Source: 2026-09-11 self-audit of v0.19.5 (commit f6f8484), finding D-H9 in the reconciled review; raw finding mech 6.2 ≡ sem 5.14.
Severity: high · Disposition: fix before porting · Evidence: observed fact
Location
core/broadside.ts:1790 (max_cost default); mcp-server/server.ts:1235,2329-2340.
Defect
Pi asks the user before submitting over the estimate; MCP cannot ask and ships with no default max_cost, so a host that calls codecarto_broadside submit with the shipped config spends whatever the estimate is.
Proposed fix
Ship a non-zero default max_cost; MCP refuses a submit over it unless force is passed; make explicit max_cost: 0 spellable as 'unlimited'.
The reimplementation spec carries this as a normative rule with a named acceptance scenario.
Source: 2026-09-11 self-audit of v0.19.5 (commit
f6f8484), finding D-H9 in the reconciled review; raw finding mech 6.2 ≡ sem 5.14.Severity: high · Disposition: fix before porting · Evidence: observed fact
Location
core/broadside.ts:1790(max_costdefault);mcp-server/server.ts:1235,2329-2340.Defect
Pi asks the user before submitting over the estimate; MCP cannot ask and ships with no default
max_cost, so a host that callscodecarto_broadside submitwith the shipped config spends whatever the estimate is.Proposed fix
Ship a non-zero default
max_cost; MCP refuses a submit over it unlessforceis passed; make explicitmax_cost: 0spellable as 'unlimited'.The reimplementation spec carries this as a normative rule with a named acceptance scenario.