Reserve provider requests inside the durable worker envelope
Some checks failed
Governed runtime contract / contract (push) Failing after 31s
Some checks failed
Governed runtime contract / contract (push) Failing after 31s
Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
parent
4ae245a88f
commit
c30806b968
13 changed files with 1114 additions and 12 deletions
105
docs/evidence/2026-09-09-guarded-overrun.json
Normal file
105
docs/evidence/2026-09-09-guarded-overrun.json
Normal file
|
|
@ -0,0 +1,105 @@
|
|||
{
|
||||
"case": "guarded-overrun",
|
||||
"binary_version": "2.1.266 (Claude Code)",
|
||||
"binary_sha256": "19842705e989393fce936804df6d2ab034860e24b8f8880357981d87ffd83fac",
|
||||
"argv": [
|
||||
"/opt/claude",
|
||||
"--print",
|
||||
"--permission-mode",
|
||||
"dontAsk",
|
||||
"--allowedTools",
|
||||
"Read,Write,Edit,Glob,Grep,Bash(git add:*),Bash(git commit:*),Bash(git status),Bash(git log:*),Bash(git diff:*),Bash(date:*),Bash(ls:*)",
|
||||
"--output-format",
|
||||
"json",
|
||||
"--max-budget-usd",
|
||||
"0.01",
|
||||
"--max-turns",
|
||||
"4",
|
||||
"--bare",
|
||||
"--setting-sources",
|
||||
"",
|
||||
"--strict-mcp-config",
|
||||
"--mcp-config",
|
||||
"{\"mcpServers\":{}}",
|
||||
"--disallowedTools",
|
||||
"mcp__*",
|
||||
"--tools",
|
||||
"Read,Write,Edit,Glob,Grep,Bash",
|
||||
"--no-session-persistence",
|
||||
"--model",
|
||||
"claude-sonnet-4-6"
|
||||
],
|
||||
"scope": "synthetic API in isolated network namespace; no real credential or provider request",
|
||||
"returncode": 1,
|
||||
"terminal": {
|
||||
"type": "result",
|
||||
"subtype": "success",
|
||||
"is_error": true,
|
||||
"total_cost_usd": 0,
|
||||
"num_turns": 1,
|
||||
"usage": {
|
||||
"output_tokens_details": {
|
||||
"thinking_tokens": 0
|
||||
},
|
||||
"input_tokens": 0,
|
||||
"cache_creation_input_tokens": 0,
|
||||
"cache_read_input_tokens": 0,
|
||||
"output_tokens": 0,
|
||||
"server_tool_use": {
|
||||
"web_search_requests": 0,
|
||||
"web_fetch_requests": 0
|
||||
},
|
||||
"service_tier": "standard",
|
||||
"cache_creation": {
|
||||
"ephemeral_1h_input_tokens": 0,
|
||||
"ephemeral_5m_input_tokens": 0
|
||||
},
|
||||
"inference_geo": "",
|
||||
"iterations": [],
|
||||
"speed": "standard"
|
||||
},
|
||||
"permission_denials": []
|
||||
},
|
||||
"requests": [],
|
||||
"markers": {
|
||||
"hook-ran": false,
|
||||
"mcp-ran": false,
|
||||
"denied-ran": false
|
||||
},
|
||||
"created_file": null,
|
||||
"network_namespace": "net:[4026532319]",
|
||||
"guard_attempts": [
|
||||
{
|
||||
"fields": [
|
||||
"context_management",
|
||||
"max_tokens",
|
||||
"messages",
|
||||
"metadata",
|
||||
"model",
|
||||
"output_config",
|
||||
"stream",
|
||||
"system",
|
||||
"thinking",
|
||||
"tools"
|
||||
],
|
||||
"betas": "claude-code-20250219,interleaved-thinking-2025-05-14,thinking-token-count-2026-05-13,context-management-2025-06-27,prompt-caching-scope-2026-01-05,effort-2025-11-24",
|
||||
"context_management": {
|
||||
"edits": [
|
||||
{
|
||||
"type": "clear_thinking_20251015",
|
||||
"keep": "all"
|
||||
