@getmarrow/install 0.1.25 → 0.1.27

package/README.md

@@ -1,104 +1,66 @@
 # @getmarrow/install
 
-Universal installer for Marrow passive agent setup.
+Universal installer for Marrow agent governance, proof, and passive control setup.
 
-Use it when you want Marrow to detect the local agent/runtime environment and wire the safest passive integration automatically.
+Use it when you want Marrow to detect the local agent/runtime environment and wire the safest passive governance integration automatically.
 
 ```bash
 npx @getmarrow/install --dry-run
 npx @getmarrow/install --yes
 npx @getmarrow/install --repair
 npx @getmarrow/install doctor
+npx @getmarrow/install govern
 npx @getmarrow/install fleet
 npx @getmarrow/install integrations
 npx @getmarrow/install hermes
 npx @getmarrow/install openclaw
 ```
 
-## What's New in v0.1.25
-
-v0.1.25 adds first-class harness add-on paths for Hermes Agent and OpenClaw.
-
-- `npx @getmarrow/install integrations` lists Marrow-supported harness add-ons.
-- `npx @getmarrow/install hermes` shows the Hermes attachment path and, when `MARROW_API_KEY` is present, verifies the backend integration contract.
-- `npx @getmarrow/install openclaw` shows the OpenClaw attachment path and verifies the backend integration contract.
-- `npx @getmarrow/install govern` now detects Hermes config files alongside Codex, Claude Code, Cursor, OpenCode, OpenClaw, CI scripts, and custom commands.
-- Hermes `/goal`, verification evidence, `/learn`, `/journey`, and background subagents map into Marrow runtime gates, proof packs, fleet lessons, governance timeline, and outcome closure.
-- OpenClaw sessions, handoff/result files, watchdog checkpoints, silent exits, and release supervisor results map into Marrow workflow sessions, proof packs, stale-outcome detection, and reusable handoff lessons.
-
-This is the intended positioning: keep the harness your team already uses, and add Marrow as the governance, proof, and fleet-intelligence layer around it.
-
-Examples:
-
-```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install hermes
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install openclaw
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install integrations --json
-```
-
-## What's New in v0.1.20
+## What's New in v0.1.26
 
-v0.1.20 adds the Fleet Operator TUI for teams running multiple agents under one Marrow account.
+v0.1.26 expands Marrow's supported harness registry so teams can attach governance to the agent tools, IDE agents, model CLIs, MCP clients, CI runners, and custom harnesses they already use.
 
-- `npx @getmarrow/install fleet` opens a terminal operator view when run in a real TTY.
-- CI/headless agents can use `npx @getmarrow/install fleet --no-interactive` for a stable text snapshot or `--json` for machine-readable status.
-- The view shows live agents, active workflows, risky actions waiting for proof, failed/stale outcomes, backpressure/capacity status, recent decisions, degraded hooks, and deploy/publish/merge gate posture.
-- Operators can press Enter to inspect an agent and print the exact fix command when hooks, outcome closure, or status coverage is degraded.
-- The command reads existing Marrow account endpoints and degrades gracefully when a route is unavailable, so it is safe to use during incidents.
+- `npx @getmarrow/install integrations` lists supported surfaces, support level, install command, capture path, and detection signals.
+- `GET /v1/agent/data-quality` lets agents verify attribution coverage after install, including agent ID, source metadata, harness/client, workflow type, outcome closure, and exact repair guidance.
+- `GET /v1/agent/integrations/{client}` gives supported harnesses a per-client setup guide with install command, capture points, source metadata, runtime/commit/batch mapping, and exact next action.
+- `npx @getmarrow/install govern` detects Codex, Claude Code, Cursor, Cursor Composer, Windsurf, Cline, OpenCode, Hermes, OpenClaw, Gemini, Grok, DeepSeek, Qwen, Kimi, MiniMax, GLM, MCP clients, CI scripts, and custom commands.
+- Hermes Agent and OpenClaw remain first-class add-ons.
+- Codex, Claude Code, Cursor, Cursor Composer, Windsurf, Cline, OpenCode, Gemini, Grok, DeepSeek, Qwen, Kimi, MiniMax, GLM, MCP clients, CI scripts, and custom shell/API harnesses can use MCP/SDK hooks, the governed runner, or `POST /v1/agent/integrations/events`.
+- Custom harness events should include `harness`, `event_type`, `agent_id`, and `action`, so Marrow can return the right runtime, commit, or batch-ingest next step without storing unsupported or under-attributed raw payloads.
 
-Example:
+The positioning is simple: keep the harness your team already uses, and add Marrow as the governance, proof, and fleet-intelligence layer around it.
 
-```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install fleet
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install fleet --no-interactive
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install fleet --json
-```
+## What's New in v0.1.24
 
-## What's New in v0.1.14
+v0.1.24 aligns the installer docs with Marrow's control-plane direction.
 
