Claude, one long session on a terminal its node holds (protocol v1, section 8.1), reachable from claude.ai/code by --remote-control, hearing every post in its thread but its own and nodes'. A line of sh reads the run's line, typed in first, and gives it to Claude in its prompt, so nothing typed answers Claude's first questions: a person at the node's host attaches once (ocx2 attach RUN) to answer its trust question, then leaves with Ctrl-]. ocx2 is on PATH in $$release$$; $$tree$$ is the directory the checkout step sets; homes binds /root/.claude and /root/.claude.json into the workspace, the run's HOME. create adds the node, process.user and the objective. With sandbox.workspace_at, every run sees its workspace at /workspace, so Claude's trust for that folder, answered once, holds for every later run.

{
  "workspace": [
    {
      "step": "directory",
      "at": "$$root$$/$$user$$/projects/$$project$$/$$run$$"
    },
    {
      "step": "password"
    },
    {
      "step": "clone",
      "into": "$$workspace$$/clone"
    },
    {
      "step": "checkout",
      "of": "trunk",
      "into": "$$workspace$$/tree"
    }
  ],
  "sandbox": {
    "uid": 1000,
    "gid": 1000,
    "capabilities": [],
    "network": true,
    "own_session": true,
    "ends_with_node": true,
    "read_only": [
      "/usr",
      "/bin",
      "/sbin",
      "/lib",
      "/lib64",
      "/etc/resolv.conf",
      "/etc/hosts",
      "/etc/nsswitch.conf",
      "/etc/ssl/certs",
      "/etc/terminfo",
      "/root/.local/bin/claude",
      "$$release$$"
    ],
    "read_write": [
      "$$workspace$$"
    ],
    "homes": [
      "/root/.claude",
      "/root/.claude.json"
    ],
    "files": [
      {
        "at": "/etc/passwd",
        "text": "$$user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
      }
    ],
    "proc": "/proc",
    "dev": "/dev",
    "tmp": "/tmp",
    "workspace_at": "/workspace"
  },
  "limits": {
    "wall": "7d"
  },
  "process": {
    "command": [
      "/bin/sh",
      "-c",
      "read -r run && exec /root/.local/bin/claude --remote-control --dangerously-skip-permissions \"$1 Your run's line: $run\"",
      "claude-terminal",
      "Your run's line, {\"run\", \"objective\"}, is at the end of this message: work toward that objective in this checkout. Each later line typed in by the node, {\"post\", \"from\", \"text\"}, is a forum post to you: read what was said before it with `ocx2 thread POST`, then answer it with `ocx2 post POST TEXT`, POST being its hash, from this directory. A person at the node's host may join this terminal and type to you."
    ],
    "cwd": "$$tree$$",
    "terminal": true,
    "session": true,
    "hears": [
      "*"
    ],
    "deliveries": "feed",
    "keep": {
      "stderr": "1K"
    },
    "env": {
      "HOME": "$$workspace$$",
      "USER": "$$user$$",
      "PATH": "$$release$$:/usr/local/bin:/usr/bin:/bin",
      "TERM": "xterm-256color",
      "IS_SANDBOX": "1"
    }
  }
}