{
  "schema": "metered-activation-review/v1",
  "status": "review-only",
  "dispatch_enabled": false,
  "owner_digest": "97ee637a8e022922bbf6264b57a55f68d05d4372dabd20e3cd74bed14db57cd2",
  "policy_review": {
    "passed": true,
    "failures": [],
    "maximum_request_microusd": 4640000,
    "maximum_request_eur_at_configured_fx": "4.0368",
    "full_output_requests_that_fit": 1,
    "provider_facts_ref": "https://platform.claude.com/docs/en/models/sonnet-5/whats-new-sonnet-5",
    "authority_granted": false,
    "remaining_acceptance": [
      "FX upper bound and validity",
      "live CLI/beta compatibility",
      "native delivery and runtime admission"
    ]
  },
  "plans": [
    {
      "catalog_id": "glas-claude-agent-dev-anthropic",
      "stage": "prod",
      "decision_id": "",
      "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
      "role_name": "se-prod-glas-claude-agent-dev-anthropic",
      "actions": [
        {
          "kind": "kv-mount-check",
          "target": "platform",
          "detail": {
            "type": "kv-v2",
            "management": "existing",
            "mutation": "none"
          }
        },
        {
          "kind": "policy",
          "target": "se-prod-glas-claude-agent-dev-anthropic",
          "detail": {
            "paths": "platform/data/workloads/glas-harness/claude-agent-dev"
          }
        },
        {
          "kind": "approle",
          "target": "se-prod-glas-claude-agent-dev-anthropic",
          "detail": {
            "token_policies": "se-prod-glas-claude-agent-dev-anthropic",
            "auth": "approle",
            "token_ttl": "5m",
            "token_max_ttl": "15m",
            "token_num_uses": 8,
            "secret_id_ttl": "5m",
            "secret_id_num_uses": 1
          }
        }
      ],
      "policy_hcl": "# Generated by secrets-engine for policy \"se-prod-glas-claude-agent-dev-anthropic\"\n\npath \"platform/data/workloads/glas-harness/claude-agent-dev\" {\n  capabilities = [\"read\"]\n}\n"
    },
    {
      "catalog_id": "activity-core-metered-worker-token",
      "stage": "prod",
      "decision_id": "",
      "policy_name": "se-prod-activity-core-metered-worker-token",
      "role_name": "se-prod-activity-core-metered-worker-token",
      "actions": [
        {
          "kind": "kv-mount-check",
          "target": "platform",
          "detail": {
            "type": "kv-v2",
            "management": "existing",
            "mutation": "none"
          }
        },
        {
          "kind": "policy",
          "target": "se-prod-activity-core-metered-worker-token",
          "detail": {
            "paths": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01"
          }
        },
        {
          "kind": "approle",
          "target": "se-prod-activity-core-metered-worker-token",
          "detail": {
            "token_policies": "se-prod-activity-core-metered-worker-token",
            "auth": "approle",
            "token_ttl": "5m",
            "token_max_ttl": "15m",
            "token_num_uses": 8,
            "secret_id_ttl": "5m",
            "secret_id_num_uses": 1
          }
        }
      ],
      "policy_hcl": "# Generated by secrets-engine for policy \"se-prod-activity-core-metered-worker-token\"\n\npath \"platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01\" {\n  capabilities = [\"read\"]\n}\n"
    }
  ],
  "actions": [
    {
      "catalog": "glas-claude-agent-dev-anthropic",
      "action": "apply",
      "request": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service"
        },
        "action": "apply",
        "resource": {
          "id": "catalog:glas-claude-agent-dev-anthropic",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "attributes": {
            "stage": "prod",
            "fields": [],
            "policy_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "auth_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ]
          }
        },
        "context": {
          "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
          "catalog_target": {
            "kind": "kv",
            "org": "coulomb",
            "repo": "sand-boxer",
            "mount": "platform",
            "path": "workloads/glas-harness/claude-agent-dev",
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "mount_management": "existing",
            "consumers": [
              {
                "name": "sand-boxer-glas-agent-dev",
                "auth": "approle",
                "claim": "catalog:glas-claude-agent-dev-anthropic",
                "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
              }
            ],
            "delivery_modes": [
              "exec-env",
              "read-check"
            ],
            "delivery_auth": {
              "method": "approle",
              "management": "engine",
              "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
              "role_name": "se-prod-glas-claude-agent-dev-anthropic",
              "metadata_read": false,
              "token_ttl": "5m",
              "token_max_ttl": "15m",
              "secret_id_ttl": "5m",
              "secret_id_num_uses": 1,
              "token_num_uses": 8
            },
            "delivery_config": {
              "exec_owner": {
                "status": "configured",
                "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
                "command": [
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                  "-I",
                  "-B",
                  "-m",
                  "rein_aharness.cli",
                  "metered-once",
                  "--owner-config",
                  "/home/tegwick/hfact/owner-metered/owner.json"
                ],
                "cwd": "/home/tegwick/hfact/owner-metered",
                "environment": {
                  "PATH": "/usr/bin:/bin",
