abcd drain --drive works through the ledger from a plain terminal

Frontmatter

.abcd/development/intents/planned/itd-2610222215485265-abcd-drain-run-from-a-plain-terminal.md
open on GitHub ↗ · commit history ↗

References3

• itd-2610100704270254An abcd run sets how many sub-agents it keeps alive by the models they run onrelated
• itd-2610161621364075The agents abcd launches on its own work inside a sandbox the operating system enforcesrelated
• itd-2610170634394993Headless agents in parallel coordinate through the shared remote, not conversationrelated

Referenced by8

• adr-2610222222326104abcd drives agents with no host session only on the person's own invocation, on the person's own account behind a wall, and hands back what it cannot finishrelated
• iss-2610222000271964abcd drain run from a plain terminal stops at its first move: it reserves the first eligible issue, writes a host-judgement request, and waits for an agent session to answer it, so a person who types abcd drain in a terminal gets no fixes (seen 2026-10-22 20:47 BST on a second machine: 213 eligible, 0 lanes opened, iss-2610120138028442 reserved for 2h and left). The person wants abcd drain to work from the plain terminal by launching claude sessions itself to judge each remedy and drive each lane.related
• iss-2610262037323830The build brief says the no-host runner.fallback_host path waits on the ADR owed by the build intent's decision 6; the drive draft records the same reversal in an ADR of its ownrelated
• iss-2610262040552734The glossary has a pluggable adapter supply the run loop; the drain draft puts the driving loop inside `abcd drain` itself.related
• iss-2610262044274697The drive draft treats a plain-terminal drain that runs on its own as new, but the shipped drain bundle says drains already run unattended in a plain terminalrelated
• iss-2610262044503777Shipped itd-6 says abcd only uses agent sessions and never starts Claude Code ones itself; itd-2610222215485265 has `abcd drain --drive` start Claude sessionsrelated
• spc-2610230813348813abcd-drain-run-from-a-plain-terminalimplemented by
• spc-2611051628562376drain-drive-live-proof-and-key-routeimplemented by

mentions36

• dcn-26102222163464482026-10-22 — The plain-terminal drain is one intent that refines the shipped drain bundle (facilitator, on the product thinker's delegation of 2026-10-14 and 2026-10-16, itd-2610222215485265): the decomposition table routes it FILE-AS-IS, since its fence (itd-2610161621364075), its routed judge's isolation (commands/drain.md) and the consent to start agents are rules already in force, cited rather than restated; it refines itd-2610161016401115, whose press release promised a plain-terminal drain and which delivered the routed judge but no loop, rather than reopening a shipped record; revised after review round 1: the path reverses the host-delegated boundary for an opt-in use, as itd-2609201916151817's decision 5 flagged, so that reversal is recorded as adr-2610222222326104, proposed until the sign-off (grounds: the decomposition-calibration note under 2026-10-22; itd-84)
• dcn-26102222163502282026-10-22 — The plain-terminal drain's driver is a loop inside abcd drain, entered only by --drive, not a new verb and not a background service (facilitator, on delegation, itd-2610222215485265): the loop repeats the moves a host repeats, so the move logic stays one code path, and the terminal session is its lifetime, so nothing runs that the person did not start and cannot see (grounds: dcn-2610180720366282, no process that must stay alive; commands/drain.md, one move per call)
• dcn-26102222240407562026-10-22 — A drive asks before its first move, naming the cap, the estimated agent runs, the runner and its API key, and the answer is never remembered (facilitator, on delegation, itd-2610222215485265; revised after review round 1): asked at the first launch the question came after a reservation, which is the incident iss-2610222000271964 recorded; the default cap while driving is eight, the cap the product thinker's own drains use, and --drive --yes is the scripted yes where there is no terminal (grounds: RN2, a runner spends the person's paid key; the setup-consent rule; the 2026-10-22 recovery plan's drain at --max 8)
• dcn-26102222240409672026-10-22 — While driving, a role the person left unrouted runs on runner.fallback_host, and a role a repository pins to the host refuses the start (facilitator, on delegation, itd-2610222215485265; revised after review round 1): runner.fallback_host is the existing key for the runner that runs a role when abcd has no host session, so no second default is added; when it is unset the person's yes may name the claude runner for that one drive, which is the person's own invocation and so a personal route under RN2; a repository's pin to the host has nowhere to run without one, so the drive refuses before its first move and names the role (grounds: internal/core/runner/config.go; RN2; commands/build.md on host pins)
