abcd drives agents with no host session only on the person's own invocation, on the person's own account behind a wall, and hands back what it cannot finish

Frontmatter

.abcd/development/decisions/adrs/2610222222326104-abcd-drives-agents-with-no-host-session.md
open on GitHub ↗ · commit history ↗

References5

• adr-25The LLM is host-delegated by default; oracles are opt-in adaptersrelated
• itd-2609201916056194A role runs through the command-line harness the operator chose, and every fall back to the host is recordedrelated
• itd-2609201916151817One verb takes a READY intent to delivered, and refuses while a decision is openrelated
• itd-2610161016401115Drains run unattended and visiblyrelated
• itd-2610222215485265abcd drain --drive works through the ledger from a plain terminalrelated

Referenced by2

• adr-2610310235000654An unattended plan stands in for the sign-off only on a recorded, reviewed, unchanged draftrelated
• adr-2611011231015519The launches abcd makes spend a person's money only within the budget they set, past it only through named residualsrelated

mentions20

• adr-2610222026262980Coordination between headless agents is bounded by deadlines, fenced by the claim's tip, version-checked, and done under each session's own credential
• dcn-26101807203662822026-10-18 — The coordination pass runs on demand (facilitator-on-delegation, itd-2610170634394993 planning prep): land, build, drain and status run the pass from the records they have just fetched before they act; there is no timer lease and no process that must stay alive, and every deadline and expiry is derived when the records are read, as a reservation's release already is (grounds: the draft's research note on controllers; kubernetes.io/docs/concepts/architecture/controller; brief invariant 7; itd-2609151838312703 decision 14; itd-2609091034175565 decision 13)
• dcn-26102222163464482026-10-22 — The plain-terminal drain is one intent that refines the shipped drain bundle (facilitator, on the product thinker's delegation of 2026-10-14 and 2026-10-16, itd-2610222215485265): the decomposition table routes it FILE-AS-IS, since its fence (itd-2610161621364075), its routed judge's isolation (commands/drain.md) and the consent to start agents are rules already in force, cited rather than restated; it refines itd-2610161016401115, whose press release promised a plain-terminal drain and which delivered the routed judge but no loop, rather than reopening a shipped record; revised after review round 1: the path reverses the host-delegated boundary for an opt-in use, as itd-2609201916151817's decision 5 flagged, so that reversal is recorded as adr-2610222222326104, proposed until the sign-off (grounds: the decomposition-calibration note under 2026-10-22; itd-84)
• dcn-26102307104691232026-10-23 — The product thinker's ruling of 2026-10-23, restated, narrowing their 2026-10-22 C1 answer (dcn-2610222025104969): only the helpers abcd launches on its own, the build and drain lanes, must run away from the person's GitHub login. The person's own sessions working while they are away keep running on their own computer under their login, and a drain the person starts and watches may count as attended. It settles choice 1 of the coordination intent (itd-2610170634394993) and choice 2 of the terminal-drain intent (itd-2610222215485265), and the login check before an unattended run (dcn-2610222030477927) covers abcd's own launches only.
• dcn-26102307164089752026-10-23 — The product thinker's ruling of 2026-10-23, restated, narrowing ruling RN2 (dcn-2610020000000016) for the terminal drive (itd-2610222215485265): a drive runs the person's own unmodified claude CLI on their subscription by default, walled off from their own setup, and on an API key only when their configuration asks for it. The wall on the subscription route is a dedicated CLAUDE_CONFIG_DIR the person logs into once, CLAUDE_CODE_DISABLE_CLAUDE_MDS=1, CLAUDE_CODE_DISABLE_AUTO_MEMORY=1, --strict-mcp-config with an empty --mcp-config, --settings with disableAllHooks true, and --no-session-persistence, with ANTHROPIC_API_KEY unset; abcd never reads, stores or forwards the login token. The API-key route keeps --bare. Grounds: a check of the vendor's current docs on 2026-10-23 found that an end user may sign in to the unmodified CLI with their own subscription, that only other apps may not use or handle that login, and that --bare, the one documented full seal, reads no OAuth login and so needs an API key. The docs are silent on settings.json under --bare, claude.ai connectors under --strict-mcp-config and plugin hooks under disableAllHooks, so the walls are proved in a live run before anything else is built, and a drive refuses to start when any wall fails. Whether the build runner takes the same default is a follow-up for the product thinker.
