---
id: LLM-WP-0009
type: workplan
title: "Owner-metered Messages transport for bounded factory execution"
domain: agents
repo: llm-connect
status: active
owner: codex
topic_slug: llm-connect
created: "2026-09-09"
updated: "2026-09-09"
related:
  - HFACT-WP-0001
  - REINAH-WP-0003
  - GLAS-WP-0015
state_hub_workstream_id: "d396a090-c2ed-5042-aaea-b75fd1d3a471"
---

The factory's installed-CLI proof demonstrated native dollar-threshold overshoot.
Implement its accepted next source slice in the transport owner, reusing rein's
parent ledger. This workplan records implementation under the user's continued
factory programme; it grants no operating, custody, deployment or paid authority.

## Define request admission and implement the narrow transport

```task
id: LLM-WP-0009-T01
status: done
priority: high
state_hub_task_id: "a1d7a2f0-9b98-5c3a-8832-0e500b444059"
```

Implemented immutable policy/upper-rate liability, explicit owner meter protocol,
fixed-origin HTTPS Messages forwarding, strict supported features and beta
allowlist, bounded streaming, full-charge accounting and uncertain-outcome holds.
No retry, proxy discovery, redirect or existing /execute bypass exists on this
listener. See `contracts/functional/messages-admission.md`.

## Prove admission through the real consumer CLI with a fake provider

```task
id: LLM-WP-0009-T02
status: done
priority: high
state_hub_task_id: "abd0af2e-377a-5603-bea8-c0a760bdf242"
```

Rein's real HTTP/SQLite tests cover exhausted capacity, concurrent requests,
unknown prior outcomes, replay, revoked/expired leases and parent recovery.
The installed Claude Code 2.1.266 proof refuses the USD 0.01 counterexample with
zero upstream requests; a permitted two-request tool session creates its file.
No actual inference, provider credential or live price/FX policy is involved.

## Integrate the admitted owner route and prove production confinement

```task
id: LLM-WP-0009-T03
status: wait
priority: high
blocking_reason: "Requires trusted owner hosting and actual lease/token delivery, provider custody and direct-route denial under HFACT T03/T04; accepted tariff/FX and G0 remain HFACT T01."
state_hub_task_id: "98a38d75-73ab-5f37-b710-5df9d9681e49"
```

Return to HFACT-WP-0001-T01 and REINAH-WP-0003-T05/T06: integrate this transport
inside the protected owner runtime, initialize the request extension explicitly,
bind a run-scoped route to the real lease, inject only its base URL/token into
the workload and revoke on lease loss. Keep the provider key and ledger outside
the sandbox, enforce sole egress through the owner, and prove bypass denial.
Pin accepted provider context/output and maximum tariffs with validity and FX;
review compatibility of the exact CLI/beta combination against the actual
provider before accepting a live profile. Local fake-provider evidence cannot
close this task or establish a hard live EUR ceiling. Reuse GLAS-WP-0015 identity
and native-delivery owner work; completed verifier CCRs are not reopened.


Pre-release quality return: configured repository-wide checks expose 177 Ruff
diagnostics and 36 mypy errors, reproduced identically at the original 00560945
source baseline. The new transport adds none after its protocol types were
completed. The 263 passing tests are not a claim of green full-repository CI.
Resolve or explicitly disposition those existing checks before an owner accepts
the protected artifact/release. Evidence:
`docs/evidence/2026-09-09-request-admission-quality.json`.

## Repair historical source identities blocking primary synchronization

```task
id: LLM-WP-0009-T04
status: done
priority: medium
state_hub_task_id: "c9418f44-1ce6-5d72-b764-4865528caec1"
```

HFACT-WP-0001-T02 side quest: qualified 65 historical parent-local task IDs to
match their already-existing Hub record IDs across five finished workplans.
Preserved all workplan/task UUIDs, parent links, statuses and task content;
qualified local references and retained an exact before/after mapping in
`docs/evidence/2026-09-09-legacy-task-qualification.json`. This is source identity
repair, not a UUID migration, record recreation or retirement. Six missing
historical ad-hoc source bindings also resolve to existing matching Hub UUIDs;
only Repo Manager's managed-field write may restore those pointers. The
AGENTS.md versus registry prefix disagreement remains a future-instruction
issue; published workplan IDs are unchanged.