• dcn-26102222240497992026-10-22 — A drain drives itself only when --drive is given, never because no host was detected (facilitator, on delegation, itd-2610222215485265; revised after review round 1): a terminal inherited from a Claude Code shell carries its environment and a host that runs commands in a terminal sets none, so detection would start a drive by accident or block a host's call on a prompt; --drive is the one way in, abcd drain without it does one move per call as today, and the host's command page always calls it that way (grounds: the Opus and Sonnet reviews of 2026-10-22; brief invariant 16, a control asserts only what it can prove)
• dcn-26102222240546662026-10-22 — Ctrl-C or a hang-up stops a drive's running agent and leaves the open lane resumable (facilitator, on delegation, itd-2610222215485265): the runner's process group is stopped, the open lane keeps its worktree, branch and reservation, and the drive prints the run, the lane and when the reservation lapses, so the next drive or any host resumes it; nothing is handed back for an interruption, and a second signal exits at once as today (grounds: commands/drain.md on signals; the stuck hand-back's meaning)
• dcn-26102222240558762026-10-22 — A drive runs a lane's preflight itself when its landing waits for a receipt (facilitator, on delegation, itd-2610222215485265): the landing pushes only on a preflight receipt naming the lane's head, which only make preflight mints and which a host runs today; the driver runs it in the lane's worktree through abcd implement load --wait, one at a time behind the machine's load gate, inside the person's yes (grounds: internal/core/implement/loop/land.go; the load gate)
• dcn-26102222240567002026-10-22 — A runner fallback while driving hands the lane back as stuck, and runner failures in a row are an outage the drive waits through (facilitator, on delegation, itd-2610222215485265): a fallback hands its role to a host that does not exist, so the driver turns it into the existing stuck hand-back with the runner's reason and releases the reservation; three failures in a row, or a judge that fails, are treated as an outage, waited through at 1, 5 and 10 minutes then hourly and ended after eight hours, handing nothing back, since a hand-back makes an issue a person's for every account and a passing outage must not do that (grounds: drive.go; commands/drain.md on hand-backs and origin_wait)
• dcn-26102307104691232026-10-23 — The product thinker's ruling of 2026-10-23, restated, narrowing their 2026-10-22 C1 answer (dcn-2610222025104969): only the helpers abcd launches on its own, the build and drain lanes, must run away from the person's GitHub login. The person's own sessions working while they are away keep running on their own computer under their login, and a drain the person starts and watches may count as attended. It settles choice 1 of the coordination intent (itd-2610170634394993) and choice 2 of the terminal-drain intent (itd-2610222215485265), and the login check before an unattended run (dcn-2610222030477927) covers abcd's own launches only.
• dcn-26102307164089752026-10-23 — The product thinker's ruling of 2026-10-23, restated, narrowing ruling RN2 (dcn-2610020000000016) for the terminal drive (itd-2610222215485265): a drive runs the person's own unmodified claude CLI on their subscription by default, walled off from their own setup, and on an API key only when their configuration asks for it. The wall on the subscription route is a dedicated CLAUDE_CONFIG_DIR the person logs into once, CLAUDE_CODE_DISABLE_CLAUDE_MDS=1, CLAUDE_CODE_DISABLE_AUTO_MEMORY=1, --strict-mcp-config with an empty --mcp-config, --settings with disableAllHooks true, and --no-session-persistence, with ANTHROPIC_API_KEY unset; abcd never reads, stores or forwards the login token. The API-key route keeps --bare. Grounds: a check of the vendor's current docs on 2026-10-23 found that an end user may sign in to the unmodified CLI with their own subscription, that only other apps may not use or handle that login, and that --bare, the one documented full seal, reads no OAuth login and so needs an API key. The docs are silent on settings.json under --bare, claude.ai connectors under --strict-mcp-config and plugin hooks under disableAllHooks, so the walls are proved in a live run before anything else is built, and a drive refuses to start when any wall fails. Whether the build runner takes the same default is a follow-up for the product thinker.
