Priors identity bonds spent real tokens while an agent budget counter stayed at zero

A Priors advisory documents a mismatch between on-chain wallet effects and an MCP session's configured spending counter. In the affected first_line operation, the wallet could approve and deposit a 5 USDG identity bond without charging that cost to PRIORS_MAX_SPEND_USD. The published reproduction signed two such deposits, transferring 10 USDG while a cap set to zero still reported zero spending.

That outcome is not a blockchain double spend and does not establish a production theft. The spending cap was bypassed because the application measured only selected operations, not the total economic effects signed with the wallet. Separate daily limits may still restrict transactions under some configurations. The affected @priors/mcp release series is 0.12.x, and the advisory identifies 0.13.0 as the correction.

The canonical Case and first-party advisory make the accounting discrepancy testable. A proper agent budget guard must reconcile every signed token delta, allowance and deposit against the same principal and period before a transaction is authorized. A model reporting that it is within budget cannot replace a ledger constraint enforced outside the model.