[iscekic]

Summary

• Increase the Bouncer signup timeout from 500 ms to 3,000 ms.
• Reject new-account creation when Bouncer is unavailable or its verdict is invalid.
• Return SIGNUP-UNAVAILABLE with retry guidance instead of an abuse message.
• Return HTTP 503 for native signup failures and release the email-code reservation for retry.
• Increase the inference timeout from 500 ms to 1,000 ms and preserve fail-open behavior.
• Keep existing sign-in, provider linking, and the development bypass unchanged.

Verification

Verified on a disposable Google Cloud VM with real PostgreSQL and local HTTP Bouncer and Stripe fixtures. All credentials were synthetic. Runtime egress was restricted to loopback.

• A verdict delayed by 1,000 ms admitted signup and created exactly one account and Stripe customer.
• A stalled response returned SIGNUP-UNAVAILABLE in 3,013 ms, with no user, provider, or Stripe customer created.
• Retrying the same email succeeded once. A later sign-in created no duplicate account or customer.
• HTTP 503, transport failure, invalid JSON, and unknown verdicts rejected signup without creation side effects.
• Valid quota rejection remained SIGNUP-RATE-LIMITED; report-only verdicts admitted signup.
• Missing or invalid IPs rejected signup without calling Bouncer or Stripe.
• Existing provider linking bypassed unavailable Bouncer. Development kept its admission bypass.
• The actual Next.js sign-in page displayed the retryable error. Baseline and updated screenshots were captured.
• Inference admitted no upstream call when an enforced verdict arrived after 750 ms, across anonymous, free, paid, and team tiers.
• Stalled inference verdicts failed open after 1,002 ms and reached a local upstream, across all four tiers.
• Inference HTTP errors, unknown verdicts, slow response bodies, and transport failures still failed open.
• The standalone inference smoke used real admission helpers and HTTP fixtures, with request-scope and telemetry shims only.
• Both verification VMs, their boot disks, the tunnel, and temporary source archives were removed.

Baseline reproduction: stalled or delayed Bouncer responses created accounts after the old 500 ms timeout. A malformed verdict also created an account.

Visual Changes

Before/after screenshots are attached in the verification comment. No image files are committed.

Reviewer Notes

• Signup now requires a usable IP and a valid admission verdict outside development. Missing configuration also fails closed.
• Native email-code retries remain possible because settlement failures release the reservation before returning HTTP 503.
• The signup test run passed: 5 suites, 326 tests. An isolated bundled inference suite passed all 13 tests. Changed-file lint passed.
• This change does not alter Bouncer enforcement settings or inference failure behavior.

[iscekic]

Verified the actual Next.js sign-in page on the disposable verification VM. Before: generic auth error. After: signup-unavailable error with retry guidance. Screenshots contain only synthetic local data.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of the bouncer timeout test adjustment found no issues; the change only replaces a pinned { timeoutMs: 500 } assertion with expect.anything() so the gateway tests no longer couple to the incidental admission timeout value.

Files Reviewed (1 file)

• packages/web-shared/src/lib/ai-gateway/handlers/llm-proxy.test.ts

Previous Review Summaries (2 snapshots, latest commit 2a200bf)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 2a200bf)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of the Bouncer fail-closed follow-up (timeout constants and the signup rejection-reason fix) found no remaining issues; the earlier rejection-reason misattribution is now fixed.

Files Reviewed (3 files)

• ENVIRONMENT.md
• apps/web/src/lib/user/index.ts
• packages/web-shared/src/lib/bouncer/inference.ts

Previous review (commit aadb99c)

Status: 1 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
apps/web/src/lib/user/index.ts	611	The verdict === null rejection always logs reason: 'bouncer_unavailable', but that branch also runs when bouncerIp is undefined (no usable signup IP), misattributing the cause during incident triage.

Files Reviewed (12 files)

• ENVIRONMENT.md
• apps/web/src/app/api/auth/native/token/route.test.ts
• apps/web/src/app/api/auth/native/token/route.ts
• apps/web/src/components/auth/AuthErrorNotification.tsx
• apps/web/src/hooks/useSignInFlow.ts
• apps/web/src/lib/user/anaconda-auth.test.ts
• apps/web/src/lib/user/index.test.ts
• apps/web/src/lib/user/index.ts - 1 issue
• apps/web/src/lib/user/sso.ts
• packages/web-shared/src/lib/auth/constants.ts
• packages/web-shared/src/lib/bouncer/client.test.ts
• packages/web-shared/src/lib/bouncer/client.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by deepseek-v4.1-flash · Input: 31.1K · Output: 3.1K · Cached: 240.3K}

_{Review guidance: REVIEW.md from base branch main}