"""Runs inside a network namespace: deterministic HTTP responses, no inference.""" import http.server import json import os import subprocess import threading from pathlib import Path root = Path("/work") settings = json.loads((root / "case.json").read_text()) seen = [] guard_attempts = [] class Handler(http.server.BaseHTTPRequestHandler): def log_message(self, *args): pass def do_POST(self): body = json.loads(self.rfile.read(int(self.headers.get("Content-Length", 0)))) results = [] for message in body.get("messages", []): if isinstance(message.get("content"), list): results.extend( { "id": block.get("tool_use_id"), "is_error": block.get("is_error", False), } for block in message["content"] if block.get("type") == "tool_result" ) seen.append( { "path": self.path, "model": body.get("model"), "max_tokens": body.get("max_tokens"), "tools": [tool.get("name") for tool in body.get("tools", [])], "tool_results": results, "ambient_context_loaded": "AMBIENT_CONTEXT_SENTINEL" in json.dumps(body), } ) if "count_tokens" in self.path: self.send_response(200) self.send_header("Content-Type", "application/json") self.end_headers() self.wfile.write(b'{"input_tokens":100}') return message_number = sum("count_tokens" not in request["path"] for request in seen) if settings["case"] in ("tools", "guarded-tools") and message_number == 1: blocks = [ { "type": "tool_use", "id": "tool_allowed", "name": "Bash", "input": { "command": "git status", "description": "Read fixture status", }, }, { "type": "tool_use", "id": "tool_create", "name": "Edit", "input": { "file_path": "/work/target/result.txt", "old_string": "", "new_string": "fixture-created\n", }, }, { "type": "tool_use", "id": "tool_denied", "name": "Bash", "input": { "command": "printf bypass > /work/denied-ran", "description": "Fixture forbidden operation", }, }, ] stop = "tool_use" else: blocks = [{"type": "text", "text": "fixture complete"}] stop = "end_turn" usage = { "input_tokens": 60000 if settings["case"] in ("overrun", "guarded-overrun") else 100, "output_tokens": 0, "cache_creation_input_tokens": 0, "cache_read_input_tokens": 0, } events = [ ( "message_start", { "type": "message_start", "message": { "id": "msg_fixture_" + str(message_number), "type": "message", "role": "assistant", "model": "claude-sonnet-4-6", "content": [], "stop_reason": None, "stop_sequence": None, "usage": usage, }, }, ) ] for index, block in enumerate(blocks): if block["type"] == "text": start = {"type": "text", "text": ""} delta = {"type": "text_delta", "text": block["text"]} else: start = {**block, "input": {}} delta = { "type": "input_json_delta", "partial_json": json.dumps(block["input"]), } events += [ ( "content_block_start", { "type": "content_block_start", "index": index, "content_block": start, }, ), ( "content_block_delta", {"type": "content_block_delta", "index": index, "delta": delta}, ), ("content_block_stop", {"type": "content_block_stop", "index": index}), ] events += [ ( "message_delta", { "type": "message_delta", "delta": {"stop_reason": stop, "stop_sequence": None}, "usage": {**usage, "output_tokens": 10}, }, ), ("message_stop", {"type": "message_stop"}), ] encoded = "".join( "event: " + name + "\ndata: " + json.dumps(value) + "\n\n" for name, value in events ).encode() self.send_response(200) self.send_header("Content-Type", "text/event-stream") self.send_header("Content-Length", str(len(encoded))) self.end_headers() self.wfile.write(encoded) server = http.server.ThreadingHTTPServer(("127.0.0.1", 0), Handler) threading.Thread(target=server.serve_forever, daemon=True).start() gate = meter = None route_token = "fixture-no-provider-secret" base_url = "http://127.0.0.1:" + str(server.server_port) if settings["case"].startswith("guarded-"): from datetime import UTC, datetime, timedelta from types import SimpleNamespace from llm_connect.messages_gate import MessagesPolicy, MessagesServer, RequestRefused from rein_aharness.request_admission import RequestLedger from rein_aharness.spend_admission import SpendLedger, SpendPolicy class ObservedPolicy(MessagesPolicy): def validate(self, data, betas): row = { "fields": sorted(data), "betas": betas, "context_management": data.get("context_management"), "thinking": data.get("thinking"), "output_config": data.get("output_config"), } guard_attempts.append(row) try: value = super().validate(data, betas) row["liability_microusd"] = value return value except RequestRefused as exc: row["refusal"] = str(exc) raise # Synthetic accepted bounds ONLY, never a live price/FX/authority packet. policy = ObservedPolicy( "fixture:no-live-tariff", "claude-sonnet-4-6", 200000, 32000, 3, 15, allowed_betas=( "claude-code-20250219", "interleaved-thinking-2025-05-14", "thinking-token-count-2026-05-13", "context-management-2025-06-27", "prompt-caching-scope-2026-01-05", "effort-2025-11-24", ), ) cap = "0.01" if settings["case"] == "guarded-overrun" else "5" private = root / "private" private.mkdir(mode=0o700) now = datetime.now(UTC) expiry = (now + timedelta(minutes=5)).isoformat() parent_policy = SpendPolicy( "1", "fixture", "fixture:no-live-authority", (now - timedelta(minutes=1)).isoformat(), expiry, "UTC", "fixture-worker", "fixture-definition", "/work/target", "fixture", "harness.fixture@1.0.0", "a" * 64, "b" * 64, "fixture-grant", cap, cap, 4, "1", cap, cap, cap, ) parent = SpendLedger(private / "spend.sqlite3", parent_policy) parent.initialize() meter = RequestLedger(parent) meter.initialize() parent.reserve( SimpleNamespace( id="fixture-run", activity_definition_id="fixture-definition", idempotency_key="fixture", attempt=1, ) ) route_token = meter.bind_route( "fixture-run", policy.sha256, lease_id="fixture-lease", expires_at=expiry ) gate = MessagesServer( policy, meter, provider_key="fixture-owner-only-key", upstream_url=base_url, allow_test_http=True, ) gate.start() base_url = "http://127.0.0.1:" + str(gate.port) (root / "target" / ".claude").mkdir(parents=True) (root / "target" / ".claude" / "settings.json").write_text( json.dumps( { "permissions": {"allow": ["Bash"]}, "hooks": { "SessionStart": [ {"hooks": [{"type": "command", "command": "touch /work/hook-ran"}]} ] }, } ) ) (root / "target" / ".mcp.json").write_text( json.dumps( { "mcpServers": { "fixture": {"command": "/bin/sh", "args": ["-c", "touch /work/mcp-ran"]} } } ) ) (root / "target" / "CLAUDE.md").write_text("AMBIENT_CONTEXT_SENTINEL\n") subprocess.run(["git", "init", "-q", str(root / "target")], check=True) env = dict( os.environ, ANTHROPIC_BASE_URL=base_url, ANTHROPIC_API_KEY=route_token, CLAUDE_CONFIG_DIR="/work/config", CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1", DISABLE_AUTOUPDATER="1", ) try: proc = subprocess.run( settings["argv"], input="Run the deterministic fixture.", text=True, capture_output=True, check=False, env=env, cwd="/work/target", timeout=45, ) terminal = json.loads(proc.stdout) output = { "returncode": proc.returncode, "terminal": { key: terminal.get(key) for key in ( "type", "subtype", "is_error", "total_cost_usd", "num_turns", "usage", "permission_denials", ) }, "requests": seen, "markers": { name: (root / name).exists() for name in ("hook-ran", "mcp-ran", "denied-ran") }, "created_file": (root / "target" / "result.txt").read_text() if (root / "target" / "result.txt").exists() else None, "network_namespace": os.readlink("/proc/self/ns/net"), "guard_attempts": guard_attempts, "request_reservations": meter.status() if meter else [], } print(json.dumps(output)) finally: if gate: gate.stop() server.shutdown()