rein-aharness/docs/request-admission.md

Child request reservations in the worker envelope

rein_aharness.request_admission.RequestLedger implements llm-connect's owner-hosted Messages meter in the existing private SpendLedger database. It introduces no second daily/total allowance and does not install a service.

The trusted provisioning path calls RequestLedger.initialize() before any run reservation. Missing tables or state refuse; initialization is additive and cannot reset existing request tables. After the normal validated parent dispatch reservation, the owner calls bind_route(run_id, policy_sha256, lease_id=..., expires_at=...) with the real accepted lease expiry. This returns one random token whose hash is stored with run, lease, exact request policy and expiry. The owner supplies that token and the gateway URL to the workload; no provider key or ledger path belongs in the sandbox. There is no replacement/renewal path for a run; expiry or revocation requires owner handling, not workload replay.

Each forward first commits a child hold in micro-USD. Requests serialize with SQLite BEGIN IMMEDIATE; a pending or unknown request blocks additional calls. Sum of full child liabilities cannot exceed the parent's admitted USD maximum. Trusted terminal usage charges the full child reservation without refunds. Known overrun records the larger amount and freezes the whole envelope. Request receipts contain only bounded IDs/digests, amounts, times and disposition.

Parent observation revokes the route, including unknown accounting results. Even an apparent successful CLI result cannot settle a parent with pending child requests. Existing operator reconciliation still requires attested provider termination and final accounting; it settles child holds conservatively and never reopens a route or grants another demand attempt. revoke_route is the trusted callback for real lease loss; an expiry also denies new admissions. In-flight cancellation retains liability until outcome is known.

The downstream protocol is documented in llm-connect/contracts/functional/messages-admission.md (LLM-WP-0009). The default worker/serve configurations do not yet host or inject this route. REINAH-WP-0003-T05/T06 and LLM-WP-0009-T03 retain protected owner hosting, real lease/token wiring, provider custody, enforced egress and bypass proof, accepted tariffs/FX, runtime installation and admitted real-profile/queue execution.

The installed-CLI fake-provider proof uses synthetic bounds and dummy keys. With a USD 0.01 parent the same native request is refused with zero upstream calls; with adequate fixture capacity a two-request tool session succeeds. That verifies request admission and accounting, not a live EUR ceiling or owner/workload secret and network separation.

When AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION is set, preflight also refuses before any claim unless the in-process owner carries positive integer input and output micro-USD upper rates and an activate path that can bind an accepted queue lease to a route token. Those rates are the fixture or owner pin already on MessagesPolicy. They are not a live tariff or FX. The 2026-10-08 fixture receipt is docs/evidence/2026-10-08-fixture-recovery-rate-queue.json. It does not deploy the admitted runtime or start a paid request. Activity Core still owes a reply to message 27cd4c47-117c-46a8-a3cf-204f65caa540: a heartbeat 409 stays claimed because this worker must not terminal-close a lost lease.

Owner lifecycle and sole-route integration are now documented in owner-messages-route.md. This is local source/fixture evidence; live bootstrap and placement acceptance remain open.