[snyaggarwal]

OpenConceptLab/ocl_online#517

What changes

• Capacity tier per group, from the groups config. get_tier no longer reads group names. Staff and superusers get the staff tier; everyone else gets the highest tier their groups are set to, else the lowest. Each group's tier is capacity_tier in the groups config (OCL_GROUPS_CONFIG), stored in the new GroupCapacityTier table (migration capacity.0002).
• seed_group_capabilities syncs capacity_tier like permissions: set when declared, deleted when not. A name outside core.capacity.constants.TIERS stops the seed with an error.
• New permission users.mapper_ai_output_locale (fixture pk 1009): choosing the Mapper OCL AI Assistant's output language. Admins grant it per group.

The tier names and the capacity config defaults are unchanged, so stored CapacityConfig rows and the X-OCL-Capacity-Tier header values still work.

Related PRs

• OpenConceptLab/ocl_online#517 | Mapper settings checkpoint, output language by permission, exact group names oclmap#111: checks the new permission, and runs follow X-OCL-Capacity-Suggested-Concurrency
• OpenConceptLab/ocl_online#548
• OpenConceptLab/oclinfrastructure#20: sets capacity_tier and grants the permission per group

Merge order

Merge OpenConceptLab/oclinfrastructure#20 before or with this PR. Today's code ignores capacity_tier, so the config can land first. If this deploys before the config declares tiers, every non-staff user gets the lowest tier until the next seed.

Testing

• manage.py test core.capacity core.capabilities: 128 pass, run in Docker with the CI compose files.
• makemigrations --check: no changes.
• pylint is clean on the changed modules.

🤖 Generated with Claude Code

[snyaggarwal]

Reviewed with the sibling changes for OpenConceptLab/ocl_online#517. No blocking findings. Tier selection now comes from deployment-provided group configuration instead of group-name logic, with lowest-tier fallback and highest-tier resolution covered by tests. Pylint and Snyk are green; the full Tests job is still pending, so merge should wait for it.

[paynejd]

Reviewed together with OpenConceptLab/oclmap#111 and the private PRs for OpenConceptLab/ocl_online#517. Codex pass 1 is in a separate comment.

Please change before merge

1. Fixture pk 1009 is already taken in existing databases (inline, with a suggestion).
   • load_fixtures resets the permission sequence after loading 1001–1008, so the permissions Django created for later models took 1009 onwards.
   • Startup runs migrate before load_fixtures, so this entry would rewrite that row as mapper_ai_output_locale, and any grant of the old permission would become a grant of this one.
   • Fresh databases, like CI's, don't hit it.
   • Dropping the pk lets loaddata match the row by its natural key.
2. The tests copy the group-to-tier mapping into public code (inline).
   • TEST_GROUP_TIERS and the two capacity_tier lines in groups.test.yaml restate the mapping this PR takes out of get_tier.
   • Please give the capacity tests their own groups with explicit tiers, as test_get_tier_comes_from_the_groups_tier_not_its_name does, and drop the two yaml lines.

Checked

• get_tier reads only GroupCapacityTier. Staff and superusers still get the staff tier, and users with no tier get the lowest. It still fails open inside acquire.
• The seed checks capacity_tier against TIERS and syncs it the way it syncs permissions. Today's seed ignores the key and skips an unknown permission with a warning, so the config can land first, as the PR says.
• Merges cleanly onto master, with no migration clash. CI is green.

Not for this PR: the tier names themselves (OpenConceptLab/ocl_online#532).

[paynejd]

Codex review, pass 1 (codex-cli 0.163.0, commit 5569305)

Verdict: findings. 2 finding(s).

• F1.1 (P1) core/fixtures/auth_groups.yaml:58: The fixed permission ID can overwrite an existing permission and change its grants during upgrade.
• F1.2 (P1) core/capacity/tests/tests.py:40: The new test helper copies deployment-specific group-to-tier policy into public code.

findings.json

{
  "reviewer": "codex-cli 0.163.0",
  "perspective": "defects",
  "mode": "full",
  "commit": "556930524886b20478a52a04a02bfa50a18b30e9",
  "verdict": "findings",
  "prior": [],
  "findings": [
    {
      "id": "F1.1",
      "severity": "P1",
      "tag": null,
      "file": "core/fixtures/auth_groups.yaml",
      "line": 58,
      "claim": "The fixed permission ID can overwrite an existing permission and change its grants during upgrade.",
      "scenario": "Loading the previous fixture advances the permission sequence beyond 1008. Subsequent model migrations, including the earlier CapacityConfig migration, can allocate 1009. Since startup runs migrate before load_fixtures, this fixture then overwrites that existing permission. Its user/group assignments now reference the output-language permission, losing their original meaning. Fresh-database tests miss this upgrade case, and the stated deployment order does not prevent it.",
      "action": "Create or resolve this permission by its natural key instead of assigning a numeric primary key. Add an upgrade regression test that preserves an existing permission at this ID and its grants across fixture loading.",
      "lines_delta": null,
      "confidence": "high"
    },
    {
      "id": "F1.2",
      "severity": "P1",
      "tag": null,
      "file": "core/capacity/tests/tests.py",
      "line": 40,
      "claim": "The new test helper copies deployment-specific group-to-tier policy into public code.",
      "scenario": "TEST_GROUP_TIERS and the added assignments in groups.test.yaml reproduce the concrete group mapping removed from get_tier. Publishing these additions violates OpenConceptLab/ocl_online#517's explicit boundary requirement, which includes tests and fixtures.",
      "action": "Use synthetic group names with explicitly assigned capacity tiers in public tests. Keep deployment-specific group assignments in private configuration.",
      "lines_delta": null,
      "confidence": "high"
    }
  ]
}