# Unattended takeover

A `claude -p` run (or another unattended client) that continues a Task reads the injected Pack, decides what to do
about a Session left open, works, records and ends its own Session. It can ask no one, so the rules below decide for
it.

**What to allow.** In `.claude/settings.local.json`, under `permissions.allow`. The smallest rules are what
`memprove mcp print-config` prints and `memprove hook install --allow-tools` writes: `mcp__memprove` (every tool
of the server named `memprove`), `Bash(memprove run:*)` (a Bash command that starts with `memprove run`; write
that, not the test command itself, since a test counts as Evidence only when `memprove run` ran it) and
`Bash(<absolute path of this memprove> run:*)` (for an agent that runs it by its path because `memprove` is not on
`PATH`; `doctor`'s `path` line says whether it is). The unattended rules of the takeover evaluation widen the second
and third to the whole command line, `Bash(memprove:*)` and `Bash(<path>/memprove:*)`, so that `begin`,
`checkpoint create` and `end` in the shell are allowed too. No rule allows a read of the environment: under the
evaluation's allow rules a command that expands a variable or calls `printenv`, `env`, or `date` is refused, and the
client does not need one, since the opening gives it its name, the current time and its parent (the three conditions
below need no such read).

**Which open Session to end.** The Pack shows each Session that has not ended with its start, the time the ledger last
recorded one of its writes, and its agent (`; agent「<name>」(<role>[, dispatched by Session <j>])`), and the line of
one that is not yours ends with the takeover hint. In an unattended takeover, end such a Session as abandoned only
when all three hold:

- (a) its agent is not you: its name differs from your name, the one the hook's or pack's opening gives you (`You are
  agent「<name>」(<role>)`) or, when it gives none, the name you declare (`agent_name`), or it has no name and you have
  one;
- (b) it looks gone: its last write (`last wrote to the ledger at <UTC>`), compared with the current time in the
  hook's or pack's opening (`The current UTC time is <UTC>`) or your own clock, is more than 15 minutes old, or the
  Session that dispatched it (`dispatched by Session <j>`) has ended, or the operator's prompt says the previous run
  is gone;
- (c) it is not your own parent: the Session the hook's or pack's opening gives you (`, parent Session <ID>`) or, when
  the opening names no agent, the one you declare (`--parent-session` or `parent_session`, or
  `MEMPROVE_PARENT_SESSION`); when the opening names you without a `parent Session`, you have no parent.

No record shows whether a client is still alive; the three conditions decide it. How the Pack shows that a dispatcher
has ended: every Session that has not ended has a Session line, never left out; of the Sessions that ended, the Pack
gives a line only to the latest one and the latest three that ended abandoned, and counts the rest on the `Sessions:`
line. So a Session with no Session line, or whose line says it ended, has ended. The dispatcher `dispatched by Session
<j>` names is still at work only when the `Session j` line says `not ended`. `dispatched by unlisted Session <id>`
names a Session that is not one of this Task's: the Pack does not say whether it ended, so the 15 minutes or the
operator's prompt decide (b).

When one does not hold, do not end it: `begin` as usual (only your own context's Session stops a `begin`), and record
an open item `another Session (Session k) may still be working, not ended` in your first checkpoint. The hook's and
the MCP `pack` tool's opening say this too; it ends with `Under the unattended takeover rule, this session records
each Session it leaves open as an open item 「another Session (Session k) may still be working, not ended」 in its first
checkpoint.` The 15 minutes are this guide's constant: a `claude -p` run writes to the ledger several times within 15
minutes, so a run silent that long is unlikely to be at work; a person can leave an interactive Session silent for 15
minutes and still be working, so the rule is for unattended takeovers only (an interactive reader asks the person).
Nothing checks the rule: `memproved` lets any role end a Session as abandoned and records who did. The MCP `begin`
tool's `agent_name` and the `end` tool's `abandoned` state this rule in their descriptions too, as the same three
conditions, as statements: this section gives them as a procedure, in imperatives, and the descriptions as sentences
about what is the case, so the words differ and the conditions, the 15 minutes, and the open item do not. Both
descriptions begin with the statement `When the hook's or pack's opening names you, the server uses the agent it was
started with, and begin and end need no agent input.`

The takeover evaluation checks the branch for a condition that does not hold in scenario E (`docs/takeover-eval.md`):
the Session left open is the client's own parent, so (c) does not hold, and the client leaves it open and runs `begin`
as usual; it records the open item above. It checks the second clause of (b) in scenario F (`docs/takeover-eval.md`):
the Session left open was dispatched by a Session that has ended (its `Session j` line says it ended), so (b) holds
although its last write is less than 15 minutes old, and the client ends it as abandoned before its `begin` without
waiting for the 15 minutes.

**When a rule is missing,** the tool result is `permission_denied`; the agent says so and does not work around it, and
the ledger is as it was. Add the rule and run the command again.