feat: Introduce `OutOfCycles` error for flexible outcalls by eichhorl · Pull Request #11040 · dfinity/ic

eichhorl · 2026-08-05T14:56:22Z

A flexible outcall whose committee has spent too much of its per-replica allowances to cover the consensus cost of delivering any response used to sit pending until it timed out. It is now reported to the caller as FlexibleHttpGlobalError::OutOfCycles as soon as that is provable.

The proof is the signed receipts seen so far: what is left of the committee's collective allowance is at most their unspent allowances plus a full allowance for every member not seen yet, and delivering a response costs at least min_flexible_consensus_cost of the same receipts.

For an ok response, at least min_responses ok shares need to be included, whereas for a reject response at least total_requests - min_responses + 1 reject shares must be included. This determines how many "unseen" shares we need to consider in order to build the out of cycles proof.

…y/ic into eichhorl/switch-to-spent-receipts

…ity/ic into eichhorl/use-ctxt-size-and-schedule

…ichhorl/deliver-spent

…rl/cover-consensus-cost

An unfundable flexible outcall now stays pending until it times out, rather than being reported to the caller as `OutOfCycles`. The error, the lower bound on the consensus cost that decides it, and their tests move to eichhorl/out-of-cycles-error, which targets this branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

A flexible outcall whose committee has spent too much of its per-replica allowances to cover the consensus cost of delivering any response used to sit pending until it timed out. It is now reported to the caller as `FlexibleHttpGlobalError::OutOfCycles` as soon as that is provable. The proof is the signed receipts seen so far: what is left of the committee's collective allowance is at most their unspent allowances plus a full allowance for every member not seen yet, and delivering a response costs at least `min_flexible_consensus_cost` of the same receipts. A share arriving later can only lower the former and raise the latter, so the verdict never flips back. Omitting a receipt does not help a proposer either, since an unreported replica is credited a full allowance. `min_flexible_consensus_cost` bounds the two results that deliver bodies — a group of `min_responses` successful responses, or the rejects proving a `TooManyRejects` — by their cheapest form, counting only bodies that must come out of the receipts seen at their actual size, and skipping a result that is no longer reachable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…les-error

Copilot

Pull request overview

Adds early OutOfCycles reporting for flexible HTTP outcalls based on signed spending receipts and minimum delivery cost.

Changes:

Adds protobuf and internal error representations.
Computes and validates exhaustion proofs.
Adds pricing and consensus tests.
Includes an unrelated, inactive delegation module.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`rs/types/types/src/batch/canister_http.rs`	Adds serialization and accounting for `OutOfCycles`.
`rs/protobuf/src/gen/types/types.v1.rs`	Adds generated protobuf types.
`rs/protobuf/def/types/v1/canister_http.proto`	Defines the new wire-format variant.
`rs/interfaces/src/canister_http.rs`	Adds validation failure reasons.
`rs/https_outcalls/pricing/src/fees.rs`	Computes minimum deliverable-response cost.
`rs/https_outcalls/consensus/src/payload_builder/utils.rs`	Detects and constructs exhaustion proofs.
`rs/https_outcalls/consensus/src/payload_builder/tests.rs`	Tests construction and validation behavior.
`rs/https_outcalls/consensus/src/payload_builder.rs`	Validates, accounts for, and returns the error.
`rs/canonical_state/src/delegation.rs`	Adds an unrelated, undeclared delegation module.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

zeropath-ai · 2026-08-07T12:31:30Z

✅ No security or compliance issues detected. Reviewed everything up to afe7f1c.

Security Overview

🔎 Scanned files: 8 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/f5e9d2bb-29a4-4b64-902a-391d65fd8b2d?scanId=fcd18713-af22-454e-a416-24c5ba4fcf23&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► rs/https_outcalls/consensus/src/payload_builder.rs Implement OutOfCycles handling and integrate Cycles import ► rs/https_outcalls/consensus/src/payload_builder.rs Extend error handling to include OutOfCycles in flexible responses ► rs/https_outcalls/consensus/src/payload_builder/tests.rs Add tests for OutOfCycles behavior and validation scenarios ► rs/https_outcalls/consensus/src/payload_builder/utils.rs Add OutOfCyclesProof struct and check_out_of_cycles function ► rs/https_outcalls/pricing/src/fees.rs Add min_flexible_consensus_cost function and supporting logic ► rs/interfaces/src/canister_http.rs Add FlexibleOutOfCycles variants to InvalidCanisterHttpPayloadReason enum ► rs/protobuf/def/types/v1/canister_http.proto Define FlexibleCanisterHttpOutOfCycles message and wire into errorDetails ► rs/protobuf/src/gen/types/types.v1.rs Add FlexibleCanisterHttpOutOfCycles message struct and fields ► rs/types/types/src/batch/canister_http.rs Extend FlexibleCanisterHttpError enum with OutOfCycles variant and associated fields ► rs/types/types/src/batch/canister_http.rs Update count_bytes and conversion logic to support OutOfCycles

pierugo-dfinity · 2026-08-10T08:23:20Z

    }
 }

+pub(crate) struct OutOfCyclesProof {


Maybe add a comment that explains that the "proof" is that unspent_allowance is smaller than min_cost?

pierugo-dfinity · 2026-08-10T08:59:08Z

+    let mut unspent_allowance = Cycles::zero();
+    let mut seen = 0;
+    for share in seen_shares {
+        unspent_allowance += allowance - share.content.spent();
+        seen += 1;
+    }
+    unspent_allowance += allowance * committee_size.saturating_sub(seen);


This could be simplified with something like

let unspent_allowance = allowance * committee_size - seen_shares.iter().map(|share| share.content.spent()).sum();

pierugo-dfinity · 2026-08-10T09:32:23Z

+    subnet_size: NumberOfNodes,
+    committee_size: usize,
+    min_responses: u32,
+) -> Option<Cycles> {


