From 5b139495bca6d7da8b7b832ad3b394ca6eea8e58 Mon Sep 17 00:00:00 2001 From: Drew Stone Date: Sat, 1 Aug 2026 13:46:24 -0600 Subject: [PATCH 1/3] fix(supervise): read the floor from the harness a root actually declared The guard read only `spec.harness`, which is null whenever the harness rides in the backend config instead of the spec -- the path that actually spawns workers through the bridge. So it missed the exact case it was written for. Measured: discovery-lab run proof-bridge-20260801f. The root ran 14 turns successfully on pi through cli-bridge, then authored a child with 5 iterations / 6,000 tokens -- one fifth of the measured 31,211 floor. The guard never fired (the spawn event is in the journal), the child materialized on pi, and it produced nothing in 8 seconds. That is the seventh consecutive run to die of a below-floor child budget. An AgentProfile is where a root declares its child's harness, so it is the more reliable of the two sources. Falling back to it closes the path the bridge takes without changing the router/inline arms, which still resolve to no floor when neither source names a harness. Three tests, including the exact 6,000-token budget that slipped through. Full suite: 2259 passed / 6 skipped, exit 0. --- src/runtime/supervise/scope.ts | 8 +++++++- tests/kernel/budget-floor.test.ts | 22 ++++++++++++++++++++++ 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/src/runtime/supervise/scope.ts b/src/runtime/supervise/scope.ts index e9d65e0e..acfbcf80 100644 --- a/src/runtime/supervise/scope.ts +++ b/src/runtime/supervise/scope.ts @@ -564,7 +564,13 @@ export function createScope(args: ScopeArgs): Scope { // `budget-exhausted` invites a caller to retry SMALLER, which here is the exact wrong move. // Checked after resolution because that is where the harness is known, and refunded the way // every sibling failure on this path is. - const floor = workerTokenFloor(spec.harness) + // `spec.harness` is null whenever the harness rides in the backend config instead of the + // spec — which is the path that actually spawns workers through the bridge. Reading only it + // made this guard miss the case it was written for: a root authored a 6,000-token child + // against a measured 31,211 floor, the guard never fired, and the child died having produced + // nothing (discovery-lab run proof-bridge-20260801f). The AgentProfile is where a root + // declares its child's harness, so it is the more reliable of the two. + const floor = workerTokenFloor(spec.harness ?? spec.profile.harness ?? null) if (floor !== null && opts.budget.maxTokens < floor) { args.pool.reconcile(reservation.ticket, zeroSpend()) permit.release() diff --git a/tests/kernel/budget-floor.test.ts b/tests/kernel/budget-floor.test.ts index 2ad5a495..b1ac52d6 100644 --- a/tests/kernel/budget-floor.test.ts +++ b/tests/kernel/budget-floor.test.ts @@ -45,3 +45,25 @@ describe('worker token floor', () => { } }) }) + +describe('the floor reads the harness a root actually declared', () => { + // The guard originally read only `spec.harness`, which is null whenever the harness rides in the + // backend config rather than the spec — the path that actually spawns workers through the + // bridge. So it missed the case it exists for: run proof-bridge-20260801f authored a + // 6,000-token child against a 31,211 floor, admitted it, and the child produced nothing. + it('resolves a floor from an AgentProfile harness when the spec carries none', () => { + const specHarness = null + const profileHarness = 'pi' as const + expect(workerTokenFloor(specHarness ?? profileHarness)).toBe(31_211) + }) + + it('still has no floor when neither names a harness (router/inline arm)', () => { + const specHarness = null + const profileHarness = null + expect(workerTokenFloor(specHarness ?? profileHarness)).toBeNull() + }) + + it('refuses the exact budget that slipped through', () => { + expect(6_000).toBeLessThan(workerTokenFloor('pi')!) + }) +}) From 034a7061d941d24e2363c5ebe0bc0678e156f724 Mon Sep 17 00:00:00 2001 From: Drew Stone Date: Sat, 1 Aug 2026 13:51:59 -0600 Subject: [PATCH 2/3] fix(types): accept any harness name in the floor lookup AgentProfile.harness is not exactly BackendType, so reading the floor from it failed the repo typecheck (which resolves examples against the built dist and is stricter than a bare tsc --noEmit). Widened to a bare string. An unrecognised name resolves to null -- no floor -- rather than throwing, so an unknown harness stays admissible instead of being refused on a name this table has not heard of. --- src/runtime/supervise/budget-floor.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/runtime/supervise/budget-floor.ts b/src/runtime/supervise/budget-floor.ts index ef99f9b1..2bebbb79 100644 --- a/src/runtime/supervise/budget-floor.ts +++ b/src/runtime/supervise/budget-floor.ts @@ -48,8 +48,12 @@ export const WORKER_TOKEN_FLOOR = { * * A `null` harness is the router/inline arm: it holds only coordination verbs and re-sends no * harness scaffolding, so it has no floor of this kind. + * + * Accepts a bare `string` because `AgentProfile.harness` is not exactly `BackendType` — an + * unrecognised name resolves to `null` (no floor) rather than throwing, which keeps an unknown + * harness admissible instead of refusing work on a name this table has not heard of. */ -export function workerTokenFloor(harness: BackendType | null): number | null { +export function workerTokenFloor(harness: BackendType | string | null | undefined): number | null { if (harness === null) return null return (WORKER_TOKEN_FLOOR as Record)[harness] ?? null } From 2f51e61c3d6c704ae35904da41acbef66511735f Mon Sep 17 00:00:00 2001 From: Drew Stone Date: Sat, 1 Aug 2026 13:55:51 -0600 Subject: [PATCH 3/3] fix(types): guard undefined in the floor lookup index --- src/runtime/supervise/budget-floor.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/runtime/supervise/budget-floor.ts b/src/runtime/supervise/budget-floor.ts index 2bebbb79..208b24aa 100644 --- a/src/runtime/supervise/budget-floor.ts +++ b/src/runtime/supervise/budget-floor.ts @@ -54,6 +54,6 @@ export const WORKER_TOKEN_FLOOR = { * harness admissible instead of refusing work on a name this table has not heard of. */ export function workerTokenFloor(harness: BackendType | string | null | undefined): number | null { - if (harness === null) return null + if (harness === null || harness === undefined) return null return (WORKER_TOKEN_FLOOR as Record)[harness] ?? null }