                  "LANG": "C.UTF-8",
                  "HOME": "/home/tegwick",
                  "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                  "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                  "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                  "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                  "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                  "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                  "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                  "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                  "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
                  "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
                },
                "files": {
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                    "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
                    "private": false
                  },
                  "/home/tegwick/hfact/owner-metered/owner.json": {
                    "sha256": "e0d3fb84649fdca302eccd9415f3cc2beaee84bf07bd83205cdffbe93e5573bc",
                    "private": true
                  },
                  "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                    "sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
                    "private": true
                  }
                },
                "companions": [
                  {
                    "catalog": "activity-core-metered-worker-token",
                    "field": "token",
                    "env": "ACTIVITY_CORE_WORKER_TOKEN"
                  }
                ]
              }
            },
            "auth_capability": {},
            "workload_delivery": []
          },
          "human_control": true
        }
      }
    },
    {
      "catalog": "glas-claude-agent-dev-anthropic",
      "action": "verify",
      "request": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service"
        },
        "action": "verify",
        "resource": {
          "id": "catalog:glas-claude-agent-dev-anthropic",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "attributes": {
            "stage": "prod",
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "policy_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "auth_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ]
          }
        },
        "context": {
          "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
          "catalog_target": {
            "kind": "kv",
            "org": "coulomb",
            "repo": "sand-boxer",
            "mount": "platform",
            "path": "workloads/glas-harness/claude-agent-dev",
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "mount_management": "existing",
            "consumers": [
              {
                "name": "sand-boxer-glas-agent-dev",
                "auth": "approle",
                "claim": "catalog:glas-claude-agent-dev-anthropic",
                "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
              }
            ],
            "delivery_modes": [
              "exec-env",
              "read-check"
            ],
            "delivery_auth": {
              "method": "approle",
              "management": "engine",
              "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
              "role_name": "se-prod-glas-claude-agent-dev-anthropic",
              "metadata_read": false,
              "token_ttl": "5m",
              "token_max_ttl": "15m",
              "secret_id_ttl": "5m",
              "secret_id_num_uses": 1,
              "token_num_uses": 8
            },
            "delivery_config": {
              "exec_owner": {
                "status": "configured",
                "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
                "command": [
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                  "-I",
                  "-B",
                  "-m",
                  "rein_aharness.cli",
                  "metered-once",
                  "--owner-config",
                  "/home/tegwick/hfact/owner-metered/owner.json"
                ],
                "cwd": "/home/tegwick/hfact/owner-metered",
                "environment": {
                  "PATH": "/usr/bin:/bin",
                  "LANG": "C.UTF-8",
                  "HOME": "/home/tegwick",
                  "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                  "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                  "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                  "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                  "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                  "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                  "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                  "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                  "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
                  "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
                },
                "files": {
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                    "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
                    "private": false
                  },
                  "/home/tegwick/hfact/owner-metered/owner.json": {
                    "sha256": "e0d3fb84649fdca302eccd9415f3cc2beaee84bf07bd83205cdffbe93e5573bc",
                    "private": true
                  },
                  "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                    "sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
                    "private": true
                  }
                },
