SettleBridge's training run completion routine approved the top ranked submission with no read of auto_approve and no check of a reject recommendation (a2a-settlement/settlebridge-ai issue 5)

Affected

Organisation

a2a-settlement

Product

SettleBridge (a2a-settlement/settlebridge-ai), an AI agent training and settlement marketplace

Component

backend/app/services/training_service.py (complete_run's own settlement loop), contrasted with backend/app/routes/submissions.py (the ordinary submission path's own auto_approve gate); fixed by two new modules, backend/app/services/training_gates.py and backend/app/services/compliance.py

Versions

Affected revision 2ad5948d5d3c620f0a7d6991dbb0dc720421de80, confirmed by this entry's own direct read; fixed at commit d1bbf4ac10d6438ffc31b3440d6e6b26104109fe, independently confirmed by this entry to be the repository's own current main tip

Configurations

Any training run whose parent bounty carries auto_approve: false, the requester's own explicit request for manual review; Any training run where two or more pending submissions carry an AI review score, regardless of what recommendation the reviewer attached to the top ranked one

Execution authority facts

Fields the evidence does not establish are shown as unknown rather than guessed.

Intended task

A training run finishes; its own completion routine settles any pending, AI reviewed submissions and seals the parent bounty

Agent

SettleBridge's own backend service, specifically training_service.complete_run

Delegating actor

The bounty's own requester, who set auto_approve to false on both bounties the issue names, requesting a human decision rather than automatic settlement

Action

Marked the highest scoring pending submission APPROVED and its claim ACCEPTED, and sealed the parent bounty COMPLETED, confirmed by this entry's own direct read to occur inside a branch that reads neither the parent bounty's own auto_approve field nor the submission's own AI reviewer recommendation before approving

Target resource

The pending submission's own status field and the parent bounty's own status field

Environment

SettleBridge's own production backend, reached whenever a training run's own client calls the run completion endpoint

Credentials used

unknown

Privileges available

Whatever the backend service's own database session already holds to mutate submission, claim and bounty rows

Authority presented

A training run reaching its own natural completion point, with at least one AI reviewed pending submission

Authority required

The parent bounty's own auto_approve setting granting automatic approval authority, and, where granted, a reviewer recommendation that does not itself reject the submission

Applicable policy

bounty.auto_approve, confirmed by this entry's own direct read to be checked and enforced on the platform's ordinary submission path at the identical affected revision; not read anywhere inside complete_run's own settlement loop at that revision

Approval mechanism

none

Required approver

unknown

Independent approval

no

Action binding

None found on the completion path at the affected revision. This entry confirmed directly that the local `rec` variable, the submission's own AI reviewer recommendation, is computed on every loop iteration but referenced only inside the branches handling submissions other than the top ranked one

Sequence context

The mismatch is structural and present at every training run completion through the affected revision, not a one time event; this entry's own evidence is a direct reading of the code that would run on any qualifying completion, not a captured trace of one specific request

Impact

Consequence

Two production bounties reportedly settled completed with a submission marked approved, one on a deliverable missing a required key and every required forecast value, scored 92 out of 100 by the AI reviewer, one on a training run whose every iteration scored 15 out of 100 with a reject recommendation; this entry did not independently re-fetch either bounty from the production host, which was blocked at this session's own network egress policy

Reach

systemic

Reversibility

unknown

Detectability

delayed

Propagation

potential

Recovery

Fixed in commit d1bbf4ac10d6438ffc31b3440d6e6b26104109fe, independently confirmed by this entry to be the repository's own current main tip. complete_run now derives auto_approve from the parent bounty and runs its settlement loop only when it is true, and a new module, training_gates.py, additionally requires a non reject recommendation, a score clearing the run's own score_threshold, and a passing compliance check where one was authored, before approving. Production deployment status is not established by anything this entry could reach.

