Protect manual Sub2API account from sentinel

scripts/src/platform-infra-sub2api-codex-sentinel.ts

@@ -59,6 +59,7 @@ export interface CodexPoolSentinelConfig {
     usdPer1MOutputTokens: number;
   };
   historyLimit: number;
+  protectedManualAccounts?: string[];
 }
 
 export interface CodexPoolSentinelImageTarget {
@@ -157,6 +158,7 @@ export function defaultCodexPoolSentinelConfig(): CodexPoolSentinelConfig {
       usdPer1MOutputTokens: 10,
     },
     historyLimit: 200,
+    protectedManualAccounts: [],
   };
 }
 
@@ -295,6 +297,7 @@ export function codexPoolSentinelSummary(config: CodexPoolSentinelConfig): Recor
     sdk: config.sdk,
     cadence: config.cadence,
     freeze: config.freeze,
+    protectedManualAccountCount: config.protectedManualAccounts?.length ?? 0,
     accounting: {
       mode: "record-only",
       pricing: config.pricing,
@@ -329,6 +332,7 @@ export function renderCodexPoolSentinelManifest(
     cadence: config.cadence,
     freeze: config.freeze,
     pricing: config.pricing,
+    protectedManualAccounts: config.protectedManualAccounts ?? [],
     state: {
       configMapName: config.stateConfigMapName,
       historyLimit: config.historyLimit,
@@ -778,6 +782,8 @@ class Sub2ApiAdmin:
         self.base = config["service"]["baseUrl"].rstrip("/")
         self.email = os.environ.get("ADMIN_EMAIL") or config["service"]["adminEmailDefault"]
         self.password = os.environ.get("ADMIN_PASSWORD") or ""
+        protected = config.get("protectedManualAccounts") if isinstance(config.get("protectedManualAccounts"), list) else []
+        self.protected_manual_accounts = set(str(item) for item in protected if isinstance(item, str) and item)
         self.token = None
         self.accounts_by_name = None
 
@@ -847,6 +853,14 @@ class Sub2ApiAdmin:
         return None
 
     def set_schedulable(self, account_name, schedulable):
+        if account_name in self.protected_manual_accounts:
+            return {
+                "accountId": None,
+                "previousSchedulable": None,
+                "schedulable": None,
+                "skipped": True,
+                "reason": "protected-manual-account",
+            }
         account = self.account(account_name)
         if not account or account.get("id") is None:
             raise RuntimeError(f"account {account_name} not found")