85 lines
5 KiB
Markdown
85 lines
5 KiB
Markdown
|
# Native CLI boundary proof — 2026-09-09
|
||
|
|
|
||
|
|
The installed Claude Code 2.1.266 binary was exercised against a deterministic
|
||
|
|
Anthropic-shaped API in a separate bwrap network namespace. The namespace had
|
||
|
|
no provider network route, operator home, real credential or inference service.
|
||
|
|
Only the CLI binary, system runtime and a temporary fixture workspace were mounted.
|
||
|
|
The executable receipt records the binary SHA-256 and exact adapter-generated argv.
|
||
|
|
|
||
|
|
## Findings and resulting change
|
||
|
|
|
||
|
|
With `--max-budget-usd 0.01`, the first fixture response reported 60,000 input
|
||
|
|
and 10 output tokens. The CLI estimated **USD 0.18015**, then exited with
|
||
|
|
`error_max_budget_usd`. Only one messages request reached the fixture. This
|
||
|
|
reproduces a stop after the response, not a pre-request maximum-liability check.
|
||
|
|
The rein terminal-accounting validator refused success and preserved known cost.
|
||
|
|
No amount in this experiment was billed by a provider.
|
||
|
|
|
||
|
|
The existing spend ledger remains necessary: it reserves declared per-run
|
||
|
|
liability and retains unknown outcomes. The experiment does not establish that
|
||
|
|
the declared liability is a valid bound on every possible native request. A
|
||
|
|
provider-facing request guard is the next HFACT-WP-0001-T01 implementation return;
|
||
|
|
raising the native threshold or accepting a newer binary cannot substitute for it.
|
||
|
|
|
||
|
|
The adapter also previously used `--allowedTools` with `acceptEdits`. Those flags
|
||
|
|
alone did not constrain the available tool inventory or repository-provided
|
||
|
|
customizations. Runs with native USD or turn controls now require CLI >=2.1.266
|
||
|
|
and use `dontAsk`, explicit builtin tools derived from registered rules, `--bare`,
|
||
|
|
empty settings sources, empty strict MCP configuration, an MCP deny rule, and no
|
||
|
|
session persistence. Legacy unconfigured sessions retain their existing behavior.
|
||
|
|
The worker prompt explicitly requires reading applicable AGENTS.md/CLAUDE.md;
|
||
|
|
these files are instructions, not permission to load executable configuration or
|
||
|
|
expand grants. The factory's protected runtime must be rebuilt and re-proven for
|
||
|
|
the new minimum; this source change installs or admits no runtime.
|
||
|
|
|
||
|
|
The real binary's bare mode exposed Bash, Read and Edit, a subset of the explicit
|
||
|
|
inventory. A synthetic tool sequence successfully ran permitted `git status` and
|
||
|
|
created a new file through Edit. An unapproved shell write was denied. A fixture
|
||
|
|
project containing a broad Bash permission override, a SessionStart hook and an
|
||
|
|
MCP command could activate none of them; its ambient CLAUDE.md was not auto-loaded.
|
||
|
|
The second messages request contained the expected allowed/denied tool results.
|
||
|
|
|
||
|
|
These tests prove the specified direct-tool and configuration boundaries. They
|
||
|
|
are not an arbitrary-code sandbox proof: permitted Git operations can invoke
|
||
|
|
repository-controlled helpers, and file edits can influence later commands.
|
||
|
|
Filesystem, credential and network confinement remain sandbox-owner controls.
|
||
|
|
To enforce spend against such indirect execution, the workload must not possess
|
||
|
|
a provider credential plus an unmetered route to the provider. A run-scoped,
|
||
|
|
owner-controlled request path must cover every forwarded request and retry.
|
||
|
|
|
||
|
|
## Reproduction and acceptance
|
||
|
|
|
||
|
|
`REIN_REAL_CLAUDE=1` enables `tests/test_native_cli_boundary.py`. The default binary
|
||
|
|
comes from `claude` on PATH; `REIN_CLAUDE_PROOF_BINARY` can select an exact installed
|
||
|
|
file. The fixture deliberately requires version 2.1.266; revalidate and record a
|
||
|
|
new receipt before claiming the same proof for another version. The adapter's
|
||
|
|
minimum-version gate does not itself prove arbitrary future binaries.
|
||
|
|
|
||
|
|
```text
|
||
|
|
REIN_REAL_CLAUDE=1 REIN_REAL_BWRAP=1 python -m pytest tests/ -q
|
||
|
|
```
|
||
|
|
|
||
|
|
The reproducible fixture is `tests/native_cli_fixture.py`; optional
|
||
|
|
`REIN_CLAUDE_PROOF_OUTPUT` writes bounded evidence without prompts, headers,
|
||
|
|
credentials or response bodies. The actual CLI checks are opt-in because ordinary
|
||
|
|
CI does not provision that binary. Deterministic native launch/accounting tests
|
||
|
|
are now included in both mandatory runtime and recovery gates. Paired receipts:
|
||
|
|
`docs/evidence/2026-09-09-native-cli-overrun.json` and
|
||
|
|
`docs/evidence/2026-09-09-native-cli-tools.json`.
|
||
|
|
|
||
|
|
No paid factory request, profile promotion, credential reader or production
|
||
|
|
rollout was authorized or performed. REINAH-WP-0003-T05/T06 and HFACT-WP-0001-T01/
|
||
|
|
T03/T04/T05 retain the request-admission, exact identity, protected placement and
|
||
|
|
natural queue/model execution returns.
|
||
|
|
|
||
|
|
## Upstream contract reviewed
|
||
|
|
|
||
|
|
The [CLI reference](https://code.claude.com/docs/en/cli-reference) distinguishes
|
||
|
|
available tools from auto-permission rules and describes the native stop flag.
|
||
|
|
The [headless guide](https://code.claude.com/docs/en/headless) documents bare-mode
|
||
|
|
configuration isolation and the API-key authentication path. The
|
||
|
|
[cost guide](https://code.claude.com/docs/en/costs) identifies CLI totals as local
|
||
|
|
estimates, not authoritative billing, and notes the residency-cost correction in
|
||
|
|
2.1.239. Reviewed 2026-09-09; the local executable findings above are narrower
|
||
|
|
than a claim about all provider billing or future CLI releases.
|