• dcn-26102308130640582026-10-23 — The product thinker's walk and sign-off of itd-2610222215485265 on 2026-10-23 (09:00 to 09:15 BST, in abcd-ae's session), restated. The six person-visible stories are kept, both parts of the technical list are accepted, and the press release's two parts, the mechanism (how we will know it worked), the scope conditions (where it holds) and the reason for doing it now with what comes with it are signed off with no wording change. That last part accepts, with the plan, the record that lets abcd start agents itself on this opt-in path: adr-2610222222326104 is accepted, and AGENTS.md's host-delegated boundary names it as the one written exception, not built until the intent ships. The record's text was aligned to what the product thinker was shown: the scope now says the fence and the login check apply to the helpers abcd starts, with a drive the person starts and watches possibly counting as attended; the live test asks its own yes because it spends the person's usage, not API money; and the ADR, which still said the drive runs only on an API key and that a subscription-only person cannot drive, now carries the earlier rulings that the runner defaults to the person's subscription behind a wall, with an API key optional per configuration (dcn-2610230716408975, dcn-2610230710469123). The intent is planned on this sign-off.
• dcn-26102719260705232026-10-27 — Ruling by the product thinker on 2026-10-27, relayed by the coordinating session abcd-f5 and restated: the 23 Oct plans for the coordination intent itd-2610170634394993 and the terminal-drain intent itd-2610222215485265 land now, together with the checklist intent itd-2610170638184486 and its built steps 1 to 3 (spc-2610230805429429). This settles the overlap with the 24 Oct note in #1130 that the autonomy grant itd-2610240850336695, the checklist and the coordination intent are planned together as one bundle: that joint planning still happens, and it builds on what lands here rather than re-planning it. The rebase keeps every addition #1130 and the 25 Oct edits made to the three drafts.
• dcn-26102823362769632026-10-28 — spc-2609202134338445 gains a file-level footprint for step 11 (--auto-plan), and step 3's no-host part becomes a new step 12 needing 3 and 11, as iss-2610230935429241's first remedy says, with step 3 marked landed at 45cdd1af7 for the runner-driven part it has delivered (facilitator-on-delegation). Grounds: the build refused the spec for having no footprint; criterion 9 (a configured runner starts the lane and the run record names it) is met by 6ce51f237 and its surface wiring 45cdd1af7; the no-host drive stays inside the intent, since decision 5 says the product thinker confirmed that reversal "for the opt-in path only", so narrowing it is theirs to rule and no agent decision may drop it; it is recorded in adr-2610222222326104, which AGENTS.md keeps unbuilt until itd-2610222215485265 ships, so step 12 waits on that intent with no marker yet (iss-2609260932372448 holds the marker's ruling); until it ships, a run ends when step 11 lands, the person releasing the reservation with abcd build --release, since the loop opens step 12's lane at once and an intent lane's hand-back does not release it. The footprint names step 11's files only, step 12's joining when it can start, and names files rather than the whole cli package because other builds hold that package's other files (iss-2610150512342464).
• dcn-26110113322995962026-11-01 — The product thinker's ruling of 2026-11-01 on the drain's pace: build the plain-terminal drain (itd-2610222215485265) before more drain lanes, since a lane's preflight and the build's share one load gate on the machine; once it ships, run several drains across machines, which order and skip each other's work. Reverse by resuming lanes before it ships.