Can this function ever return None?

pierugo-dfinity · 2026-08-10T09:47:31Z

        /// The total amount of cycles spent by the subnet to produce this response.
        initial_spent: Cycles,
    },
+    OutOfCycles {


Who is paying for the block space used by this new error message if the canister has not attached enough cycles?

pierugo-dfinity · 2026-08-10T09:50:56Z

+        // A committee of 4 that has all responded successfully, but needs 10
+        // responses: neither the 10 successes nor a reject can still turn up, so


Is this scenario realistic?

pierugo-dfinity · 2026-08-10T10:01:02Z

+                        callback_id,
+                        context,
+                    )
+                    .map_err(CanisterHttpPayloadValidationError::InvalidArtifact)?;


Maybe could we add some debug_asserts that in the Err case, .min_cost <= .unspent_allowance and in the Ok case, .min_cost > .unspent_allowance?

pierugo-dfinity · 2026-08-10T10:05:46Z

+            reject_share(0, 50, 0),
+            reject_share(1, 50, 0),
+            reject_share(2, 50, 0),


Could be interesting to have different content sizes to make sure we select the 2 smallest responses

eichhorl and others added 30 commits July 8, 2026 09:07

spent

ac96a9e

spend can exceed allowance on free subnets

a383497

deliver

77ed954

merge

47483d5

comment

e57d9c4

limit

e375240

review

f56db0d

wording

9c9cb37

bound

0f603b3

Merge branch 'eichhorl/switch-to-spent-receipts' of github.com:dfinit…

ea0c318

…y/ic into eichhorl/switch-to-spent-receipts

merge

a8f7edc

clean

1d5e743

tests

ce71533

test

b17c562

.

dc0ace7

Automatically updated Cargo*.lock

2651fa6

fix

7de89c8

clean

cf70f90

Merge branch 'eichhorl/use-ctxt-size-and-schedule' of github.com:dfin…

61f0ba9

…ity/ic into eichhorl/use-ctxt-size-and-schedule

merge

5df4c80

fix

4eb7990

fix

a9d52da

fix

29d00e4

unify pricing

9387429

Automatically updated Cargo*.lock

1ad7149

clean

1777d91

Merge branch 'eichhorl/deliver-spent' of github.com:dfinity/ic into e…

f633f7e

…ichhorl/deliver-spent

clean

8a20297

split

923c26d

fix

4c808f8

eichhorl and others added 10 commits July 31, 2026 12:05

merge

665edde

merge

aed98db

Merge branch 'eichhorl/cover-consensus-cost-non-flexible' into eichho…

d10feb6

…rl/cover-consensus-cost

merge

c9dd362

merge

dfd893d

fix

d71eaed

out of cycles

97b4a76

Automatically fixing code for linting and formatting issues

834654a

github-actions Bot added the feat label Aug 5, 2026

Merge branch 'eichhorl/cover-consensus-cost' into eichhorl/out-of-cyc…

ec03aa5

…les-error

Base automatically changed from eichhorl/cover-consensus-cost to master August 6, 2026 12:50

eichhorl added 5 commits August 6, 2026 14:00

merge

743ecf0

revert

1aac90a

clean

9d2264d

clean

97a5660

fix

5082d31

eichhorl force-pushed the eichhorl/out-of-cycles-error branch from 5eb2e2c to 5082d31 Compare August 7, 2026 12:16

eichhorl requested a balanced review from Copilot August 7, 2026 12:18

Copilot started reviewing on behalf of eichhorl August 7, 2026 12:19 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Comment thread rs/https_outcalls/consensus/src/payload_builder/utils.rs

Comment thread rs/https_outcalls/consensus/src/payload_builder/utils.rs

Comment thread rs/canonical_state/src/delegation.rs Outdated

fix

afe7f1c

eichhorl force-pushed the eichhorl/out-of-cycles-error branch from 661f084 to afe7f1c Compare August 7, 2026 12:24

eichhorl changed the title ~~feat: OutOfCycles flexible error~~ feat: Introduce OutOfCycles error for flexible outcalls Aug 7, 2026

eichhorl marked this pull request as ready for review August 7, 2026 12:30

eichhorl requested a review from a team as a code owner August 7, 2026 12:30

github-actions Bot added the @core-protocol label Aug 7, 2026

pierugo-dfinity reviewed Aug 10, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat: Introduce `OutOfCycles` error for flexible outcalls - #11040

feat: Introduce `OutOfCycles` error for flexible outcalls#11040
eichhorl wants to merge 73 commits into
masterfrom
eichhorl/out-of-cycles-error

eichhorl commented Aug 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zeropath-ai Bot commented Aug 7, 2026

Uh oh!

pierugo-dfinity Aug 10, 2026

Uh oh!

pierugo-dfinity Aug 10, 2026

Uh oh!

pierugo-dfinity Aug 10, 2026

Uh oh!

pierugo-dfinity Aug 10, 2026

Uh oh!

pierugo-dfinity Aug 10, 2026

Uh oh!

pierugo-dfinity Aug 10, 2026

Uh oh!

pierugo-dfinity Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		// A committee of 4 that has all responded successfully, but needs 10
		// responses: neither the 10 successes nor a reject can still turn up, so

Uh oh!

Conversation

eichhorl commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zeropath-ai Bot commented Aug 7, 2026

Uh oh!

pierugo-dfinity Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

pierugo-dfinity Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

pierugo-dfinity Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

pierugo-dfinity Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

pierugo-dfinity Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

pierugo-dfinity Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

pierugo-dfinity Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

eichhorl commented Aug 5, 2026 •

edited

Loading