docs: a human-set autonomy grant, and the run's hold-ups captured

.abcd/development/brief/06-delivery/03-out-of-scope.md

@@ -151,8 +151,10 @@ That is what keeps "not hand-counted" true after the day it was written.
 - `itd-2610170638184486` — Every session keeps a checklist on disk, so no run stalls and no stall spreads
 - `itd-2610222029228127` — Every session's checklist reaches a shared copy and the phone
 - `itd-2610222215485265` — abcd drain --drive works through the ledger from a plain terminal
+- `itd-2610240850336695` — The person grants their sessions what they may do alone, until a time
 - `itd-2610240913343804` — No surprises: abcd says up front what it will do on its own and what it will ask
 - `itd-2610240933025076` — abcd plans unattended and asks only what a person owns
+- `itd-2610241015120503` — The person and the repository agree when abcd may merge, and what a cloud session may do
 <!-- /index -->
 
 **Later-phase items with no intent id.** These four were written into the brief

.abcd/development/decisions/adrs/2610240850193281-a-human-set-autonomy-grant-permits.md

@@ -0,0 +1,133 @@
+---
+id: adr-2610240850193281
+slug: a-human-set-autonomy-grant-permits
+status: proposed
+date: 2026-10-24
+supersedes: null
+superseded_by: null
+related_intents: [itd-2610240850336695, itd-2610241015120503, itd-2610180912189125, itd-2610170638184486, itd-2610161621364075, itd-97, itd-2610150602547271]
+related_rfcs: []
+related_adrs: [adr-2610150603484802, adr-42]
+---
+
+# ADR-2610240850193281: A human-set autonomy grant permits, separately from the agent-written waiting-on badge
+
+## Context
+
+`abcd mode` carries two things. The badge (`managed`, `facilitator`,
+`product-thinker`) reports whose answer the loop is waiting on; a question's
+chip sets it and the answer resets it, so in practice the agent writes it. The
+away mode (`abcd mode autonomous`, `queue`, `back`, itd-2610180912189125)
+records that the person is away and grants no rights: no reader in `build`,
+`implement`, `drain` or `landing` consults it, and `--hold-pushes` changes only
+the stop hook's wording. The one setting meant to grant something,
+`facilitator.mode: auto|human` (adr-2610150603484802), lives in the
+repository's config and is not built.
+
+The away mode first granted a narrow right, a session pushing its own branches
+and opening their pull requests (`dcn-2610181003456444`).
+`dcn-2610181016510153` reversed it: the OS sandbox fences only the agents abcd's
+runner launches, never the person's own interactive sessions, so guard entries
+"would never become a boundary" and would buy "a trust claim the plan cannot
+make".
+
+The consequence surfaced on 2026-10-24: a session refused to push a branch and
+open a pull request without a standing permission, and the person found no
+setting that gives one. The permission lived only in chat.
+
+State of the art, read on 2026-10-24: Claude Code's permission modes, Codex's
+approval and sandbox presets, Cline's auto-approve toggles and LangChain's
+per-tool interrupts are all grants the harness enforces, none of them an OS
+boundary for the person's own session. Each is kept apart from the session's
+"needs input" status (Claude Code's agent view states the separation), each is
+built from per-capability grants with named presets on top, and each keeps a
+short list of irreversible acts gated at every level (force-push, merging an
+unapproved pull request, production deploys; GitHub's coding agent cannot
+merge at all). None of them expires a grant on a clock.
+
+## Decision
+
+We will treat a grant and a fence as different things. A grant says what a
+session may do without asking; it needs no sandbox, because it widens nothing
+the session could not already do and only removes the stop. A fence restricts,
+and stays a mistake filter where abcd cannot enforce it (adr-42), as
+`--hold-pushes` already is.
+
+We will therefore give the person one autonomy grant, kept apart from the
+badge:
+
+- The person alone sets it, by an explicit command (`/abcd:mode autonomous`,
+  or `abcd mode autonomous` at a terminal), never from a sentence in chat, and
+  it lives in their home (`~/.abcd.noindex/`), keyed on the repository's root
