[freeqaz-openai]

Five call sites now share the same start: wait for the revision’s deployment work to succeed, request withdrawal of its Harness credential source, and read the first durable withdrawal work item. The helper does not wait for withdrawal to finish. Each test still controls its timing and checks its own outcome.

All 36 tests passed before and after on disposable PostgreSQL, with simulated gateway responses. Making a temporary refusal permanent broke the retry-to-success test while the permanent-refusal test still passed. No production code changed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR extracts the deployment wait, Harness withdrawal request, and first work-item lookup into one helper used at five test sites.

Example: A withdrawal encounters one transient authentication refusal with maxAttempts set to 2.

• Before: The test repeats deployment waiting, withdrawal admission, and work lookup before asserting success on attempt 2.
• After: The shared helper performs the same setup, while the test retains its attempt-count, revocation, and event assertions.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A correct, useful test refactor supported by PostgreSQL harness validation; execution detail is limited to the author's report and check results.
Proof confidence	🦐 gold shrimp (3/6)	This collaborator-authored test-only refactor has no changed shipped behavior requiring separate runtime proof; reported PostgreSQL runs and successful exact-head checks support the preserved integration scenarios.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Test only · Worth it: Yes · Fix scope: Complete
Reason: The collaborator-authored direction is established, and the focused extraction reduces repetition while retaining independently meaningful failure scenarios.

Merge readiness

✅ Ready for maintainer review

Keep open: this collaborator-authored PR makes a focused test refactor, preserves scenario behavior, and has no actionable defects identified.

Priority: P3
Reviewed head: f3a6cb1dd40cbdc516ff3ad9ceb3e9d34e068521

Before merge

None.

Findings

None.

Agent review details

How this fits together

The PostgreSQL integration suite exercises OCC admission and the durable revision worker using synthetic credential sources and simulated Compute responses; it observes persisted work, withdrawal status, and audit events.

flowchart LR
  A[Test scenario] --> B[Shared withdrawal setup]
  B --> C[OCC withdrawal admission]
  C --> D[PostgreSQL work queue]
  D --> E[Revision worker]
  E --> F[Simulated Compute response]
  E --> G[Persisted outcomes and assertions]

Loading

Technical review

Best possible solution:

Retain the file-local helper with scenario-specific fault injection, timing, and outcome assertions in each test.

Do we have a high-confidence way to reproduce the issue?

This PR addresses repeated test setup rather than a product bug; the repetition and equivalent extraction are directly verifiable in the pinned diff.

Is this the best way to solve the issue?

The extraction is appropriately scoped: it reuses existing admission and work-query helpers, preserves their order and inputs, and leaves consequential assertions visible in each scenario.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cd3e5ef7c6d4.

Provenance checked

• Source-bound withdrawal requests, reads, and replays keeps the original intent (cc14939: Keep every withdrawal attached to its requested Agent and credential source while explicitly identifying each acting principal.)
• Credential-source scenario placement and deployment waiting keeps the original intent (f890b9d: Split credential-source cases from the growing revision-worker file; this commit carried existing scenario lines rather than proving their original introduction.)
• Transient and permanent authentication-refusal coverage keeps the original intent (3bdfcb1: Protect retry-to-success and attempt-budget exhaustion for transient gateway refusals while preserving immediate failure for permanent refusals.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Behavior-preserving introduced diff: All five replacements preserve the original awaited operations and arguments. The helper returns the withdrawal handle and first durable attempt without waiting for withdrawal completion; scenario-specific timing and assertions remain outside it. (tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs:1351, f3a6cb1dd40c)
• Current-main comparison: The touched file is identical between the pinned base and fetched main, so the repeated setup remains on main and this extraction is distinct work. (tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs, cd3e5ef7c6d4)
• Source-bound withdrawal provenance: The merged discussion at Keep credential withdrawal tests bound to the source they requested #2774 explains binding each withdrawal to its Agent and source while naming principals for reads and replays; this PR retains that owner and those explicit calls. (tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs:1341, cc14939ce187)
• Exact-head validation: PostgreSQL Application, Static Checks, and CI Required succeeded for the reviewed head. The body reports 36 passing cases before and after plus a transient-refusal mutation check. Detailed job logs could not be inspected because their redirected storage host was blocked; no local tests were run. (f3a6cb1dd40c)
• Applicable policy and clean checkout: Read the full root AGENTS.md; no nested AGENTS.md files were found under tests, and no maintainer-notes directory or pr-simplify skill exists. Applied the test-audit and enterprise-testing guidance subject to the read-only review restriction; final git status was clean. (AGENTS.md, f3a6cb1dd40c)
• Feature-history ownership: History across the current credential-source file and its earlier revision-worker file shows Free Wortley carrying the split, withdrawal helpers, source-bound handles, retry coverage, and recent setup refactors. Some older blobs were unavailable, limiting introduction tracing without affecting the verified diff. (tests/integration/postgres-worker-agent-revision-credential-sources.test.mjs, cd3e5ef7c6d4)

Review metrics

Metric	Value	Why it matters
Change size	Production 0 LOC; tests +29/-48; net -19	One local helper replaces repeated setup without adding tests, dependencies, or production machinery.

Labels

Label changes:

• add P3: This is a low-risk integration-test cleanup with unchanged product behavior.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is a low-risk integration-test cleanup with unchanged product behavior.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 18, 2026, 3:32 AM ET / 07:32 UTC.