2026-11-01 — The terminal drain (itd-2610222215485265) keeps the 2026-10-23 route: a drive runs the person's own claude on their subscription by default, behind the wall dcn-2610230716408975 describes, and on an API key only when their configuration asks for it. The per-repository route choice of dcn-2611012102280663 covers the agents abcd hands out from a build or drain, not the terminal drive's own route, so spc-2610230813348813 stands as planned.

Frontmatter

.abcd/work/decisions/dcn-2611012105401437-the-terminal-drain-itd-2610222215485265.md
open on GitHub ↗ · commit history ↗

mentions4

• dcn-26102307164089752026-10-23 — The product thinker's ruling of 2026-10-23, restated, narrowing ruling RN2 (dcn-2610020000000016) for the terminal drive (itd-2610222215485265): a drive runs the person's own unmodified claude CLI on their subscription by default, walled off from their own setup, and on an API key only when their configuration asks for it. The wall on the subscription route is a dedicated CLAUDE_CONFIG_DIR the person logs into once, CLAUDE_CODE_DISABLE_CLAUDE_MDS=1, CLAUDE_CODE_DISABLE_AUTO_MEMORY=1, --strict-mcp-config with an empty --mcp-config, --settings with disableAllHooks true, and --no-session-persistence, with ANTHROPIC_API_KEY unset; abcd never reads, stores or forwards the login token. The API-key route keeps --bare. Grounds: a check of the vendor's current docs on 2026-10-23 found that an end user may sign in to the unmodified CLI with their own subscription, that only other apps may not use or handle that login, and that --bare, the one documented full seal, reads no OAuth login and so needs an API key. The docs are silent on settings.json under --bare, claude.ai connectors under --strict-mcp-config and plugin hooks under disableAllHooks, so the walls are proved in a live run before anything else is built, and a drive refuses to start when any wall fails. Whether the build runner takes the same default is a follow-up for the product thinker.
• dcn-26110121022806632026-11-01 — Which route the agents abcd hands out (the implementer, both reviewers, the intent auditor, the drain judge and the planning interviewer) bill is a per-repository choice between the person's subscription and their API key, and the subscription is the default abcd ships. The subscription route is the person's own claude on their subscription: the host session's agents today, and the walled claude CLI dcn-2611011332308128 describes once that is built. The choice is the person's own per-repository setting, in the git-ignored local layer of the configuration order, never a committed repository file, which is still refused a runner route so a clone can never spend the person's key; the machine layer may set it for every repository. abcd offers and explains the choice rather than leaving the person to hand-write a roles block, and writes it only on their yes, so host delegation stays the written default of AGENTS.md's Boundaries. This keeps dcn-2611011332308128's subscription default and adds the per-repository choice; the terminal drive's own route keeps its subscription default (dcn-2611012105401437). While the subscription's weekly budget is near its limit, this repository's own work runs on the API key. It answers the routing default iss-2611012054262885 asks for; how the subscription route itself is walled stays open in iss-2610230716454430.
• itd-2610222215485265abcd drain --drive works through the ledger from a plain terminal
• spc-2610230813348813abcd-drain-run-from-a-plain-terminal