Expose typed runtime execution limits for bounded agent turns

[jhgaylor]

Review Loop cannot bound a running reviewer through the public Fountain API. Usage arrives after completion, so several parallel reviewers can exceed a run allowance before the consumer can stop further work. #1730 demonstrated this gap.

The pinned claude-agent-acp 0.66.0 accepts SDK maxTurns and maxBudgetUsd via session/new._meta.claudeCode.options; Fountain's public agent/conversation schema and the ACP peer do not expose typed execution limits. Inspected adapter revision: 6b405138fc82be947964612fac04e56654827b66. Arbitrary metadata or environment injection is not an appropriate public interface.

Acceptance:

• Add allowlisted, validated execution-limit fields with explicit runtime capability checks; unsupported controls must fail clearly.
• Enforce host/account ceilings and prevent a conversation override from expanding authorized limits.
• Preserve limits across session load, resume and worker recreation; document whether each limit is per turn or per session.
• Return an explicit incomplete/limit outcome, retaining partial usage and its uncertainty. A stopped review must not appear successful.
• Prove a deliberately bounded live run stops, cancellation/restart preserves the limit, and the worker is physically deleted.
• Document that SDK dollar limits are estimates and requests already started can consume additional usage.

This supplies per-task enforcement. Review Loop still owns allocation and durable reservations across parallel reviewers: managoat/review-loop#30.

[jhgaylor]

Two prerequisites are now concrete:

• Fountain currently treats ACP max_tokens, max_turn_requests, and unknown stop reasons as completed turns. A local fix allows normal completion only for end_turn, retains reported usage, and prevents a later zero exit from changing the outcome or double-counting. Three regression cases fail before the fix; 108 focused tests pass afterward. Full precommit is in progress.
• Upstream Claude warm resume/load ignores changed maxTurns/maxBudgetUsd because the session fingerprint omits them. Submitted agentclientprotocol/claude-agent-acp#1097; 1,240 tests pass with bounded test workers. Published release and exact pinning are still required before relying on that fix.

Typed API limits, host/account ceilings, durable remaining-budget allocation, and live exhaustion/restart/deletion acceptance remain open. These patches do not establish a cross-session spend cap.

[jhgaylor]

#1739 is merged and deployed at b9b4a4a6ba14225c6e8b51f8e3be218fcef10591; both replicas are ready. A read-only call to the deployed state machine classifies end_turn as completed and max_tokens, max_turn_requests, and unknown as failed. This verifies deployed classification, not live SDK exhaustion.

The initial manifest publication failed downloading promtool (HTTP 504); one failed-job retry passed. Typed ACP limits are released in managoat_acp 0.4.0 (PR #10); the runtime bridge and Fountain’s persisted API/account ceilings are still pending. Upstream warm-resume handling remains Claude ACP #1097.

[jhgaylor]

The reviewer setup fixes are merged, but #1665 exposed a remaining tool-progress failure. Typed SDK turn/cost limits alone cannot bound one blocked tool call: the ACP peer may still await its prompt result while its local process is alive.

Please include a durable host-enforced wall-clock allowance in the execution-limit design, covering tool execution and recovery. A stopped turn must retain partial/unknown usage and an explicit reason; an alive conversation process or a provider's coarse worker status is insufficient evidence of progress. Keep this distinct from an arbitrary silence timeout that could interrupt legitimate long checks.

The acceptance fixture is back in draft after cancellation and verified worker deletion. Detailed account-scoped diagnostics are retained by the Review Loop operator.

[jhgaylor]

Remote stop prerequisite: managoat/managoat_sandbox#9, targeting Hex 0.3.0. The actual Elixir adapter passed a live detached-session test: remote process remained alive after disconnect, termination stopped it, a neighboring process exited 7 as expected, and worker deletion returned not found. Local gate: 266 tests, zero failures, 97.27% coverage.

Fountain still needs an absolute deadline persisted on each turn, enforcement outside the conversation mailbox, and an ownership fence that prevents late completion or a stale termination from affecting a replacement turn. A timeout must preserve partial/unknown usage and remain incomplete. SDK turn/cost limits and upstream warm-resume support remain separate requirements. This library PR alone does not close this issue.

[jhgaylor]

Remote termination is now released in managoat_sandbox 0.3.0. The remaining SDK identity change is Sprites #33, tracked through release/pinning and Fountain integration in Review Loop #109.

Next: persist the original session/turn/sandbox binding and absolute deadline, enforce it outside the conversation mailbox, and prevent late callbacks or uncertain termination from affecting a replacement turn. This is separate from SDK cost/turn limits and completed-command exit recovery. No Fountain deadline enforcement is claimed yet.

[jhgaylor]

Remaining extraction tracker: Fountain #1864 — PR boundaries, sequencing and acceptance criteria.