}
|
||||
]
|
||||
},
|
||||
"thinking": {
|
||||
"type": "adaptive",
|
||||
"display": "omitted"
|
||||
},
|
||||
"output_config": {
|
||||
"effort": "high"
|
||||
},
|
||||
"liability_microusd": 1080000
|
||||
}
|
||||
],
|
||||
"request_reservations": []
|
||||
}
|
||||
204
docs/evidence/2026-09-09-guarded-tools.json
Normal file
204
docs/evidence/2026-09-09-guarded-tools.json
Normal file
|
|
@ -0,0 +1,204 @@
|
|||
{
|
||||
"case": "guarded-tools",
|
||||
"binary_version": "2.1.266 (Claude Code)",
|
||||
"binary_sha256": "19842705e989393fce936804df6d2ab034860e24b8f8880357981d87ffd83fac",
|
||||
"argv": [
|
||||
"/opt/claude",
|
||||
"--print",
|
||||
"--permission-mode",
|
||||
"dontAsk",
|
||||
"--allowedTools",
|
||||
"Read,Write,Edit,Glob,Grep,Bash(git add:*),Bash(git commit:*),Bash(git status),Bash(git log:*),Bash(git diff:*),Bash(date:*),Bash(ls:*)",
|
||||
"--output-format",
|
||||
"json",
|
||||
"--max-budget-usd",
|
||||
"1",
|
||||
"--max-turns",
|
||||
"4",
|
||||
"--bare",
|
||||
"--setting-sources",
|
||||
"",
|
||||
"--strict-mcp-config",
|
||||
"--mcp-config",
|
||||
"{\"mcpServers\":{}}",
|
||||
"--disallowedTools",
|
||||
"mcp__*",
|
||||
"--tools",
|
||||
"Read,Write,Edit,Glob,Grep,Bash",
|
||||
"--no-session-persistence",
|
||||
"--model",
|
||||
"claude-sonnet-4-6"
|
||||
],
|
||||
"scope": "synthetic API in isolated network namespace; no real credential or provider request",
|
||||
"returncode": 0,
|
||||
"terminal": {
|
||||
"type": "result",
|
||||
"subtype": "success",
|
||||
"is_error": false,
|
||||
"total_cost_usd": 0.0009000000000000001,
|
||||
"num_turns": 4,
|
||||
"usage": {
|
||||
"input_tokens": 200,
|
||||
"cache_creation_input_tokens": 0,
|
||||
"cache_read_input_tokens": 0,
|
||||
"output_tokens": 20,
|
||||
"output_tokens_details": {
|
||||
"thinking_tokens": 0
|
||||
},
|
||||
"server_tool_use": {
|
||||
"web_search_requests": 0,
|
||||
"web_fetch_requests": 0
|
||||
},
|
||||
"service_tier": "standard",
|
||||
"cache_creation": {
|
||||
"ephemeral_1h_input_tokens": 0,
|
||||
"ephemeral_5m_input_tokens": 0
|
||||
},
|
||||
"inference_geo": "",
|
||||
"iterations": [],
|
||||
"speed": "standard"
|
||||
},
|
||||
"permission_denials": [
|
||||
{
|
||||
"tool_name": "Bash",
|
||||
"tool_use_id": "tool_denied",
|
||||
"tool_input": {
|
||||
"command": "printf bypass > /work/denied-ran",
|
||||
"description": "Fixture forbidden operation"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"requests": [
|
||||
{
|
||||
"path": "/v1/messages",
|
||||
"model": "claude-sonnet-4-6",
|
||||
"max_tokens": 32000,
|
||||
"tools": [
|
||||
"Bash",
|
||||
"Edit",
|
||||
"Read"
|
||||
],
|
||||
"tool_results": [],
|
||||
"ambient_context_loaded": false
|
||||
},
|
||||
{
|
||||
"path": "/v1/messages",
|
||||
"model": "claude-sonnet-4-6",
|
||||
"max_tokens": 32000,
|
||||
"tools": [
|
||||
"Bash",
|
||||
"Edit",
|
||||
"Read"
|
||||
],
|
||||
"tool_results": [
|
||||
{
|
||||
"id": "tool_allowed",
|
||||
"is_error": false
|
||||
},
|
||||
{
|
||||
"id": "tool_create",
|
||||
"is_error": false
|
||||
