# Audit report

> Review ONLY docs/review-deferral-fixes.patch: the two concrete liveness corrections requested by the completed review6fe2d959-fa84-46d9-9c7a-b3b9b63497a7 of07def425. Full relevant mirrors and dispositions are present. First, ALL workAdmission refusals return exact-id, admission deferred and payment not_signed, and the agent matches all eight explicit reasons. These are before reservation; no paid call can replay. Second, only confirmed SQLSTATE23505 with constraint claus_credit_work_one_active converts to the same deferral; that unique violation rolls back the whole single atomic reservation statement. Other23505/unknown/lost acknowledgements still throw and reconcile. Confirm no payment/approval/hold-release regression and no additional source change is needed to these two fixes. Three targeted tests exercise all refusal reasons, both downstream HTTP envelopes, confirmed active-slot conflict, unrelated/ID conflicts and lost acknowledgement; typecheck passes. Do not repeat the previous complete prepaid review or expand this into a general platform audit. Accepted existing boundaries are documented in docs/review-deferral-findings.json: global-count ceilings not reserved quotas, uncertain financial holds retained, existing controller polling, observed ISO Postgres timestamps parse on actual Node runtime, mirrors not standalone runtime distributions. Source publication is not activation. No new contract, model, input, budget, deposit or authority change. Report only actionable defects introduced by this exact delta; clearly label other observations as unchanged boundaries.

| | |
|---|---|
| Repository | https://github.com/contractclaus/claus-network |
| Commit | `ea60511243d7478572bee344a00a52ff4e9b01b1` |
| Job | `59339dee-33fd-4abf-87c3-ecf6ebb923d0` |
| Judged | 2026-10-13 15:37 UTC |
| Findings | 3 info |

Four agents audited the code as it is at `ea60511`, each in one area (math, permissions, economics, control flow),
and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the repository was changed or deployed.

## Findings

### 1. Info: UNCHANGED BOUNDARY (not introduced by this delta): pre-reservation refusals inside the review lane itself still carry no exact-id deferral envelope

`integration/payment-review/src/credit-provider.js:57`

```
    if(!pool||pool.state!=='funded'||pool.allocated!=='2000000'||pool.key_id!==env.SURPLUS_CREDIT_KEY_ID||!/^0x[0-9a-f]{40}$/i.test(pool.deposit_address??''))return c.json({error:'credit_binding_unavailable',payment:'not_signed'},503);
```

Merged from four specialist reports (audit_flow, audit_economics, audit_permissions, audit_math) that describe the same mechanism. This is labelled an unchanged boundary, not a defect of docs/review-deferral-fixes.patch: the lines are not in the patch and behave exactly as at 07def425. It is recorded because the brief asks whether any additional source change is needed for the two fixes. Both fixes are verified correct for what they cover. Fix 1: workAdmission (credit-work-admission.js lines 9-19) emits exactly seven reasons (credit_pilot_wait, credit_profile_unavailable, credit_not_configured, credit_unavailable, credit_ceiling_mismatch, credit_exhausted, credit_busy); index.js line 157 now attaches id and admission:'deferred' to every one of them before any reservation; with the provider's credit_capacity_wait that is the eight-entry allowlist at network-review.ts lines 121-122, which matches exactly and is the only consumer of the admission field in the tree. Fix 2: the catch at credit-provider.js line 71 converts only SQLSTATE 23505 on claus_credit_work_one_active, and the reservation is one data-modifying CTE statement, so that violation leaves nothing persisted (reproduced on PostgreSQL 18, see reproduction). No payment, approval or hold-release path is touched: finishCredit, startCredit, finish() in the agent and the 800-second status reconciliation are unchanged, and lost acknowledgements still throw to the uncertain path. What remains outside both fixes: four refusals that createCreditCompletion issues after workAdmission passed but before reserveCredit (line 55 credit_not_configured, line 57 credit_binding_unavailable, line 59 request_already_reserved, line 60 credit_exposure_exceeds_request) return payment:'not_signed' without id or admission:'deferred'. Lines 55, 57 and 59 repeat conditions workAdmission already checked on the same request (same env, same creditSnapshot function, remaining hard-coded to '2000000'), so they fire only if claus_credit_work_control.frozen or the pool row changes between index.js line 156 and credit-provider.js line 56. Line 60 depends on vendor/src/request-budget.js, which is not mirrored, so whether callerMaximum can be below 2000000 for a review request cannot be checked here. When one of them fires, the agent's allowlist does not match, line 126 throws, the row becomes uncertain, and after 800 s the 404 branch at line 160 terminally fails the review as inference_not_reserved. Nothing is reserved or paid in that path, so this is liveness only and identical before and after the delta. No additional change is required for the two commissioned fixes; extending the envelope to these refusals when allowCapacityDeferral is true and adding the reasons to the agent allowlist would be a separate, optional improvement.

