# Claude subscription boundary
Setup: [Provider authentication](provider-authentication.md#claude-subscription).
## Runtime ownership
| Owner | Responsibility |
| --- | --- |
| Installed Claude CLI | Subscription login, refresh, model access and authenticated Messages requests |
| Rust provider | Projection, native process, deadlines, cancellation, ordered events and tool validation |
| One-admission relay | Forward one generation to Anthropic, replace placeholder with ordered host history, validate response |
| Host agent runner | Durable history, approvals, tools, continuation and compaction |
Each request launches installed `claude -p` with one ordinary placeholder prompt. The relay replaces its messages with the complete host conversation. There is no SDK dependency, manual assistant-input protocol, mirrored Claude session, or second credential-refresh owner. Temporary system prompt, settings and inert tool inventory live in an owner-private directory. Native session persistence is disabled.
Built-in CLI tools and skills are disabled. User/project/local settings are disabled; managed policy still applies. Strict MCP configuration exposes only the inert host inventory. Magi-code replaces the system prompt and disables native compaction. The CLI and inert MCP server share a process group, terminated on completion, failure or cancellation.
The [subscription guidance](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan) permits CLI, SDK and third-party usage against subscription limits. It does not specifically certify this history-rewriting relay. API-key and alternate-backend environment overrides are removed from children, but existing subscription usage credits may still be charged. Magi-code never enables credits or changes billing settings.
## Execution and failure policy
`CLAUDE_CODE_MAX_RETRIES=0` and `CLAUDE_CODE_DISABLE_NONSTREAMING_FALLBACK=1` constrain native retries. They are not enforcement: the relay refuses every Messages request after the first admission. Unexpected history replacement fails before upstream I/O. Both native and restored requests are capped at 8 MiB; captured response at 16 MiB.
The CLI is launched with `--thinking-display summarized` to request provider-generated thinking summaries. They use the same live reasoning display and saved-history path as other providers. Signed thinking blocks remain intact for replay; signatures and redacted thinking payloads are never displayed. Empty or provider-hidden thinking produces no reasoning card.
Text, reasoning and usage may stream before completion. Tools and the remaining ordered suffix require:
- Valid upstream stop and usage records.
- Native assistant, result and `message_stop` records.
- Successful native exit.
- A tool name in the request's host inventory.
A completed tool-use response may end the one-turn CLI with `error_max_turns` and exit 1. Only that exact subtype with a validated upstream tool call permits exit 1. Other errors, missing terminal records and incomplete streams fail without releasing tools. Accepted partial text remains durable. A later host continuation is a new request, not a retry within the same admission.
Native lines are capped at 1 MiB and cross a bounded 16-message channel. Startup allows five minutes; configured semantic inactivity applies after progress. Upstream completion starts one fixed finalization grace interval. Each generation has a 30-minute overall limit. Diagnostics exclude raw prompts, authorization headers and native stderr.
## Context capacity
| Explicit model selection | Input ceiling |
| --- | ---: |
| Opus 4.6 and newer with `[1m]`, including `claude-opus-5-5[1m]` | 1,000,000 |
| Fable 5 and newer with `[1m]`, including `claude-fable-5[1m]` and `claude-fable-5-1[1m]` | 1,000,000 |
| All other selections, including aliases | 202,000 |
Compaction uses the same settings, context reserve, model inheritance and prompt-border display as every other provider. Defaults are an 80% automatic trigger and four compactions per run; no separate Claude controls or required alternative model. Catalog windows and native `modelUsage` cannot raise transport limits. Refresh the catalog to show extended-context variants of eligible listed models, or select one explicitly. No suffix is added automatically.
The explicit suffix matters when `ANTHROPIC_BASE_URL` points at a relay: native gateway defaults can differ from direct subscription defaults. See [Claude model configuration](https://code.claude.com/docs/en/model-config). Account entitlements still decide acceptance. Estimates are not provider token counts; token-dense input can exceed them substantially. Keep headroom. Oversize rejection uses host compaction, not a hidden model or billing fallback.
## Native observations
Observed on macOS with installed CLI **2.1.283** and a Claude Max account, using isolated host settings and workspace directories. No credentials were copied. Synthetic histories contained complete prior user/assistant turns and markers at separated positions.
