agents: sessions end at their deliverable — synced policy block + PreToolUse hook (repos_sync --write)

The rule: a session ends when it reports its deliverable — never arm anything
that outlives the turn (send_later, subscribe_pr_activity, CronCreate,
ScheduleWakeup, /loop, RemoteTrigger create/update/run) to wait for CI, a
review or a merge; judge once, report, stop, and let the human re-run /prm.
Measured cause: five 2026-08-31 batch members armed hourly check-ins, and a
mobile /prm re-armed a 60-minute send_later hourly all night on 2026-09-03
with no task active, draining usage. Canonical source (single-sourced and
checked by repos_sync): PyAutoMind/policy/end_at_deliverable.md.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014KoFfaxano8nN644BAncrF

Author: 2 people

.claude/hooks/end-at-deliverable.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# GENERATED — canonical source: PyAutoMind/policy/end_at_deliverable_hook.sh
+# Installed into every checked-out repo as .claude/hooks/end-at-deliverable.sh by
+# `python3 PyAutoMind/scripts/repos_sync.py --write`, and drift-checked by
+# `--check`. Edit the canonical file, never a copy.
+#
+# ---------------------------------------------------------------------------
+# Sessions end at their deliverable (PyAutoMind/policy/end_at_deliverable.md).
+#
+# A PreToolUse guard on the tools that outlive the turn. It exists because the
+# prose rule was already written and was still broken twice: five batch members
+# armed hourly check-ins on 2026-08-31 (fixed for batch members only), and on
+# 2026-09-02/03 a mobile `/prm` re-armed a 60-minute `send_later` hourly from
+# 02:39 to 12:11 UTC with no task active, leaving twenty fired one-shots and a
+# drained usage window. A rule a session can talk itself past is not a rule, so
+# this one is enforced by the harness.
+#
+# Registered under `hooks.PreToolUse` with the matcher
+#   ^(send_later|subscribe_pr_activity|ScheduleWakeup|CronCreate|RemoteTrigger|mcp__.*(send_later|subscribe_pr_activity).*)$
+#
+# Allowed through:
+#   * `RemoteTrigger` with action list / get / list_runs / get_run_log — reading
+#     what already exists never outlives the turn;
+#   * anything at all when PYAUTO_ALLOW_TIMERS=1 — the human-authorised escape
+#     for a routine the human actually asked for.
+#
+# Everything else exits 2 (the harness treats stderr as the reason and blocks
+# the call). An unreadable payload also exits 2: this fails closed, because the
+# failure it guards against is silent and costs a night of usage.
+set -uo pipefail
+
+# Human-authorised routine: the one way past this guard, and it has to be set
+# deliberately in the environment.
+[ "${PYAUTO_ALLOW_TIMERS:-}" = "1" ] && exit 0
+
+payload="$(cat)"
+
+# python3 rather than jq: python3 is present everywhere this hook is installed
+# (it is what the SessionStart hook guarantees), jq is not. The payload rides in
+# the environment rather than on stdin so the heredoc keeps its own stdin.
+PYAUTO_HOOK_PAYLOAD="$payload" python3 <<'PY'
+import json
+import os
+import sys
+
+# Read-only RemoteTrigger actions: they inspect what exists and schedule nothing.
+READ_ONLY_REMOTE_TRIGGER = {"list", "get", "list_runs", "get_run_log"}
+
+REASON = (
+    "policy end_at_deliverable: sessions end at their deliverable "
+    "— {tool} would outlive the turn.\n"
+    "Report and stop; the human re-runs /prm. Set PYAUTO_ALLOW_TIMERS=1 only "
+    "for a routine the human asked for.\n"
+)
+
+
+def block(tool):
+    sys.stderr.write(REASON.format(tool=tool))
+    raise SystemExit(2)
+
+
+try:
+    event = json.loads(os.environ.get("PYAUTO_HOOK_PAYLOAD", ""))
+    if not isinstance(event, dict):
+        raise ValueError("PreToolUse payload is not a JSON object")
+    tool = event.get("tool_name")
+    if not isinstance(tool, str) or not tool:
+        raise ValueError("PreToolUse payload carries no tool_name")
+    tool_input = event.get("tool_input")
+    if not isinstance(tool_input, dict):
+        tool_input = {}
+except Exception:
+    # Fail closed. A payload this hook cannot read is a call it cannot clear.
+    block("an unreadable tool call")
+
+if "RemoteTrigger" in tool:
+    action = tool_input.get("action")
+    if isinstance(action, str) and action in READ_ONLY_REMOTE_TRIGGER:
+        raise SystemExit(0)
+
+block(tool)
+PY

.claude/settings.json

@@ -9,6 +9,17 @@
           }
         ]
       }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "^(send_later|subscribe_pr_activity|ScheduleWakeup|CronCreate|RemoteTrigger|mcp__.*(send_later|subscribe_pr_activity).*)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/end-at-deliverable.sh"
+          }
+        ]
+      }
     ]
   }
 }

AGENTS.md

@@ -126,3 +126,15 @@ tracked repo, no force-push to `main`, no fresh-start "Initial commit", no
 `filter-repo` / `filter-branch` / `rebase -i` on pushed branches. To get a
 clean tree: `git fetch origin && git reset --hard origin/main && git clean -fd`.
 <!-- repos_sync:history:end -->
+
+<!-- repos_sync:deliverable:begin -->
+## Sessions end at their deliverable
+
+A session ends when it reports its deliverable — never arm anything that
+outlives the turn to wait for CI, a review or a merge: no `send_later`, no
+`subscribe_pr_activity`, no `CronCreate`, no `ScheduleWakeup`, no `/loop`, no
+`RemoteTrigger` create/update/run. Judge once, report, stop; the human re-runs
+`/prm` (or the batch review) when it is green. Measured: five batch members
+armed hourly check-ins on 2026-08-31, and a mobile `/prm` re-armed a 60-minute
+`send_later` hourly all night on 2026-09-03 with no task active, draining usage.
+<!-- repos_sync:deliverable:end -->