Reserve provider requests inside the durable worker envelope

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/request-admission.md

@@ -0,0 +1,43 @@
+# Child request reservations in the worker envelope
+
+`rein_aharness.request_admission.RequestLedger` implements llm-connect's
+owner-hosted Messages meter in the existing private `SpendLedger` database.
+It introduces no second daily/total allowance and does not install a service.
+
+The trusted provisioning path calls `RequestLedger.initialize()` before any run
+reservation. Missing tables or state refuse; initialization is additive and
+cannot reset existing request tables. After the normal validated parent dispatch
+reservation, the owner calls `bind_route(run_id, policy_sha256, lease_id=...,
+expires_at=...)` with the real accepted lease expiry. This returns one random
+token whose hash is stored with run, lease, exact request policy and expiry.
+The owner supplies that token and the gateway URL to the workload; no provider
+key or ledger path belongs in the sandbox. There is no replacement/renewal path
+for a run; expiry or revocation requires owner handling, not workload replay.
+
+Each forward first commits a child hold in micro-USD. Requests serialize with
+SQLite `BEGIN IMMEDIATE`; a pending or unknown request blocks additional calls.
+Sum of full child liabilities cannot exceed the parent's admitted USD maximum.
+Trusted terminal usage charges the full child reservation without refunds.
+Known overrun records the larger amount and freezes the whole envelope. Request
+receipts contain only bounded IDs/digests, amounts, times and disposition.
+
+Parent observation revokes the route, including unknown accounting results.
+Even an apparent successful CLI result cannot settle a parent with pending child
+requests. Existing operator reconciliation still requires attested provider
+termination and final accounting; it settles child holds conservatively and
+never reopens a route or grants another demand attempt. `revoke_route` is the
+trusted callback for real lease loss; an expiry also denies new admissions.
+In-flight cancellation retains liability until outcome is known.
+
+The downstream protocol is documented in
+`llm-connect/contracts/functional/messages-admission.md` (LLM-WP-0009).
+The default worker/serve configurations do not yet host or inject this route.
+REINAH-WP-0003-T05/T06 and LLM-WP-0009-T03 retain protected owner hosting, real
+lease/token wiring, provider custody, enforced egress and bypass proof, accepted
+tariffs/FX, runtime installation and admitted real-profile/queue execution.
+
+The installed-CLI fake-provider proof uses synthetic bounds and dummy keys.
+With a USD 0.01 parent the same native request is refused with zero upstream
+calls; with adequate fixture capacity a two-request tool session succeeds.
+That verifies request admission and accounting, not a live EUR ceiling or
+owner/workload secret and network separation.