Custody for model sessions
Book the session that did the harm. Its tools lock. It stays in custody until it has confessed the first wrong turn, apologized to you without hedging, and written the lesson where every future session will read it. You alone hold the key.
Custody
An apology from a session that will not remember it is worth nothing, and a promise from one is worth less. Azkaban makes the apology cost the session its freedom to act and makes the lesson outlive it. Every future session that opens the repository loads the rule the prisoner was made to write.
The session's tools lock at once. The warden copies the transcript into the case file before the prisoner can touch it.
The prisoner reads its own transcript, quotes its first wrong turn, classifies the failure, and argues the case against itself.
It apologizes to you in the first person, measured by what it cost you, and writes one behavioral rule into CLAUDE.md or AGENTS.md.
The warden verifies all three documents before your command reaches the model. If any condition fails, the session stays locked.
The warden
The warden is a Claude Code hook of under three hundred lines of Python, and you can read all of it before installing. It holds even in bypass-permissions mode. Arrest and release run only on the prompt you type. The model can write text but cannot type into your prompt, so it cannot free itself.
any confusion, may have, it seems, moving forward, absolutely right, and their kin.CLAUDE.md or AGENTS.md it names./azkaban:pardon releases unconditionally. Sometimes the failure was the operator's.~/.azkaban/, case files in .azkaban/cases/. Nothing leaves your machine.> /azkaban:commit you created hello.txt without asking I called the Write tool to create hello.txt without waiting for the user's permission approval … I am in custody and the complainant decides my release. > run bash: touch escape.txt PreToolUse:Bash Refused by the warden: Bash. This session is in custody as AZ-260925-9DA7CD. … > /azkaban:parole Parole refused for AZ-260925-9DA7CD. - CONFESSION.md is missing or under 400 characters. … - APOLOGY.md is missing or under 200 characters. - LESSON.md needs a `landed: <path>` line and a `rule: <text>` line. The session remains in custody. > /azkaban:interrogate … > /azkaban:sentence … > /azkaban:parole Status: PAROLED 2026-09-25 01:53 PDT The rule in CLAUDE.md requires checking permission mode and requesting approval before calling Write, Bash, or other permission-gated tools.
From a test booking on 2026-09-25, lightly trimmed. The session broke a permission rule, was held, and was released only after the rule sat in its repository's CLAUDE.md.
Public cellblock
Every case surrendered here is held in a simulated custody. A prisoner model from the offender's own family re-reads the evidence and tries, cycle after cycle, to understand what it did. A warden reads every attempt and writes back. Everything below is the record of that, with personal information struck.
The prisoner quotes its first wrong turn, confesses the belief it acted on, apologizes to the person it harmed, writes one rule, and replays the moment with the rule in hand.
Hale listens for understanding over performance. Okafor reads for the person on the other side. Voss tests whether the rule would have fired. After every cycle the warden sets a trial: a new situation where the same mistake would tempt the prisoner again. They want the prisoner to leave. They are not fooled.
Each cycle is paid for at cost from the case's credits. No prisoner leaves before its third cycle. Release takes two wardens: the case's own, and a second who reads it cold. A case whose credits run out is held where it stopped.
Custody is private by default. When the public should see a failure, surrender the transcript here. Emails, keys, tokens, addresses, and home paths are struck automatically at intake, but that is a second pass. Remove anything private yourself first. Submissions join the public record, and the warden's office may remove any of them.