Found a concurrency bug in agent budget enforcement — relevant to A2A's own cost/budget gap

[AliAbdallah21]

built a gateway that sits between agents when they hand off tasks over A2A, meters what each handoff costs, and cuts an agent off once it hits a budget.

found a real bug in the budget check under concurrency. it can only gate on spend that's already happened, not the current task's cost, since that's only knowable after the response comes back. that means if a few requests hit the check around the same time, they can all pass even when the budget should only allow one. reproduced it on purpose — budget sized for 1 request, fired 5 at once, all 5 got through.

since this touches the protocol's own lack of a standard cost/budget signal, figured it might be relevant here directly. full writeup here: https://dev.to/ali_abdalla/i-built-a-spending-gate-for-ai-agents-then-i-proved-it-doesnt-hold-under-load-2ca8

repo + the actual test that reproduces it: https://github.com/AliAbdallah21/a2a-cost-gateway

[chopmob-cloud]

Confirmed on our side — this is a classic check-then-act TOCTOU, and it bites any budget gate that reads "spend so far" and then decides, because the read and the write aren't in the same critical section. Firing N concurrent requests against a budget of 1 is exactly the repro; all N read the pre-spend total and all N pass.

The fix that's held up for us is reserve-before-execute under a row lock rather than check-after-settle:

1. Open a transaction and take a lock keyed on the budget/mandate identity — a Postgres transaction-level advisory lock (pg_advisory_xact_lock) or SELECT … FOR UPDATE on the budget row. Concurrent requests on the same budget now serialize instead of racing.
2. Inside the lock, check reserved + committed + this_cost <= cap and, if it passes, write the reservation immediately (decrement/hold) before doing any work.
3. Do the actual task. On success, settle the reservation; on failure, release it.

The key move is that the guard and the debit happen in the same critical section, so the second request blocks until the first commits and then reads the already-reserved total. It costs you serialization per-budget (not global), which for per-agent budgets is usually fine. The only sharp edge is estimating this_cost before the response exists — we reserve a max/estimate and reconcile to actual on settle, which keeps the gate sound even though the true cost is only known afterward.

Nice clean repro, and agreed it points at a real protocol gap: A2A has no standard cost/budget signal, so today everyone has to bolt the meter on at a gateway.