+  commit. A repository's committed `.abcd/config.json` may remove a capability
+  from it and never add one.
+- It is built from `push-branch`, `open-pr` and `decide-as <role>`, with three
+  presets on top (`nothing`, `ship-work`, `everything`); a grant that names
+  none carries `ship-work` (`push-branch`, `open-pr`, `decide-as facilitator`).
+- On the grant alone, abcd's own commands refuse merging to the default
+  branch and cutting a release, and the guard filters the shell routes to them
+  where its hooks run. A release or merge the person asks for in the session is
+  the person's act, not the grant's, and is not refused. A session never
+  force-pushes, even on the person's word: the person runs it in their own
+  terminal.
+- It ends at a time the person names, or seven days after it was set; an ended
+  or unreadable grant reads as no grant.
+- It holds whether the person is present or away: being away stays its own
+  record, and ending the absence does not end the grant.
+- It reaches a session only through abcd's hook output, and is checked again
+  at each push and pull request, so where abcd's hooks do not run there is no
+  grant.
+- Only the person sets it: the guard refuses a session that sets or writes it,
+  by every route abcd can be invoked through.
+- The badge stays the agent's report of whose answer is owed; the status line
+  shows the grant beside it.
+
+Whether abcd may merge on its own (`queue-merge`, and the repository's planned
+`facilitator.mode: auto`) and what a cloud session may do are not decided
+here; they are itd-2610241015120503's, because each would reverse an accepted
+rule (ruling AM1 in the landing's merge gate, adr-2610150603484802, invariant
+23).
+
+This reverses dcn-2610181016510153 in whole, on rights and on who sets the
+mode (it let a session set it "on their word"), and reinstates
+dcn-2610181003456444's person-only guard with a wider grant;
+dcn-2610241016208164 records the reversal from the decisions' side.
+
+The grant and the fence are two axes, as Codex keeps its approval policy apart
+from its sandbox mode. Where abcd puts up a fence, the grant is embedded in it:
+the agents abcd's runner launches run inside the operating-system sandbox of
+itd-2610161621364075, and the grant says what they may do there without asking.
+Where abcd cannot fence, the person's own interactive sessions (the part B that
+intent names for a draft of its own), the grant stands alone, abcd claims no
+boundary, and the person's host settings stay the outer fence (product thinker,
+planning interview, 2026-10-24).
+
+## Alternatives Considered
+
+- **Keep the away mode as a record that grants nothing** (the standing
+  decision). Rejected: the person's permission then lives in chat, one session
+  hears it and its peers do not, and compaction can drop it. Every tool
+  examined ties the human control to what the agent may do.
+- **Grant rights only where abcd can fence them** (the runner's sandboxed
+  agents). Rejected: it leaves the person's interactive sessions, the ones
+  that paused on 2026-10-24, with no grant at all.
+- **A single autonomy level** (off, low, full). Rejected: every tool examined
+  builds its levels from per-capability grants, and a single level cannot say
+  "push and open pull requests, but do not decide product questions".
+- **Per-capability grants with named presets, irreversible acts outside every
+  preset** (chosen). It matches the state of the art and keeps the acts the
+  person cannot undo with the person.
+
+## Consequences
+
+- A session may push its own branch and open a pull request under a grant
+  without asking, and the morning list must name what it did.
+- abcd takes on a refusal it does not have today: on the grant alone, its own
+  commands refuse merging to the default branch, a release cut and a
+  force-push, with the guard as the shell-side mistake filter.
+- The shipped away mode's "or asking a session to" route is withdrawn: a
+  breaking change for anyone who sets it in prose.
+- The badge loses its human writer on the `/abcd:mode` page; the page leads
+  with the grant.
+- The grant is a permission, not a sandbox: a session that ignores it is not
+  stopped by it, and the documentation says so.