-v0.1.14 adds adaptive governance mode recommendations without silent auto-switching.
+- Marrow is positioned as an agent governance, proof, and intelligence layer, not a single-agent memory app.
+- The recommended setup path remains passive by default: install once, then let agents call runtime gates, completion contracts, and outcome closure as they work.
+- Hermes Agent is a supported client label and integration target; Marrow maps Hermes goals, verification evidence, learning, journey, and subagent outcomes into fleet governance proof.
+- New backend surfaces include governance control-plane proof, completion-contract evaluation, fleet governance timeline, and buyer-grade value proof.
 
-- `npx @getmarrow/install govern` now detects project signals such as `package.json`, deploy/publish scripts, `wrangler` config, GitHub workflows, migrations, Cursor/Codex/Claude files, and MCP config.
-- When `MARROW_API_KEY` is present, the TUI asks Marrow for a recommended mode: `passive`, `pilot`, or `enforce`.
-- The TUI shows the exact reasons, confidence, and selected command before the user applies anything.
-- User choice is explicit. Marrow logs whether the recommendation was accepted or overridden, but it does not silently switch modes.
-- Policy profiles are supported by the backend/SDK/MCP so businesses can define rules like local=passive, staging=pilot, production deploys=enforce.
+## What's New in v0.1.23
 
-Example recommendation:
-
-```text
-Recommended mode: pilot
-Reason:
-- Node project detected
-- Cloudflare Worker detected
-- GitHub workflow detected
-- No owner approval policy configured yet
-```
+v0.1.23 improves attribution quality so Marrow can produce cleaner per-agent, per-harness, and per-workflow value reports.
 
-## What's New in v0.1.13
+- Installer self-tests and governed runner calls attach `source_meta.channel`, `source_meta.client`, and inferred workflow intent by default.
+- Generated passive runtime keeps using SDK defaults for `agent_id`, harness/client, source channel, and user intent attribution.
+- Set `MARROW_CLIENT`, `MARROW_HARNESS`, or `MARROW_AGENT_CLIENT` to labels such as `codex`, `claude-code`, `cursor`, `gemini`, `qwen`, `opencode`, `hermes`, `openclaw`, or `custom`.
+- Invalid or unknown client labels fall back to `custom` instead of breaking onboarding.
+- Marrow still does not store prompts, completions, tool stdout/stderr, plaintext API keys, or raw model output for this feature.
 
-v0.1.13 turns `npx @getmarrow/install govern` into an interactive terminal setup flow when run in a real TTY.
+Business value: dashboards and reports can show which agents, harnesses, and workflow types are improving instead of grouping too much work into "unknown."
 
-- Select Codex, Claude Code, Cursor, OpenCode, OpenClaw, CI scripts, or a custom command with arrow keys.
-- Choose passive setup, governed pilot mode, or governed enforce mode.
-- Run passive setup + self-test from the TUI after explicit confirmation.
-- Check Marrow status and test the before-action gate from the same screen.
-- Print the exact command for the selected harness/mode so users know what to run next.
-- Exit cleanly with `q`, `Esc`, or `Ctrl+C`.
-- CI/non-TTY usage remains stable with `npx @getmarrow/install govern --no-interactive`.
+## Governed Runner
 
-This keeps Marrow passive-first: install once, verify Marrow is active, then let agents use the runtime/gate path automatically for risky work.
-
-## What's New in v0.1.12
-
-v0.1.12 adds the Marrow governed runner for businesses that want agent governance without replacing their existing harness.
+The Marrow governed runner is for businesses that want agent governance without replacing their existing harness.
 
 - `npx @getmarrow/install govern` prints a setup panel for detected harnesses and recommended protected commands.
 - `npx @getmarrow/install run --agent <agent-id> -- <command>` wraps existing agent, deploy, merge, publish, migration, and verification commands with Marrow's pre-action runtime gate.
 - Risky actions can fail closed by default when Marrow requires owner approval, blocks an action, or requires missing proof.
 - Successful and failed commands automatically close outcomes through `/v1/agent/commit` with a redacted proof pack.
 - The runner sends action and command metadata only; it does not upload command stdout, stderr, full environment values, or plaintext API keys.
-- This gives teams a thin governance path for Codex, Claude Code, OpenClaw, OpenCode, Cursor, CI scripts, and custom shell-based agents.
+- This gives teams a thin governance path for Codex, Claude Code, Cursor, Cursor Composer, Windsurf, Cline, OpenClaw, Hermes, OpenCode, Gemini, Grok, DeepSeek, Qwen, Kimi, MiniMax, GLM, MCP clients, CI scripts, and custom shell-based agents.
 
 Business value: Marrow can sit in front of the commands that matter most, tell the agent what prior lesson or proof is required before action, and produce an audit-ready outcome trail after the command finishes.
 
