Allow selective quiet-hours throttle bypasses (#977)

Quiet-hours throttling currently applies to every PR author, leaving
operators with no selective exception short of disabling the stronger
interval.

This adds a case-insensitive bypass_users list under ci.quiet_hours. The
quiet-hours and ordinary throttle exemptions remain independent, so
bypassing the overnight layer does not weaken the base per-PR throttle
unless both policies exempt the author.

The GitHub integration guide documents the distinction, and regression
coverage pins both policy combinations.

---------

Co-authored-by: Codex <codex@openai.com>

Author: wesm

docs/integrations/github.md

@@ -474,9 +474,10 @@ start = "23:00"            # HH:MM, 24-hour clock; both start and end are requir
 end = "05:00"              # start > end wraps past midnight
 timezone = "US/Central"    # IANA name; empty means machine local time
 throttle_interval = "1h"   # per-PR minimum between reviews in the window; default 1h
+bypass_users = ["trusted-contributor"] # skips only the quiet-hours throttle
 ```
 
-While the window is active, the effective throttle for every PR is the larger of `throttle_interval` and `quiet_hours.throttle_interval`, and it applies to **all** users — including `throttle_bypass_users`. A PR's first-ever review is never blocked, and throttled pushes get the usual pending "review deferred" status. When the window ends, the next poll reviews the latest HEAD once, so overnight pushes collapse into a single fresh review.
+While the window is active, the effective throttle for every PR is the larger of `throttle_interval` and `quiet_hours.throttle_interval`. The quiet-hours interval applies to every author except those listed in `quiet_hours.bypass_users`; matching is case-insensitive. The ordinary throttle remains independent, so a quiet-hours bypass user must also appear in `[ci].throttle_bypass_users` to bypass both intervals. A PR's first-ever review is never blocked, and throttled pushes get the usual pending "review deferred" status. When the window ends, the next poll reviews the latest HEAD once, so overnight pushes collapse into a single fresh review.
 
 A push deferred only by quiet hours (one the base throttle would have allowed) does not cancel an in-flight review — unlike ordinary throttling, where a new push supersedes the stale run. Frequent overnight pushes would otherwise kill every review before it completes; instead, the running review finishes and posts, so a busy PR gets one snapshot review per interval. Pushes deferred by the base throttle keep their existing supersede behavior, inside or outside the window.
 
@@ -564,7 +565,8 @@ Set under `[ci.quiet_hours]` (global config only). See [Quiet Hours](#quiet-hour
 | `start` | string | | Window start as `"HH:MM"` (24-hour clock). Both `start` and `end` must be set to enable quiet hours. |
 | `end` | string | | Window end as `"HH:MM"`. When `start > end` the window wraps past midnight. |
 | `timezone` | string | machine local | IANA timezone name (e.g. `"US/Central"`) in which the window is evaluated |
-| `throttle_interval` | string | `"1h"` | Per-PR minimum time between reviews while the window is active. Applies to all users, including `throttle_bypass_users`. |
+| `throttle_interval` | string | `"1h"` | Per-PR minimum time between reviews while the window is active. |
+| `bypass_users` | array | `[]` | GitHub usernames that bypass only the additional quiet-hours throttle (case-insensitive) |
 
