Severity: MEDIUM · Source: docs/backend-contract-bug-audit.md finding #14 · Split out of umbrella #127
Regression introduced when routes moved from legacy <graph_update> XML parsing to Pydantic AI tools.
Problem
ORCHESTRATOR_LIMITS (8 req / 10 tool-calls / 100k tokens) is defined but never passed to .run(). The tool-using chat-tutor and quiz agents run with no token or tool-call ceiling.
Verified on main (2026-07-08)
backend/agents/__init__.py:17 — ORCHESTRATOR_LIMITS defined; docstring claims "every agent call site passes via the explicit usage_limits= kwarg".backend/routes/learn.py_chat_via_agent — run_kwargs passes deps / message_history / model / model_settings, no usage_limits.backend/routes/quiz.py:192 — _quiz_via_agentrun_kwargs passes deps / model, no usage_limits.
Extra context: the refactor/token-unification branch already wired usage_limits=WORKER_LIMITS into every worker agent (document.py, documents.py), so the docstring's claim is true for workers but false for the chat/quiz orchestrators. This issue is the remaining gap.
Fix
Pass usage_limits=ORCHESTRATOR_LIMITS in the run_kwargs of _chat_via_agent and _quiz_via_agent.
Status
Fix in flight in PR #243. Best sequenced with/after refactor/token-unification so the usage-limits story lands coherently. PR should Closes this issue.
Umbrella: #127.
Severity: MEDIUM · Source:
docs/backend-contract-bug-audit.mdfinding #14 · Split out of umbrella #127Regression introduced when routes moved from legacy
<graph_update>XML parsing to Pydantic AI tools.Problem
ORCHESTRATOR_LIMITS(8 req / 10 tool-calls / 100k tokens) is defined but never passed to.run(). The tool-using chat-tutor and quiz agents run with no token or tool-call ceiling.Verified on
main(2026-07-08)backend/agents/__init__.py:17—ORCHESTRATOR_LIMITSdefined; docstring claims "every agent call site passes via the explicitusage_limits=kwarg".backend/routes/learn.py_chat_via_agent—run_kwargspassesdeps/message_history/model/model_settings, nousage_limits.backend/routes/quiz.py:192—_quiz_via_agentrun_kwargspassesdeps/model, nousage_limits.Extra context: the
refactor/token-unificationbranch already wiredusage_limits=WORKER_LIMITSinto every worker agent (document.py,documents.py), so the docstring's claim is true for workers but false for the chat/quiz orchestrators. This issue is the remaining gap.Fix
Pass
usage_limits=ORCHESTRATOR_LIMITSin therun_kwargsof_chat_via_agentand_quiz_via_agent.Status
Fix in flight in PR #243. Best sequenced with/after
refactor/token-unificationso the usage-limits story lands coherently. PR shouldClosesthis issue.Umbrella: #127.