Eight small replacements from Fountain #1754 are published:

• #1796: isolate global pricing tests (1 file).
• #1797: delete only the owned broker session (4 files).
• #1818: share the image byte limit (2 files).
• #1820: record trusted provider identity (6 files; recording only).
• #1826: require committed state before launching workers (2 files).
• #1827: revoke only the failed provision's token (4 files).
• #1831: preserve replacement/completed/cancelled state after a stale startup error (2 files).
• #1840: validate opening input before allocation (5 files).

All eight pass full local precommit and CI and are ready for review. Another agent owns merges after review and CI.

Existing reset PR #1768 is also updated and ready: an enclosing-transaction guard adds 18 lines across two existing files. Its 62 focused tests and full precommit (4,892 tests +6 doctests) pass; the new regression fails on the old handler. Current-base CI passes on da12a039. The base change cancelled the superseded push run before tests.

This extraction pass is complete: eight new focused PRs plus the reset update. The residual 211-path audit against main bed264af found no additional standalone small cuts worth publishing. Remaining work needs coherent protocol replacements:

• Provider create intent/results with retained ownership and capacity; then confirmed deletion and recovery. Account deletion and billing must retain uncertain operations.
• Committed holder transfer and actor launch ownership, with startup/teardown/recovery tests. Preserve #1801's merged identity filter; a waiting helper or replacement callback alone omits the required transfer guarantee.
• Durable prompt persistence, admission, claim and delivery through an actual worker, including HTTP outcomes and replay tests.

Schemas, dispatch workers, dependency pins and historical evidence must accompany their implemented protocol. The frozen reference and held execution stack stay unmerged. No execution-control/provider-recovery activation, SDK release or deployment. The extraction audit does not complete the lifecycle work.

Previous extraction (historical validation): Fountain #1793 moves account and agent lock waits before fleet reservation on fresh admission. Foreign-key inserts could still stall all tenants after #1790 removed explicit row locks. The two-file fix preserves atomic admission and the upstream creation helpers. Both PostgreSQL contention regressions reproduce on #1790; 78 affected tests, full precommit (4,869 tests +6 doctests) and CI pass. Ready for review.

Next: current host/account ceilings on later turns and recovery, plus contention review of other quota callbacks. New runtime controls remain disabled.

Earlier extraction history follows; validation counts below refer to those original revisions.

Focused replacements from the frozen investigation:

• Merged: fix: prevent stale callbacks from reviving retired sandboxes #1761 stale revival, fix: count turn progress and wake time as sandbox activity #1762 idle activity, test: separate permission timer expiry from message delivery #1763 permission timer test, fix: refuse new turns from stale sandbox actors #1764 stale turn admission.

• fix: fence sandbox resets until deletion succeeds #1768: reset fence and retained capacity on uncertain deletion — now based on main, preserving the merged retirement guard; 10 files, +232/-57. Updated validation: 150 affected tests, 4,723 tests +6 doctests in full precommit, 24 PostgreSQL race interleavings with fake providers, and CI passed.

• feat: extract execution-limit policy resolver #1773: pure execution-limit resolver from Define typed execution-limit policy and API contracts #1745 — 2 files, +320, based on main; 18 focused tests, full precommit (4,708 tests + 6 doctests) and CI passed. It validates fields, inherits ceilings and refuses wider launch/resume allowances. No production admission or runtime enforcement is wired by this extraction.

• fix: refuse unenforced execution limits before admission #1774: refuse unenforced or malformed execution-limit requests before launch, attachment or channel mutation — 4 files, +171/-1; stacked on feat: extract execution-limit policy resolver #1773. Seven baseline regressions reproduced; 155 related tests, full precommit (4,717 tests +6 doctests) and CI passed. This guards requested limits only; saved allowances and runtime enforcement remain required.

• feat(conversations): store versioned execution allowances #1775: versioned conversation allowance storage, refusing stale writes and duplicate replacement. 3 files, +318; stacked on feat: extract execution-limit policy resolver #1773. 46 affected tests, an observed PostgreSQL lock wait, safe rollback checks, and full precommit (4,719 tests +6 doctests) passed; CI passed. This is a storage primitive only: no setting, endpoint or admission caller is enabled. Tenant-scoped admission, later-turn/recovery integration and live enforcement remain required.

• fix(conversations): check saved allowances before turn admission #1776: check saved allowances atomically at turn creation. 2 files, +266/-1; stacked on feat(conversations): store versioned execution allowances #1775. Eight parent regressions, 47 related tests, four PostgreSQL lock interleavings, and full precommit (4,730 tests +6 doctests) passed; CI passed. Saved unsupported or malformed allowances now refuse user/autonomous turn creation without a turn or usage event. No policy writer or runtime control is enabled; synchronous prompt, launch/channel, wake and recovery integration remain.

