commit dd588f3e337c5f478653c006905a09a2e12bcdc1
Author:     tegwick <bernd.worsch@gmail.com>
AuthorDate: Tue Oct 13 22:52:59 2026 +0200
Commit:     tegwick <bernd.worsch@gmail.com>
CommitDate: Tue Oct 13 22:52:59 2026 +0200

    Add HARNESS-WP-0008: simpler metered retry
    
    Free host rehearsal, evidence-backed release of unused holds, and a
    one-command owner renewal; multi-attempt envelopes, image shipping and
    per-envelope approvals recorded as decisions.
    
    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
    
    Assistant: claude-code
    Assistant-Model: opus
    Assistant-Process: 269692@bnt-lap001
    Assistant-Session: 8077e68a-0985-4b41-898c-2dc602b0d6be

diff --git a/workplans/HARNESS-WP-0008-simpler-metered-retry.md b/workplans/HARNESS-WP-0008-simpler-metered-retry.md
new file mode 100644
index 0000000..bfa06e2
--- /dev/null
+++ b/workplans/HARNESS-WP-0008-simpler-metered-retry.md
@@ -0,0 +1,175 @@
+---
+id: HARNESS-WP-0008
+type: workplan
+title: "Simpler metered retry: free rehearsal, zero-cost hold release, one-command renewal"
+domain: infotech
+repo: rein-aharness
+status: ready
+owner: claude-code
+topic_slug: rein-aharness
+priority: high
+created: "2026-10-13"
+updated: "2026-10-13"
+related:
+  - REINAH-WP-0003
+---
+
+# HARNESS-WP-0008 — Simpler metered retry
+
+## Origin
+
+On 2026-10-13 the owner reconciled the 2026-09-27 hold for run `6efa9436`
+(`docs/evidence/2026-10-13-held-liability-reconciliation.json`). A corrected
+runtime `ee3d0a53…` was built
+(`docs/evidence/2026-10-13-corrected-owner-runtime-build.json`). The owner
+authorized a new envelope and one retry.
+
+Preparing that retry took too many owner ceremonies:
+
+1. The runtime is built on the workstation and copied to railiance01 by hand.
+2. `owner.json` and the spend policy hold five digests that the owner edits
+   by hand.
+3. A failed attempt keeps its full hold even when no provider request was
+   made, so every failure needs a new envelope, ledger and pins.
+4. Every attempt needs six native approvals.
+5. The launcher bug that failed run `6efa9436` was found only by spending
+   money. A free check on the host would have caught it.
+
+The owner agreed (2026-10-13) to fix items 5, 3 and 2 here, and to record
+the rest as decisions instead of blocking on them.
+
+**Goal:** a retry becomes: install the artifact, rehearse for free, approve
+once, run.
+
+## A. Free rehearsal on the host
+
+```task
+id: HARNESS-WP-0008-T01
+status: todo
+priority: high
+```
+
+Add `rein-aharness owner check --rehearse <owner.json>`. It runs everything
+`metered-once --check` does. It then executes the admitted runtime's
+`rein-aharness` and `glas-harness` launchers inside bwrap, from the mount
+path, with `--unshare-all`, no credentials, no provider route and no ledger
+write. It also checks that the sandbox profile resolves. It prints a single
+pass or fail line with the runtime digest.
+
+Today's launcher check reads only the first line of each launcher. This
+rehearsal runs them, the same way the failing run did.
+
+**Done when:** tests prove the rehearsal fails on a runtime whose launchers
+point at a missing build directory (the `6efa9436` failure) and passes on a
+relocated runtime. It must make no network calls and write nothing. The
+owner procedure in `docs/owner-bootstrap.md` makes the rehearsal a required
+step before any paid attempt.
+
+## B. Release holds that provably cost nothing
+
+```task
+id: HARNESS-WP-0008-T02
+status: todo
+priority: high
+```
+
+`SpendLedger.reconcile` keeps the full hold (`max(held, observed)`). Add an
+evidence-backed release. If the run has zero provider-request reservations
+and its request route is revoked, reconciliation may set the liability to
+the observed amount. Otherwise the current rule stands. The release records
+which evidence allowed it, and the CLI flag says so, for example
+`--release-unused-hold`.
+
+This changes a deliberate safety rule, so it needs owner sign-off on the
+exact rule before merge. That sign-off is recorded in T04's decision note.
+
+**Done when:** tests cover all four cases. A run with no request
+reservations and a revoked route releases. A run with any request
+reservation, or with a live route, refuses the release. A second, identical
+reconcile changes nothing. The envelope is never marked breached by a
+release.
+
+## D. One owner command for renewal
+
+```task
+id: HARNESS-WP-0008-T03
+status: todo
+priority: high
+```
+
+Add `rein-aharness owner renew --owner <owner.json> --runtime <digest>
+--envelope <envelope.json>`. It does three things:
+
+1. It refuses unless every reservation in the current ledger is settled.
+2. It writes the new spend policy, initializes a fresh ledger, and updates
+   the runtime and spend-policy pins in `owner.json` together. Old files are
+   kept as backups. Existing ledgers are never reset.
+3. It prints one summary for the owner to review: old to new runtime, old
+   to new policy digest, envelope cap and attempt limit, and ledger path.
+
+Add a dry-run mode that only prints the summary. Afterwards, run the T01
+rehearsal.
+
+**Done when:** a test renews from the 2026-09-27 layout to a new envelope.
+The owner check passes on the result. A second renew with an unsettled
+reservation refuses. No digest has to be typed by hand.
+
+## C. Envelopes that cover several attempts (decision)
+
+```task
+id: HARNESS-WP-0008-T04
+status: wait
+priority: medium
+```
+
+Owner decision: should future envelopes be admitted as "up to N attempts
+within EUR X" instead of one attempt? The EUR 10 cap already fits two
+USD 4.64 request holds. Record the choice, together with T02's sign-off,
+as a decision note in `docs/`. T03's envelope format then reflects it.
+
+## E. Ship the owner runtime as a container image (decision)
+
+```task
+id: HARNESS-WP-0008-T05
+status: wait
+priority: low
+```
+
+Decision for later, with Platform (railiance) and Sand-boxer: should the
+owner runtime ship through the registry and GitOps, using the existing
+`make image` path, instead of rsync and a manual digest check? Out of scope
+here. If accepted, hand it off as a residual intake to the owning repos.
+
+## F. Approvals per envelope (decision)
+
+```task
+id: HARNESS-WP-0008-T06
+status: wait
+priority: low
+```
+
+Decision for later, with Secrets Engine: should one approval set cover an
+envelope's attempts instead of six native approvals per attempt? The work
+lives outside this repo. If accepted, hand it off as a residual intake.
+
+## Retry on the corrected runtime
+
+```task
+id: HARNESS-WP-0008-T07
+status: wait
+priority: high
+```
+
+Waits on T01 and T03. It does not need T02.
+
+Steps:
+
+1. Rebuild `ee3d0a53…`, or the then-current corrected runtime, from the
+   pinned commits.
+2. Install it on railiance01.
+3. Run the T01 rehearsal.
+4. Renew with T03 to the owner-authorized new envelope (EUR 10, authorized
+   2026-10-13).
+5. Run exactly one attended attempt, which consumes fresh native approvals.
+
+Record the result in REINAH-WP-0003-T05/T06.
