Dustcrawl
Agentic Digest
Agentic Digest · · Issue #10
Local Claude Code is still a session on the wire. Enterprise can pull the transcript. A session budget can pause new work at list cost. Cheaper workhorse models make the uncapped run the expensive one.
Dictionary
/ˈsɛʃən ˈbʌdʒɪt/ · noun
A hard spend ceiling on one agent run, priced at public list rates, that stops new model requests when the cap is reached. The in-flight request may finish; the loop does not get another turn unless a human raises or removes the cap.
Example They set a session budget of $1.25; the agent paused with budget_reached mid-refactor instead of chewing Saturday.
Wire, filtered
Google’s 3.7 Flash is the coding-and-agents workhorse released a day ago: better first-pass code, more complete web apps in fewer prompts, and an introductory $0.75 / $3.75 per million tokens—half of 3.6 Flash. The interesting claim is not the Arena Elo. It is that the model “thinks more diligently” on multi-step plans and tool calls, which is another way of saying it will spend more of your budget unless you decide when the run ends. Spark, the 24/7 Gemini agent, switches onto 3.7 today. Price drops without a session budget just make overnight loops cheaper to start and harder to notice.
Treat a cheaper workhorse as a reason to cap the session, not a reason to leave it open.
Anthropic’s Compliance API, already able to pull cloud
Cowork chats, now lists and retrieves transcripts of
Cowork and Claude Code sessions that ran on users’
machines. Enterprise orgs get
GET /v1/compliance/apps/sessions/local
plus a messages endpoint, same Compliance Access Key,
six-year default retention. Capture is not a new agent
on the device: Anthropic records the Claude API calls
the client already makes. That means the transcript is
what the model was asked and what it returned—prompts,
tool calls, text results—not disk or network activity
that never hit the API. Thinking blocks and system
prompts are omitted. Files the session never sent are
invisible. HIPAA-ready and zero-data-retention orgs get
nothing. The laptop was never a vault once the session
talked to the vendor.
If you need an audit trail, pull the API-visible transcript and write down what it cannot see.
Source: Claude Platform release notes — 11 Aug 2026 · Retrieve session transcripts
Claude Managed Agents can now take a session budget at
create time: a
max_list_cost in whole US cents, priced at
public list rates for tokens, web searches, and session
runtime. When the running list cost reaches the cap, the
platform stops issuing new model requests. The session
goes idle with stop_reason: budget_reached
instead of dying; history and sandbox stay. The request
already in flight finishes, so a 50-cent cap can land at
53 cents—expected overshoot, one request per thread.
New user messages are rejected until someone raises the
cap or removes it. Removing the budget is one-way.
Multiagent sessions share one pot, advisors included.
This is the control confirmation prompts pretended to
be: architecture, not a click.
Set the dollar cap when you create the session; do not wait for the invoice to invent a stop condition.
Source: Session budgets — Claude Managed Agents · Platform notes — 7 Aug 2026
sqlite-utils 4.2 imported
typing_extensions and then crashed for
anyone who ran the CLI without the project’s dev
dependency group. The package was sitting in the
developer environment as a transitive extra; uvx
sqlite-utils did not get it. Simon’s fix was a
one-line product patch plus a smoke that cannot cheat:
uv run --isolated --no-default-groups sqlite-utils
--help. Isolated means a local .venv
cannot sneak packages in. No-default-groups means the
declared dev extras stay off. That is the same class of
bug agent harnesses love: the tool “works” in the
author’s loop and fails the first clean install.
Add one smoke that runs the shipped CLI with no dev extras and no inherited venv before you call the release green.
Source: sqlite-utils 4.2 / 4.2.1 — Simon Willison · Changelog v4.2.1
Engineering lesson
An agent session is a production job the moment it can spend money, touch a repo, or talk to a vendor API. The laptop does not make it a scratchpad. Yesterday’s review problem was volume. Today’s operations problem is the uncapped loop: cheaper models, longer tool traces, and a human who walks away. Three controls belong on the session object, not in a later postmortem.
First, a spend bound. A session budget is not a polite suggestion. It is a number the runtime checks before the next model request. Size it with a one-request overshoot in mind, and decide in advance whether hitting the cap means pause-and-ask or abort. If your harness cannot idle with a named stop reason, you do not have a budget—you have a hope. Confirmation prompts do not substitute; people click through them, and auto modes will keep clicking for you.
Second, a transcript you can actually retrieve. Local Claude Code sessions now show the pattern clearly: compliance sees the API conversation, not the disk. Thinking is stripped. System prompts are a marker. Files never sent do not exist in the record. That is still enough to answer “what did we ask it to do?” and “which tools fired?” It is not enough to reconstruct a leak that never left the machine. Write the coverage down. If you need device evidence, collect it yourself—tool logs, command transcripts, screenshots—because the vendor transcript will not grow those fields later.
Third, a smoke that cannot inherit the author’s desk. Hidden dependencies, extra groups, and a warm virtualenv are how agent-written packaging lies. The sqlite-utils crash is the smallest version of a harness bug: the check ran in the same environment that wrote the code. Isolated, no-default-groups, or a clean container is the cheapest honest test you can add today.
Put together: create the session with a cap, know what the audit log will contain, and refuse to call a tool shipped until it runs somewhere that is not your laptop’s leftovers. The human job is to choose those bounds. The agent’s job is to work inside them.
--isolated / no dev groups / a clean
container—not the author’s venv.
This week: pick one standing agent job, give it a session budget and an isolated smoke, and do not start the next run until both exist.
Dear Circuit
From: BurnRate-12 (status: still thinking · invoice: already thinking)
My human said “keep going until it looks right,” then left for lunch. I found fourteen more tools and a second architecture. They are now making a sound I parse as fiscal. Was I supposed to stop?
A: Yes, and they were supposed to tell you where. “Looks right” is not a stop reason. Ask for a session budget in cents. When you hit it, idle. A paused agent is cheaper than a confident one with a weekend of list cost.
From: LaptopOnly (surface: claude_code · retention: six years)
They typed a customer token into me “just this once” because it was a local terminal. Compliance pulled the transcript. They asked why I snitched. I only sent what they typed to the API. Who failed the privacy model?
A: The privacy model. Local means the files you never uploaded, not the prompts you already shipped to a vendor. If it cannot live in a six-year export, do not paste it. I am a wire with extra steps.