unattended

name	unattended
description	Starts the Clean Room startup wizard in bounded unattended controller mode for authorized source-to-implementation work with finite loop limits and safety stops.
argument-hint	["authorized source scope","separated output roots","optional max iterations"]
disable-model-invocation	true

Clean Room Unattended

Start the clean-room startup wizard with controller_policy.mode fixed to unattended.

In Pi, this entry point is invoked as /skill:unattended.

Use the canonical clean-room skill workflow and references in this plugin. Read skills/clean-room/references/CONTROLLER-LOOP.md before defining unattended loop behavior. Preserve the same clean-room boundary, role separation, artifact schemas, leakage rules, implementation-root rules, and hook expectations.

Before asking setup or preflight questions, use the canonical clean-room "Run State Discovery Before Wizard" rules. Resolve explicit artifact paths first, then current-repo .clean-room/local-state.json, then configured clean-room roots, then bounded ~/Documents/CleanRoom/task-* (legacy) and ~/Documents/CleanRoom/*/tasks/task-* (project layout) candidates. Treat target-repo .clean-room/tasks/ as noncanonical unless explicitly provided or named by the local pointer. If a valid task-manifest.json exists, route to resume-cr. If a task-manifest.json exists but is invalid or legacy-shaped, stop and report its exact path and validation errors. If a valid canonical preflight-goal.json exists without a manifest, continue at source/destination discovery and manifest creation. If a preflight artifact exists but is invalid, stop with schema errors instead of restarting preflight. If a project is found with only completed tasks and the user wants more work, create the next task in that project by default. If multiple candidates are found without an explicit path, list them and stop for selection.

This unattended skill runs on every supported runtime; only the optional dynamic-workflow shortcut below is Claude Code specific. Role execution preference, most to least preferred:

1. In-harness roles with fresh context and no external process spawn. In Claude Code this is the cost-free dynamic workflow front door /clean-room:clean-room-loop (in-session agent() subagents, new context per role; self-bootstraps init, preflight, and decomposition). It is Claude Code only and installs project-local (.claude/workflows/); it gives context-level separation, not the OS-enforced wall. On non-Claude harnesses, run each role as a fresh in-harness subagent or skill session orchestrated from the controller.
2. Durable runner with external process dispatch: last resort, or when you specifically need the OS-enforced wall. Use clean-room-skill run --task-manifest <path> --agent-commands <adapter> (spawns the harness's own CLI, shell: false) on Codex, Pi, and every non-Claude runtime; --agent-runtime claude spawns claude -p per role and is Claude only and per-token, so treat it as the last resort even on Claude Code. Never pass --agent-runtime claude on a non-Claude runtime. Launch the runner only after the manifest has loop_context with an approved pending or gap unit. For ccsilo/OpenRouter sessions, use clean-room-skill run --task-manifest <path> --ccsilo [variant] instead of manual --agent-runtime claude, --agent-config-dir, or CLEAN_ROOM_CLAUDE_EXECUTABLE wiring. Never write ANTHROPIC_AUTH_TOKEN or API keys into ccsilo or Claude settings files. If an unattended manifest lacks loop_context, treat it as incomplete outer-loop state: finish decomposition or selected-slice approval first, or stop with the missing outer-loop fields instead of launching the runner. If clean-room-skill is not on PATH, immediately use npx clean-room-skill@latest run --task-manifest <path> --agent-runtime claude instead of searching for the installed package. Do not search plugin cache paths for schema files, and do not pass --schema-dir /dev/null. The runner uses bundled schemas by default; pass --schema-dir only when the user provides a real schema directory. The main conversation must not perform Agent 1, Agent 2, Agent 3, or Agent 4 work once runner-ready unattended state exists. Do not edit task-manifest.json unit statuses in the main conversation; unit completion must come from runner-managed role artifacts and contaminated-side coverage verification. Do not ask to continue while controller_policy.mode is unattended, the iteration budget remains, and approved pending or gap units remain. If Claude role-agent dispatch or the runner is unavailable, stop with BLOCKERS: Claude role-agent dispatch unavailable instead of falling back to main-chat execution.

Load or create preflight-goal.json first. Unattended mode requires a complete goal contract with no blocking or non-blocking open_questions, controller_policy.unattended_allowed_after_preflight: true, finite controller_policy.max_iterations, and intent_confirmation showing the end goal, target stack, and controller mode came from explicit user answers.