.abcd/development/decisions/adrs/README.md

@@ -220,6 +220,7 @@ The intent lint (a Go implementation) extends to verify these reciprocally.
 | [adr-2610222026262980](2610222026262980-coordination-between-headless-agents-is.md) | Coordination between headless agents is bounded by deadlines, fenced by the claim's tip, version-checked, and done under each session's own credential | proposed | 2026-10-22 |
 | [adr-2610222026265719](2610222026265719-a-session-s-checklist-names-a-credential.md) | A session's checklist names a credential by its kind, scope and expiry, never its value or anything that retrieves it | accepted | 2026-10-22 |
 | [adr-2610222222326104](2610222222326104-abcd-drives-agents-with-no-host-session.md) | abcd drives agents with no host session only on the person's own invocation, on a paid key, and hands back what it cannot finish | proposed | 2026-10-22 |
+| [adr-2610240850193281](2610240850193281-a-human-set-autonomy-grant-permits.md) | A human-set autonomy grant permits, separately from the agent-written waiting-on badge | proposed | 2026-10-24 |
 | [adr-2610241022330872](2610241022330872-setup-edits-the-shell-settings-to-put.md) | Setup edits the shell settings to put abcd's folder on the PATH, on a yes | accepted | 2026-10-24 |
 | [adr-2610241022541063](2610241022541063-each-person-s-commit-identity-lives-on.md) | Each person's commit identity lives on their own machine, not in the repository | accepted | 2026-10-24 |
 | [adr-2610241057124151](2610241057124151-abcd-installs-the-tools-it-needs-from.md) | abcd installs the tools it needs from downloads pinned in its own release | accepted | 2026-10-24 |

.abcd/development/intents/drafts/itd-2610170634394993-several-headless-agents-work-one.md

@@ -75,6 +75,20 @@ Surveyed 2026-10-17 against primary sources ([research note](../../research/note
 
 Path taken: 2. The forge and the shared remote are the native floor (the queue, compare-and-swap pushes, branches cloud sessions can push), and the pass, the dependency line, the generation number and the budgets are bespoke to abcd's records, behind a seam.
 
+
+**Carried in from itd-2610240850336695, its Decision 19 (product thinker,
+2026-10-24).** When sessions push under a credential of their own, the
+repository gains a ruleset refusing non-fast-forward pushes on every branch,
+with a bypass for the person's admin role: a session and abcd then cannot
+force-push anywhere, and the person still can, through `gh` or the forge's web
+interface. Until then the person's grant ships with the force-push stop on
+feature branches resting on this machine's pre-push hook and the guard.
+
+**The bundle gains a third member (product thinker, 2026-10-24).** The
+person's grant, itd-2610240850336695, joins the autonomous-agents bundle with
+this intent and the checklist, so its force-push stop lands with this intent's
+credential split and the all-branch ruleset above.
+
 ## Open Questions
 
 Answered on 2026-10-18 by the planning prep (facilitator, each a decision

.abcd/development/intents/drafts/itd-2610170638184486-every-abcd-session-keeps-a-checklist-on.md

@@ -263,6 +263,14 @@ session's interview on 2026-10-17:
   2026-10-22):** the private shared option, the public option and the phone
   app, with the decisions about them below, which now bind that draft
   (dcn-2610222025212338).
+- **Moved out to itd-2610240850336695 (the person's grant, 2026-10-24).** The
+  parked person-only work above (the guard refusing a session's own `abcd mode
+  autonomous` by every route, the shell and file-tool refusals on the away
+  store, the wider PreToolUse matcher, the recorded attempts and the two live
+  checks) is that intent's Decision 5, because it gives the away mode the rights
+  worth guarding. That intent `builds_on` this one: when this draft's pre-run
+  blocker sweep ships, it runs before an away grant takes effect, so the person
+  is asked every undecided design decision first (its Decision 16).
 
 ## Decisions
 
@@ -301,6 +309,11 @@ five bullets now bind itd-2610222029228127, where they are carried.
 - **The release:** this intent and the coordination intent form the
   autonomous-agents bundle, built as the next big release once current work
   settles; dashboard work joins later (product thinker).
+- **The bundle gains a third member (product thinker, 2026-10-24).** The
+  person's grant, itd-2610240850336695, joins the autonomous-agents bundle, so
+  the grant, the checklist and the coordination intent are planned together.
+  Its Decision 14 narrows "they say so" above: the person sets the away mode
+  and the grant by the explicit command, never by a sentence in chat.
 - **Credentials:** autonomous sessions never use the product thinker's own
   forge login; each runs under its own weaker credential, owned by the
   coordination intent. The checklist records the credential's kind, scope and