 ### GitHub App Options
 

internal/config/ci.go

@@ -325,6 +325,10 @@ type QuietHoursConfig struct {
 	// the window is active. Default: "1h". "0" makes quiet hours a
 	// no-op (a zero interval never exceeds the base throttle).
 	ThrottleInterval string `toml:"throttle_interval"`
+
+	// BypassUsers lists GitHub usernames that bypass the additional
+	// quiet-hours throttle. Matching is case-insensitive.
+	BypassUsers []string `toml:"bypass_users"`
 }
 
 // QuietHoursWindow is a parsed, validated quiet-hours window.
@@ -410,18 +414,28 @@ func parseClockMinutes(s string) (int, error) {
 	return t.Hour()*60 + t.Minute(), nil
 }
 
-// IsThrottleBypassed reports whether the given GitHub login is in
-// the ThrottleBypassUsers list. Comparison is case-insensitive.
-func (c *CIConfig) IsThrottleBypassed(login string) bool {
+// IsBypassed reports whether the given GitHub login bypasses the additional
+// quiet-hours throttle. Comparison is case-insensitive.
+func (q *QuietHoursConfig) IsBypassed(login string) bool {
+	return containsUsername(q.BypassUsers, login)
+}
+
+func containsUsername(users []string, login string) bool {
 	lower := strings.ToLower(login)
-	for _, u := range c.ThrottleBypassUsers {
-		if strings.ToLower(u) == lower {
+	for _, user := range users {
+		if strings.ToLower(user) == lower {
 			return true
 		}
 	}
 	return false
 }
 
+// IsThrottleBypassed reports whether the given GitHub login is in
+// the ThrottleBypassUsers list. Comparison is case-insensitive.
+func (c *CIConfig) IsThrottleBypassed(login string) bool {
+	return containsUsername(c.ThrottleBypassUsers, login)
+}
+
 // ResolvedMaxRepos returns the maximum number of repos to poll.
 // Defaults to 100 if not set or non-positive.
 func (c *CIConfig) ResolvedMaxRepos() int {

internal/config/quiet_hours_test.go

@@ -180,6 +180,13 @@ func TestQuietHoursWindowActive(t *testing.T) {
 	})
 }
 
+func TestQuietHoursBypassUsers(t *testing.T) {
+	q := QuietHoursConfig{BypassUsers: []string{"Trusted-User"}}
+	assert.True(t, q.IsBypassed("trusted-user"))
+	assert.True(t, q.IsBypassed("TRUSTED-USER"))
+	assert.False(t, q.IsBypassed("other-user"))
+}
+
 func TestQuietHoursConfigTOMLParsing(t *testing.T) {
 	configPath := filepath.Join(t.TempDir(), "config.toml")
 	err := os.WriteFile(configPath, []byte(`
@@ -191,6 +198,7 @@ start = "23:00"
 end = "05:00"
 timezone = "US/Central"
 throttle_interval = "90m"
+bypass_users = ["trusted-user"]
 `), 0o644)
 	require.NoError(t, err)
 
@@ -201,4 +209,5 @@ throttle_interval = "90m"
 	assert.Equal(t, "05:00", q.End)
 	assert.Equal(t, "US/Central", q.Timezone)
 	assert.Equal(t, "90m", q.ThrottleInterval)
+	assert.Equal(t, []string{"trusted-user"}, q.BypassUsers)
 }

internal/daemon/ci_poller.go

@@ -605,18 +605,20 @@ type throttleDecision struct {
 }
 
 // throttlePR reports whether the PR was reviewed recently enough to defer this
-// push. Bypass users skip the base throttle interval, but the quiet-hours
-// interval applies to everyone while the window is active. The throttle is
-// purely time-based on the most recent panel run for the PR (any HEAD SHA).
-// Pure decision, no side effects: the caller publishes the deferred status
-// via postDeferredStatus after its retention/supersede bookkeeping.
+// push. Base-throttle bypass users skip the ordinary interval, while
+// quiet-hours bypass users skip only the additional interval active during
+// that window. The throttle is purely time-based on the most recent panel run
