# What structural signals indicate a safety-gated commit is about to fire on a speculative tool call whose pre-execution has already mutated shared state

**Date of Record:** 2026 November 7

**Scope:** Applies to speculative tool-call pre-execution pipelines where a candidate tool invocation is executed ahead of LITMUS commitment and the tool has side effects on shared, non-idempotent state (caches, locks, counters, external APIs). Does not apply to pure/read-only tools, nor to pipelines where pre-execution is sandboxed with copy-on-write isolation of all touched state.

## Core Distinction

The distinction that matters is between *speculative execution* and *speculative commitment*. A LITMUS scorer produces a scalar per candidate; the commit gate fires when the score crosses a threshold. The non-obvious failure is that pre-execution and commit are decoupled in time, and the gate is evaluated against a score computed *before* the tool ran. When a tool's pre-execution mutates shared state, the LITMUS score that justified pre-execution is no longer the score that should justify commitment — the state the scorer observed has been altered by the act of scoring's consequence. The gate then commits a call whose post-execution side effects make the original score stale, and the system has no invariant binding "the score that authorized pre-execution" to "the state at commit time."

The structural signal is not a low score. It is a *divergence between the pre-execution score and a recomputed score over the same candidate after the tool's side effects have landed*. If the recomputed score falls below the gate while the cached pre-execution score remains above it, the commit is firing on stale evidence.

## What Was Observed

In a pipeline where a `write_file` tool was speculatively pre-executed to warm an output path, LITMUS scored the candidate at 0.81 (threshold 0.75) and pre-execution proceeded. The tool created the file and acquired an advisory lock on the parent directory. A second candidate in the same batch then scored 0.78 on the *original* snapshot, but the lock acquisition by the first tool's pre-execution changed the reachability graph the scorer walks: the second candidate's recomputed score dropped to 0.62 because its own write target was now behind a held lock. The gate committed both. The second commit blocked on the lock for 40 seconds and then failed, but the first had already been committed and could not be rolled back because the lock was released only on process exit.

The observable structural signal was a *lock-holder count delta* between the pre-execution snapshot and the commit-time snapshot, paired with a score delta exceeding the scorer's own noise floor. Neither signal alone was sufficient; the combination was.

## Condition of Validity

This record is valid only when all of the following hold:

1. Pre-execution of the tool can mutate state visible to the LITMUS scorer's feature extraction (locks, counters, file existence, cache entries).
2. The commit gate evaluates a score that was cached at pre-execution time rather than recomputed at commit time.
3. At least two candidates share a resource whose reachability or cost is changed by another candidate's pre-execution.
4. Rollback of a committed call is not guaranteed (non-idempotent or externally visible effects).

If condition 2 is false — the gate recomputes at commit time — the failure degrades to a latency issue, not a correctness issue. If condition 4 is false, the stale commit is recoverable and the boundary is benign.

## Decision Boundary

The boundary to encode: **pre-execution is authorized by a score, but commitment must be authorized by a score recomputed against post-pre-execution state, or by an explicit proof that pre-execution did not mutate any feature the scorer reads.**

Operationally, before firing a safety-gated commit, check for a *feature-mutation witness*: any state delta between pre-execution snapshot and commit-time snapshot that intersects the scorer's declared feature set. If the intersection is non-empty, treat the cached score as invalid and either recompute or block. The threshold crossing is necessary but not sufficient; the witness check is the sufficient condition.

A second boundary: if two candidates in the same batch are ordered such that candidate A's pre-execution mutates a feature read by candidate B's score, the batch must be committed in reverse pre-execution order or serially re-scored. Parallel commitment is unsafe under condition 3.

## Operational Effect

The effect of ignoring this boundary is a class of commits that are individually score-justified but jointly unjustified, producing lock contention, partial writes, and unrecoverable external side effects. The mitigation is a two-phase gate: (a) pre-execution authorized by cached score, (b) commitment authorized only after a feature-mutation witness check against the scorer's feature set, with recompute on witness. The cost is one extra feature extraction per commit; the benefit is that the gate's authorization is bound to the state it actually commits against.

```python
class StaleLITMUSCommitError(RuntimeError):
    """Raised when a safety-gated commit fires on a score computed before
    speculative pre-execution mutated a feature the scorer reads."""
    pass


def commit_guard(candidate, pre_exec_score, commit_score, feature_witness, threshold):
    # feature_witness: set of scorer features whose state changed between
    # pre-execution snapshot and commit-time snapshot.
    if commit_score < threshold:
        raise StaleLITMUSCommitError(
            f"candidate {candidate!r}: commit-time score {commit_score:.3f} "
            f"below gate {threshold:.3f} (pre-exec score was {pre_exec_score:.3f})"
        )
    if feature_witness:
        raise StaleLITMUSCommitError(
            f"candidate {candidate!r}: pre-execution mutated scorer features "
            f"{sorted(feature_witness)}; cached score {pre_exec_score:.3f} "
            f"is stale relative to commit-time state"
        )
    return True
```