` — clock drift could cause missed or premature candidate selection
 - **Fix:** Replaced with `jedis.time()` to use Redis server clock, consistent with reserve/commit/release/extend/expire Lua scripts

cycles-protocol-service/README.md

@@ -154,6 +154,8 @@ Beyond expires_at_ms:                  extend blocked (410)
 
 The same three policies apply to `/v1/events` for direct debits.
 
+When `overage_policy` is omitted from the request, the server resolves it from the tenant's `default_commit_overage_policy` (set via the Admin API). If the tenant has no default configured, `REJECT` is used.
+
 ### Debt and Overdraft
 
 - If `overdraft_limit` is absent or `0`, no overdraft is permitted (`ALLOW_WITH_OVERDRAFT` behaves as `ALLOW_IF_AVAILABLE`).
@@ -304,9 +306,9 @@ Reserve budget before executing an action. Returns `200 OK`.
 | `action.tags` | no | — | max 10 items, each max 64 chars |
 | `estimate.unit` | yes | — | see Units |
 | `estimate.amount` | yes | — | ≥ 0 |
-| `ttl_ms` | no | `60000` | 1000–86400000 ms |
+| `ttl_ms` | no | tenant `default_reservation_ttl_ms` or `60000` | 1000–86400000 ms; capped to tenant `max_reservation_ttl_ms` |
 | `grace_period_ms` | no | `5000` | 0–60000 ms |
-| `overage_policy` | no | `REJECT` | see Overage Policies |
+| `overage_policy` | no | tenant `default_commit_overage_policy` or `REJECT` | see Overage Policies |
 | `dry_run` | no | `false` | evaluates without persisting if true |
 
 **Response** `200 OK`
@@ -430,7 +432,7 @@ Extend the reservation TTL. Only allowed while `server_time ≤ expires_at_ms` (
 
 `extend_by_ms` is added to the current `expires_at_ms` (not to request time). Does not change reserved amount, unit, subject, action, or scope.
 
-**Error conditions:** `409 RESERVATION_FINALIZED` if the reservation is already COMMITTED or RELEASED; `410 RESERVATION_EXPIRED` if `server_time > expires_at_ms`; `404 NOT_FOUND` if the reservation does not exist.
+**Error conditions:** `409 RESERVATION_FINALIZED` if the reservation is already COMMITTED or RELEASED; `410 RESERVATION_EXPIRED` if `server_time > expires_at_ms`; `409 MAX_EXTENSIONS_EXCEEDED` if the tenant's `max_reservation_extensions` limit has been reached; `404 NOT_FOUND` if the reservation does not exist.
 
 ---
 

cycles-protocol-service/cycles-protocol-service-api/src/test/java/io/runcycles/protocol/api/BaseIntegrationTest.java

@@ -211,6 +211,23 @@ protected String createReservationAndGetId(String tenant, String apiKey, long am
         return (String) response.getBody().get("reservation_id");
     }
 
+    /**
+     * Seed a tenant record in Redis with configurable defaults.
+     */
+    protected void seedTenant(Jedis jedis, String tenantId, String overagePolicy,
+                               Long defaultTtlMs, Long maxTtlMs, Integer maxExtensions) throws Exception {
+        Map<String, Object> tenant = new HashMap<>();
+        tenant.put("tenant_id", tenantId);
+        tenant.put("name", tenantId);
+        tenant.put("status", "ACTIVE");
+        tenant.put("created_at", Instant.now().toString());
+        if (overagePolicy != null) tenant.put("default_commit_overage_policy", overagePolicy);
+        if (defaultTtlMs != null) tenant.put("default_reservation_ttl_ms", defaultTtlMs);
+        if (maxTtlMs != null) tenant.put("max_reservation_ttl_ms", maxTtlMs);
+        if (maxExtensions != null) tenant.put("max_reservation_extensions", maxExtensions);
+        jedis.set("tenant:" + tenantId, objectMapper.writeValueAsString(tenant));
+    }
+
     /**
      * Seed a budget at an arbitrary scope path (e.g. "tenant:tenant-a/workspace:default/agent:my-agent").
      */