Enforce the wall-clock budget on verify, not just act

A loop's max_seconds is a per-run ceiling, but the runner computed the remaining
budget once before the act step and reused that same figure for verify. If act
consumed most of the window, verify was still handed the pre-act budget and could run
a second full window — overrunning max_seconds by up to 2x.

verify now recomputes the time left from the shared deadline after act returns, so its
timeout reflects what's actually left. _run_command also short-circuits a non-positive
timeout instead of spawning a process only to kill it.

83 -> 86 passing (budget-recompute regression, short-circuit, _time_left).

Author: yingchen-coding

loopforge/runner.py

@@ -63,8 +63,18 @@ def _read_context(loop: Loop, root: Path) -> str:
     return "\n\n".join(parts)
 
 
+def _time_left(deadline: float | None) -> float | None:
+    """Seconds remaining until the wall-clock budget deadline (None = no budget)."""
+    if deadline is None:
+        return None
+    return deadline - time.monotonic()
+
+
 def _run_command(command: str, prompt: str | None, cwd: Path, timeout: float | None) -> tuple[int, str]:
     """Run a command. {prompt} is replaced with a temp file path; otherwise prompt goes to stdin."""
+    if timeout is not None and timeout <= 0:
+        # the wall-clock budget is already spent — don't spawn a process just to kill it
+        return 124, "timeout"
     stdin_text: str | None = None
     tmp: Path | None = None
     try:
@@ -240,20 +250,21 @@ def run(
             result.handback_reason = "budget-exceeded"
             break
 
-        remaining = deadline - time.monotonic() if deadline else None
         iteration_started = _dt.datetime.now(_dt.UTC).isoformat()
-        rc, out = _run_command(act_cmd, context, workdir, remaining)
+        rc, out = _run_command(act_cmd, context, workdir, _time_left(deadline))
 
         # verify is independent: a `command` is a test/build (no prompt); a `reviewer_command` is a
-        # second model that must SEE the act output to review it.
+        # second model that must SEE the act output to review it. Recompute the time budget here —
+        # act may have consumed most of it, and reusing the pre-act figure would let verify run the
+        # full window again, overrunning max_seconds by up to 2x.
         verified: bool | None = None
         verify_rc: int | None = None
         verify_out = ""
         if verify_command:
-            verify_rc, verify_out = _run_command(verify_command, None, workdir, remaining)
+            verify_rc, verify_out = _run_command(verify_command, None, workdir, _time_left(deadline))
             verified = verify_rc == 0
         elif reviewer_command:
-            verify_rc, verify_out = _run_command(reviewer_command, out, workdir, remaining)
+            verify_rc, verify_out = _run_command(reviewer_command, out, workdir, _time_left(deadline))
             verified = verify_rc == 0
         if verified is not None:
             consecutive_failures = 0 if verified else consecutive_failures + 1

tests/test_runner.py

@@ -167,3 +167,47 @@ def test_max_iterations_override(tmp_path):
     result = run(p, max_iterations=3)
     assert result.iterations == 3
     assert result.handback_reason == "max-iterations"
+
+
+def test_run_command_short_circuits_when_budget_is_spent():
+    # A non-positive remaining budget must NOT spawn the process — it returns a timeout immediately.
+    # If it spawned, `echo` would return (0, "hi"); the guard makes it (124, "timeout").
+    from loopforge.runner import _run_command
+    rc, out = _run_command("echo hi", None, Path("."), timeout=-0.5)
+    assert rc == 124
+    assert out == "timeout"
+
+
+def test_time_left_counts_down_from_deadline():
+    import time as _t
+
+    from loopforge.runner import _time_left
+    assert _time_left(None) is None
+    deadline = _t.monotonic() + 10
+    left = _time_left(deadline)
+    assert left is not None and 0 < left <= 10
+    assert _time_left(_t.monotonic() - 1) < 0  # already past the deadline
+
+
+def test_verify_budget_is_recomputed_after_act(tmp_path, monkeypatch):
+    # Regression: verify used to reuse the pre-act time budget, so it could run a full second window
+    # after act already consumed max_seconds. With the fix, verify's timeout is recomputed from the
+    # shared deadline AFTER act ran — so it is strictly less than act's, never the original window.
+    import loopforge.runner as runner
+
+    p = make_loop(tmp_path, act="echo working", verify="echo verifying", max_iter=1)  # default max_seconds
+
+    calls = []
+    real = runner._run_command
+
+    def spy(command, prompt, cwd, timeout):
+        calls.append((command, timeout))
+        return real(command, prompt, cwd, timeout)
+
+    monkeypatch.setattr(runner, "_run_command", spy)
+    runner.run(p)
+
+    act_timeout = next(to for cmd, to in calls if cmd == "echo working")
+    verify_timeout = next(to for cmd, to in calls if cmd == "echo verifying")
+    assert act_timeout is not None and verify_timeout is not None  # deadline enforced on both
+    assert verify_timeout < act_timeout  # recomputed after act, so strictly less time remains