+// for the PR (any HEAD SHA). Pure decision, no side effects: the caller
+// publishes the deferred status via postDeferredStatus after its
+// retention/supersede bookkeeping.
 func (p *CIPoller) throttlePR(ghRepo string, pr ghPR, cfg *config.Config) (throttleDecision, error) {
 	base := cfg.CI.ResolvedThrottleInterval()
 	if cfg.CI.IsThrottleBypassed(pr.Author.Login) {
 		base = 0
 	}
 	throttle := base
-	if q := p.quietHours; q != nil && q.Active(p.nowFn()) && q.Interval > throttle {
+	if q := p.quietHours; q != nil && q.Active(p.nowFn()) &&
+		!cfg.CI.QuietHours.IsBypassed(pr.Author.Login) && q.Interval > throttle {
 		throttle = q.Interval
 	}
 	if throttle <= 0 {
@@ -634,7 +636,7 @@ func (p *CIPoller) throttlePR(ghRepo string, pr ghPR, cfg *config.Config) (throt
 		throttled: true,
 		quietOnly: base <= 0 || elapsed >= base,
 		// With the quiet-hours interval this can overstate the wait for
-		// bypass users, who become eligible at the first poll after the
+		// base-throttle bypass users, who become eligible at the first poll after the
 		// window ends. The status is advisory; capping at the window end
 		// isn't worth the wrap-around complexity.
 		nextEligible: lastReview.Add(throttle),

internal/daemon/ci_poller_quiet_hours_test.go

@@ -114,6 +114,56 @@ func TestCIPollerProcessPR_QuietHoursThrottlesBypassUser(t *testing.T) {
 		"member must not be canceled")
 }
 
+func TestCIPollerProcessPR_QuietHoursBypassSkipsQuietThrottle(t *testing.T) {
+	now := time.Now()
+	h := newQuietHoursHarness(t, "1h", []string{"trusted-user"}, now)
+	h.Cfg.CI.QuietHours.BypassUsers = []string{"TRUSTED-USER"}
+	h.Poller.quietHours = quietWindow(t, now, "1h", true)
+
+	pr := func(sha string) ghPR {
+		return ghPR{
+			Number: 98, HeadRefOid: sha, BaseRefName: "main",
+			Author: ghPRAuthor{Login: "trusted-user"},
+		}
+	}
+
+	err := h.Poller.processPR(context.Background(), "acme/api", pr("first-sha"), h.Cfg)
+	require.NoError(t, err, "first processPR")
+	require.True(t, h.hasPanel(t, "acme/api", 98, "first-sha"))
+
+	err = h.Poller.processPR(context.Background(), "acme/api", pr("second-sha"), h.Cfg)
+	require.NoError(t, err, "second processPR")
+	assert.True(t, h.hasPanel(t, "acme/api", 98, "second-sha"),
+		"author bypassing both throttle layers should be reviewed immediately")
+}
+
+func TestCIPollerProcessPR_QuietHoursBypassPreservesBaseThrottle(t *testing.T) {
+	now := time.Now()
+	h := newQuietHoursHarness(t, "1h", nil, now)
+	h.Cfg.CI.QuietHours.BypassUsers = []string{"TRUSTED-USER"}
+	h.Poller.quietHours = quietWindow(t, now, "1h", true)
+
+	pr := func(sha string) ghPR {
+		return ghPR{
+			Number: 99, HeadRefOid: sha, BaseRefName: "main",
+			Author: ghPRAuthor{Login: "trusted-user"},
+		}
+	}
+
+	err := h.Poller.processPR(context.Background(), "acme/api", pr("first-sha"), h.Cfg)
+	require.NoError(t, err, "first processPR")
+	require.True(t, h.hasPanel(t, "acme/api", 99, "first-sha"))
+
+	err = h.Poller.processPR(context.Background(), "acme/api", pr("second-sha"), h.Cfg)
+	require.NoError(t, err, "second processPR")
+	assert.False(t, h.hasPanel(t, "acme/api", 99, "second-sha"),
+		"quiet-hours bypass must not bypass the ordinary throttle")
+
+	active, err := h.DB.GetActivePanelsForPR("acme/api", 99)
+	require.NoError(t, err)
+	assert.Empty(t, active, "ordinary throttle must supersede the stale panel")
+}
+
 func TestCIPollerProcessPR_QuietHoursElapsedBaseKeepsPanel(t *testing.T) {
 	assert := assert.New(t)
 	// A non-bypass contributor whose base throttle (1h) has elapsed but whose