Morpheus drain

The overnight autonomous coder — and how it confines itself to a task’s scope before a human is anywhere near.

The Morpheus drain is the unattended coding pipeline: it takes a queue of todos and works through them on its own, running the coding phase, opening pull requests for the operator to review in the morning. Because no human is watching each keystroke, the enforcement plane matters most here — and the drain adds one more idea on top of it: it reads the scope of each task from the task itself.

Same gate, same wall

The drain is not a privileged path around the rules. It calls the same gate before every write, runs inside the same Landlock wall (installed when the daemon starts, fail-closed), and its output is checked by the same post-hoc sweep and merged through the same CODEOWNERS gate. Autonomy changes who is watching, not which rules apply.

Scope from todo tags

Each todo can carry tags that tell the drain what it is — and isn’t — allowed to touch. The scope guard reads two kinds:

• #scope:<token> — grants one of the recognised scope tokens for this task (only tokens the policy actually knows are honoured; unknown ones are ignored).
• #scope-out:<path> — marks an extra path as off-limits for this task, beyond the standing protected list. A task-specific “do not touch.”

From these the guard builds the task’s working boundary and renders it straight into the coding prompt — an “Out of scope” block listing the allowed tokens and the paths to avoid, with the instruction that if the plan needs a protected path without the matching token, the agent should skip that part and write down the decision rather than force it.

Safety in the tag parsing

The #scope-out paths are checked before they’re trusted. A pattern that is empty, starts at the filesystem root, or tries to climb out with .. is rejected — a task cannot use a scope tag to point the guard at something outside the repo. After a run, the guard validates the changed paths against both the standing protected globs and the task’s extra out-of-scope patterns, producing a list of violations the same shape the sweep uses.

Built on the one policy

The scope guard does not keep its own copy of what’s protected. It reads AGENT_POLICY.yaml — the same canonical source of truth every other checkpoint reads. It began life parsing the human-readable PROTECTED_PATHS.md directly; that was migrated so the YAML is the single source. If the policy can’t be loaded, the guard falls back to a small hard-coded emergency list (.env files, keys, secrets, /etc) so a missing policy still isn’t an open door.

Where it fits

Think of the drain as the enforcement plane’s stress test. Everything documented on this site was built so that a coding agent running all night with no one watching still cannot cross the lines — read its scope from the task, work inside the wall, get checked on the way out, and present its work to a human at the merge gate. If the rules only held when someone was looking, they wouldn’t be rules.

See also

• The gate — called before every write, drain included.
• Post-hoc sweep — checks the drain’s output.
• Protected paths — the tokens the scope tags grant.
• Agent policy (YAML) — the source the scope guard reads.
• Morpheus — the full subsystem: consolidation, probes, approvals, self-edit, and the drain.