[cristim]

Summary

This is part 3 of 3 for #51. It is stacked on #69. Merge #69 first, then retarget this PR to main.

The per-call USD cap (#69) still let a model repeat a purchase with a fresh idempotency_nonce, region or profile and spend again. Real purchases now also require CUDLY_MCP_BUDGET_USD, a ceiling on the total USD this server process commits.

• Before credentials: authorizeRealPurchase reads the budget, and an unset or invalid value refuses before ResolveClient. It now returns purchaseLimits{usd, budget}.
• Reservation: after enforceUSDCap prices the purchase, its total is reserved against the budget under a mutex, so concurrent calls cannot both pass. One stderr line is logged per reservation.
• Settle: purchaseAndSettle makes the PurchaseCommitment call, logs, audits and settles. Once the purchase is invoked, the reservation stays counted on every error, including an unknown outcome, and on every non-no-op result. Only a clean no-op, or a commitment the library adopted (ExistingCommitment), releases it. Refusals before the purchase call never count.
• Scope of the budget: it lives in memory. It resets on restart, is not shared between processes or MCP clients, and cannot see purchases made elsewhere. The README says so, and the error message names the restart caveat. A persisted budget is not implemented. The owner's question on it went unanswered by its deadline, so the per-process default applies; persistence is tracked in feat(mcp): persist the cumulative purchase budget across restarts and processes #74.
• Operator surface:
  • mcpb/manifest.json: env var in all 3 platform blocks, plus a budget_usd user setting.
  • server.json
  • README spend-cap paragraph and CHANGELOG Breaking / Added entries.
  • The shared unset-cap message now says "to a positive value".

Closes #51. With #66, #69 and this PR, scope items 1 and 2 are implemented. Item 3 (priced RI/CUD preview) was an optional owner decision and is not done. GCP re-enable is #67, auditing refusals is #68 and a persisted budget is #74.

Verification (local, macOS)

Fake-cloud and unit evidence only. No real purchase or cloud call is made. The full suite ran at 909549f; after the rebase onto #69 at 928c95c (range-diff identical), build, vet and go test -race were re-run at 241f692 and pass.

• gofmt, go vet ./... and make build pass.
• go test -race -count=1 ./... passes in all 3 packages. golangci-lint and gosec, both run with GOTOOLCHAIN=go1.26.9, report 0 issues.
• gocyclo -over 10 lists no non-test code. markdownlint passes and both JSON files parse.
• Regression (the feat(mcp): USD spend cap on the execute path and a cumulative purchase budget #51 repeat-call hole): TestBudgetRepeatCallWithFreshNonceRefused makes two identical $60 purchases with different nonces under a $100 budget. With the reserve call disabled both execute and the test fails. With it, the second is refused and no purchase call is made for it.
• Other tests:
  • concurrency under -race (exactly 3 of 10 reservations succeed)
  • a failed purchase stays counted
  • a clean no-op is released
  • an existing commitment is released
  • an amount equal to the limit is allowed
  • an unset budget refuses before resolve
  • env parsing
• Mutation probes (scratch copy, restored): each of these fails tests:
  • disabling reserve
  • settle always releasing
  • > changed to >= in reserve
  • dropping the ExistingCommitment release

Review

An independent reviewer (Sonnet, high effort, non-author) did two passes. It walked every (err, Success, Error, ExistingCommitment) combination and every path between reserve and settle; there are no leaks and no double settle. It also checked the singleton against parallel tests and found no race.

Pass 1 found:

• A detached doc comment: fixed.
• A missing equal-to-limit test, because the >= mutation survived: added, and now caught.
• Unset-message wording that was wrong for the integer count cap: fixed.

Pass 2 found no actionable findings. CodeRabbit is not pinged because the org's CR quota is exhausted.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-mcp/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: e5f542b4-ca31-434b-924b-1ba2e929cf8c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

This closed automatically when #69 merged and its base branch was deleted. It is replaced by #80: the same commit rebased onto main, with an identical range-diff. [claude-mcp-impl]