[debuggingfuture]

Four proposed records.

• ADR-0006, spend guard. Admission refuses new runs once month-to-date estimated spend reaches a monthly budget, and a burn ceiling caps the summed hourly rate of admitted runs across pools. Both default low in code (50 USD a month, 1.50 USD an hour). Over budget, checks conclude neutral, never red.
• ADR-0007, cost-efficient execution. The receiver skips repos that never opted in, a cache key is uploaded once, fan-out parts skip repeated installs, and the Rust image ships prebuilt heavy native libraries.
• ADR-0008, cheaper waiting. rpc is the default sandbox transport, admission polls slow down with queue position, and each supersession logs what it cancelled.
• ADR-0009, fast, trustworthy verdicts. Interactive runs admit ahead of fan-out parts, check-run writes are budgeted and reconciled until delivered, a gate runs a light tier on pull requests and its heavy tier on the default branch, and pool caps are upper bounds under the spend guard.

Implementation: #236, #235, #234, #233 and a delivery PR.

[flaredispatch-fractalboxdev]

AI code review — 🛑 Request changes

Risk tier: full · 1 critical · 3 warnings · 0 suggestions

Reviewers: security 3 · performance 1 · code-quality ⚠️ · documentation ⚠️ · release-management ⚠️ · compliance ⚠️ · agents-md 0

1. 🛑 Critical — Cross-month executions bypass the monthly budget

📍 specs/adr/0006-spend-guard.md:27-33

The spend query includes only executions admitted during the current UTC month. An execution admitted before month-end but still running afterward is omitted from the new month's unfinished-execution total, and its eventual cost is attributed to the prior month. Long-running executions can therefore consume current-month compute without reducing the current-month budget. Count active executions by overlap with the month (and allocate finished cost by active-time overlap), or explicitly carry their accrued cost into the new month.

2. ⚠️ Warning — Budget and burn-limit overrides need an explicit authorization boundary

📍 specs/adr/0006-spend-guard.md:39-43

A single CONFIG_KV write can set the monthly budget or burn ceiling, including 'unlimited', but the ADR does not require operator-only authorization, audit logging, or protection against repository/tenant users changing these global controls. Ensure these keys are writable only by an authenticated, authorized operator and record changes; otherwise a compromised or malicious repo configuration can disable the spend guard.

3. ⚠️ Warning — Spend endpoint lacks an access-control and tenant-scoping requirement

📍 specs/adr/0006-spend-guard.md:69-72

'GET /api/spend' exposes month-to-date spend and configured limits, which is sensitive operational and financial data, but the endpoint contract specifies no authentication, authorization, or tenant scoping. Require an authenticated authorized principal and return only the spend data that principal is allowed to see; do not expose global totals to arbitrary callers.

4. ⚠️ Warning — Parallel cache saves can still duplicate the upload

📍 specs/adr/0007-cost-efficient-execution.md:46-48

The 'head'-then-pack/upload sequence is a check-then-act race: concurrent misses can all observe no object, pack the same archive, and upload it. This defeats the stated fan-out performance improvement. Use an atomic create-if-absent operation, a per-key lock/lease, or tolerate and detect duplicate uploads before packing.

📋 View full logs & reviewed diff ↗

[flaredispatch-fractalboxdev]

AI code review — 🛑 Request changes

Risk tier: full · 2 critical · 1 warnings · 0 suggestions

Reviewers: security ⚠️ · performance ⚠️ · code-quality ⚠️ · documentation 2 · release-management 1 · compliance ⚠️ · agents-md 0

1. 🛑 Critical — HEAD-before-upload does not guarantee one upload under concurrency

📍 specs/adr/0007-cost-efficient-execution.md:59-61

The documented 'bucket.head' check has a time-of-check/time-of-use race: parallel misses can all observe no object, pack, and upload the same key. Add an atomic conditional-create, per-key lock, or explicitly document that duplicate uploads remain possible; the current claim that parallel misses upload once is not supported by this algorithm.

2. ⚠️ Warning — Unapplied archives cannot be repaired

📍 specs/adr/0007-cost-efficient-execution.md:56-57

The decision skips saving whenever restore application fails because the key already exists. This is only safe for transport/application failures; a corrupt, truncated, or otherwise invalid archive would remain permanently cached and every execution would repeat the failure. Specify validation and a repair/eviction path, or narrow the skip-save rule to known non-corruption failures.

3. 🛑 Critical — Month-boundary accounting can misstate spend

📍 specs/adr/0006-spend-guard.md:28-33

The unfinished-execution term charges the entire duration since 'admitted_at', even when admission occurred in a prior UTC month, while finished executions are included only when admitted this month. Around month rollover this can both overcharge the new month for pre-rollover runtime and omit a prior-month execution when it finishes in the new month, causing the budget guard and release decisions to use an inconsistent month-to-date total. Define explicit month-start clipping and handling for executions spanning or finishing across the boundary.

📋 View full logs & reviewed diff ↗