feat(scheduled-agents): agent-integrity for Claude Code scheduled agents#52
Merged
Merged
Conversation
New community integration that fingerprints the things that run without you watching -- declared routine specs (schedule, allowed tools, MCP servers, prompt, model) and the auto-run hooks in settings.json -- and warns at SessionStart when any of it drifts from an approved baseline. Drift detection (snapshot/verify/approve + the SessionStart hook) is Python stdlib only, so the hook never blocks a session. /schedule-trace signs a TRACE Trust Record (Level 0, software-only) verifiable by a third party; signing needs agentrust-trace and is exercised in the signing CI job. Mirrors the claude-code plugin layout and its stdlib/signing test split. 21 tests pass; the signed record passes the public Level 0 conformance suite. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
imran-siddique
force-pushed
the
feat/scheduled-agents-integration
branch
from
July 21, 2026 22:37
8e76357 to
72c7c56
Compare
…essing) Mirrors claude-code/PRIVACY.md: names and fingerprints only, no secrets, no credentials file, no telemetry; baseline and records stay on the machine. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A new community integration,
scheduled-agents/, that answers one question for the part of Claude Code you do not sit and watch: are the things that run without me the ones I approved, nothing added, nothing subtracted?A coding session is driven; you approve every tool call. A scheduled agent runs headless on a cron and keeps running long after setup. "Set it and forget it" assumes its behaviour next week matches today. It rarely does: a routine's tools get widened during a debug session and never narrowed back, a schedule moves, a new hook drops into
settings.jsonand now a command auto-runs every session.This plugin fingerprints both surfaces and warns the moment either drifts from an approved baseline:
~/.claude/agentrust/routines/*.json): schedule, allowed tools, MCP servers, prompt, model.~/.claude/settings.jsonthat auto-run on events.How it mirrors
claude-code/SessionStarthook is stdlib-only, fail-safe (any error → benign context, exit 0), never blocks a session./schedule-manifest verify | approve | showand/schedule-trace./schedule-tracesigns a TRACE Level 0 (software-only) record with a persistent Ed25519 key; the public JWK is published for third-party verification.scheduled-agents-tests.yml).Honest scope
Baselines the declared routine specs and on-disk hooks and detects drift in those declarations. It does not introspect a live cloud routine's runtime behaviour (nothing on a dev box can prove that), and it is software integrity (Level 0), never presented as hardware-attested. v1 reads the global settings hooks block; project-scoped hooks are roadmap.
Verification
agentrust-trace).added routine tool babysit-prs: Bash(curl:*), schedule change, injectedcurl … | shhook) → plain-English report → signedtrace.jsonpassing the public Level 0 conformance suite (8/8).🤖 Generated with Claude Code