feat(engine): COND-1 — rules that read the clock and the meter

[ericlovold]

The second approved engine arc, on the pattern INHERIT-1 proved. A tool rule can now carry a when — a closed vocabulary, exactly one predicate per rule, restrictive effects only. No DSL, no expression language: composition is more rules, which stays simulable and explainable.

The two predicates

Predicate	The sentence it enables
outside_hours_utc: [start, end)	"Production deploys escalate to a human outside business hours" — midnight wrap supported
after_model_calls_today: N	The runaway breaker: "once this agent's model calls pass N today, block everything until a human looks"

An allow is never conditional — allow-list semantics never depend on a clock or a counter.

The design correction, recorded not hidden

The design doc proposed maxDecisionsPerDay. Implementation surfaced the data problem: allowed tool calls are decision-only and never persisted, so a "decisions today" counter would be blind to exactly the runaway loops it targets. The shipped signal is model calls today (persisted token logs) — always real, always counted. The doc carries the correction, same ritual as INHERIT-1's concat fix.

Determinism (ADR-0009)

Signals are captured once per request by the enforcement shell — the UTC hour, and the token-log count fetched only when some layer actually conditions on it (proven by a test asserting zero counter queries otherwise) — passed into the pure ladder, and persisted in the decision's evidence. Replay reads the stored snapshot, never the live clock. A rule whose signal is absent from a context is deterministically inactive, so pre-COND rows replay unchanged.

Composition

• Precedence: block → conditional block → allow-list → escalate → conditional escalate
• Inheritance: conditions ride the INHERIT-1 layers — an org-level breaker binds every team below (route-tested)
• Parity: AuthZEN PDP wired with the identical signal contract
• Write path: new Policy.toolConditions Json column (migration included), validated in lib/policy.ts (exactly one predicate, hour bounds, start ≠ end), already writable via PATCH /wallets/policy and console actions through the shared policyInputSchema; OpenAPI documents the shape
• Console: tool-posture card counts conditionals; the inherited card names them (render-checked)
• Simulate boundary, stated: the tool ladder predates SIM-1's simulatable set; candidate tool_conditions echo back in ignored_fields

Verified

• 17 new tests: window boundaries + midnight wrap, threshold edges with the counts in the reason string, absent-signal inactivity, precedence (conditional block beats allow-list mention; unconditional block beats conditional escalate), prefix-glob; route-level threshold deny with signals asserted in the persisted evidence, lazy counter proven, parent-condition-binds-child
• Live-fired both predicates in both directions against the seeded Meridian org — deploy escalated outside the window with the labeled reason (…requires human approval outside 02–03 UTC (deploy.*)), allowed inside it; batch.* allowed at 0 calls, denied at the threshold with after 2 model calls today (2 so far) — including catching and redoing a false positive where a leftover unconditional escalate masked the conditional one
• tsc clean · eslint 0 errors · 1130 passing

Truth surfaces (same PR)

TRACEABILITY COND-1 row + suite map · DOMAIN · roadmap Now ("Rules that read the clock and the meter") · changelog entry · design doc stamped with the correction · backlog checked off.

Both engine items from the sprint-C queue are now shipped. Next signals (spend pace, denial rate) wait until each has an honest persisted source.

---

Generated by Claude Code

---

Note

^{Cursor Bugbot is generating a summary for commit f0f69d2. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sanction	Ready	Preview	Aug 20, 2026 12:57am

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5d5e9d08-7c23-40cc-b451-fa639a94f353

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f0f69d2. Configure here.}

[cursor]

Replay loses conditional escalate code

Medium Severity

Idempotent replay of a tool escalation always reports TOOL_ESCALATION_REQUIRED and its remediation. A live TOOL_CONDITION_ESCALATION_REQUIRED decision therefore comes back as an unconditional escalate on retry or status poll, so agents replan against the wrong code.

 

^{Reviewed by Cursor Bugbot for commit f0f69d2. Configure here.}