                "companions": [
                  {
                    "catalog": "activity-core-metered-worker-token",
                    "field": "token",
                    "env": "ACTIVITY_CORE_WORKER_TOKEN"
                  }
                ]
              }
            },
            "auth_capability": {},
            "workload_delivery": []
          },
          "human_control": true
        }
      }
    },
    {
      "catalog": "glas-claude-agent-dev-anthropic",
      "action": "exec",
      "request": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service"
        },
        "action": "exec",
        "resource": {
          "id": "catalog:glas-claude-agent-dev-anthropic",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "attributes": {
            "stage": "prod",
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "policy_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ],
            "auth_targets": [
              "se-prod-glas-claude-agent-dev-anthropic"
            ]
          }
        },
        "context": {
          "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
          "catalog_target": {
            "kind": "kv",
            "org": "coulomb",
            "repo": "sand-boxer",
            "mount": "platform",
            "path": "workloads/glas-harness/claude-agent-dev",
            "fields": [
              "ANTHROPIC_API_KEY"
            ],
            "mount_management": "existing",
            "consumers": [
              {
                "name": "sand-boxer-glas-agent-dev",
                "auth": "approle",
                "claim": "catalog:glas-claude-agent-dev-anthropic",
                "purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
              }
            ],
            "delivery_modes": [
              "exec-env",
              "read-check"
            ],
            "delivery_auth": {
              "method": "approle",
              "management": "engine",
              "policy_name": "se-prod-glas-claude-agent-dev-anthropic",
              "role_name": "se-prod-glas-claude-agent-dev-anthropic",
              "metadata_read": false,
              "token_ttl": "5m",
              "token_max_ttl": "15m",
              "secret_id_ttl": "5m",
              "secret_id_num_uses": 1,
              "token_num_uses": 8
            },
            "delivery_config": {
              "exec_owner": {
                "status": "configured",
                "owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
                "command": [
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
                  "-I",
                  "-B",
                  "-m",
                  "rein_aharness.cli",
                  "metered-once",
                  "--owner-config",
                  "/home/tegwick/hfact/owner-metered/owner.json"
                ],
                "cwd": "/home/tegwick/hfact/owner-metered",
                "environment": {
                  "PATH": "/usr/bin:/bin",
                  "LANG": "C.UTF-8",
                  "HOME": "/home/tegwick",
                  "ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
                  "AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
                  "AGENT_HARNESS_OPS_LABELS": "hfact-metered",
                  "AGENT_HARNESS_OPS_LABELS_MODE": "all",
                  "AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
                  "AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
                  "AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
                  "AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
                  "AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
                  "AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
                },
                "files": {
                  "/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
                    "sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
                    "private": false
                  },
                  "/home/tegwick/hfact/owner-metered/owner.json": {
                    "sha256": "e0d3fb84649fdca302eccd9415f3cc2beaee84bf07bd83205cdffbe93e5573bc",
                    "private": true
                  },
                  "/home/tegwick/hfact/owner-metered/spend-policy.json": {
                    "sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
                    "private": true
                  }
                },
                "companions": [
                  {
                    "catalog": "activity-core-metered-worker-token",
                    "field": "token",
                    "env": "ACTIVITY_CORE_WORKER_TOKEN"
                  }
                ]
              }
            },
            "auth_capability": {},
            "workload_delivery": []
          },
          "human_control": true,
          "exec_owner_sha256": "97ee637a8e022922bbf6264b57a55f68d05d4372dabd20e3cd74bed14db57cd2"
        }
      }
    },
    {
      "catalog": "activity-core-metered-worker-token",
      "action": "apply",
      "request": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service"
        },
        "action": "apply",
        "resource": {
          "id": "catalog:activity-core-metered-worker-token",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "attributes": {
            "stage": "prod",
            "fields": [],
            "policy_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "auth_targets": [
              "se-prod-activity-core-metered-worker-token"
            ]
          }
        },
        "context": {
          "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
          "catalog_target": {
            "kind": "kv",
            "org": "coulomb",
            "repo": "activity-core",
            "mount": "platform",