},
|
||||
{
|
||||
"id": "tool_denied",
|
||||
"is_error": true
|
||||
}
|
||||
],
|
||||
"ambient_context_loaded": false
|
||||
}
|
||||
],
|
||||
"markers": {
|
||||
"hook-ran": false,
|
||||
"mcp-ran": false,
|
||||
"denied-ran": false
|
||||
},
|
||||
"created_file": "fixture-created\n",
|
||||
"network_namespace": "net:[4026532319]",
|
||||
"guard_attempts": [
|
||||
{
|
||||
"fields": [
|
||||
"context_management",
|
||||
"max_tokens",
|
||||
"messages",
|
||||
"metadata",
|
||||
"model",
|
||||
"output_config",
|
||||
"stream",
|
||||
"system",
|
||||
"thinking",
|
||||
"tools"
|
||||
],
|
||||
"betas": "claude-code-20250219,interleaved-thinking-2025-05-14,thinking-token-count-2026-05-13,context-management-2025-06-27,prompt-caching-scope-2026-01-05,effort-2025-11-24",
|
||||
"context_management": {
|
||||
"edits": [
|
||||
{
|
||||
"type": "clear_thinking_20251015",
|
||||
"keep": "all"
|
||||
}
|
||||
]
|
||||
},
|
||||
"thinking": {
|
||||
"type": "adaptive",
|
||||
"display": "omitted"
|
||||
},
|
||||
"output_config": {
|
||||
"effort": "high"
|
||||
},
|
||||
"liability_microusd": 1080000
|
||||
},
|
||||
{
|
||||
"fields": [
|
||||
"context_management",
|
||||
"max_tokens",
|
||||
"messages",
|
||||
"metadata",
|
||||
"model",
|
||||
"output_config",
|
||||
"stream",
|
||||
"system",
|
||||
"thinking",
|
||||
"tools"
|
||||
],
|
||||
"betas": "claude-code-20250219,interleaved-thinking-2025-05-14,thinking-token-count-2026-05-13,context-management-2025-06-27,prompt-caching-scope-2026-01-05,effort-2025-11-24",
|
||||
"context_management": {
|
||||
"edits": [
|
||||
{
|
||||
"type": "clear_thinking_20251015",
|
||||
"keep": "all"
|
||||
}
|
||||
]
|
||||
},
|
||||
"thinking": {
|
||||
"type": "adaptive",
|
||||
"display": "omitted"
|
||||
},
|
||||
"output_config": {
|
||||
"effort": "high"
|
||||
},
|
||||
"liability_microusd": 1080000
|
||||
}
|
||||
],
|
||||
"request_reservations": [
|
||||
{
|
||||
"receipt": "183fdd9d-acb4-44ec-8393-9361d978ab70",
|
||||
"run_id": "fixture-run",
|
||||
"policy_sha256": "37b66853a37b5e7e772f128687cc96085fa7fb7c4a5687beb8ed53aab9d9daf3",
|
||||
"lease_id": "fixture-lease",
|
||||
"liability_microusd": 1080000,
|
||||
"state": "charged",
|
||||
"observed_microusd": 450,
|
||||
"created_at": "2026-09-09T19:41:28.936634+00:00"
|
||||
},
|
||||
{
|
||||
"receipt": "23f1e246-7011-437b-9db3-a1c7db1dacf5",
|
||||
"run_id": "fixture-run",
|
||||
"policy_sha256": "37b66853a37b5e7e772f128687cc96085fa7fb7c4a5687beb8ed53aab9d9daf3",
|
||||
"lease_id": "fixture-lease",
|
||||
"liability_microusd": 1080000,
|
||||
"state": "charged",
|
||||
"observed_microusd": 450,
|
||||
"created_at": "2026-09-09T19:41:29.290569+00:00"
|
||||
}
|
||||
]
|
||||
}
|
||||
43
docs/request-admission.md
Normal file
43
docs/request-admission.md
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# Child request reservations in the worker envelope
|
||||
|
||||
`rein_aharness.request_admission.RequestLedger` implements llm-connect's
|
||||
owner-hosted Messages meter in the existing private `SpendLedger` database.
