Two bounds that did not cover what they claimed to.
config_hash covered the agent table, not the block
config_hash is recorded with each consultation for provenance and compared by the dashboard's restart banner — the only way one process can tell the separate MCP server is still running an older file. It hashed the agent table alone.
Reviewers, roots, workflow bindings, spend ceilings and timeouts could all change without moving it, so the banner stayed silent on most of what the dashboard itself can edit, and a stored reply recorded the routing table that answered it while saying nothing about the ceilings it was answered under.
It now covers everything the MCP server reads at boot and cannot re-read — every field except dashboard:, which belongs to a process that re-reads the file on every request, so a port change there needs no restart and a banner demanding one would be wrong.
On upgrade the banner fires once. Widening moves every hash, so the first dashboard load after this finds a stored row that cannot match. That is not a false positive: a server still serving those rows is running the old code. Restart it and it clears.
consult.spend bounded reviews and workflows, not consultations
Three enforcement sites, none of them on orchestrator_consult. That tool takes a consultation_id and resumes the session behind it, so every call after the first spends another turn against the same paid CLI, and neither the review ceiling nor the workflow one was ever asked about it.
Two new optional ceilings:
consult:
spend:
max_cost_usd_per_consultation: 2.0
max_turns_per_consultation: 8Absent by default like the other four, so nothing changes for a config that does not set them. Checked where the public bind, the reviewer bind and the workflow bind converge, so one check covers every door — reviewers and workflow steps are consultations too, and are now bounded by their own ceiling as well as the ones above them.
A consultation with no turns is never refused: nothing has been spent, so no ceiling has been reached. What these stop is the turn after one. The refusal is checked before the turn is written, so it costs nothing and does not push the total further past the bound it is refusing to cross.
Set the turn ceiling as well as the dollar one if your routing includes an agent on a flat-rate plan — codex and antigravity report no per-turn price, so a dollar ceiling over them never leaves $0.00.
Also in this tag
No behavior change: three functions and one script that nothing in the source, the tests, the workflows or the packaging called were removed, and a lease test that asserted a wall-clock deadline no shared CI runner can honour now asserts only the renewal it is named for.
Install
pip install --upgrade orchestrator-mcp-server
brew upgrade orchestrator-mcp-server