feat(admission): manifest-declared team budgets refuse over-budget spawns - #101
Merged
Conversation
…awns Refuse the declaration, not the spawn: admission gates sit at the operator verbs (work, scale, run, shift) with a reconciler backstop and hold latch, so desired state never becomes permanently unsatisfiable and the tables never lie. Every refusal emits admission.refused with the arithmetic; a hold clearing emits admission.cleared. Default open: a manifest with no budget block behaves exactly as before, and the gate exists only where an operator declared a budget (resource-matrix enforcement locus 2, elem-agentic-resource-matrix, ratified 2026-08-01). Enforced dimensions: max_sessions (counted from the store) and max_tokens (windowed prompt-token spend from the usage accountant). max_cost_usd, max_team_rss_bytes, and max_session_ctx_percent are registered and rejected at parse with the owner named, so a declared-but-unenforced budget cannot silently pass. Unmeasured token figures render as unmetered rather than ok with full headroom. New internal/admission (pure arithmetic, stdlib + api only; doc.go records the meter/gate split and rulings), api budget vocabulary, team hold state machine, daemon snapshot seam, marvel get budgets, and the Act 4 demo fixture (examples/demo-act4-budget). 50+ new tests; build, vet, golangci-lint, gofmt, test -p 1, and -race on touched packages all green; the demo runbook verified end to end against an isolated daemon. Refs: aae-orc-qiay
arcaven
added a commit
that referenced
this pull request
Aug 2, 2026
…see finding-009 (#102) finding-009 records the qiay admission design knowledge (refuse the declaration, not the spawn; default-open ratified gate; unmetered over fictional headroom; the measured pre-existing YAML-fallback defect, bd aae-orc-z7c3). Matrix node and CLAUDE.md locus-2 line updated from MISSING to first-brick-shipped with PR #101 refs. Refs: aae-orc-qiay
arcaven
added a commit
that referenced
this pull request
Aug 2, 2026
…#105) Demo beat 1d run one step past the runbook surfaced four pre-existing defects (rollback honesty, mid-shift generation tagging, restart_policy=never accounting bypass with a pane leak, backoff invisibility). Five-agent investigation, 9/9 symptom-commit cells across 2be837a/31f1ea5/fe8f874; PRs #99 and #101 exonerated. Fixes tracked as aae-orc-d0pt and aae-orc-pyre; socket-isolation method knowledge included (aae-orc-t6da). Refs: aae-orc-d0pt, aae-orc-pyre
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The motivating failure is self-DoS by fan-out: one
marvel scale --replicas 40on a shared provider quota takes the whole fleet down with it. This PR gives marvel its first admission control (resource-matrix enforcement locus 2, ratified 2026-08-01): a team manifest declares a budget, and marvel refuses work that would exceed it, with the arithmetic in the events ring. Additive and default-open: no budget block means byte-identical behavior to today.The design choice worth reading: refuse the declaration, not the spawn. Gating only the reconciler's
Createwould letscalereport success, leaveget teamsclaiming 40 replicas while 6 run, and re-evaluate an impossible deficit every 2 seconds forever. Instead the gates sit at the operator verbs (work,scale,run,shift): the verb fails with the arithmetic, the store keeps the number that is still true, and nothing is left permanently unsatisfiable. The reconciler check is a backstop with a hold latch (refusals are not crashes; no backoff pollution, no retry storm, holds clear when headroom returns).Enforced now:
max_sessions(counted from the store) andmax_tokens(windowed prompt-token spend from the #99 accountant).max_cost_usd,max_team_rss_bytes,max_session_ctx_percentare registered and rejected at parse with the owner named, so a declared-but-unenforced budget cannot silently pass. Unmeasured token figures renderunmetered, neverokwith fictional headroom.Surfaces:
marvel get budgets(per-dimension limit/observed/headroom/state),admission.refused/admission.clearedevents, andexamples/demo-act4-budget.{toml,yaml}carrying the five-beat Act 4 runbook, verified end to end against an isolated daemon.Verification: 50+ new tests; build/vet/golangci-lint/gofmt/test green,
-raceclean on all touched packages. Adversarially reviewed under governance, reconciler-safety, and integration lenses; round one found 10 blockers, all fixed and re-verified to zero.Two pre-existing defects were measured en route and deliberately not fixed here (YAML manifest validation errors masked by the TOML parse fallback; a doubled
parse manifest:prefix in apply errors); tracked separately.Refs: aae-orc-qiay