2026-10-02 — Ruling RN2 of the technical facilitator, FINAL (2026-10-02, asked in plain words by abcd-a2 [75597f]; same local-tier file as the H3-0 entry above; recorded by lane rd2), verbatim: "YES, SEALED, PAID KEY ONLY — runner keeps --bare with an API key; only machine-layer (personal) routes may hand a role to a runner; repo routes skipped with a warning; subscription-only owners run the role in their own session." It supersedes the provisional answer, "TREAT IT LIKE A PAID SERVICE", given with the note "are you sure it cannot run via a subscription? Investigate first.", which stood only until a research pass returned: no flag set short of the bare flag seals project instructions, plugins, skills and agents (code.claude.com/docs/en/cli-reference, read 2026-10-02), and the vendor's terms do not permit third-party developers to route requests through Free, Pro or Max plan credentials on behalf of their users (code.claude.com/docs/en/legal-and-compliance, read 2026-10-02). Not built at this entry's base; lane runnerSeal of autonomous run A builds it with OC1 and OC2.

Frontmatter

.abcd/work/decisions/dcn-2610020000000016-ruling-rn2-of-the-technical-facilitator.md
open on GitHub ↗ · commit history ↗

mentions6

• dcn-26102307164089752026-10-23 — The product thinker's ruling of 2026-10-23, restated, narrowing ruling RN2 (dcn-2610020000000016) for the terminal drive (itd-2610222215485265): a drive runs the person's own unmodified claude CLI on their subscription by default, walled off from their own setup, and on an API key only when their configuration asks for it. The wall on the subscription route is a dedicated CLAUDE_CONFIG_DIR the person logs into once, CLAUDE_CODE_DISABLE_CLAUDE_MDS=1, CLAUDE_CODE_DISABLE_AUTO_MEMORY=1, --strict-mcp-config with an empty --mcp-config, --settings with disableAllHooks true, and --no-session-persistence, with ANTHROPIC_API_KEY unset; abcd never reads, stores or forwards the login token. The API-key route keeps --bare. Grounds: a check of the vendor's current docs on 2026-10-23 found that an end user may sign in to the unmodified CLI with their own subscription, that only other apps may not use or handle that login, and that --bare, the one documented full seal, reads no OAuth login and so needs an API key. The docs are silent on settings.json under --bare, claude.ai connectors under --strict-mcp-config and plugin hooks under disableAllHooks, so the walls are proved in a live run before anything else is built, and a drive refuses to start when any wall fails. Whether the build runner takes the same default is a follow-up for the product thinker.
• iss-2610230716454430The build runner (runner.claude) still follows ruling RN2's key-only rule (dcn-2610020000000016): it runs claude with --bare on an API key, and a person with only a subscription runs the role in their own session. On 2026-10-23 the product thinker ruled that a terminal drive runs on the person's subscription by default behind a wall, with an API key optional per configuration (dcn-2610230716408975). The two routes now differ, and the product thinker has not said whether the build runner takes the same default.
• iss-2610240932215918The claude runner cannot run on a Claude subscription, so a person without an API key has no route to any role abcd runs from a plain terminal: the planning interview, a build's implementer and validators, the drain's judge.
• itd-59Every Autonomous Run Pass Leaves the Same Durable, Queryable Transcript an Interactive Session Does
• itd-2609201916151817One verb takes a READY intent to delivered, and refuses while a decision is open
• itd-2610240933025076abcd plans unattended and asks only what a person owns