rein-aharness/workplans/REINAH-WP-0008-simpler-metered-retry.md

id	type	title	domain	repo	status	owner	topic_slug	priority	created	updated	related	state_hub_workstream_id
REINAH-WP-0008	workplan	Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal	infotech	rein-aharness	ready	claude-code	rein-aharness	high	2026-10-13	2026-10-13	REINAH-WP-0003	187c2599-84a6-5764-a14f-7e9121975bf2

REINAH-WP-0008 — Simpler metered retry

Origin

On 2026-10-13 the owner reconciled the 2026-09-27 hold for run 6efa9436 (docs/evidence/2026-10-13-held-liability-reconciliation.json). A corrected runtime ee3d0a53… was built (docs/evidence/2026-10-13-corrected-owner-runtime-build.json). The owner authorized a new envelope and one retry.

Preparing that retry took too many owner ceremonies:

1. The runtime is built on the workstation and copied to railiance01 by hand.
2. owner.json and the spend policy hold five digests that the owner edits by hand.
3. A failed attempt keeps its full hold even when no provider request was made, so every failure needs a new envelope, ledger and pins.
4. Every attempt needs six native approvals.
5. The launcher bug that failed run 6efa9436 was found only by spending money. A free check on the host would have caught it.

The owner agreed (2026-10-13) to fix items 5, 3 and 2 here, and to record the rest as decisions instead of blocking on them.

Goal: a retry becomes: install the artifact, rehearse for free, approve once, run.

A. Free rehearsal on the host

id: REINAH-WP-0008-T01
status: todo
priority: high
state_hub_task_id: "c6536c8d-7862-5de6-ad2b-401077b60c04"

Add rein-aharness owner check --rehearse <owner.json>. It runs everything metered-once --check does. It then executes the admitted runtime's rein-aharness and glas-harness launchers inside bwrap, from the mount path, with --unshare-all, no credentials, no provider route and no ledger write. It also checks that the sandbox profile resolves. It prints a single pass or fail line with the runtime digest.

Today's launcher check reads only the first line of each launcher. This rehearsal runs them, the same way the failing run did.

Done when: tests prove the rehearsal fails on a runtime whose launchers point at a missing build directory (the 6efa9436 failure) and passes on a relocated runtime. It must make no network calls and write nothing. The owner procedure in docs/owner-bootstrap.md makes the rehearsal a required step before any paid attempt.

B. Release holds that provably cost nothing

id: REINAH-WP-0008-T02
status: todo
priority: high
state_hub_task_id: "6a413f5a-4ac2-5d5e-9b19-71b33445c0a9"

SpendLedger.reconcile keeps the full hold (max(held, observed)). Add an evidence-backed release. If the run has zero provider-request reservations and its request route is revoked, reconciliation may set the liability to the observed amount. Otherwise the current rule stands. The release records which evidence allowed it, and the CLI flag says so, for example --release-unused-hold.

This changes a deliberate safety rule, so it needs owner sign-off on the exact rule before merge. That sign-off is recorded in T04's decision note.

Done when: tests cover all four cases. A run with no request reservations and a revoked route releases. A run with any request reservation, or with a live route, refuses the release. A second, identical reconcile changes nothing. The envelope is never marked breached by a release.

D. One owner command for renewal

id: REINAH-WP-0008-T03
status: todo
priority: high
state_hub_task_id: "87457216-2371-51ca-b3d4-3917e6f180a2"

Add rein-aharness owner renew --owner <owner.json> --runtime <digest> --envelope <envelope.json>. It does three things:

1. It refuses unless every reservation in the current ledger is settled.
2. It writes the new spend policy, initializes a fresh ledger, and updates the runtime and spend-policy pins in owner.json together. Old files are kept as backups. Existing ledgers are never reset.
3. It prints one summary for the owner to review: old to new runtime, old to new policy digest, envelope cap and attempt limit, and ledger path.

Add a dry-run mode that only prints the summary. Afterwards, run the T01 rehearsal.

Done when: a test renews from the 2026-09-27 layout to a new envelope. The owner check passes on the result. A second renew with an unsettled reservation refuses. No digest has to be typed by hand.

C. Envelopes that cover several attempts (decision)

id: REINAH-WP-0008-T04
status: wait
priority: medium
state_hub_task_id: "898e02af-51bb-5e8d-93d0-ae908466c612"

Owner decision: should future envelopes be admitted as "up to N attempts within EUR X" instead of one attempt? The EUR 10 cap already fits two USD 4.64 request holds. Record the choice, together with T02's sign-off, as a decision note in docs/. T03's envelope format then reflects it.

E. Ship the owner runtime as a container image (decision)

id: REINAH-WP-0008-T05
status: wait
priority: low
state_hub_task_id: "b486e86b-9d0f-501d-a394-771b40f771ee"

Decision for later, with Platform (railiance) and Sand-boxer: should the owner runtime ship through the registry and GitOps, using the existing make image path, instead of rsync and a manual digest check? Out of scope here. If accepted, hand it off as a residual intake to the owning repos.

F. Approvals per envelope (decision)

id: REINAH-WP-0008-T06
status: wait
priority: low
state_hub_task_id: "4cf721e6-724b-5c64-91bb-67b098bb97af"

Decision for later, with Secrets Engine: should one approval set cover an envelope's attempts instead of six native approvals per attempt? The work lives outside this repo. If accepted, hand it off as a residual intake.

Retry on the corrected runtime

id: REINAH-WP-0008-T07
status: wait
priority: high
state_hub_task_id: "80318842-ccaa-5484-a54a-3d9981eaec8b"

Waits on T01 and T03. It does not need T02.

Steps:

1. Rebuild ee3d0a53…, or the then-current corrected runtime, from the pinned commits.
2. Install it on railiance01.
3. Run the T01 rehearsal.
4. Renew with T03 to the owner-authorized new envelope (EUR 10, authorized 2026-10-13).
5. Run exactly one attended attempt, which consumes fresh native approvals.

Record the result in REINAH-WP-0003-T05/T06.