Verification — P2.4.1 Capability Gates (derived limits)

Task ID: fcaac02d-62bd-4ecc-8cdd-23984731c787 Branch: feature/p2-4-1-limits Base: main @ 7e5cf9d3 Date: 2026-05-12 Step: 5 of 5 (audit → contract → packet → implement → verify)

§1. Scope

This document is evidence that the implementation in feat(p2-4-1-limits): … (commit 9ed9f80d) satisfies every acceptance criterion from p2-4-1-limits-contract.md §6.

All three Phase 0 gates passed (npm run build && npm run lint && npm test).

§2. Files shipped

Action	Path	Lines
CREATE	docs/audits/p2-4-1-limits-audit.md	227
CREATE	docs/contracts/p2-4-1-limits-contract.md	231
CREATE	docs/packets/p2-4-1-limits-packet.md	169
CREATE	src/domains/reputation/limits.ts	235
CREATE	src/__tests__/domains/reputation/limits.test.ts	322
CREATE	docs/verification/p2-4-1-limits-verification.md	this file

No edits to existing files.

§3. Gate results

§3.1 npm run build

> colibri@0.0.1 build
> tsc

> colibri@0.0.1 postbuild
> node scripts/copy-migrations.mjs

copy-migrations: copied 7 migration(s) ...

Exit 0. TypeScript compilation clean.

§3.2 npm run lint

> colibri@0.0.1 lint
> eslint src

Exit 0. ESLint clean — zero errors, zero warnings.

§3.3 npm test

Test Suites: 53 passed, 53 total
Tests:       2552 passed, 2552 total
Snapshots:   0 total
Time:        51.535 s
Ran all test suites.

Exit 0. 2552 / 2552 passing. Baseline claimed in dispatch was 2478; the delta is +74 tests / 0 regressions. (The 32 new tests in limits.test.ts account for half of the delta; the remaining ~42 are likely from intervening slices not reflected in the dispatch packet’s baseline number, since the worktree was branched from origin/main @ 7e5cf9d3.)

§3.4 New file isolation run

A targeted run of npx jest src/__tests__/domains/reputation/limits.test.ts confirmed 32/32 tests pass in isolation (one suite, all green). The full npm test invocation is the binding gate; the isolation run is supplementary evidence that the new file is self-contained and does not depend on cross-test ordering.

§4. Coverage on limits.ts

Jest coverage output for the file under test (--coverage enabled by default):

Metric	Value
% Statements	96
% Branches	93.33
% Functions	100
% Lines	96
Uncovered lines	77

Line 77 is the module-load defensive throw in the if (typeof isqrt !== 'function' || …) guard. That branch is only reachable if the κ BUILTINS table ever drops the isqrt or ilog2 entries — which the P1.3.2 contract guarantees it will not. Mocking the κ surface to force the guard would require deep dependency injection that’s out of scope for a Phase 2 verification slice; the existence of the guard is the contract’s defence-in-depth posture, not a tested branch.

All five public functions are 100% covered. Every branch on score < 20n, score > 1n, score > 1000n, ban_until_epoch !== null, and the ban comparison is exercised by a boundary test.

§5. Acceptance criteria — traced to tests

Mapping from p2-4-1-limits-contract.md §6 to limits.test.ts cases:

AC	Statement	Test cases
AC-1	max_parallel_tasks returns bigint ∈ [0n, 20n], exact cap at score=400	returns 0n when execution score is 0, returns 19n at score=399, returns 20n at score=400, returns 20n at score=401, returns 20n at score=10000
AC-2	rate_limit_bonus returns bigint ≥ 0n; returns 0n at score ∈ [0, 1]	returns 0n at score=0, returns 0n at score=1, returns 1n at score=1024 with base_rate=1000n, returns 1n at score=10000 with base_rate=1000n, returns 100n at score=1024 with base_rate=100000n
AC-3	stake_discount floors at score=1000; stake×10 at floor, stake×1 at 10000	returns stake×10 at score=0, returns stake×10 at score=999, returns stake×10 at score=1000, returns stake×2 at score=5000, returns stake×1 at score=10000
AC-4	can_arbitrate is true iff arb≥5000 ∧ exec≥3000 ∧ ¬banned	7 cases under describe('can_arbitrate', …) covering all three sub-gates + ban off-by-one trio
AC-5	can_govern is true iff gov≥4000 ∧ ¬banned	5 cases under describe('can_govern', …)
AC-6	All five functions are pure (idempotent)	5 cases under describe('determinism — same inputs yield same outputs', …) — one per derivation
AC-7	Determinism scanner clean on limits.ts	src/__tests__/domains/reputation/determinism.test.ts reputation corpus self-scan test passes — automatically extended via the src/domains/reputation/** glob shipped in P2.1.2
AC-8	ESLint clean on both files	npm run lint exit 0
AC-9	Build + lint + test all green; +15–25 tests over baseline	Build exit 0, lint exit 0, test 2552/2552 (+74; 32 of those are this slice’s new tests)

All nine ACs satisfied.