• dcn-26102308130640582026-10-23 — The product thinker's walk and sign-off of itd-2610222215485265 on 2026-10-23 (09:00 to 09:15 BST, in abcd-ae's session), restated. The six person-visible stories are kept, both parts of the technical list are accepted, and the press release's two parts, the mechanism (how we will know it worked), the scope conditions (where it holds) and the reason for doing it now with what comes with it are signed off with no wording change. That last part accepts, with the plan, the record that lets abcd start agents itself on this opt-in path: adr-2610222222326104 is accepted, and AGENTS.md's host-delegated boundary names it as the one written exception, not built until the intent ships. The record's text was aligned to what the product thinker was shown: the scope now says the fence and the login check apply to the helpers abcd starts, with a drive the person starts and watches possibly counting as attended; the live test asks its own yes because it spends the person's usage, not API money; and the ADR, which still said the drive runs only on an API key and that a subscription-only person cannot drive, now carries the earlier rulings that the runner defaults to the person's subscription behind a wall, with an API key optional per configuration (dcn-2610230716408975, dcn-2610230710469123). The intent is planned on this sign-off.
• dcn-26102823362769632026-10-28 — spc-2609202134338445 gains a file-level footprint for step 11 (--auto-plan), and step 3's no-host part becomes a new step 12 needing 3 and 11, as iss-2610230935429241's first remedy says, with step 3 marked landed at 45cdd1af7 for the runner-driven part it has delivered (facilitator-on-delegation). Grounds: the build refused the spec for having no footprint; criterion 9 (a configured runner starts the lane and the run record names it) is met by 6ce51f237 and its surface wiring 45cdd1af7; the no-host drive stays inside the intent, since decision 5 says the product thinker confirmed that reversal "for the opt-in path only", so narrowing it is theirs to rule and no agent decision may drop it; it is recorded in adr-2610222222326104, which AGENTS.md keeps unbuilt until itd-2610222215485265 ships, so step 12 waits on that intent with no marker yet (iss-2609260932372448 holds the marker's ruling); until it ships, a run ends when step 11 lands, the person releasing the reservation with abcd build --release, since the loop opens step 12's lane at once and an intent lane's hand-back does not release it. The footprint names step 11's files only, step 12's joining when it can start, and names files rather than the whole cli package because other builds hold that package's other files (iss-2610150512342464).
• dcn-26110317225120372026-11-03 — The product thinker ruled on 2026-11-03 that drain --drive keeps its walled subscription route, and that watching is no control: a person cannot interrupt a tool call as it runs, so a person's presence never makes an unwalled agent acceptable. So every session that coordinates unattended work starts walled itself (no connectors or MCP servers, no personal memory, abcd's own guard hook kept), and a stage run as a host sub-agent gets only file and shell tools, never the person's connectors, browser or documents; a stage that cannot run within that limit does not run. This refines dcn-2611031720012399's host routing.
• dcn-26110415501266392026-11-04 — The product thinker's rulings on the per-key budget draft itd-2611011230226453, at its planning interview. The API key a session names is a named credential, resolved through the credential store by name from whichever of its homes the person chose (adr-2609221017021499); the keychain is the suggested home, never a required one, so a machine without a keychain tool is offered the key route like any other, and the draft is reworded to say so. Spend never passing a cap admits the exceptions the record names: a response larger than any launch cost recorded on the key before it, a launch whose cost cannot be read, several launches sharing one key at once, and the same key used by abcd on a second machine; an overrun abcd can see is recorded against the key and named in the run's record, and the provider's own console limit is the outer stop past every one of them. On that ruling adr-2611011231015519 is accepted, and its refinement of decisions 17 and 34 of itd-2610161733316518 is no longer advisory. The key route and the subscription route compose by one rule: a key at its cap pauses or moves to a second key the person named and never falls to a subscription, a subscription at its usage mark never opens a route the person has not named, and both out at once is a wait, never a third route. The key reaches the harness by a channel the agent's own shell cannot read, proved to work with the harness first, and that proof is the plan's first step; this binds how the key is handed over and not what an agent spends through the harness, which the caps bound.