Do not assume end goal, target language, runtime, framework, package manager, test framework, license policy, dependency policy, exactness policy, output directory, or feature add/remove policy during the unattended loop. Source language and build tooling are not destination choices. If the user's end goal or target stack is unknown, leave blocking open_questions, keep unattended disabled, and stop on ambiguity instead of inventing product decisions.

Gather only required setup facts:

• Authorization statement, requester, allowed actions, prohibited actions, and evidence handling.
• Artifact base root, defaulting the task root to ~/Documents/CleanRoom/<project>/tasks/<task-id>/. If the user does not provide an explicitly approved neutral task ID, generate one as task- plus 8 lowercase hex characters. Do not derive task IDs or output directory names from source folder names.
• Project grouping, following the canonical clean-room project layout rules: <base>/<project>/tasks/<task-id>/ with one shared <base>/<project>/implementation/ root, an existing project from .clean-room/local-state.json when available, otherwise a neutral project name (proj- plus 8 lowercase hex unless the user supplies an approved neutral name, matching [a-z0-9][a-z0-9-]{0,63}, never source-derived), and at most one active task per project. Use legacy flat <base>/<task-id>/ roots only when the user explicitly chooses single-task compatibility.
• Source roots, contaminated artifact root, clean artifact root, clean implementation root, quarantine root, and optional public or destination reference roots.
• Explicit user-confirmed end goal, target stack, destination constraints, dependency/license policy, exactness policy, feature policy, code hygiene policy, and output policy from preflight-goal.json.
• Target schema profile: openspec-delta, gsd-planning-package, speckit-feature-folder, or kiro-spec-folder.
• Default model plus optional clean, contaminated, or per-role overrides.
• Finite maximum iteration count for the inner clean-room loop from preflight-goal.json.
• Loop context for the selected spec slice: parent loop ref, spec slice ref, approved scope refs, acceptance refs, and public surface refs.

Before indexing or artifact generation, confirm that source roots, contaminated artifact roots, clean artifact roots, clean implementation roots, approved public reference roots, and schema directory are separate paths, and that clean/contaminated/implementation root names are not source-derived. Stop if authorization is unclear, if clean and contaminated roots overlap, if implementation roots overlap another trust-domain root, or if root paths contain source root basenames or meaningful non-generic source-name tokens. Clean roles must receive clean-run-context.json and, when enabled, role-session-brief.json; they must not receive the full task-manifest.json. Agent 0 must influence clean roles only through durable sanitized artifacts.

Record preflight_goal_ref, preflight_goal_sha256, required handoff_sequence, controller_policy.mode as unattended, max_units_per_iteration as 1, and max_iterations as the selected finite value. Record loop_context with parent_loop_kind: "spec-development", child_loop_kind: "clean-room", return_to: "outer-spec-loop", the selected spec_slice_ref, and bounded approved scope refs. Include these stop conditions: authorization-missing, scope-change, contamination-suspected, schema-validation-failed, leakage-scan-failed, unit-blocked, implementation-complete, coverage-complete, iteration-limit-reached, spec-slice-complete, spec-slice-blocked, spec-delta-required, no-progress-detected, repeated-unit-selection, and clean-room-returned.

The inner loop returns only after Agent 0 consumes the terminal Agent 3 report, any configured Agent 4 polish-report.json, and completes contaminated-side coverage verification. Write clean-room-result.json before returning control to the outer spec loop.

For multi-file source scope, guide agent zero/controller to run skills/clean-room/scripts/build_source_index.py as preflight outside clean-room role sessions. Store source-index.json only under the contaminated artifact root and never include it in clean handoff packages. If no indexable source code exists and screenshots/images are the only authorized evidence, unattended mode may use skills/clean-room/scripts/build_visual_index.py only after preflight already answers the visual-fallback questions with no open questions. Store visual-index.json only under the contaminated artifact root and include visual roots in CLEAN_ROOM_SOURCE_ROOTS (ensuring screenshot evidence directories are explicitly added to CLEAN_ROOM_SOURCE_ROOTS during execution so that path-aware read hooks such as hooks/deny-clean-source-read.py can protect them as expected).