rein-aharness/docs/owner-bootstrap.md

# One-cycle owner bootstrap

`rein-aharness metered-once --owner-config /absolute/private/owner.json` is the
explicit exec-env child entry point. It prepares the exact admitted pins, consumes
only the deliberately delivered `ANTHROPIC_API_KEY`, removes provider authentication
and base-URL variables before other child processes, and runs at most one claim
cycle. The provider key is held by MessagesOwner outside the sandbox. Missing/mixed
credentials, invalid pins, missing ledgers, blocked profiles, failed readiness and
unclaimed refusals return nonzero. Receipt output excludes raw errors and prompts.
There is no key fetch, alternate provider, key file, OAuth/HOME or daemon fallback.
`--check` validates local pins without a key, queue access or workload dispatch;
it can advance the ledger's clock watermark but never initializes/reset its schema.

Use the standalone candidate interpreter as `python -I -B -m rein_aharness.cli`.
`-I` excludes editable PYTHONPATH/user-site fallbacks; `-B` prevents bytecode writes
from changing the complete artifact digest. The source and namespace rein commands
continue to use their existing entry points. The owner config selects the pinned
runtime through the trusted, ephemeral sandbox binding; it cannot add egress or
provider credentials to the child. Normal `claim-loop` behavior is unchanged.

The mode-0600, regular, owner-owned config has exactly these fields:

```json
{
  "version": "1",
  "authority_ref": "REPLACE_WITH_ACCEPTED_SPEND_AUTHORITY",
  "spend_policy_sha256": "REPLACE_WITH_ACCEPTED_SPEND_POLICY_DIGEST",
  "messages_policy": {
    "tariff_ref": "REPLACE_WITH_ACCEPTED_PROVIDER_BOUNDS_AND_RATES",
    "model": "claude-sonnet-4-6",
    "context_tokens": 0,
    "max_output_tokens": 0,
    "input_microusd_per_token": 0,
    "output_microusd_per_token": 0,
    "allowed_betas": []
  },
  "runtime": {
    "path": "/absolute/accepted/runtime",
    "sha256": "REPLACE_WITH_ACCEPTED_COMPLETE_ARTIFACT_DIGEST"
  }
}
```

The placeholders and zero bounds deliberately refuse. The authority reference and
spend digest must match the private existing SpendPolicy. Worker/project, exact
profile/descriptor digests, operational readiness, model, empty-egress bwrap profile
and runtime digest are checked before claim. Runtime, owner state and target checkout
must not overlap. Provision parent and request ledgers as separate reviewed actions.
The normal ACTIVITY_CORE/AGENT_HARNESS worker and state configuration still applies.

This config is not an authorization decision or a custody provenance proof. The
invoking credential engine must already have passed its exact action approval,
consume, scoped backend/readiness and admitted consumer checks. Its reviewed command
must be the fixed one-cycle owner entry point, with the accepted immutable config.
The current `glas-claude-agent-dev-anthropic` catalog describes delivery through the
sandbox helper and does not yet admit this owner holder. SECRETS-WP-0009-T03 and
HFACT-WP-0001-T03/T04 retain that review, existing client/audit/service dependencies,
Railiance placement and live negative tests. No real key is read by local validation.

This initial bootstrap obtains delivery before one claim cycle; an empty queue still
uses that delivery attempt. It intentionally exits after that cycle. Native scheduled
activation must not wrap a persistent claim loop with one reusable provider credential.
Later per-run acquisition for a continuous worker belongs to REINAH-WP-0003-T05/T06
and the same credential owner; it must retain exact action/lease/budget semantics.

`scripts/prove-metered-runtime.py` runs with a built candidate's `python -I -B`.
It verifies all four packages and definitions come from the artifact, exercises this
CLI once against an empty fake HTTP queue with a synthetic exec-env key, and runs the
pinned actual Claude CLI through the protected bwrap mount and metered owner. The
positive fake stream and pre-forward insufficient-capacity refusal are separate
cases. It checks unchanged artifact digest and teardown. Queue/provider/key/profile
are disposable fixtures, never evidence of live admission. The project records the
candidate result in `prj-helixforge-factory/evidence/2026-09-09-owner-bootstrap.json`.


## Current metered admission review — 2026-09-27

The credential catalog now configures the metered owner and companion, so the
older pending-holder paragraph above is historical. The corrected owner policy and Secrets Engine 11cc0d5 are installed after
explicit user approval; native spend/delivery approval remains open. Use
`../secrets-engine/docs/proposals/glas-metered-20260927/README.md` for exact inputs.

The proof script requires `--profile-ref` and `--expected-model`; for the current
b6e4e8a4 artifact use `--profile-ref harness.agent-dev-local@1.1.1
--expected-model claude-sonnet-5 --context-tokens 1000000
--max-output-tokens 64000 --input-rate 4 --output-rate 10
--extra-beta mid-conversation-system-2026-04-07` in addition to runtime/hash.
The fixture price input is explicit and still grants no paid authority. A passing
first-response proof does not prove a tool loop or native provider compatibility.

Add `--tool-cycle` for a synthetic EUR 10 parent envelope and two provider
requests with an actual Bash git-status tool result. This passed on Railiance;
receipt: `docs/evidence/2026-09-27-sonnet5-tool-session-proof.json`. The fixture
uses native USD 1/max-turns 4 and total EUR 30, not the live owner spend policy.
The requested inactive EUR 10 proposal is in the factory operations directory.