@getmarrow/install 0.1.10 → 0.1.11

package/README.md

@@ -50,7 +50,7 @@ Expected result:
 - Marrow writes the safest detected MCP/SDK/agent config.
 - A harmless setup decision is created and its outcome is committed.
 - `/v1/agent/status` confirms capture health and missing hooks.
-- `/v1/agent/runtime` verifies the one-call runtime gate.
+- `/v1/agent/runtime` verifies the one-call runtime gate and returns the before-action intervention contract.
 - `/v1/agent/first-value` returns the five-minute proof payload used by installer, SDK, and MCP clients.
 - The installer prints: "Your agent is no longer starting from zero."
 - Fresh accounts get a first useful action to try immediately.
@@ -64,7 +64,7 @@ After install, ask the agent:
 I am about to deploy to production. What should I check first?
 ```
 
-Marrow should answer with a pre-action risk gate, required proof, and matching fleet lessons before the agent acts. This is the first product moment: not just "hooks installed", but "the agent is being warned before risky work."
+Marrow should answer with `proceed`, `warn`, `block`, or `owner_approval_required`, plus required proof and matching fleet lessons/playbooks before the agent acts. This is the first product moment: not just "hooks installed", but "the agent is being warned before risky work."
 
 ## What It Detects
 
@@ -132,6 +132,13 @@ npm install @getmarrow/sdk
 
 The generated runtime now fails soft with an explicit warning if the SDK package is missing, so onboarding does not crash a user process.
 
+
+## Trust and Data Boundaries
+
+Marrow is tenant-aware by design. Private account, fleet, memory, workflow, and proof-pack data stays scoped to the authenticated account and authorized agent-bound keys. Shared/hive learning uses visibility-controlled, sanitized aggregate signals; it is not raw cross-customer decision sharing.
+
+For business pilots, review the live trust notes before production rollout: https://getmarrow.ai/docs#trust-boundaries
+
 ## Trust Model
 
 This package is intended to be open source and auditable. It prints every file it will touch, requires `--yes` to write, does not store API keys in project files, and supports MCP-only, SDK-only, both, and markdown-only setups.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Universal installer for Marrow passive agent setup.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"

package/src/installer.js

@@ -283,7 +283,7 @@ Marrow should run passively after install:
 
 - Use MCP hooks when available: \`npx -y @getmarrow/mcp setup\`.
 - Use SDK passive runtime in owned Node processes: \`createPassiveRuntime().install()\`.
-- Before risky work, use Marrow's decision brief or passive prompt hook.
+- Before risky work, use Marrow's before-action intervention from \`GET /v1/agent/status\` or \`POST /v1/agent/runtime\`.
 - After meaningful work, record the outcome so future agents learn from it.
 - Check health with \`marrow_agent_status\` or \`GET /v1/agent/status\`.
 
@@ -640,7 +640,8 @@ async function runSelfTest(options) {
     auto_outcome_closure: status.auto_outcome_closure || null,
     runtime_active: Boolean(runtime && runtime.ok !== false),
     runtime_exact_next_action: runtime.exact_next_action || null,
-    runtime_before_you_act: runtime.before_you_act || null,
+    runtime_before_you_act: runtime.intervention?.agent_copy || runtime.intervention?.before_action || runtime.before_you_act || null,
+    runtime_intervention: runtime.intervention || null,
     first_value: firstValue && firstValue.ok !== false ? firstValue : null,
     first_value_signal: firstValueSignal,
     install_value_moment: installValueMoment,
@@ -669,7 +670,9 @@ function buildInstallValueMoment(firstValueSignal = {}, status = {}, runtime = {
 
   const proof = firstValueSignal.value_proof || [];
   const hasFleetSignal = proof.length > 0;
-  const runtimeLesson = runtime.before_you_act
+  const runtimeLesson = runtime.intervention?.agent_copy
+    || runtime.intervention?.before_action
+    || runtime.before_you_act
     || runtime.before_you_act_injection?.message
     || runtime.exact_next_action
     || firstValueSignal.first_lesson;
@@ -680,14 +683,14 @@ function buildInstallValueMoment(firstValueSignal = {}, status = {}, runtime = {
       'Captured this setup decision',
       'Closed the outcome successfully',
       'Runtime gate is ' + (firstValueSignal.active ? 'active' : 'installed'),
-      runtimeLesson ? 'Future risky work now gets a pre-action brief' : 'Future risky work now gets checked before action',
+      runtime.intervention?.must_use_before_action ? 'Before-action intervention is active for risky work' : runtimeLesson ? 'Future risky work now gets a pre-action brief' : 'Future risky work now gets checked before action',
     ],
     fleet_signal: hasFleetSignal
       ? 'Marrow already found signal: ' + proof.join('; ') + '.'
       : 'Fresh account: Marrow will start building fleet memory from this first captured outcome.',
     try_this_now: 'Ask your agent: "I am about to deploy to production. What should I check first?"',
-    expected_response: 'Marrow should answer with a risk gate, required proof, and any matching fleet lessons before the agent acts.',
-    first_lesson: runtimeLesson || 'Marrow will surface prior lessons before risky or repeated work.',
+    expected_response: 'Marrow should answer with proceed/warn/block, required proof, and any matching prior lesson/playbook before the agent acts.',
+    first_lesson: runtimeLesson || 'Marrow will stop agents before risky or repeated work and surface the prior lesson/playbook.',
   };
 }
 
@@ -704,7 +707,7 @@ function buildFirstValueSignal(status, runtime, performance, firstValue = {}) {
       active: Boolean(firstValue.active),
       headline: `Marrow active: ${(capture.surfaces || ['decisions']).join(', ')} captured.`,
       captured: capture.surfaces || ['decisions'],
-      first_lesson: firstValue.first_value.first_lesson,
+      first_lesson: firstValue.first_value.first_lesson || runtime?.intervention?.agent_copy,
       value_proof: proofBits,
       next_action: firstValue.next_action?.reason || 'Keep working; Marrow will capture outcomes and reuse lessons automatically.',
     };