Round two: G22 was passing for the wrong reason, and four regressions from round one

[arpanghoshal]

A second adversarial review pass, requested before tagging 0.9.0. It found eight defects and seven surviving mutations; a ninth fell out of a document written to test one of the survivors, and it is the one that matters most.

G22 was passing for a reason that had nothing to do with G22

ctrlrun verify --only G22 reported FAIL on examples/authority/payments.yaml — the status that means the kernel is broken — while the full run reported PASS.

G22 resolves the charges it fills the budget with through Control._charges_for, which answers from _AUTHORITY_RESULT: a context variable only execute sets. G22 runs it before its own control leg, so it returned () whenever nothing had executed in that context yet. The synthetic hold reserved nothing, the budget was never filled, and the next action ran.

In a full run it got the right charges only because an earlier scenario's execute had left its result in that variable. The milestone's headline guarantee — the one that proves a budget holds a charge at all — was passing because of what ran before it. G22 now resolves authority for its own action and asks the Authority directly, and a control leg asserts the charges are non-empty rather than filling nothing quietly.

--only is the switch that exposed it, and T413s now grades G22 both ways and requires the two to agree.

Four regressions from round one

All four were introduced by fixing the first review's findings.

• An observed resumed receipt reported another action's spend. execute clears _BUDGET_CHARGES at its top; resume relied on _resumed_charges to do it, and the observe path skipped that call. A receipt for an action whose metric cannot be measured claimed a charge of 700 belonging to a different effect — on the one receipt §8.3 makes the whole evidence for an MCP multi round-trip. That is T448's defect, on the observe path.
• The resumed recompute got a throwaway _Observation(), so the block was discarded and the event written twice: the receipt said ALLOW with no blocked reason while two ACTION_DENIED events beside it said otherwise. An answer and the evidence may not disagree about the same action, which is the rule acs.py states one boundary lower.
• The observed budget refusal lost its effect key when the check was split, so the one event naming which effect a budget would refuse stopped naming it.
• _UnmeasurableError was not picklable and InvalidArgument is. A caller fanning Control.execute across a ProcessPoolExecutor lost the pool instead of catching the refusal. Nothing in this repository pickles it, so only probing the type could have found it.

ctrlrun verify still exited 3, and still accused the kernel

_deciding_grant was wired into the resize loop but not the early return, and it applied two of the four predicates Authority.evaluate applies. A task-bound grant carrying no budget was returned as the decider for an action outside its task, so a sibling's budget went unchecked. It now applies all four, in the same order.

Also fixed from the earlier round, both demonstrated by the first review and both mine: a resize could move the action onto a grant whose budget was never checked, and the resize set only the first budgeted metric, so a grant with budgets on two metrics was declined even when a fitting vector existed — silently, at exit 0, taking a document from thirteen graded guarantees to none.

Where I stopped, and why

§4.2.1 claimed the report and the enforcement "cannot drift". That is true of the arithmetic and false of the ordering: _secure and _observe_secure are separate implementations and _Observation keeps the first reason it is given. Three cases were found and aligned across the two rounds (approval gate, reservation, scope). The review demonstrated two more.

§4.2.1b now states the limit instead of patching a fourth time: observe mode reports a refusal exactly when enforce mode would refuse, and does not promise to name the same one. The two unaligned cases are named with what they cost. Neither is an enforcement difference — observe mode refuses nothing either way.

Aligning the rest means one ordered list of checks both modes walk, which is a refactor of both functions together. Three reorderings in this milestone produced four regressions between them, which is the argument for stopping and saying so rather than continuing.

Verification

4,363 tests pass with Postgres; mypy --strict and ruff clean. Every fix here landed with the probe that reproduced it first, and eight of the review's mutations now die where they previously survived. ctrlrun verify on the shipped example: 22/22, and now identical under --only G22.

[coderabbitai]

Warning

Review limit reached

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 355caac0-5f03-4f49-966f-e09c83aa60e6

📥 Commits

Reviewing files that changed from the base of the PR and between 907bdbb and d1d52a4.

📒 Files selected for processing (5)

• docs/SPEC-v0.9.md
• src/ctrlrun/control.py
• src/ctrlrun/verify/scenarios.py
• tests/test_budget_holds.py
• tests/test_verify_authority.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}