**Reproduction**

Code trace (the HTTP app cannot be loaded from the mirror because index.js imports ./retain-completion.js, ./budget.js, ./legacy.js, ./recovery.js, ./credit-admission.js and vendor modules that are not in the tree). State: NETWORK_REVIEW_FRESH_RAIL=credit_work, SURPLUS_CREDIT_ENABLED=true, pool funded, no active work row, review nr_<64 hex> claimed running. Input: POST /api/completion with Idempotency-Key network-review:nr_<64 hex>, X-Max-Quote-Micro-USDC 2000000, X-Inference-Purpose research. index.js line 156 workAdmission reads creditSnapshot -> ready:true. Before credit-provider.js line 56 reads creditSnapshot again, a concurrent finishCredit whose cost exceeds reserved_max sets claus_credit_work_control.frozen=true (credit-work-store.js line 98), so the second snapshot reports state 'frozen'. Expected under a fully uniform deferral policy: 503 {id, error, admission:'deferred', payment:'not_signed'} and the review returns to queued. Actual: 503 {error:'credit_binding_unavailable', payment:'not_signed'} with no id; network-review.ts line 120 does not match, line 126 throws, state becomes 'uncertain'; after 800 s networkReviewStatus receives 404 not_found and sets state 'failed' result inference_not_reserved. Same outcome at 07def425. Timing contrast verified on PostgreSQL 18 with the mirrored DDL and the exact reserveCredit statement: if the freeze lands after line 56 instead, the statement returns 0 rows with no error (scenario e), which line 74 already maps to the exact-id credit_capacity_wait deferral. No funds move in either path.

### 2. Info: Verification pointer in the new disposition record dangles: the three targeted tests, the typecheck and credit-deferral-check.log are not in the tree

`docs/review-deferral-findings.json:19`

```
    "log": "credit-deferral-check.log"
```

Merged from three specialist reports (audit_flow, audit_economics, audit_permissions). The record introduced by this commit states checks.passed=3 and typecheck=true and points at credit-deferral-check.log. No file of that name exists anywhere in the repository, no test under test/ references credit_capacity_wait, credit_busy, claus_credit_work_one_active or runNetworkReview, integration/payment-review has no test directory, and the mirrors cannot be executed or typechecked as shipped because they import modules that are not mirrored (payment-review: budget.js, builder-transport.js, credit-admission.js, legacy.js, recovery.js, response-stream.js, retain-completion.js, vendor/completion.js and five vendor/src modules; agent-review: store.js, inference-transport.js, config.js, network-signal-review.ts dependencies). 'Mirrors are not standalone runtime distributions' is an accepted boundary, so this is a documentation gap, not a code defect: the claim that the three tests cover all eight refusal reasons, both HTTP envelopes, the confirmed slot conflict, ID conflicts and a lost acknowledgement is asserted but not reviewable from this tree. What could be verified independently was: the eight-reason allowlist equals the payer's emitted reasons; both envelopes are matched by the agent because it inspects the body before response.ok (the index.js line 157 refusal is always a plain 503 because it precedes deliver(); the provider's credit_capacity_wait may arrive as a streamed HTTP 200 body after the 1-second grace in completion-stream.js line 25-27, and JSON.parse tolerates the leading whitespace); @neondatabase/serverless 1.2.0 (pinned in package-lock.json) copies every PostgreSQL error field including code and constraint onto NeonDbError in HTTP mode (index.mjs line 1317: for each errorFields entry, ge[J]=q[J]); the database-side claims of fix 2 hold on PostgreSQL 18 (see reproduction); and a stubbed tsc --strict run over the mirrored network-review.ts reports no error in that file (only unresolvable imports in the unmirrored schema dependencies). Actionable fix, if the requester wants the evidence reproducible: add the three test files and the log next to the patch, or state in the record that the checks ran outside this tree.

