[jeanduplessis]

Summary

Surface the stored BytePlus upstream identifier in the admin Pending Key Rotation
queue so staff can map inventory items to provider-side subscriptions.

Why this change is needed

The queue showed — for the upstream identifier on every BytePlus row because the
revocation query deliberately nulled the stored value for byteplus-coding. Admins
could not map inventory items to provider-side seats, blocking manual deprovisioning
and reconciliation. Support authorized exposing the assigned username to authorized
admins.

How this is addressed

• The revocation-queue query returns the stored upstream identifier for all providers
  instead of nulling it for BytePlus (MiniMax Upstream Plan ID or BytePlus assigned
  username), so the existing queue column is populated.
• Upload help copy now states the BytePlus assigned username appears in the queue for
  provider-side mapping; API keys remain encrypted and are never returned.
• The Coding Plans spec permits authorized administrative remediation surfaces to
  display the stored identifier, and the clauses that previously forbade BytePlus
  usernames were reconciled.

Human Verification

• pnpm test -- coding-plans (apps/web): 13 suites, 164 tests passed, including a new
  test asserting the queue returns the stored BytePlus username to an admin.
• Local code review across 8 quality focuses. The single Major finding (a spec
  contradiction) was resolved, and the security and logic re-reviews returned PASS.
• Spec reconciliation for clauses 3.6, 4.2, 4.8, and 8.2 confirmed internally
  consistent.

Reviewer Notes

Human Reviewer Flags

• Spec change: 3.6, 4.2, 4.8, and 8.2 now permit authorized admin remediation surfaces
  to display the assigned BytePlus username; 8.4 still prohibits usernames in quota
  responses and logs.
• Trade-off: a provider username previously classified server-only is now returned to
  the admin console (gated by adminProcedure). This is an intentional disclosure
  broadening based on product authorization.

Code Reviewer Agent

Code Reviewer Notes

• The queue query no longer redacts the identifier for byteplus-coding and returns
  the stored value for every provider.
• No API shape change: upstreamPlanId was already string | null, and the UI already
  rendered item.upstreamPlanId ?? '—'; only the alert copy changed in the client.
• New coverage persists a BytePlus username and asserts the authorized admin queue
  returns it; existing coverage still asserts non-admin rejection and that raw
  credentials are never returned.
• React Doctor reported pre-existing high-complexity warnings at unchanged lines; not
  addressed (out of scope).

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (4 files)

• .specs/coding-plans.md
• apps/web/src/app/admin/coding-plans/CodingPlansOperationsContent.tsx
• apps/web/src/lib/coding-plans/revocation.ts
• apps/web/src/routers/coding-plans-router.test.ts

---

_{Reviewed by grok-4.6 · Input: 62.6K · Output: 7.9K · Cached: 445.2K}

_{Review guidance: REVIEW.md from base branch main}