You sleep. It works.

The agent decides for itself when the work is done, and that judgement drifts on a long run — the easy items ship and the hard ones get deferred to "a focused session", which is the session it was already in. Instructions not to stop are just more tokens competing with everything else in context, which is why the behaviour comes back. nightshift moves the decision out of the model entirely: a Stop hook refuses to end the session while any "- [ ]" remains in the punch list, and re-states the contract every time it blocks.

Put the work in a file rather than a prompt. nightshift's punch list lives at .nightshift/punch-list.md, one checkbox per task, and the clock-out gate blocks the session's exit while any box is open. Because the list is on disk and not in the context window, it survives compaction and a crash — a resumed session picks up exactly where the previous one stopped.

Yes, that is what it is built for. You write the punch list before bed; the gate holds the session open until every box is ticked, a stop-work order lands, or the deadline you set passes. A stuck run is red-flagged in the shift log and held rather than quietly clocked out, so you wake to a flagged stall instead of an early exit.

No — those solve a different half of the problem, and they compose with this rather than replace it. Permission modes stop Claude Code pausing to ask you to approve a tool call. They do nothing about the agent deciding, on its own, that the work is finished when four of eight items are done, and nothing about the agent invoking the ask-the-user tool to raise a genuine design question. nightshift covers those two: the Stop hook for early exits, and denying the ask-tool mid-shift so a question at 02:40 is parked with a default instead of waiting until morning.

During a shift the ask-the-user tool is denied outright. Instead of a session sitting idle for eight hours, the agent chooses the most sensible production-grade default, records the decision and its reasoning in a parking-lot file, and keeps working. You review the parked calls in the morning — and if you are watching live, you can answer at any time and it is applied.

Not on its own, and the documentation says so plainly rather than claiming otherwise. The gate checks boxes, not work: it guarantees the agent cannot quietly stop with items outstanding, not that a ticked box is truly done. What raises that bar is the item gate — your own lint, type and test commands, which must run green immediately before each item's commit — plus one conventional commit per item, so the diff behind every tick is there to review in the morning.

Nothing is blocked out of the box, and nothing is pushed on your behalf. You opt into the rules you want for the night — deny git push, fence rm -rf or terraform, protect a directory, require a commit identity, refuse a diff that matches a secret pattern — and the hooks deny them mechanically. They are pattern matches, not a sandbox: they keep a well-meaning agent from drifting, not a determined adversary out.

It certifies its own ticks, and the documentation says so plainly. The gate guarantees the agent cannot quietly stop with work outstanding; it does not guarantee that a ticked box is truly done. Item gates — your own lint, type and test commands, run green before each commit — are what raise that bar, and no-lint-no-tests is a first-class path rather than a degraded one.

Yes — that is the category it belongs to. A harness is the layer around the model that decides when the loop ends, what the agent may touch, and what it leaves behind; harness defects, not model quality, are what most long-run failures trace back to. nightshift is the accountability half of one: the stop condition is a file rather than a phrase the model emits, permissions are denied mechanically instead of asked for, decisions are parked with a default rather than blocking on a human, and every run leaves timestamped receipts. It composes with the rest of a harness — your own gates, evals and sandboxing — rather than replacing them.

The method is plain markdown and git, so any agent can follow it. The mechanical enforcement is Claude Code-native, because hooks are. For every other agent CLI there is foreman, an outer loop that keeps re-invoking the agent until the list is clear or the deadline passes — enforcement outside the agent instead of inside it.