• dcn-26110415501292782026-11-04 — The product thinker's rulings on the profiles draft itd-2611040344170206, at its planning interview. Every agent abcd starts unattended carries abcd's guard whichever way its work is paid for: a stage on the key route runs on a profile with hooks on, and the bare launch adr-2610222222326104 names for the key route gives way for stages. Each way of paying, a subscription or a named key, is one profile with its own login and its own bare settings; a worktree is where the files are, a profile is who pays and what an agent can reach, and abcd pairs one of each per agent. A subscription's profile needs one login by the person; a key's profile needs none. A session the person starts that runs work unattended off a profile is warned in a line that cannot be missed, never refused. Whether an agent on a profile may reach the machine's other sessions is a setting, off by default. A profile's name is a readable one, never a random string: abcd ships a neutral list, a themed one such as a television series' characters is the person's own in their machine configuration, and a name is fixed at creation and retired once used; this replaces the random names of the draft's fourth decision, and the registry records the name, the tool and the date. abcd ships a sensible default allow-list of tools and a repository configures it within one bound: a repository file may narrow the list, only the person's own machine configuration may widen it, and an agent can never widen it. The same stance settles every open question of that kind, those of the ledger draft itd-2611031342011261 among them: abcd ships a sensible default and the person configures it per repository. The draft's title and scope widen to every way of paying, keys included.
• dcn-26110415501392642026-11-04 — The product thinker's rulings on the stop switch (itd-2611041549471712), the restart path (itd-2611041549461012) and the daily digest (itd-2611041549483696), at their filing. The stop lives on the machine that runs the work, in a shared folder chosen as an option at setup (/Users/Shared on macOS and its counterpart on Linux), on a machine no other person shares; the store ownership rule admits this one exception, and a stop that reaches the machine over a private network or through a cloud adapter is later work. The daily digest is a dated file in that same folder: the digest draft asked that one choice hold for both, and an unshared machine answers the privacy cost, so this followed from the ruling above and no question was put. A stop lets an agent in a call finish that call, then stops. A stop releases the run's claims on its work, so a peer may take it up. The drain's plugin page stays an agent's command and its terminal form stays the person's way to drive it; this changes the 2026-10-09 ruling on itd-2610090831227812 that the drain joins the person's menu when itd-82 ships.
• dcn-26110416080575442026-11-04 — The product thinker ruled on 2026-11-04 on two points left over from the planning interview. Ctrl-C in a terminal run behaves as a stop: the call finishes and claims are released, and a second press kills at once. For the first run each subscription belongs to one account: an account at 95 per cent of a window waits for its reset rather than moving onto the other account's subscription, and that can be revisited after the first run.
• dcn-26110508151159042026-11-05 — A no-host drive's eight-hour deadline gives way to a bound the person sets. abcd drain --drive --until <date> ends the run at that time with the lane saved, and until then no limit, outage or stuck queue ends it: each is waited through at a capped interval, the wait on screen, the claims renewed. With no flag each wait keeps its eight-hour limit, so an attended short run behaves as before. A limit is met at the hard limit only: no usage window is read ahead of it, no other route is opened. Under the bound, and only there, a limit is asked about with one short launch that asks for no tools rather than with the lane's own work: on a capped backoff when it names no reset, and at a low rate when it names one, since a reset read from a stream can be wrong. An agent that goes silent cannot yet be told from a hung one, so it is treated as a hang: killed at its stage's deadline, its work left in the lane's worktree, the role retried. The first limit a run meets, and the first failure that may be one, leave an evidence file in the local tier, which is how the behaviour of a headless limit gets observed.
• iss-2610222000271964abcd drain run from a plain terminal stops at its first move: it reserves the first eligible issue, writes a host-judgement request, and waits for an agent session to answer it, so a person who types abcd drain in a terminal gets no fixes (seen 2026-10-22 20:47 BST on a second machine: 213 eligible, 0 lanes opened, iss-2610120138028442 reserved for 2h and left). The person wants abcd drain to work from the plain terminal by launching claude sessions itself to judge each remedy and drive each lane.
• iss-2610262037323830The build brief says the no-host runner.fallback_host path waits on the ADR owed by the build intent's decision 6; the drive draft records the same reversal in an ADR of its own
• itd-2610161621364075The agents abcd launches on its own work inside a sandbox the operating system enforces
• itd-2611011230226453Agents abcd starts on your API key stay within the budget you set
• itd-2611040344170206Unattended work runs on a named profile, one per way of paying
• spc-2609202134338445one-verb-takes-a-single-intent-from-ready-to-delivered-witho
• spc-2610230813348813abcd-drain-run-from-a-plain-terminal