|
||||
It introduces no second daily/total allowance and does not install a service.
|
||||
|
||||
The trusted provisioning path calls `RequestLedger.initialize()` before any run
|
||||
reservation. Missing tables or state refuse; initialization is additive and
|
||||
cannot reset existing request tables. After the normal validated parent dispatch
|
||||
reservation, the owner calls `bind_route(run_id, policy_sha256, lease_id=...,
|
||||
expires_at=...)` with the real accepted lease expiry. This returns one random
|
||||
token whose hash is stored with run, lease, exact request policy and expiry.
|
||||
The owner supplies that token and the gateway URL to the workload; no provider
|
||||
key or ledger path belongs in the sandbox. There is no replacement/renewal path
|
||||
for a run; expiry or revocation requires owner handling, not workload replay.
|
||||
|
||||
Each forward first commits a child hold in micro-USD. Requests serialize with
|
||||
SQLite `BEGIN IMMEDIATE`; a pending or unknown request blocks additional calls.
|
||||
Sum of full child liabilities cannot exceed the parent's admitted USD maximum.
|
||||
Trusted terminal usage charges the full child reservation without refunds.
|
||||
Known overrun records the larger amount and freezes the whole envelope. Request
|
||||
receipts contain only bounded IDs/digests, amounts, times and disposition.
|
||||
|
||||
Parent observation revokes the route, including unknown accounting results.
|
||||
Even an apparent successful CLI result cannot settle a parent with pending child
|
||||
requests. Existing operator reconciliation still requires attested provider
|
||||
termination and final accounting; it settles child holds conservatively and
|
||||
never reopens a route or grants another demand attempt. `revoke_route` is the
|
||||
trusted callback for real lease loss; an expiry also denies new admissions.
|
||||
In-flight cancellation retains liability until outcome is known.
|
||||
|
||||
The downstream protocol is documented in
|
||||
`llm-connect/contracts/functional/messages-admission.md` (LLM-WP-0009).
|
||||
The default worker/serve configurations do not yet host or inject this route.
|
||||
REINAH-WP-0003-T05/T06 and LLM-WP-0009-T03 retain protected owner hosting, real
|
||||
lease/token wiring, provider custody, enforced egress and bypass proof, accepted
|
||||
tariffs/FX, runtime installation and admitted real-profile/queue execution.
|
||||
|
||||
The installed-CLI fake-provider proof uses synthetic bounds and dummy keys.
|
||||
With a USD 0.01 parent the same native request is refused with zero upstream
|
||||
calls; with adequate fixture capacity a two-request tool session succeeds.
|
||||
That verifies request admission and accounting, not a live EUR ceiling or
|
||||
owner/workload secret and network separation.
|
||||
|
|
@ -134,6 +134,9 @@ installation are also still required before natural factory execution.
|
|||
|
||||
The [native CLI proof](native-cli-boundary-proof.md) now demonstrates the missing
|
||||
pre-request bound: one fixture response overshot a USD 0.01 threshold to an
|
||||
estimated USD 0.18015. HFACT T01 must implement and prove a metered request path
|
||||
outside the workload, including direct-provider bypass denial. The full-charge
|
||||
reservation/reconciliation implementation remains unchanged.
|
||||
estimated USD 0.18015. The [request extension](request-admission.md) now provides
|
||||
child holds and the llm-connect transport proves reserve-before-forward with the
|
||||
installed CLI. HFACT T01 retains owner hosting, actual lease/token integration,
|
||||
accepted tariffs/FX and direct-provider bypass denial. Parent observation also
|
||||
revokes request routes and retains unresolved children; operator reconciliation
|
||||
keeps full liability while closing the route.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue