rein-aharness/docs/native-cli-boundary-proof.md

Native CLI boundary proof — 2026-09-09

The installed Claude Code 2.1.266 binary was exercised against a deterministic Anthropic-shaped API in a separate bwrap network namespace. The namespace had no provider network route, operator home, real credential or inference service. Only the CLI binary, system runtime and a temporary fixture workspace were mounted. The executable receipt records the binary SHA-256 and exact adapter-generated argv.

Findings and resulting change

With --max-budget-usd 0.01, the first fixture response reported 60,000 input and 10 output tokens. The CLI estimated USD 0.18015, then exited with error_max_budget_usd. Only one messages request reached the fixture. This reproduces a stop after the response, not a pre-request maximum-liability check. The rein terminal-accounting validator refused success and preserved known cost. No amount in this experiment was billed by a provider.

The existing spend ledger remains necessary: it reserves declared per-run liability and retains unknown outcomes. The experiment does not establish that the declared liability is a valid bound on every possible native request. A provider-facing request guard is the next HFACT-WP-0001-T01 implementation return; raising the native threshold or accepting a newer binary cannot substitute for it.

The adapter also previously used --allowedTools with acceptEdits. Those flags alone did not constrain the available tool inventory or repository-provided customizations. Runs with native USD or turn controls now require CLI >=2.1.266 and use dontAsk, explicit builtin tools derived from registered rules, --bare, empty settings sources, empty strict MCP configuration, an MCP deny rule, and no session persistence. Legacy unconfigured sessions retain their existing behavior. The worker prompt explicitly requires reading applicable AGENTS.md/CLAUDE.md; these files are instructions, not permission to load executable configuration or expand grants. The factory's protected runtime must be rebuilt and re-proven for the new minimum; this source change installs or admits no runtime.

The real binary's bare mode exposed Bash, Read and Edit, a subset of the explicit inventory. A synthetic tool sequence successfully ran permitted git status and created a new file through Edit. An unapproved shell write was denied. A fixture project containing a broad Bash permission override, a SessionStart hook and an MCP command could activate none of them; its ambient CLAUDE.md was not auto-loaded. The second messages request contained the expected allowed/denied tool results.

These tests prove the specified direct-tool and configuration boundaries. They are not an arbitrary-code sandbox proof: permitted Git operations can invoke repository-controlled helpers, and file edits can influence later commands. Filesystem, credential and network confinement remain sandbox-owner controls. To enforce spend against such indirect execution, the workload must not possess a provider credential plus an unmetered route to the provider. A run-scoped, owner-controlled request path must cover every forwarded request and retry.

Reproduction and acceptance

REIN_REAL_CLAUDE=1 enables tests/test_native_cli_boundary.py. The default binary comes from claude on PATH; REIN_CLAUDE_PROOF_BINARY can select an exact installed file. The fixture deliberately requires version 2.1.266; revalidate and record a new receipt before claiming the same proof for another version. The adapter's minimum-version gate does not itself prove arbitrary future binaries.

REIN_REAL_CLAUDE=1 REIN_REAL_BWRAP=1 python -m pytest tests/ -q

The reproducible fixture is tests/native_cli_fixture.py; optional REIN_CLAUDE_PROOF_OUTPUT writes bounded evidence without prompts, headers, credentials or response bodies. The actual CLI checks are opt-in because ordinary CI does not provision that binary. Deterministic native launch/accounting tests are now included in both mandatory runtime and recovery gates. Paired receipts: docs/evidence/2026-09-09-native-cli-overrun.json and docs/evidence/2026-09-09-native-cli-tools.json.

No paid factory request, profile promotion, credential reader or production rollout was authorized or performed. REINAH-WP-0003-T05/T06 and HFACT-WP-0001-T01/ T03/T04/T05 retain the request-admission, exact identity, protected placement and natural queue/model execution returns.

Upstream contract reviewed

The CLI reference distinguishes available tools from auto-permission rules and describes the native stop flag. The headless guide documents bare-mode configuration isolation and the API-key authentication path. The cost guide identifies CLI totals as local estimates, not authoritative billing, and notes the residency-cost correction in 2.1.239. Reviewed 2026-09-09; the local executable findings above are narrower than a claim about all provider billing or future CLI releases.