Fix paid submission guardrails

[ammaster10s]

Summary

• enforce submit N as a global cap on actual paid batch submissions
• block HALT, CUT, and unknown governor decisions; allow only PROCEED and STRETCH
• return distinct nonzero CLI status for invalid input and governor blocks
• keep unharvested jobs in projected future cost until the ledger records actual spend
• add regression coverage for stage caps, sparse stages, zero-row builds, CLI behavior, governor thresholds, and in-flight cost reservation

Why

The previous implementation parsed N but did not use it, so submit 1 could fill every free per-stage slot. CUT was advisory and still allowed the uncut workload to be submitted. Live completion counts also reduced projected future cost before those jobs appeared in the spend ledger, which could make reserved paid work disappear from the governor projection.

Behavior

• N is the maximum number of successful batch.submit calls per invocation.
• N=0 is a successful no-op; negative, non-integer, or extra values are usage errors.
• HALT, CUT, and unknown decisions perform no build, submit, save, or state mutation and return exit code 3.
• PROCEED and STRETCH retain their existing submission behavior.
• Per-stage in-flight caps remain independent upper bounds.

Verification

• python3 -m unittest discover -s tests
• 72 tests passing
• git diff --check

Follow-up

This focused PR does not solve the pre-existing crash window between Vertex accepting a job and local state persistence. Durable pre-submit attempt reservation and idempotent reconciliation should follow separately.

[Copilot]

🟡 Changes recommended

The new guardrail tests are environment-sensitive (stage caps come from PW_INFLIGHT_*) and may fail depending on CI/local env values unless the tests pin INFLIGHT_BY_STAGE.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens paid submission guardrails in the Patchwork pipeline by enforcing a global per-invocation submission cap, failing closed on governor decisions that require operator intervention, and making CLI exit codes distinguish usage errors vs. governor blocks. It also updates governor projections to avoid “disappearing” in-flight reserved work before the spend ledger reflects it, and adds regression tests covering these behaviors.

Changes:

• Enforce a global N cap across stages in cmd_submit, and block submission for HALT, CUT, or unknown governor decisions.
• Add CLI parsing/dispatch via main() with distinct exit codes (usage: 2, governor block: 3).
• Update governor.project() to keep unharvested submitted work in the future-cost projection; add comprehensive regression tests.

File summaries

File	Description
tests/test_session_guardrails.py	Adds regression tests for global submit caps, governor decision handling, CLI exit codes, and projection behavior.
pipeline/session.py	Enforces global submission limit, fail-closed governor gating, and introduces CLI main() with distinct exit codes.
pipeline/governor.py	Keeps submitted-but-unharvested work in projected future cost until harvest/ledger updates.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.