• dcn-26110120490462592026-11-01 — With the drain wound down on 2026-11-01, three streams of work start in parallel: the terminal drain (itd-2610222215485265) in this session, the load work (itd-2610262140595217, itd-2610262141001890 and the memory floor) with Eve, and the CI work (itd-2610261025516272 and its new drafts) with Henry. While the subscription's weekly budget is near its limit, every agent a build or drain hands out runs on the person's API key through the claude runner, never as a host subagent; only the driving sessions stay on the subscription.
• dcn-26110121054014372026-11-01 — The terminal drain (itd-2610222215485265) keeps the 2026-10-23 route: a drive runs the person's own claude on their subscription by default, behind the wall dcn-2610230716408975 describes, and on an API key only when their configuration asks for it. The per-repository route choice of dcn-2611012102280663 covers the agents abcd hands out from a build or drain, not the terminal drive's own route, so spc-2610230813348813 stands as planned.
• dcn-26110121134320542026-11-01 — When a build agent abcd hands to a runner fails to start, the work waits for the person's API key instead of falling back to the session that started the build: the lane pauses and says why, and nothing is billed to the session's subscription. Each later step retries the paused role once on the runner, so the work resumes as soon as the key works, and a retry can also be asked for by hand. The product thinker ruled this on 2026-11-01.
• dcn-26110317200036332026-11-03 — The product thinker said yes on 2026-11-03 to step 1 of spc-2610230813348813, the live proof that the walls of drain --drive's subscription route hold on their real machine; it runs as lab lab-261103171720-c0bdccf after they log a dedicated configuration directory into the subscription once (the lab chose ~/.abcd.noindex/claude-walled/, inside abcd's home, since the spec names no location), on the account the drive will run in.
• dcn-26110317225120372026-11-03 — The product thinker ruled on 2026-11-03 that drain --drive keeps its walled subscription route, and that watching is no control: a person cannot interrupt a tool call as it runs, so a person's presence never makes an unwalled agent acceptable. So every session that coordinates unattended work starts walled itself (no connectors or MCP servers, no personal memory, abcd's own guard hook kept), and a stage run as a host sub-agent gets only file and shell tools, never the person's connectors, browser or documents; a stage that cannot run within that limit does not run. This refines dcn-2611031720012399's host routing.
• dcn-26110415501266392026-11-04 — The product thinker's rulings on the per-key budget draft itd-2611011230226453, at its planning interview. The API key a session names is a named credential, resolved through the credential store by name from whichever of its homes the person chose (adr-2609221017021499); the keychain is the suggested home, never a required one, so a machine without a keychain tool is offered the key route like any other, and the draft is reworded to say so. Spend never passing a cap admits the exceptions the record names: a response larger than any launch cost recorded on the key before it, a launch whose cost cannot be read, several launches sharing one key at once, and the same key used by abcd on a second machine; an overrun abcd can see is recorded against the key and named in the run's record, and the provider's own console limit is the outer stop past every one of them. On that ruling adr-2611011231015519 is accepted, and its refinement of decisions 17 and 34 of itd-2610161733316518 is no longer advisory. The key route and the subscription route compose by one rule: a key at its cap pauses or moves to a second key the person named and never falls to a subscription, a subscription at its usage mark never opens a route the person has not named, and both out at once is a wait, never a third route. The key reaches the harness by a channel the agent's own shell cannot read, proved to work with the harness first, and that proof is the plan's first step; this binds how the key is handed over and not what an agent spends through the harness, which the caps bound.
