fix(ladder): select registered accounts for configuration

[cristim]

The ladder configuration modal now selects an account from the registered accounts list and submits its internal account ID. Provider changes clear incompatible choices, and empty, forbidden, loading, or invalid selections prevent saving.

This fixes the account input in the ladder configuration editor. It does not close #631 or claim that the full ladder feature is complete.

Independent two-pass review found no actionable findings at 4745d54. Review covered account/provider validation, permissions, hostile labels, immutable edit identity, modal lifetime, and late responses.

Exact-SHA local verification on macOS: Jest 25/25, fresh production webpack build passed, and headless Chromium production-bundle browser tests 6/6 at desktop and mobile widths. Removing the provider-pair check caused the injected mismatched-account test to fail. Browser API/auth responses were mocked; this is fixture evidence, with no cloud calls, purchases, or live configuration writes.

Summary by CodeRabbit

• New Features
  • Commitment Ladder configuration now uses a selector of registered cloud accounts instead of manual account ID entry. Options are filtered by provider, and new configurations can be saved only after choosing an available account.
  • Existing configurations retain their saved account and provider, which remain locked during editing. If account details cannot be loaded, the saved selection is preserved and a warning is shown.
  • Account selection remains protected by update permissions, and account names are displayed as text.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 65ee7e13-5acd-4f2a-9e22-e75d71b44aed

📥 Commits

Reviewing files that changed from the base of the PR and between 8cfa983 and 4745d54.

📒 Files selected for processing: 5

• frontend/src/__tests__/ladder.test.ts
• frontend/src/ladder-account-selector.ts
• frontend/src/ladder.ts
• frontend/tests-e2e/ladder-account-selector.spec.ts
• frontend/tests-e2e/ladder-config.spec.ts

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📝 Walkthrough

The ladder configuration modal replaces manual cloud account ID entry with a registered-account selector. The selector filters accounts by provider, preserves saved identities during edits, and supplies the identity used when saving. Unit and end-to-end tests cover selection, loading, permissions, and save behavior.

Changes: Commitment Ladder account selection

Layer / File(s)	Summary
Load and select registered accounts frontend/src/ladder-account-selector.ts, frontend/src/ladder.ts, frontend/src/__tests__/ladder.test.ts, frontend/tests-e2e/ladder-account-selector.spec.ts	The modal loads registered accounts and filters options by provider. Tests cover provider changes, loading and stale responses, and account selection.
Save selected account identity frontend/src/ladder.ts, frontend/src/__tests__/ladder.test.ts, frontend/tests-e2e/ladder-account-selector.spec.ts, frontend/tests-e2e/ladder-config.spec.ts	Saving requires update permission and a selected account identity. Edit tests check that saved identities remain unchanged when account lists are unavailable. End-to-end tests check saved IDs and disabled identity controls.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant LadderModal
  participant AccountSelector
  participant AccountListAPI
  participant UpsertAPI
  User->>LadderModal: Open configuration
  LadderModal->>AccountSelector: Initialize selector
  AccountSelector->>AccountListAPI: Request registered accounts
  AccountListAPI-->>AccountSelector: Return account list
  AccountSelector-->>LadderModal: Provide selected account identity
  User->>LadderModal: Save configuration
  LadderModal->>UpsertAPI: Submit configuration with selected identity

Loading

Merge Risk: ⚪ Minimal · up to 4745d

The account selector and save path appear ready to merge after normal checks. No actionable risk was established in the changed behavior.

Pre-merge checks: 3 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Linked Issues check		Issue [#631] is open and directly linked. The PR implements registered-account selection for the ladder configuration modal, including provider filtering, internal account IDs, validation, and tests. …	Implement the applicable #631 plan execution and preview requirements, including regression tests using the real plan data shape, or link this account-selector change to a narrower active issue that contains its coding requirements.
Docstring Coverage		Docstring coverage is 55.56% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 3 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: replacing manual ladder account input with registered account selection.
Out of Scope Changes check		The changed source and test files remain focused on ladder configuration account selection. Provider filtering, registered-account validation, edit identity preservation, permission checks, loading/er…

Full details: Linked Issues check

Explanation

Issue [#631] is open and directly linked. The PR implements registered-account selection for the ladder configuration modal, including provider filtering, internal account IDs, validation, and tests. It does not implement #631's required plan-step resolution, ramp sizing, real count/resource/cost/savings preview, execution against recommendations, stored execution snapshot, or failed-empty-step regression behavior. The PR description confirms that it does not claim completion of the full ladder feature.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent cold verification, 2026-10-14. Reviewer: gpt-6.1-sol, medium.

Ladder verdict: READY for publication review at exact SHA 4745d54. No actionable findings in two adversarial passes.
Pass 1: traced minimal authorized account projection, update/config permission and server-side account/provider constraints through selector and upsert payload. Compared endpoint contracts in internal/api/handler_accounts.go:143 and internal/api/handler_ladder.go:88,152. Attacked injected unknown/provider-mismatched options, registered internal IDs versus external identifiers, hostile labels, immutable edit identity, list403, empty/loading lists and permission loss. Safe text uses Option/textContent; list carries no credential/config metadata.
Pass 2: traced modal clone, selector closures and save guard; attacked provider changes during pending load and a closed/reopened modal late response. Captured nodes remain attached only to old form, current selection closure stays current. Rechecked scope and full changed tests.
Exact git-archive snapshot verification: Jest25/25; fresh production webpack build0; headless Chromium productiondist browser6/6 on isolated4451, including1280px and390px create/editor cases. Browser tests capture fixture PUT payloads, assert only ladder config write, and distinguish intentional403 list responses. Mutation deleting provider-pair check made injected azure-id test fail on unexpected upsert. Scratch source restored byte-identical to committed file. Source worktree remains clean at exact SHA.

Limits: auth/API responses mocked; no real backend/account/customer scenario, live configuration saves, cloud calls or purchases. Local source snapshots match the exact committed head.

[cristim]

CodeRabbit completed review of 4745d54 with no actionable comments and no inline findings. Its linked-issue warning is acknowledged: this PR is the separately authorized account-selector fix and explicitly does not close the broader ladder issue; plan execution and preview work remains with its existing owner. The docstring coverage suggestion is declined under the repository rule to add comments only where code cannot express the reason. The focused selector and tests are covered by the independent review and verification recorded above. No source change or new scope is introduced.

[cristim]

Final gate at 4745d54: independent two-pass review and exact-SHA macOS fixture browser/mutation evidence are recorded above. All four workflows completed successfully: frontend build 38602704441, frontend E2E 38602704728, pre-commit 38602704490, build/test 38602704445. CodeRabbit exact-head review has no actionable or inline findings; its scope/comment warnings have written responses. GitHub reports CLEAN and MERGEABLE; required CI Success and Run pre-commit hooks protections remain enforced. Proceeding with the owner-authorized normal exact-head squash merge. Live browser recheck remains with the operational root; no live save or purchase is authorized.

[cristim]

Post-merge verification: normal merge commit 970de3d has SUCCESS conclusions for all five triggered workflows: build/test 38605057003, frontend E2E 38605057043, frontend sentinel 38605057067, pre-commit 38605057020, and AWS deployment 38605057015. The conclusions were verified through each exact workflow run’s GraphQL CheckSuite after the REST Actions API reported a rate limit; monitor API failures were not treated as CI failures. The next UI fix has also merged, and root retains the read-only live browser recheck of the latest deployment. Source worktrees are preserved for the owner; no configuration save or purchase was performed.