            "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
            "fields": [
              "token"
            ],
            "mount_management": "existing",
            "consumers": [
              {
                "name": "rein-aharness-metered-railiance01",
                "auth": "approle",
                "claim": "catalog:activity-core-metered-worker-token",
                "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
              }
            ],
            "delivery_modes": [
              "exec-env"
            ],
            "delivery_auth": {
              "method": "approle",
              "management": "engine",
              "policy_name": "se-prod-activity-core-metered-worker-token",
              "role_name": "se-prod-activity-core-metered-worker-token",
              "metadata_read": false,
              "token_ttl": "5m",
              "token_max_ttl": "15m",
              "secret_id_ttl": "5m",
              "secret_id_num_uses": 1,
              "token_num_uses": 8
            },
            "delivery_config": {
              "companion_of": [
                "glas-claude-agent-dev-anthropic"
              ]
            },
            "auth_capability": {},
            "workload_delivery": []
          }
        }
      }
    },
    {
      "catalog": "activity-core-metered-worker-token",
      "action": "verify",
      "request": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service"
        },
        "action": "verify",
        "resource": {
          "id": "catalog:activity-core-metered-worker-token",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "attributes": {
            "stage": "prod",
            "fields": [
              "token"
            ],
            "policy_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "auth_targets": [
              "se-prod-activity-core-metered-worker-token"
            ]
          }
        },
        "context": {
          "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
          "catalog_target": {
            "kind": "kv",
            "org": "coulomb",
            "repo": "activity-core",
            "mount": "platform",
            "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
            "fields": [
              "token"
            ],
            "mount_management": "existing",
            "consumers": [
              {
                "name": "rein-aharness-metered-railiance01",
                "auth": "approle",
                "claim": "catalog:activity-core-metered-worker-token",
                "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
              }
            ],
            "delivery_modes": [
              "exec-env"
            ],
            "delivery_auth": {
              "method": "approle",
              "management": "engine",
              "policy_name": "se-prod-activity-core-metered-worker-token",
              "role_name": "se-prod-activity-core-metered-worker-token",
              "metadata_read": false,
              "token_ttl": "5m",
              "token_max_ttl": "15m",
              "secret_id_ttl": "5m",
              "secret_id_num_uses": 1,
              "token_num_uses": 8
            },
            "delivery_config": {
              "companion_of": [
                "glas-claude-agent-dev-anthropic"
              ]
            },
            "auth_capability": {},
            "workload_delivery": []
          }
        }
      }
    },
    {
      "catalog": "activity-core-metered-worker-token",
      "action": "exec",
      "request": {
        "tenant": "tenant:platform",
        "subject": {
          "id": "secrets-engine",
          "type": "service"
        },
        "action": "exec",
        "resource": {
          "id": "catalog:activity-core-metered-worker-token",
          "type": "secret-catalog-lane",
          "system": "secrets-engine",
          "attributes": {
            "stage": "prod",
            "fields": [
              "token"
            ],
            "policy_targets": [
              "se-prod-activity-core-metered-worker-token"
            ],
            "auth_targets": [
              "se-prod-activity-core-metered-worker-token"
            ]
          }
        },
        "context": {
          "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
          "catalog_target": {
            "kind": "kv",
            "org": "coulomb",
            "repo": "activity-core",
            "mount": "platform",
            "path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
            "fields": [
              "token"
            ],
            "mount_management": "existing",
            "consumers": [
              {
                "name": "rein-aharness-metered-railiance01",
                "auth": "approle",
                "claim": "catalog:activity-core-metered-worker-token",
                "purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
              }
            ],
            "delivery_modes": [
              "exec-env"
            ],
            "delivery_auth": {
              "method": "approle",
              "management": "engine",
              "policy_name": "se-prod-activity-core-metered-worker-token",
              "role_name": "se-prod-activity-core-metered-worker-token",
              "metadata_read": false,
              "token_ttl": "5m",
              "token_max_ttl": "15m",
              "secret_id_ttl": "5m",
              "secret_id_num_uses": 1,
              "token_num_uses": 8
            },
            "delivery_config": {
              "companion_of": [
                "glas-claude-agent-dev-anthropic"
              ]
            },
            "auth_capability": {},
            "workload_delivery": []
          }
        }
      }
    }
  ],
  "native_evaluator_digests": "not obtained; local hashes are not evaluator digests",
  "approval_ids": [],
  "host_pins_verified": false
}