Problem
The README describes Dispatch as applying "capability constraints and budgets," which reads as enforcement. In the default configuration, at least one call is always paid for before anything can stop it.
src/engine.ts:89-97 — the pre-loop budget check compares elapsedBefore / tokensBefore / costBefore, which are reductions over already-completed attempts. On the first iteration attempts is [], so those sums are all 0 and cannot trip maxTotalTokens or maxCostUsd regardless of the candidate's worstCaseUsage. runtime.invoke() fires at :146; the only usage-based check runs after invocation at :181-185.
Genuine pre-call gating exists only on the separate, opt-in authorizationLedger path (:103-140, reserving via assertCapacity in src/authorization.ts:195-210) — which is solid, race-safe work. The README concedes the gap in one easily-skimmed line ("Per-invocation budgets are measured from one Dispatch call").
For an expensive model, "cannot prevent the first call" is most of the budget.
Acceptance criteria
From a read-only adversarial audit, 2026-07-29. All evidence below was re-verified against origin/main (an earlier pass read stale checkouts and produced four false findings; those were discarded). Nothing was modified in any repository.
Problem
The README describes Dispatch as applying "capability constraints and budgets," which reads as enforcement. In the default configuration, at least one call is always paid for before anything can stop it.
src/engine.ts:89-97— the pre-loop budget check compareselapsedBefore/tokensBefore/costBefore, which are reductions over already-completed attempts. On the first iterationattemptsis[], so those sums are all0and cannot tripmaxTotalTokensormaxCostUsdregardless of the candidate'sworstCaseUsage.runtime.invoke()fires at:146; the only usage-based check runs after invocation at:181-185.Genuine pre-call gating exists only on the separate, opt-in
authorizationLedgerpath (:103-140, reserving viaassertCapacityinsrc/authorization.ts:195-210) — which is solid, race-safe work. The README concedes the gap in one easily-skimmed line ("Per-invocation budgets are measured from one Dispatch call").For an expensive model, "cannot prevent the first call" is most of the budget.
Acceptance criteria
candidate.worstCaseUsageagainst the remaining budget before the firstruntime.invoke().From a read-only adversarial audit, 2026-07-29. All evidence below was re-verified against
origin/main(an earlier pass read stale checkouts and produced four false findings; those were discarded). Nothing was modified in any repository.