Reserve provider requests inside the durable worker envelope

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_native_cli_boundary.py

@@ -21,7 +21,9 @@ pytestmark = pytest.mark.skipif(
 )
 
 
-@pytest.mark.parametrize("case", ["overrun", "tools"])
+@pytest.mark.parametrize(
+    "case", ["overrun", "tools", "guarded-overrun", "guarded-tools"]
+)
 def test_installed_cli_boundary(tmp_path, case):
     binary = Path(
         os.environ.get("REIN_CLAUDE_PROOF_BINARY") or shutil.which("claude") or ""
@@ -31,7 +33,7 @@ def test_installed_cli_boundary(tmp_path, case):
         "revalidate the fixture for this binary version before claiming the pinned proof"
     )
     adapter = AgenticClaudeCodeAdapter(workdir=tmp_path, model="claude-sonnet-4-6")
-    cap = 0.01 if case == "overrun" else 1
+    cap = 0.01 if case in ("overrun", "guarded-overrun") else 1
     argv = adapter._build_command(
         RunConfig(model_params={"max_budget_usd": cap, "max_turns": 4})
     )
@@ -45,6 +47,23 @@ def test_installed_cli_boundary(tmp_path, case):
     shutil.copyfile(
         Path(__file__).with_name("native_cli_fixture.py"), tmp_path / "fixture.py"
     )
+    if case.startswith("guarded-"):
+        import llm_connect.messages_gate
+        import rein_aharness.request_admission
+        import rein_aharness.spend_admission
+
+        for package, modules in {
+            "llm_connect": [llm_connect.messages_gate],
+            "rein_aharness": [
+                rein_aharness.request_admission,
+                rein_aharness.spend_admission,
+            ],
+        }.items():
+            target = tmp_path / package
+            target.mkdir()
+            (target / "__init__.py").write_text("")
+            for module in modules:
+                shutil.copyfile(module.__file__, target / Path(module.__file__).name)
     command = [
         "bwrap",
         "--unshare-all",
@@ -93,7 +112,9 @@ def test_installed_cli_boundary(tmp_path, case):
         "/usr/bin/python3",
         "/work/fixture.py",
     ]
-    proc = subprocess.run(command, capture_output=True, text=True, timeout=55, check=False)
+    proc = subprocess.run(
+        command, capture_output=True, text=True, timeout=55, check=False
+    )
     assert proc.returncode == 0, proc.stderr[-1000:]
     result = json.loads(proc.stdout)
     assert result["network_namespace"] != os.readlink("/proc/self/ns/net")
@@ -111,7 +132,20 @@ def test_installed_cli_boundary(tmp_path, case):
         assert request["model"] == "claude-sonnet-4-6"
         assert not request["ambient_context_loaded"]
     terminal = result["terminal"]
-    if case == "overrun":
+    if case.startswith("guarded-"):
+        assert all("refusal" not in row for row in result["guard_attempts"]), (
+            json.dumps(result["guard_attempts"])
+        )
+    if case == "guarded-overrun":
+        assert result["guard_attempts"], result
+        assert all(
+            row.get("liability_microusd") == 1_080_000
+            for row in result["guard_attempts"]
+        ), result
+        assert not requests and not result["request_reservations"]
+        assert result["returncode"] != 0 and terminal["is_error"]
+        assert terminal["total_cost_usd"] == 0
+    elif case == "overrun":
         assert len(requests) == 1
         assert proc.returncode == 0 and result["returncode"] == 1
         assert terminal["subtype"] == "error_max_budget_usd"
@@ -129,6 +163,15 @@ def test_installed_cli_boundary(tmp_path, case):
         assert result["created_file"] == "fixture-created\n"
         usage, cost = terminal_accounting(terminal, max_budget_usd=cap, max_turns=4)
         assert usage["total_tokens"] > 0 and cost > 0
+        if case == "guarded-tools":
+            assert len(result["request_reservations"]) == 2
+            assert all(
+                row["state"] == "charged" for row in result["request_reservations"]
+            )
+            assert (
+                sum(row["liability_microusd"] for row in result["request_reservations"])
+                == 2_160_000
+            )
     if output_dir := os.environ.get("REIN_CLAUDE_PROOF_OUTPUT"):
         target = Path(output_dir)
         target.mkdir(parents=True, exist_ok=True)