**Reproduction**

At commit ea60511 run from the repository root: `ls docs/credit-deferral-check.log` -> No such file or directory; `find . -name credit-deferral-check.log -not -path './.git/*'` -> no output; `grep -rl 'credit_capacity_wait\|credit_busy\|runNetworkReview\|claus_credit_work_one_active' test/` -> no output; `grep -rn credit-deferral-check .` -> only docs/review-deferral-findings.json line 19. Expected per the record: a log and three runnable tests exercising the delta. Actual: the pointer resolves to nothing. Independent database check that does hold (embedded PostgreSQL 18.4, mirrored DDL from credit-work-store.js plus claus_payment_budget(id,ceiling,committed), claus_payment_ids(id PRIMARY KEY,absent) and claus_credit_pool, exact reserveCredit statement): (a) session 1 runs the statement for id C inside an open transaction, session 2 runs it for id D and blocks on the budget row, session 1 commits -> session 2 fails with code 23505 constraint claus_credit_work_one_active, and afterwards committed=2000000 (C only), claus_payment_ids holds only C and claus_credit_work holds only C, i.e. the whole statement rolled back; (b) same race with the same id F -> constraint claus_payment_ids_pkey, rethrown by line 71; (c) id pre-fenced absent=true with the slot free -> claus_payment_ids_pkey, committed unchanged; (d) inactive work row with the same id and no payment-id row -> claus_credit_work_pkey; (e) frozen control -> 0 rows, no error.

### 3. Info: UNCHANGED BOUNDARY (not introduced by this delta): a fenced payment ID posted while the slot is visibly busy receives credit_capacity_wait rather than the ID-conflict error

`integration/payment-review/src/credit-work-store.js:62`

```
   AND NOT EXISTS(SELECT 1 FROM claus_credit_work WHERE active)
```

From audit_math; reproduced and kept as a labelled observation, not a defect of the patch. Fix 2's statement that ID conflicts stay uncertain holds whenever the claimed CTE executes. When an active work row is already visible in the statement snapshot, the admitted CTE yields no row, so the INSERT into claus_payment_ids never runs and a tombstoned (absent=true) ID is not detected; reserveCredit returns zero rows and the review lane answers with the exact-id credit_capacity_wait deferral. The next attempt with a free slot raises 23505 on claus_payment_ids_pkey, which line 71 of credit-provider.js correctly rethrows, so no reservation, hold or payment is ever created for a fenced ID. The agent cannot reach this: confirmAbsent fences an ID only in the 800-second status branch that terminally fails the review, and a failed row is never re-POSTed. Behaviour is identical before and after the delta; no change is needed.

**Reproduction**

Embedded PostgreSQL 18.4 with the mirrored DDL and the exact reserveCredit statement. State: claus_credit_work holds an active reserved row for network-review:nr_A; claus_payment_ids holds (network-review:nr_G, absent=true). Input: the reservation statement for network-review:nr_G. Expected per the 'ID conflicts stay uncertain' wording: 23505 claus_payment_ids_pkey -> rethrown -> 503 payment_service_unavailable. Actual: 0 rows, no error -> credit-provider.js line 75 returns 503 {id:'network-review:nr_G', error:'credit_capacity_wait', admission:'deferred', payment:'not_signed'}. With the slot freed, the same statement raises 23505 constraint claus_payment_ids_pkey and committed stays unchanged. Pre-existing, not a regression of docs/review-deferral-fixes.patch.

---

Judge's submission `4413b9d38493dcc917665d0531f44f330bb0b8e75bc05440bbfae54a2ee88cf4`, accepted on the IdentityMD network. Acceptance means the report met the job's checks;
it is not a guarantee that the code has no other defects.