### Opus 5.5 and Fable 5.1
Both unsuffixed selections completed a small one-write host-tool round trip: Opus 5.5 in 3.709 seconds and Fable 5.1 in 3.361 seconds. Explicit `[1m]` selections then used complete synthetic prior turns through the same host projection and one-admission relay:
| Selection | Successful observation |
| --- | --- |
| `claude-opus-5-5[1m]` | Three separated markers recovered at **868,895** input tokens (32.072s). A later turn wrote all markers once and completed fresh-query continuation, at **868,984** and **869,106** input tokens (9.502s total). |
| `claude-fable-5-1[1m]` | Wrote all three markers once and completed fresh-query continuation, at **868,951** and **869,073** input tokens (38.354s total). Signed thinking preceded the durable function call and host tool events. |
Failed observations remain part of the verification record:
- Fable's first large recall and a later approximately 911K-input attempt caused the CLI to request two additional generations. The relay refused both and failed the runs without releasing tools. Native metadata from the latter named canonical `claude-fable-5-1`, reported a 1M window and zero output tokens; that is not a successful 1M workflow.
- Opus's approximately 911K-input attempt and a later small replay received HTTP 429. The user confirmed the subscription's five-hour limit and stopped further live validation.
The configured one-million-token ceiling is a model policy, not a measured successful full-window workflow. Near-1M capacity and further model-specific compaction/cancellation runs remain unverified. The native model-identity probe was a temporary pass-through script that recorded only model/usage metadata, not prompts, reasoning or credentials. Its list-price `costUSD` field does not establish subscription charges. No billing settings were changed or usage credits enabled.
### Earlier Opus 4.6 and shared lifecycle observations
| Workflow | Observation |
| --- | --- |
| Direct CLI tools | One host write, fresh CLI continuation and durable `CLI_RELAY_OK`; reopening recovered the marker |
| Extended-context routing | Explicit `claude-opus-4-6[1m]` completed a small request |
| Larger replay | **308,152**, **498,241**, and **908,158** provider-reported input tokens; all three markers recovered in order; respective elapsed times 10.0, 14.0 and 26.5 seconds |
| Large-context tool and compaction | Host write completed with all markers, then automatic compaction completed; next continuation failed with a live Claude rate-limit error, not a history or size error |
| Post-compaction recovery | After cooldown, reopening the same session completed and retained marker-file execution evidence |
| Signed thinking and tools | Durable order was signed thinking → function call → host tool call/result → assistant output; fresh CLI continuation completed |
| Authentication isolation | Tool round trip succeeded with a deliberately invalid parent `ANTHROPIC_API_KEY` |
| Cancellation | Cancel after first text delta retained durable partial output; both observed descendants exited |
| Forced native failure | Killing CLI after first delta retained durable partial failure; both observed descendants exited, no tool released |
| Controlled HTTP failures | Direct CLI made one request for local 401 and 429 responses, but two for truncated SSE despite retry flags; all returned error results and exit 1 |
These observations cover the explicit model's larger input workflow, not every account, runtime version or model, and do not establish successful full-window use. The rate-limited run did not complete automatically; subsequent reopened continuation succeeded. Controlled HTTP failures are local simulations, not live authentication or quota failures. Account billing attribution was not independently measured.
## Why direct CLI, not an SDK sidecar
An evaluated TypeScript Agent SDK sidecar still launched installed Claude Code. It added Node, npm version management, an extra process and approximately 282 MiB of package dependencies on this machine. A matched tool sample took 5.832 seconds with direct CLI and 6.139 seconds with the SDK; neither is a performance benchmark. The SDK supplied no demonstrated reliability or latency advantage for this boundary.
Removing manual historical input does not require an SDK: the relay already supplies ordered history. The [Hermes official plugin](https://github.com/NousResearch/hermes-official-plugins/tree/682b22d019a1109421faa62efe43e16b23c2ebef/claude-subscription-directsdk) likewise uses direct CLI plus admission enforcement. [Pi's bridge](https://github.com/elidickinson/pi-claude-bridge/tree/b2e7255ece0b8bfd3a6429fd5c147fd59984c785) instead uses the SDK and synchronized Claude session files; that separate history owner is unnecessary here.
During the SDK evaluation, controlled local 401/429 responses produced one native request each. Truncated SSE caused two native attempts despite both retry flags, so the relay remains required. Earlier SDK text, signed-thinking replay, cancellation and forced-sidecar-death observations do not substitute for verification of this direct CLI revision.