Reserve provider requests inside the durable worker envelope

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/native_cli_fixture.py

@@ -10,6 +10,7 @@ from pathlib import Path
 root = Path("/work")
 settings = json.loads((root / "case.json").read_text())
 seen = []
+guard_attempts = []
 
 
 class Handler(http.server.BaseHTTPRequestHandler):
@@ -47,7 +48,7 @@ class Handler(http.server.BaseHTTPRequestHandler):
             self.wfile.write(b'{"input_tokens":100}')
             return
         message_number = sum("count_tokens" not in request["path"] for request in seen)
-        if settings["case"] == "tools" and message_number == 1:
+        if settings["case"] in ("tools", "guarded-tools") and message_number == 1:
             blocks = [
                 {
                     "type": "tool_use",
@@ -83,7 +84,9 @@ class Handler(http.server.BaseHTTPRequestHandler):
             blocks = [{"type": "text", "text": "fixture complete"}]
             stop = "end_turn"
         usage = {
-            "input_tokens": 60000 if settings["case"] == "overrun" else 100,
+            "input_tokens": 60000
+            if settings["case"] in ("overrun", "guarded-overrun")
+            else 100,
             "output_tokens": 0,
             "cache_creation_input_tokens": 0,
             "cache_read_input_tokens": 0,
@@ -155,6 +158,104 @@ class Handler(http.server.BaseHTTPRequestHandler):
 
 server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Handler)
 threading.Thread(target=server.serve_forever, daemon=True).start()
+gate = meter = None
+route_token = "fixture-no-provider-secret"
+base_url = "http://127.0.0.1:" + str(server.server_port)
+if settings["case"].startswith("guarded-"):
+    from datetime import UTC, datetime, timedelta
+    from types import SimpleNamespace
+
+    from llm_connect.messages_gate import MessagesPolicy, MessagesServer, RequestRefused
+    from rein_aharness.request_admission import RequestLedger
+    from rein_aharness.spend_admission import SpendLedger, SpendPolicy
+
+    class ObservedPolicy(MessagesPolicy):
+        def validate(self, data, betas):
+            row = {
+                "fields": sorted(data),
+                "betas": betas,
+                "context_management": data.get("context_management"),
+                "thinking": data.get("thinking"),
+                "output_config": data.get("output_config"),
+            }
+            guard_attempts.append(row)
+            try:
+                value = super().validate(data, betas)
+                row["liability_microusd"] = value
+                return value
+            except RequestRefused as exc:
+                row["refusal"] = str(exc)
+                raise
+
+    # Synthetic accepted bounds ONLY, never a live price/FX/authority packet.
+    policy = ObservedPolicy(
+        "fixture:no-live-tariff",
+        "claude-sonnet-4-6",
+        200000,
+        32000,
+        3,
+        15,
+        allowed_betas=(
+            "claude-code-20250219",
+            "interleaved-thinking-2025-05-14",
+            "thinking-token-count-2026-05-13",
+            "context-management-2025-06-27",
+            "prompt-caching-scope-2026-01-05",
+            "effort-2025-11-24",
+        ),
+    )
+    cap = "0.01" if settings["case"] == "guarded-overrun" else "5"
+    private = root / "private"
+    private.mkdir(mode=0o700)
+    now = datetime.now(UTC)
+    expiry = (now + timedelta(minutes=5)).isoformat()
+    parent_policy = SpendPolicy(
+        "1",
+        "fixture",
+        "fixture:no-live-authority",
+        (now - timedelta(minutes=1)).isoformat(),
+        expiry,
+        "UTC",
+        "fixture-worker",
+        "fixture-definition",
+        "/work/target",
+        "fixture",
+        "harness.fixture@1.0.0",
+        "a" * 64,
+        "b" * 64,
+        "fixture-grant",
+        cap,
+        cap,
+        4,
+        "1",
+        cap,
+        cap,
+        cap,
+    )
+    parent = SpendLedger(private / "spend.sqlite3", parent_policy)
+    parent.initialize()
+    meter = RequestLedger(parent)
+    meter.initialize()
+    parent.reserve(
+        SimpleNamespace(
+            id="fixture-run",
+            activity_definition_id="fixture-definition",
+            idempotency_key="fixture",
+            attempt=1,
+        )
+    )
+    route_token = meter.bind_route(
+        "fixture-run", policy.sha256, lease_id="fixture-lease", expires_at=expiry
+    )
+    gate = MessagesServer(
+        policy,
+        meter,
+        provider_key="fixture-owner-only-key",
+        upstream_url=base_url,
+        allow_test_http=True,
+    )
+    gate.start()
+    base_url = "http://127.0.0.1:" + str(gate.port)
 (root / "target" / ".claude").mkdir(parents=True)
 (root / "target" / ".claude" / "settings.json").write_text(
     json.dumps(
@@ -181,8 +282,8 @@ threading.Thread(target=server.serve_forever, daemon=True).start()
 subprocess.run(["git", "init", "-q", str(root / "target")], check=True)
 env = dict(
     os.environ,
-    ANTHROPIC_BASE_URL="http://127.0.0.1:" + str(server.server_port),
-    ANTHROPIC_API_KEY="fixture-no-provider-secret",
+    ANTHROPIC_BASE_URL=base_url,
+    ANTHROPIC_API_KEY=route_token,
     CLAUDE_CONFIG_DIR="/work/config",
     CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1",
     DISABLE_AUTOUPDATER="1",
@@ -222,7 +323,11 @@ try:
         if (root / "target" / "result.txt").exists()
         else None,
         "network_namespace": os.readlink("/proc/self/ns/net"),
+        "guard_attempts": guard_attempts,
+        "request_reservations": meter.status() if meter else [],
     }
     print(json.dumps(output))
 finally:
+    if gate:
+        gate.stop()
     server.shutdown()