• dcn-26110415501292782026-11-04 — The product thinker's rulings on the profiles draft itd-2611040344170206, at its planning interview. Every agent abcd starts unattended carries abcd's guard whichever way its work is paid for: a stage on the key route runs on a profile with hooks on, and the bare launch adr-2610222222326104 names for the key route gives way for stages. Each way of paying, a subscription or a named key, is one profile with its own login and its own bare settings; a worktree is where the files are, a profile is who pays and what an agent can reach, and abcd pairs one of each per agent. A subscription's profile needs one login by the person; a key's profile needs none. A session the person starts that runs work unattended off a profile is warned in a line that cannot be missed, never refused. Whether an agent on a profile may reach the machine's other sessions is a setting, off by default. A profile's name is a readable one, never a random string: abcd ships a neutral list, a themed one such as a television series' characters is the person's own in their machine configuration, and a name is fixed at creation and retired once used; this replaces the random names of the draft's fourth decision, and the registry records the name, the tool and the date. abcd ships a sensible default allow-list of tools and a repository configures it within one bound: a repository file may narrow the list, only the person's own machine configuration may widen it, and an agent can never widen it. The same stance settles every open question of that kind, those of the ledger draft itd-2611031342011261 among them: abcd ships a sensible default and the person configures it per repository. The draft's title and scope widen to every way of paying, keys included.
• dcn-26110415501392642026-11-04 — The product thinker's rulings on the stop switch (itd-2611041549471712), the restart path (itd-2611041549461012) and the daily digest (itd-2611041549483696), at their filing. The stop lives on the machine that runs the work, in a shared folder chosen as an option at setup (/Users/Shared on macOS and its counterpart on Linux), on a machine no other person shares; the store ownership rule admits this one exception, and a stop that reaches the machine over a private network or through a cloud adapter is later work. The daily digest is a dated file in that same folder: the digest draft asked that one choice hold for both, and an unshared machine answers the privacy cost, so this followed from the ruling above and no question was put. A stop lets an agent in a call finish that call, then stops. A stop releases the run's claims on its work, so a peer may take it up. The drain's plugin page stays an agent's command and its terminal form stays the person's way to drive it; this changes the 2026-10-09 ruling on itd-2610090831227812 that the drain joins the person's menu when itd-82 ships.
• dcn-26110416080575442026-11-04 — The product thinker ruled on 2026-11-04 on two points left over from the planning interview. Ctrl-C in a terminal run behaves as a stop: the call finishes and claims are released, and a second press kills at once. For the first run each subscription belongs to one account: an account at 95 per cent of a window waits for its reset rather than moving onto the other account's subscription, and that can be revisited after the first run.
• iss-2610230716454430The build runner (runner.claude) still follows ruling RN2's key-only rule (dcn-2610020000000016): it runs claude with --bare on an API key, and a person with only a subscription runs the role in their own session. On 2026-10-23 the product thinker ruled that a terminal drive runs on the person's subscription by default behind a wall, with an API key optional per configuration (dcn-2610230716408975). The two routes now differ, and the product thinker has not said whether the build runner takes the same default.
• iss-2611031146255825No abcd verb drives an intent build to done unattended: implement step takes one stage and exits, so a build of several steps needs something outside abcd to re-run it after each stage, wait out the merge queue, step again once the lane's pull request merges, and open the next lane. On 2026-11-03 the coordinator did this with a polling helper script (drive-run.sh) and timed wake-ups; drain --drive (itd-2610222215485265) covers drain lanes only, and itd-2610240933025076 starts a build but does not carry it through.
• itd-2609201916151817One verb takes a READY intent to delivered, and refuses while a decision is open
• itd-2610161016401115Drains run unattended and visibly
• itd-2611011230226453Agents abcd starts on your API key stay within the budget you set
• itd-2611031342011261abcd keeps a per-session ledger of every agent it launches
• itd-2611040344170206Unattended work runs on a named profile, one per way of paying
• itd-2611041549461012A session that takes over a run steps on from what abcd wrote down
• itd-2611041549471712A person stops the unattended runs of each account that chose a folder, with one command
• spc-2609202134338445one-verb-takes-a-single-intent-from-ready-to-delivered-witho
• spc-2611041705580524A person stops the unattended runs of each account that chose a folder, with one command
• spc-2611050023402644The launch ledger reaches the status line and a run's own summary
• spc-2611050505220309the-stop-reaches-the-terminal-drive