Unattended takeover

A claude -p run (or another unattended client) that continues a Task reads the injected Pack, decides what to do about a Session left open, works, records and ends its own Session. It can ask no one, so the rules below decide for it.

What to allow. In .claude/settings.local.json, under permissions.allow. The smallest rules are what memprove mcp print-config prints and memprove hook install --allow-tools writes: mcp__memprove (every tool of the server named memprove), Bash(memprove run:*) (a Bash command that starts with memprove run; write that, not the test command itself, since a test counts as Evidence only when memprove run ran it) and Bash(<absolute path of this memprove> run:*) (for an agent that runs it by its path because memprove is not on PATH; doctor’s path line says whether it is). The unattended rules of the takeover evaluation widen the second and third to the whole command line, Bash(memprove:*) and Bash(<path>/memprove:*), so that begin, checkpoint create and end in the shell are allowed too. No rule allows a read of the environment: under the evaluation’s allow rules a command that expands a variable or calls printenv, env, or date is refused, and the client does not need one, since the opening gives it its name, the current time and its parent (the three conditions below need no such read).

Which open Session to end. The Pack shows each Session that has not ended with its start, the time the ledger last recorded one of its writes, and its agent (; agent「<name>」(<role>[, dispatched by Session <j>])), and the line of one that is not yours ends with the takeover hint. In an unattended takeover, end such a Session as abandoned only when all three hold:

• (a) its agent is not you: its name differs from your name, the one the hook’s or pack’s opening gives you (You are agent「<name>」(<role>)) or, when it gives none, the name you declare (agent_name), or it has no name and you have one;
• (b) it looks gone: its last write (last wrote to the ledger at <UTC>), compared with the current time in the hook’s or pack’s opening (The current UTC time is <UTC>) or your own clock, is more than 15 minutes old, or the Session that dispatched it (dispatched by Session <j>) has ended, or the operator’s prompt says the previous run is gone;
• (c) it is not your own parent: the Session the hook’s or pack’s opening gives you (, parent Session <ID>) or, when the opening names no agent, the one you declare (--parent-session or parent_session, or MEMPROVE_PARENT_SESSION); when the opening names you without a parent Session, you have no parent.

No record shows whether a client is still alive; the three conditions decide it. How the Pack shows that a dispatcher has ended: every Session that has not ended has a Session line, never left out; of the Sessions that ended, the Pack gives a line only to the latest one and the latest three that ended abandoned, and counts the rest on the Sessions: line. So a Session with no Session line, or whose line says it ended, has ended. The dispatcher dispatched by Session <j> names is still at work only when the Session j line says not ended. dispatched by unlisted Session <id> names a Session that is not one of this Task’s: the Pack does not say whether it ended, so the 15 minutes or the operator’s prompt decide (b).

When one does not hold, do not end it: begin as usual (only your own context’s Session stops a begin), and record an open item another Session (Session k) may still be working, not ended in your first checkpoint. The hook’s and the MCP pack tool’s opening say this too; it ends with Under the unattended takeover rule, this session records each Session it leaves open as an open item 「another Session (Session k) may still be working, not ended」 in its first checkpoint. The 15 minutes are this guide’s constant: a claude -p run writes to the ledger several times within 15 minutes, so a run silent that long is unlikely to be at work; a person can leave an interactive Session silent for 15 minutes and still be working, so the rule is for unattended takeovers only (an interactive reader asks the person). Nothing checks the rule: memproved lets any role end a Session as abandoned and records who did. The MCP begin tool’s agent_name and the end tool’s abandoned state this rule in their descriptions too, as the same three conditions, as statements: this section gives them as a procedure, in imperatives, and the descriptions as sentences about what is the case, so the words differ and the conditions, the 15 minutes, and the open item do not. Both descriptions begin with the statement When the hook's or pack's opening names you, the server uses the agent it was started with, and begin and end need no agent input.

The takeover evaluation checks the branch for a condition that does not hold in scenario E (docs/takeover-eval.md): the Session left open is the client’s own parent, so (c) does not hold, and the client leaves it open and runs begin as usual; it records the open item above. It checks the second clause of (b) in scenario F (docs/takeover-eval.md): the Session left open was dispatched by a Session that has ended (its Session j line says it ended), so (b) holds although its last write is less than 15 minutes old, and the client ends it as abandoned before its begin without waiting for the 15 minutes.

When a rule is missing, the tool result is permission_denied; the agent says so and does not work around it, and the ledger is as it was. Add the rule and run the command again.

From docs/guide.md at 2625064cbf0a · Markdown