Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

The change switches gateway spend-limit coordination from shadow to enforce, bounds coordinator waits, and uses the legacy key-limit check when the coordinator is unavailable. It updates department-budget alerts and revises dashboard, API, SDK, Terraform, and localized documentation for request blocking and its exceptions.

Changes: Department Budget Enforcement

Layer / File(s)	Summary
Bound coordinator decisions apps/api/src/core/spend-limits.ts, apps/api/src/core/spend-limits.test.ts	Coordinator decisions now have a 2,000 ms wait. A timeout returns spend_limit_timeout; tests verify the timeout, late admission release, and the following request.
Enable enforcement and update alerts apps/api/wrangler*.toml, supabase/migrations/*department_budgets_block_requests.sql, supabase/schemas/public/functions/sweep_department_budget_alerts.sql, supabase/schemas/public/tables/workspace_department_budgets.sql, supabase/tests/department-spend-budgets.test.mjs, apps/api/src/pipeline/notifications/spend-limit-alerts.ts, apps/api/src/routes/v1/control/department-budgets.ts, apps/web/src/app/.../settings/budgets/actions.ts, .changeset/department-budgets-block.md	Worker configurations switch coordinator mode from shadow to enforce. The migration defines the department-budget alert sweep and notification content; tests check the migration and alert text. Supporting comments describe enforcement, reseeding, and alert timing.
Update budget settings copy apps/web/src/components/(gateway)/settings/budgets/DepartmentBudgetsSection.tsx, apps/web/src/lib/fetchers/internal/settingsTypes.ts, apps/web/messages/*/settings-ui.json	Settings descriptions and translations state that eligible API-key requests are rejected when budgets are exhausted, identify excluded request types, retain alert thresholds, and describe deletion effects.
Update API and integration documentation apps/docs/openapi/*, apps/docs/*/openapi/v1/openapi.localized.yaml, apps/docs/v1/api-reference/limits.mdx, apps/docs/*/v1/api-reference/limits.mdx, apps/docs/openapi/localized-copy.json, apps/docs/translation-status.json, packages/sdk/sdk-ts/src/oapi-gen/client/default.ts, packages/integrations/terraform-provider-phaseo/{docs/resources/department_budget.md,internal/provider/resource_department_budget.go}	OpenAPI descriptions, API references, SDK documentation, and Terraform descriptions now cover rejection responses, exclusions, reset behavior, alerts, and budget deletion. Translation checksums are updated for the revised localized documentation.

Priority: Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Request as API-key request
  participant Coordinator as Spend-limit coordinator
  participant Legacy as Legacy key-limit check
  Request->>Coordinator: Request spend-limit decision
  Coordinator-->>Request: Enforce decision or unavailable timeout
  Request->>Legacy: Check limit if coordinator is unavailable
  Legacy-->>Request: Fallback decision

Possibly related PRs

• phaseoteam/Phaseo#3208: Introduces department-budget management and the settings UI whose enforcement behavior this change updates.
• phaseoteam/Phaseo#3343: Adds an integration key with a monthly spend limit governed by API-key spend-limit enforcement.
• phaseoteam/Phaseo#3243: Adds workload-identity authentication that uses API-key-shaped results and references the shared limits and budgets behavior.

Merge Risk: Moderate · previous review 6b815

Enabling department budget blocking has edge cases when the budget check times out: spend can briefly exceed a budget, or a budget can reject requests slightly early. The API contract also understates how long Retry-After can be. Resolve the lease and double-count handling before relying on budgets as a strict cap; the other findings are documentation and copy fixes.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: department budgets now reject API-key requests after the budget is exhausted.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 9 files. (40 skipped: 39 unsupported, 1 too large.)

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• (https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)
• Mastodon
• Reddit
• LinkedIn