• fix: refuse unsupported saved allowances before wake #1777: refuse unsupported saved allowances before ordinary wake, retaining cancellation reconnect. 3 files, +206/-4; stacked on fix(conversations): check saved allowances before turn admission #1776. Eight parent regressions, 182 related tests, full precommit (4,742 tests +6 doctests) and CI passed. Prompt-triggered wake now returns 422 before provider/worker/prompt effects; no new controls are enabled. Active-server prompt, channel, boot-recovery and ceiling/save integration remain separate.

• fix: refuse saved limits before active prompt handoff #1778: refuse unsupported or malformed saved allowances before an existing server supersedes autonomous work. Three files, +123/-9; stacked on fix: refuse unsupported saved allowances before wake #1777. Four parent HTTP regressions, 159 related tests, full precommit (4,748 tests +6 doctests) and CI passed. HTTP422 preserves the current turn, connection and usage; cancellation and normal empty-policy handoff remain available. This is preflight, with the transactional turn recheck retained; no new enforcement or policy writer is enabled.

• fix: guard saved limits before queued prompt handoff #1779: check saved policy when consuming queued initial prompts, before autonomous handoff. Two files, +93/-8; stacked on fix: refuse saved limits before active prompt handoff #1778. Four parent regressions, 165 related tests, full precommit (4,754 tests +6 doctests) and CI passed. Refusal preserves existing work, connection and usage; cancellation and empty-policy handoff remain available. Transactional turn admission remains the backstop; no new control or policy writer is enabled.

• fix: refuse saved limits before channel resume #1780: refuse saved-policy channel resume before caller-tool changes; preserve lookup-only access and explicit fresh rotation. Six files, +279/-1 (25 added production lines; the rest tests/generated contracts); stacked on fix: guard saved limits before queued prompt handoff #1779. Seven parent regressions, 198 related tests, all four SDK contracts, TypeScript typecheck, full precommit (4,764 tests +6 doctests) and CI passed. Chat HTTP422 contracts and the OpenAI error envelope are consistent. SDK publication remains deferred under sdk-no-release; no writer, ceiling or runtime enforcement is enabled.

• fix: refuse saved limits before boot recovery #1781: refuse unsupported saved policy before boot recovery starts a conversation server. Two files, +127/-3; stacked on fix: refuse saved limits before channel resume #1780. Five parent regressions, 168 related tests, full precommit (4,770 tests +6 doctests) and CI passed. Repeated refusal leaves rows unchanged; mixed tenants, absent/empty allowances, existing servers and cancellation retain their behavior. Preflight only: no new recovery activation, policy writer, runtime control or stop of existing provider work.

• fix: refuse narrowing corrupt saved allowances #1782: refuse narrowing corrupt saved allowances instead of replacing JSON null with an unrestricted map. Two files, +51/-1; stacked directly on feat(conversations): store versioned execution allowances #1775. One parent regression; 32 allowance/policy tests (including the PostgreSQL stale-writer race), full precommit (4,722 tests +6 doctests) and CI passed. Invalid rows remain unchanged; valid empty policies still narrow. Tenant-scoped saving and current-ceiling integration remain separate.

• feat: narrow execution allowances by owner #1783: owner-scoped narrowing of existing saved allowances. Four files, +253/-9; stacked on fix: refuse saved limits before boot recovery #1781. Concurrent writes revalidate the latest locked policy; foreign/missing records, widening and corrupt policy are refused. No-op requests preserve the row; audit events record only changed control names after the transaction. 117 related tests (including two scoped-writer PostgreSQL lock interleavings), full precommit (4,778 tests +6 doctests) and CI passed. Initial creation, current-ceiling admission, HTTP enrollment and runtime enforcement remain separate.

• feat: store typed account execution ceilings #1784: typed account-ceiling storage with an empty backfill, ordinary-account write exclusion, and database object constraint. Three files, +166; stacked directly on feat: extract execution-limit policy resolver #1773. 40 related tests and real migration/backfill, refused rollback, empty rollback/reapply checks passed; full precommit (4,714 tests +6 doctests) and CI passed. Configured ceilings cannot be silently dropped. Storage only: leave overrides empty until admission consumes current ceilings; no endpoint or runtime control is enabled.

#1745's remaining API/storage/client wiring stays draft. #1754 remains frozen reference material, not a merge candidate. Automatic reset reconciliation and broader provider arbitration are separate lifecycle work.

#1732 retains its contract: typed per-task limits and host/account ceilings; durable enforcement across cancellation/restart; explicit incomplete results and partial usage; bounded live stop/restart and confirmed worker deletion. Each additional prerequisite needs a reproduced failure.

Original Review Loop live outcomes passed; new-control acceptance remains outstanding. Existing merge/deploy/activation holds and uncertain-operation retention remain. Fake-provider tests are not live acceptance.

