llm-connect/workplans/LLM-WP-0009-owner-metered-messages-transport.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related
LLM-WP-0009	workplan	Owner-metered Messages transport for bounded factory execution	agents	llm-connect	active	codex	llm-connect	2026-09-09	2026-09-09	HFACT-WP-0001 REINAH-WP-0003 GLAS-WP-0015

The factory's installed-CLI proof demonstrated native dollar-threshold overshoot. Implement its accepted next source slice in the transport owner, reusing rein's parent ledger. This workplan records implementation under the user's continued factory programme; it grants no operating, custody, deployment or paid authority.

Define request admission and implement the narrow transport

id: LLM-WP-0009-T01
status: done
priority: high

Implemented immutable policy/upper-rate liability, explicit owner meter protocol, fixed-origin HTTPS Messages forwarding, strict supported features and beta allowlist, bounded streaming, full-charge accounting and uncertain-outcome holds. No retry, proxy discovery, redirect or existing /execute bypass exists on this listener. See contracts/functional/messages-admission.md.

Prove admission through the real consumer CLI with a fake provider

id: LLM-WP-0009-T02
status: done
priority: high

Rein's real HTTP/SQLite tests cover exhausted capacity, concurrent requests, unknown prior outcomes, replay, revoked/expired leases and parent recovery. The installed Claude Code 2.1.266 proof refuses the USD 0.01 counterexample with zero upstream requests; a permitted two-request tool session creates its file. No actual inference, provider credential or live price/FX policy is involved.

Integrate the admitted owner route and prove production confinement

id: LLM-WP-0009-T03
status: wait
priority: high
blocking_reason: "Requires trusted owner hosting and actual lease/token delivery, provider custody and direct-route denial under HFACT T03/T04; accepted tariff/FX and G0 remain HFACT T01."

Return to HFACT-WP-0001-T01 and REINAH-WP-0003-T05/T06: integrate this transport inside the protected owner runtime, initialize the request extension explicitly, bind a run-scoped route to the real lease, inject only its base URL/token into the workload and revoke on lease loss. Keep the provider key and ledger outside the sandbox, enforce sole egress through the owner, and prove bypass denial. Pin accepted provider context/output and maximum tariffs with validity and FX; review compatibility of the exact CLI/beta combination against the actual provider before accepting a live profile. Local fake-provider evidence cannot close this task or establish a hard live EUR ceiling. Reuse GLAS-WP-0015 identity and native-delivery owner work; completed verifier CCRs are not reopened.