rein-aharness/docs/native-metered-proof.md

# Attended disposable proof — 2026-09-27

Existing work: REINAH-WP-0003-T05/T06 and SECRETS-WP-0009-T03.
No new workplan, publication, automatic retry, or factory operating admission.

The operator accepted replacement spend memo `infd-20260927-b02`, confirmed
USD 10 including tax/conversion fees fits EUR 10, and accepted all six
`metered-20260927-{provider,worker}-{apply,verify,exec}` decisions. Native
submission confirmations and replacement host installation are separate receipts
in `docs/evidence/2026-09-27-metered-*.json`. The earlier expired spend grant is
preserved and never used.

`scripts/metered-native-owner.py` checks the frozen six-request packet and exact
recipient files before native claim/PDP checks. The provider's human-control
flag and the worker companion's ordinary flag remain unchanged. Apply and
verify each consume their own native approval before OpenBao effects. Exec
uses the existing Secrets Engine primary/companion consume and delivery code;
the procedure does not manufacture decisions, claims, or delivery state.

The attended workstation wrapper `scripts/attended-metered-proof.py` follows
the existing scoped approval-client reader and nested platform-admin OIDC
procedure. The operator-controlled SSH session runs the controller on Railiance
because the approved command and owner-file bindings name that host. Client
secret, short-lived operator/negative-test tokens and PDP caller token cross
encrypted SSH stdin only. The host uses a fresh owner-only temporary directory
on `/run/user/1000` tmpfs. Approval bearer tokens are minted in memory. No
cluster reader, persistent service, credential rotation or new custody path is
created. Warden self-revokes both attended sessions; private files and the
named-pod forwarding processes are removed on normal exit, including failure.
The delivered model child receives only its catalog-bound environment plus
its separately approved provider and worker credentials.

Before activation, the installer locks and checks all three old ledger tables,
refusing any prior reservation or liability. It preserves the old ledger and
backs up both old configuration files. A new private ledger is initialized
without resetting old evidence. Replacement file hashes retire dispatch using
the old catalog pins. The immutable runtime's backend-free owner check passes.

The single trigger occurs after both lanes verify. The controller waits for
exactly one open, unclaimed, attempt-zero task with the admitted profile and
one-file/one-commit/no-publication grant. It records trigger and exec intent
before either action. An existing execution receipt refuses all replays,
including uncertain/failed attempts. The scheduled definition stays disabled.

The approved maximum request hold remains USD 4.64; at most two such holds fit
the USD 10 liability cap. The [provider tariff](https://platform.claude.com/docs/en/about-claude/pricing)
was rechecked immediately before activation: Sonnet 5 global standard output is
USD 10/million tokens; the conservative input bound of USD 4/million covers
one-hour cache writes. The proof has no authority to enlarge these limits.

After interruption, inspect the durable local/remote receipts and native
consume state before any further action. Explicitly reconcile remaining
`metered-native-*` / `metered-attended-*` private runtime directories and any
open queue item; never rerun the command as a cleanup strategy. Hard-kill
cleanup is not claimed by this wrapper. Provider-request reservations remain
conservative until reconciled. T04's tenant migrations and broader T06
acceptance requirements remain in the existing workplan.

## Actual execution and corrections

All six decisions were accepted and consumed once. Both lane apply/verify
operations passed; exec delivered through two AppRole sessions whose revocation
succeeded. The single definition trigger initially produced a row with no grant:
the deployed Activity Core worker predated the API's grant-carriage support.
Activity Core `428f2d7` and Platform `c3607ff` changed only the worker image to
the already-deployed grant-aware API image through the existing GitOps parent
and child applications. Argo reports Synced/Healthy/Succeeded.

The explicit repair script validates and locks the original disabled definition
and original open, unclaimed, attempt-zero job. It copies only the exact typed
grant from that definition; it creates no row or trigger. Nine negative/positive
guard tests pass. This repair is recorded separately and is not represented as
successful natural grant carriage by the old producer.

The `resume` mode is limited to that recorded pre-execution queue-binding failure.
It verifies the four completed native actions, installed policies/role limits,
zero prior request/reservation counts, and the same repaired job. It repeats
neither apply/verify nor queue creation. Both remaining exec approvals were then
consumed. There is no further resume path for the attempted job.

Job `6efa9436-6a91-47c0-94e5-b31b5a0e7e3a` closed `failed`, attempt 1, with its
lease cleared. Its installed Python launchers still referenced a deleted build
directory: uv's long-path shell trampoline had escaped the builder's direct
shebang rewrite. A no-credential synthetic probe reproduced exit 127 for both
launchers inside the actual pinned bwrap artifact, with zero provider forwards.
The runtime builder correction is Sand-boxer `81b5fcf`; relocation tests execute
after the old build directory disappears. Rein now also rejects these launchers
before claim and retains bounded gateway stage/cleanup facts on accounting refusal.

The approved artifact itself remains unchanged. Sandbox `b67907f1` and its
workspace are destroyed; the repository is clean at its original commit, the
lock is available, and no close-outbox item or private credential directory is
left over. The request route is revoked and there are no provider-request
reservations. The parent EUR 10 reservation remains held; observed billing was
not invented and the ledger was not reset. A corrected artifact and its changed
pins need admission, held-liability reconciliation remains an owner action, and
another attempt requires separate authority. REINAH-WP-0003 stays blocked.