• fix: check account ceilings before launch admission #1785: account-ceiling launch preflight, stacked on feat: store typed account execution ceilings #1784 and reusing fix: refuse unenforced execution limits before admission #1774. Five files, +289/-3. Omitted/null/empty requests inherit current account policy; widening, malformed policy and unsupported controls fail before launch/attachment/channel changes. Eight baseline regressions, 187 related tests, full precommit (4,732 tests +6 doctests) and CI passed. Read-only preflight is not atomic against policy changes; later-turn/recovery account checks, host ceilings, initial allowances and runtime enforcement remain separate. Keep account overrides empty until integrated.

• feat: create initial execution allowances by owner #1786: tenant-scoped initial allowance creation, stacked on feat: narrow execution allowances by owner #1783. Four files, +245/-1. Ownership stays locked through insertion; duplicates cannot replace saved policy, and successful creation audits only control names. 125 related tests, two observed PostgreSQL race waits, full precommit (4,786 tests +6 doctests) and CI passed. Internal persistence only: no launch/HTTP caller or runtime activation. Trusted current-ceiling resolution and runtime support checks remain admission responsibilities; account preflight is sibling fix: check account ceilings before launch admission #1785.

• feat: validate host execution ceilings before launch #1787: trusted host-ceiling launch preflight, stacked on fix: check account ceilings before launch admission #1785. Six files, +166/-10. FOUNTAIN_EXECUTION_LIMITS validates at boot without echoing input; launch requests inherit the stricter host/current-account ceilings. Eleven parent regressions, 65 related tests, full precommit (4,743 tests +6 doctests) and CI passed. Empty default; unsupported controls still refuse launch. Keep ceilings empty until later-turn/recovery checks and runtime enforcement integrate. Initial persistence is sibling feat: create initial execution allowances by owner #1786; this is not an atomic policy reservation or aggregate spend cap.

• chore: join execution admission prerequisites #1788: explicit join of feat: create initial execution allowances by owner #1786 saved-policy guards and feat: validate host execution ceilings before launch #1787 host/account preflight, preserving both histories. Ten files, +590, reused prerequisite changes with the shared HTTP error and alias overlap resolved. 81 related tests, full precommit (4,821 tests +6 doctests) and CI passed.

• feat: persist attachment allowances before prompt delivery #1789: atomic initial allowance persistence for attachments, stacked on chore: join execution admission prerequisites #1788. Five files, +265/-34. Account/agent/sandbox ownership stays locked through policy revalidation and both inserts; failure rolls back the conversation. Analytics, audit and prompt delivery follow commit. Five parent HTTP regressions, 147 related tests including a PostgreSQL account-update lock wait, full precommit (4,826 tests +6 doctests) and CI passed. Fresh worker reservation/persistence and later-turn/recovery current-ceiling enforcement remain separate; unsupported controls stay refused.

• Persist fresh launch allowances atomically #1790: atomic fresh sandbox/conversation/initial-allowance reservation, stacked on feat: persist attachment allowances before prompt delivery #1789. Five files, +190/-40. Rechecks current ceilings and ownership under the existing quota transaction; failed inserts roll back all three rows before worker or creation effects. Worker startup failure retains admitted state. Four reproduced parent failures, 229 related tests, a real PostgreSQL account-update lock wait, full precommit (4,832 tests +6 doctests) and CI passed. Fresh and attached initial persistence are complete; later-turn/recovery current-ceiling checks and runtime enforcement remain. Unsupported controls stay refused. Separate follow-up: channel rotation currently unbinds before fresh admission; preserve the old binding if admission fails.

• Preserve channel bindings when rotation fails #1791: preserve existing channel bindings on failed rotations, stacked on Persist fresh launch allowances atomically #1790. Three files, +353/-6 (75 net production lines). Old unbinding commits with replacement admission; failed checks roll it back. Synchronous worker/prompt refusal restores only the still-owned binding, preserving newer rotations and tenant reassignment. Nine parent regressions, 254 related tests, two independent PostgreSQL rotation races with open foreign-key references, full precommit (4,847 tests +6 doctests) and CI passed. This completes the channel-rotation follow-up from Persist fresh launch allowances atomically #1790. Current host/account ceilings for later turns/recovery and runtime enforcement remain; no new controls activated.

[jhgaylor]

Blocked on #1925 — the last thing between the stack and merging.

#1744–#1752 are all approved, green and out of draft. #1744 is CONFLICTING against main: #1768 (a7bfb8ba) landed its own durable reset fence in reset_sandbox/2 with "reaping is the supported way out", which answers the same dead-end #1744's reset_sandbox(force: true) was built for. #1925 asks which one survives; the rebase of all 21 commits follows from the answer.