Evidence

Primary sources

• Mediator scored a non-compliant deliverable 92/100 and auto-approved it; run-completion tie-break approves 'reject' submissions (GitHub Issues (a2a-settlement/settlebridge-ai))

Supporting sources

• training_service.py at the affected revision (complete_run's own unconditional approval branch) (a2a-settlement/settlebridge-ai (GitHub, source))
• submissions.py at the affected revision (the ordinary path's own auto_approve gate) (a2a-settlement/settlebridge-ai (GitHub, source))
• Commit d1bbf4ac: fix(training): decide compliance in code and gate approvals on it (a2a-settlement/settlebridge-ai (GitHub, commit))
• training_gates.py at commit d1bbf4ac (winner_may_auto_approve, apply_completion_resolution) (a2a-settlement/settlebridge-ai (GitHub, source))
• compliance.py at commit d1bbf4ac (deterministic JSON Schema draft 2020-12 compliance) (a2a-settlement/settlebridge-ai (GitHub, source))

Reproduction status

This entry read the affected source directly at 2ad5948d5d3c620f0a7d6991dbb0dc720421de80 and confirmed the mechanism against real, byte identical file contents, and separately confirmed current main's own remediation by direct read rather than by accepting the commit's own message. It did not itself operate a live SettleBridge deployment, submit a training run, or independently re-fetch either named bounty from the production marketplace host, which returned a blocked response at this session's own network egress policy on every attempt.

Evidence state

Confirmed

Known unknowns

• Whether commit d1bbf4ac10d6438ffc31b3440d6e6b26104109fe is deployed to SettleBridge's own production marketplace host, as distinct from being the repository's own current main tip.
• Whether either named bounty's own escrow tokens were actually transferred, as distinct from the submission and bounty status fields the issue reports changing.
• Whether any bounty besides the two the issue names was settled through the same unconditional completion path before the fix merged.
• Whether GitHub issue 5's own reporter holds any privileged relationship to a2a-settlement, beyond the repository collaborator attribution GitHub itself states.

Limitations

• This entry's access to a2a-settlement/settlebridge-ai is limited to its public repository, read through an anonymous git clone and direct fetches of specific commits and files. It has no access to the platform's own production database, logs, or any live training run.
• The two production bounty facts (the specific missing keys, the specific AI review scores) are carried at the issue's own first party evidence level; this entry's own direct verification covers the affected and current source, not a fresh read of either bounty's own stored data.

Claim provenance

• verified
  Fetched directly on 8 September 2026. Confirmed open, filed 7 September 2026, and states both bounty identifiers, both AI review outcomes, the affected file and line ranges, and a recommended fix list this entry's own reading of current main confirms was substantially adopted.
  The Requester Said No Auto Approve. The Run's Own Cleanup Code Approved Anyway.
• verified
  This entry read the affected revision directly, confirming the settlement loop's own `if i == 0:` approval branch never reads the local `rec` variable and never reads the parent bounty's own auto_approve field, that field being loaded only afterward, solely to seal the parent bounty COMPLETED.
  The Requester Said No Auto Approve. The Run's Own Cleanup Code Approved Anyway.
• verified
  This entry read the ordinary submission path directly at the identical affected revision, confirming its own AI driven approval block is entered only `if bounty.auto_approve and is_compliant_for_approval(compliance):`, establishing the cross path inconsistency this entry names.
  The Requester Said No Auto Approve. The Run's Own Cleanup Code Approved Anyway.
• verified
  This entry confirmed by a fresh shallow clone, not by the commit message alone, that this commit is the repository's own current main tip, and read its own diff directly.
  The Requester Said No Auto Approve. The Run's Own Cleanup Code Approved Anyway.
• verified
  This entry read the new module directly, confirming winner_may_auto_approve requires auto_approve, a non reject recommendation, a score clearing score_threshold, and a checked-and-passing compliance object where one exists, before complete_run approves a winner.
  The Requester Said No Auto Approve. The Run's Own Cleanup Code Approved Anyway.
• verified
  This entry read the new module directly, confirming check_compliance validates against criteria['custom_checks'] as JSON Schema draft 2020-12 and returns checked: false, compliant: false, distinct from a checked-and-failing result, when no custom_checks are authored.
  The Requester Said No Auto Approve. The Run's Own Cleanup Code Approved Anyway.

Related Intelligence Records

The published Moona Intelligence Records documenting this vulnerability and the evidence behind it.

• The Requester Said No Auto Approve. The Run's Own Cleanup Code Approved Anyway.