perf(organizations): use replicas for selected policy reads

[chrarnoldus]

Summary

• keep organization group-policy reads strongly consistent on primary by default
• add an explicit consistency: "eventual" option preserving repeatable-read, read-only transactions on readDb
• opt the latency-sensitive global chat route into replica-backed policy snapshots
• opt model catalogs, organization defaults, and preference presentation reads into the replica
• keep mutation-time pool/default validation, Slack filtering, and integration model updates on primary
• cover primary-default behavior and explicit replica selection at helper and chat-route levels

Consistency

Eventual consumers can observe normal replica lag but receive an internally consistent repeatable-read snapshot. This is acceptable for chat authorization because policy changes are human-driven and a short propagation delay is tolerated in exchange for lower global-route latency. readDb falls back to primary where no replica is configured.

Validation

• pnpm --filter web typecheck
• focused chat/helper Jest suites: 2 passed, 27 tests
• broader consistency review suites: 5 passed, 89 tests
• changed-file oxlint: 0 warnings, 0 errors
• pnpm format
• git diff --check

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The new commit opts the global chat route's inference-time policy read into replica-backed snapshots via consistency: 'eventual' — a read-only authorization path with no same-request read-after-write dependency, matching the PR's documented lag trade-off and falling back to primary where no replica exists — and the added test assertion pins the exact call shape against a properly mocked module.

Files Reviewed (2 files)

• apps/web/src/app/api/openrouter/[...path]/route.test.ts
• apps/web/src/app/api/openrouter/[...path]/route.ts

Previous Review Summaries (3 snapshots, latest commit 6892a4e)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 6892a4e)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The previous finding on hard-coded eventual consistency is resolved: getAvailableModelsForOrganization now defaults to strong consistency and only the three read-only presentation callers (openrouter models catalog, listAvailableModels, model-preference filtering) opt into replica reads, while both mutation-time validation paths (auto-routing pool entries, organization default-model replacement) omit the option and stay on primary, with new test assertions pinning both call shapes.

Files Reviewed (6 files)

• apps/web/src/app/api/openrouter/models/route.test.ts
• apps/web/src/app/api/openrouter/models/route.ts
• apps/web/src/lib/ai-gateway/auto-routing-pool-validation.test.ts
• apps/web/src/lib/organizations/organization-models.ts
• apps/web/src/routers/model-preferences-router.ts
• apps/web/src/routers/organizations/organization-settings-router.ts

Previous review (commit 0183b7e)

Status: 1 Issues Found | Recommendation: Address before merge

Executive Summary

getAvailableModelsForOrganization hard-codes consistency: 'eventual', which also routes two mutation-time validation paths (auto-routing pool entry validation and organization default-model replacement validation) through the read replica, contrary to the consistency contract limiting it to read-only presentation paths.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/lib/organizations/organization-models.ts	29	Hard-coded consistency: 'eventual' also applies to mutation-time validation callers (validatePoolEntries via buildEligibleCatalog, validateOrganizationDefaultReplacement), letting a just-denied model pass save-time validation during the replica-lag window

Files Reviewed (8 files)

• apps/web/src/app/api/gateway/embedding-models/route.ts
• apps/web/src/app/api/gateway/transcription-models/route.ts
• apps/web/src/app/api/openrouter/models-by-provider/route.ts
• apps/web/src/app/api/organizations/[id]/defaults/route.ts
• apps/web/src/lib/organizations/group-policies/model-access/model-access.server.ts
• apps/web/src/lib/organizations/organization-group-policy-context.server.test.ts
• apps/web/src/lib/organizations/organization-group-policy-context.server.ts
• apps/web/src/lib/organizations/organization-models.ts - 1 issue

Fix these issues in Kilo Cloud

Previous review (commit 109c795)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Routing organization group-policy snapshot reads through readDb is safe here: all callers are read-only enforcement paths with no same-request read-after-write dependency, readDb falls back to the primary pool when no replica is configured, the repeatable-read/read-only transaction options are preserved, and the narrowed resolveOrganization parameter type matches its only call site; regression coverage asserts replica selection and transaction options.

Files Reviewed (2 files)

• apps/web/src/lib/organizations/organization-group-policy-context.server.ts
• apps/web/src/lib/organizations/organization-group-policy-context.server.test.ts

---

_{Reviewed by kimi-k3 · Input: 44.4K · Output: 8.9K · Cached: 356.4K}

_{Review guidance: REVIEW.md from base branch main}