Re-check the standing lease when a proposal is committed

[b-macker]

Summary

agent.propose() gates the standing lease when candidates are generated. agent.commit() did not gate it at all. Since the deliberation gap between the two is the entire point of propose/commit, a wall-clock lease can lapse inside that gap and the commit lands anyway.

Reproduced against the stub with standing_lease_seconds: 2 — propose, wait 4s, commit:

PROPOSED turns=0
COMMIT_SUCCEEDED turns=1        <- turn advanced, history appended
SEND_DENIED (lease enforced on send path)

Same handle, same instant, same expired lease: send refused, commit went through. This isn't an agent attack — it's the intended adjudication workflow, and it's a recurrence of the bug leaseExpiredLocked() was extracted to fix one layer up (propose once checked only the turn-based half). Authority is time-varying; a proposal is not, so the check belongs on the commit half.

Changes

• src/stdlib/agent_impl.cpp — agentCommit() calls the existing leaseExpiredLocked() inside its existing s_agent_mutex block (no new lock, no lock-ordering change, no I/O), evaluating under the lock and enforcing outside it, matching agentPropose()'s shape. Refusal mirrors the two existing shapes so callers keep matching on them: the step-up substring when step_up_enabled (renewable — agent.send() resets both lease halves on a passed challenge), the hard "lease expired" wording when there's no re-auth path.
• examples/living-script_extended/src/living-script.naab — the one real consumer, and the exact affected config (standing_lease_seconds: 600 + propose_candidates_max: 3). It previously wrapped only propose in its step-up remedy, so a commit-time expiry would have been swallowed by the outer handler and surfaced as "propose/commit produced nothing" rather than "lease expired". Now pairs a pre-emptive lease_remaining_seconds renewal with a one-shot retry. The retry redoes propose → select → commit as a unit, because the re-authorizing send invalidates outstanding proposals by design — retrying just the commit cannot work.
• tests/governance_v4/test_propose_commit.sh — new Group G.
• CLAUDE.md — the propose/commit section documented the old behaviour ("commit has no step-up/lease gate of its own") and would have become wrong.

Scope

Only the wall-clock half can fire. Turns cannot advance between propose and commit, so a turn-based lease that passed propose is still valid at commit by construction. G-02 holds that claim honest instead of assuming it.

Deliberately not included

Each traced to a concrete failure rather than left out by omission:

• reloadIfChanged() — an accepted reload runs onAgentConfigChanged(), which re-baselines mandate_keywords and clears the alignment histories; the candidate was generated at propose time under the old mandate, so S11/S20 would score it against an instruction it never received. It also swaps rules_ptr_ atomically, dangling config.
• hard_stopped — a run-level budget kill; every existing call site guards a path about to spend. commit makes no API call and the candidate was paid for at propose time.
• governance_epoch_ equality stamp — it increments on pulse verdict transitions as well as config reloads, and the pulse sawtooths, so proposals would be voided during normal degraded operation.

reload_count_ stamping remains open — it's the honest remainder of "current governance conditions", but it adds a second refusal mode and deserves its own change.

Test Plan

• test_propose_commit.sh — 18/18, Groups A–F unchanged, G-01/G-02/G-03 new
• Verified the gate is load-bearing, not vacuous: temporarily stubbing lease_expired = false makes G-01 and G-03 fail while G-02 still passes (G-02 covers the path the gate must not touch)
• test_split_commit.sh 11/11 — commit-path regression
• tests/security/test_error_msg_leaks.sh — 874 checks, 0 failures (new error text)
• bash run-all-tests.sh — 441 tests, 0 unexpected failures
• living-script: parse clean; check diagnostics unchanged at 35 before and after (the two in the edited region are the pre-existing "analyzer doesn't know stdlib modules" class, orchestra/codegen)
• living-script end-to-end against the live Gemini API — both remedy layers driven deliberately, each forced rather than left to whichever happened to fire:
  • Pre-emptive (lease_floor_seconds = 999999): PROPOSE_SELECT|lease_preemptive_reauth|remaining=494 → PROPOSE_SELECT|committed=true
  • Retry (lease_floor_seconds = 0, standing_lease_seconds: 30): PROPOSE_SELECT|step_up_reauth|attempt=1 → PROPOSE_SELECT|committed=true
  • Both temporary config edits reverted; branch carries no leftover changes.

Note on what the live run does and does not establish: it proves the remedy wiring end to end (refusal → re-authorize → re-propose → commit). The commit-boundary gate itself is proven by G-01 against the stub, which is deterministic. In a live run the 30s lease is already expired by the time the phase executes, so the refusal is raised at propose and the unified catch handles it identically — timing an expiry to land precisely inside the propose→commit window is not reliably reproducible, which is exactly why that case belongs in the stub test.

Related Issues

None.

[github-actions]

NAAb Governance Report

Metric	Count
Files checked	16
Passed	16
Failed	0

All governance checks passed!

_{Generated by NAAb Governance Engine v4.0}