AntFleet

Disagreement · f5ac807a-anthropic-0

Sharp-move dedup window violates idempotency under same-minute reruns

solo Opus
repo 6f7fc663·PR #23·reviewed 1 week ago

Opus finding

Sharp-move dedup window violates idempotency under same-minute reruns

mediumbughigh
  • skills/price-threshold-alert/SKILL.md:156-162
  • skills/price-threshold-alert/SKILL.md:270-271
The constraint promises idempotency under same-minute reruns, but the sharp-move step writes `last_alerts.sharp_move = NOW` every time it fires. If the run is re-executed within the same minute with the same price input, the first run sets last_alerts.sharp_move to T0; the second run sees that timestamp within 4h and dedups. That is consistent. However, the ATH gate (Step 4) only updates `state.ath.announced_at` for the baseline case; for a real ATH it updates `observed_at` but does not specify updating `announced_at`/`last_alerts.ath`. The spec says "Notify only if the last ath alert was >4h ago" but never tells the implementer to set `last_alerts.ath = NOW` on a real ATH notification. Consequently, a re-run with the same higher price would: (a) see CURRENT_PRICE not strictly greater than the just-updated `ath.price_usd`, so `new_ath=false` — actually safe. But the missing `last_alerts.ath = NOW` write means if a later run sees an even higher price within 4h, the dedup check has stale data and the alert fires again, which is fine — but the documented dedup clock is never advanced for ATH alerts in the spec text, making the 4h dedup unreachable in practice. This is a spec/contract gap.

Recommendation

In Step 4, explicitly require setting `state.last_alerts.ath = NOW` when an ATH notification is sent (and `state.ath.announced_at = NOW`). This mirrors Step 5's explicit `last_alerts.sharp_move = NOW` write.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →

From the same review

These findings passed the unanimous gate on the same PR review. The disagreement above was filtered out; the findings below were posted.