§6. Boundary matrix audit

Cross-check against the contract §7 test matrix (15 mandatory boundary cases + ≥ 5 defensive):

Function	Required boundary	Test case in limits.test.ts
max_parallel_tasks	score=0 → 0n	line 64 returns 0n when execution score is 0
max_parallel_tasks	score=399 → 19n	line 69 returns 19n at score=399 (just below the cap)
max_parallel_tasks	score=400 → 20n	line 75 returns 20n at score=400 (exact cap boundary)
max_parallel_tasks	score=401 → 20n	line 81 returns 20n at score=401 (cap active just above isqrt=20)
max_parallel_tasks	score=10000 → 20n	line 87 returns 20n at score=10000 (cap active; isqrt=100 capped)
rate_limit_bonus	score=0, br=1000 → 0n	returns 0n at score=0 (floor activates max(0n,1n) → ilog2(1n)=0n)
rate_limit_bonus	score=1, br=1000 → 0n	returns 0n at score=1 (ilog2(1n)=0n)
rate_limit_bonus	score=1024, br=1000 → 1n	returns 1n at score=1024 with base_rate=1000n
rate_limit_bonus	score=10000, br=1000 → 1n	returns 1n at score=10000 with base_rate=1000n
rate_limit_bonus	score=1024, br=100000 → 100n	returns 100n at score=1024 with base_rate=100000n
stake_discount	score=0 → 10000n	returns stake×10 at score=0 (floor activates at 1000n)
stake_discount	score=999 → 10000n	returns stake×10 at score=999 (floor still active)
stake_discount	score=1000 → 10000n	returns stake×10 at score=1000 (exact floor)
stake_discount	score=5000 → 2000n	returns stake×2 at score=5000
stake_discount	score=10000 → 1000n	returns stake×1 at score=10000 (no effective discount)
can_arbitrate	arb=4999, exec=3000 → false	returns false when arbitration score is below 5000 (4999, exec OK)
can_arbitrate	arb=5000, exec=2999 → false	returns false when execution score is below 3000 (arb OK, exec 2999)
can_arbitrate	arb=5000, exec=3000 → true	returns true at exact thresholds (arb=5000, exec=3000, no ban)
can_arbitrate	ban=10, ce=9 → false	returns false when banned and current_epoch < ban_until (10 > 9)
can_arbitrate	ban=10, ce=10 → true	returns true when current_epoch == ban_until (ban over; 10 > 10 is false)
can_arbitrate	ban=10, ce=11 → true	returns true when current_epoch > ban_until (ban over)
can_arbitrate	arb=10000, exec=10000 → true	returns true well above all thresholds with no ban
can_govern	gov=3999 → false	returns false below threshold (gov=3999)
can_govern	gov=4000 → true	returns true at exact threshold (gov=4000)
can_govern	ban=10, ce=9 → false	returns false when banned (gov=4000, ban_until=10, current_epoch=9)
can_govern	ban=10, ce=10 → true	returns true when ban_until == current_epoch (ban over; 10 > 10 is false)
can_govern	gov=10000, ce>ban → true	returns true when well above threshold and ban over

15 mandatory boundary cases (5 + 5 + 5 from the prompt) all covered, plus 12 additional defensive / off-by-one cases, plus 5 determinism cases. Total 32.

§7. Forbidden-pattern audit (manual)

A targeted search for the κ determinism scanner’s forbidden tokens against the production source src/domains/reputation/limits.ts:

Pattern	Matches
Math.*	0
Date.*	0
new Date	0
setTimeout / setInterval / setImmediate	0
fetch / XMLHttpRequest	0
require\\(.*fs.*\\) / from .*fs.*	0
crypto.*	0
process.hrtime / process.nextTick	0
await / async fn	0
float literal (regex (?<![0-9n])\\b\\d+\\.\\d+\\b)	0 (in stripped-comment code)

Comment-resident 2.1, 2.4.1, etc. tokens are stripped by the scanner before matching, per determinism.test.ts §stripComments. The scanner run (Test Suite reputation corpus self-scan) is part of the 2552/2552 green run.

§8. Out-of-scope items not implemented (correctly)

• ❌ No MCP tool registration in src/server.ts — P2.5.1 will compose these five functions behind reputation_check_gates later.
• ❌ No DB schema changes — pure-function slice.
• ❌ No edits to compute.ts, decay.ts, penalties.ts, schema.ts, builtins.ts, integer-math.ts, or bps-constants.ts.
• ❌ No reading of rep.scar_bps or rep.last_activity_epoch (not in the derivation algebra; correctly ignored).
• ❌ No package upgrades or tsconfig changes.

§9. Residual risk register

Risk	Status
κ BUILTINS surface drift (rename isqrt → other)	Mitigated by §B module-load guard in limits.ts (will throw on load if either name is missing).
BigInt(rep.score) overflow	Unreachable — schema validates 0 ≤ score ≤ 10000.
stake_discount safe_mul overflow on absurd inputs	Possible for required_stake > INT64_MAX / BPS_100_PERCENT ≈ 9.22 × 10^14. Realistic stakes are «10^12; safe in practice. Caller validation owns this boundary.
BigInt(rep.ban_until_epoch) on a negative epoch	Schema allows number.int() without sign restriction. Implementation handles it correctly: BigInt(-5) > BigInt(0) is false, so a negative ban_until_epoch correctly reads as “not banned”.
Future readers misinterpreting sqrt_floor vs isqrt naming	Documented explicitly in limits.ts JSDoc header §”κ DSL naming alias note”.

§10. Sign-off

All acceptance criteria (AC-1 through AC-9 of the contract) are satisfied with test evidence. All three Phase 0 gates pass (build + lint + test exit 0). The implementation matches the contract §4 algorithms line for line. The boundary matrix in §7 of the contract is fully covered, with margin.

Ready for PM review and merge.

— End of verification —