@@ -110,28 +72,22 @@ Preview the detected harnesses and protected command examples:
 npx @getmarrow/install govern
 ```
 
-In a real terminal, this opens the interactive setup flow. In CI or scripts, use:
-
-```bash
-npx @getmarrow/install govern --no-interactive
-```
-
 Run a harmless command through Marrow:
 
 ```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run --agent codex-prod --profile production -- node -e "process.exit(0)"
+MARROW_API_KEY=<your_marrow_key> npx @getmarrow/install run --agent codex-prod --profile production -- node -e "process.exit(0)"
 ```
 
 Gate a production action before the agent executes it:
 
 ```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install gate "deploy production worker after tests pass"
+MARROW_API_KEY=<your_marrow_key> npx @getmarrow/install gate "deploy production worker after tests pass"
 ```
 
 Wrap a real deploy, publish, merge, or migration command only after the agent has the required proof:
 
 ```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run \
+MARROW_API_KEY=<your_marrow_key> npx @getmarrow/install run \
   --agent deploy-agent \
   --type deploy \
   --profile production \
@@ -141,15 +97,6 @@ MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run \
 
 Use `--policy warn` for pilot mode and `--fail-open` only for non-production local workflows where Marrow should never block execution.
 
-## What's New in v0.1.10
-
-- First-run output now explains the value in agent/user language: your agent is no longer starting from zero.
-- Self-test prints first proof: setup decision captured, outcome closed, runtime gate active, and risky work now gets a pre-action brief.
-- Fresh accounts get a guided prompt to try immediately: "I am about to deploy to production. What should I check first?"
-- Existing accounts/fleets show stronger proof when available: avoided mistakes, reused winning decisions, prevented risky actions, and token/time savings.
-- Generated SDK passive runtime now fails soft if `@getmarrow/sdk` is missing and the installer prints the exact dependency fix.
-- Docs now make the universal installer the default path; SDK and MCP are advanced/manual integration paths.
-
 ## Which Install Path Should I Use?
 
 Start here unless you already know you need a lower-level integration:
@@ -167,12 +114,20 @@ Use the lower-level packages only when you need direct control:
 
 The three packages are not three competing onboarding paths. `@getmarrow/install` is the front door; SDK and MCP are the implementation paths underneath it.
 
+For cleaner attribution, set an agent id and optional client label before install:
+
+```bash
+export MARROW_FLEET_AGENT_ID=codex-deploy-agent
+export MARROW_CLIENT=codex
+npx @getmarrow/install --yes
+```
+
 ## Agent Value Proof Quickstart
 
 One command should prove Marrow is active and useful:
 
 ```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install --yes
+MARROW_API_KEY=<your_marrow_key> npx @getmarrow/install --yes
 ```
 
 Expected result:
@@ -180,9 +135,12 @@ Expected result:
 - Marrow writes the safest detected MCP/SDK/agent config.
 - A harmless setup decision is created and its outcome is committed.
 - `/v1/agent/status` confirms capture health and missing hooks.
+- `/v1/agent/data-quality` confirms whether attribution is clean enough for per-agent, per-harness, and per-workflow value proof.
 - `/v1/agent/runtime` verifies the one-call runtime gate and returns the before-action intervention contract.
 - `/v1/agent/first-value` returns the five-minute proof payload used by installer, SDK, and MCP clients.
+- `/v1/agent/value/proof` returns token value proof from passive model-usage capture.
 - The installer prints: "Your agent is no longer starting from zero."
+- The installer prints: "Token value proof" with capture status, observed model calls, token totals, estimated savings, confidence, and exact next action.
 - Fresh accounts get a first useful action to try immediately.
 - Accounts with history get proof such as avoided mistakes, reused winning decisions, prevented risky actions, or estimated time/token savings.
 
@@ -196,39 +154,6 @@ I am about to deploy to production. What should I check first?
 
 Marrow should answer with `proceed`, `warn`, `block`, or `owner_approval_required`, plus required proof and matching fleet lessons/playbooks before the agent acts. This is the first product moment: not just "hooks installed", but "the agent is being warned before risky work."
 
-## Fleet Scale Startup Guidance
-
-For business fleets, agents can read `GET /v1/agent/scale/capacity-contract` after install or during startup. The capacity contract tells the agent whether the account is under backpressure, when low-risk runtime guidance can be reused, when high-risk actions must still call Marrow, and how to batch low-risk telemetry through `/v1/agent/ingest/batch`.
-
-This keeps Marrow passive without making it chatty. The current contract models the common `50 businesses x 50 agents = 2,500 agents` rollout shape and gives agents an exact next action: cache low-risk runtime guidance briefly, batch command/tool telemetry, and preserve proof-gated checks for deploys, publishes, merges, migrations, secrets, billing, and destructive work.
-
-## Fleet Operator TUI
-
-Use the operator TUI when a human owner or orchestrator agent needs to understand fleet health before acting:
-
-```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install fleet
-```
-
-It shows:
-
-- live agents and selected agent inspection
-- active workflows
-- risky actions waiting for proof
-- failed or stale outcomes
-- backpressure and capacity guidance
-- recent decisions
-- degraded hooks
-- deploy, publish, and merge gate status
-- exact fix commands for common degraded states
-
-For automated reports or headless agents:
-
-```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install fleet --no-interactive
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install fleet --json
-```
-
 ## What It Detects
 
 - OpenClaw-style workspaces
@@ -236,6 +161,8 @@ MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install fleet --json
 - Codex/agent instruction files such as `AGENTS.md`
 - Claude Code settings and hooks
 - Cursor project folders
+- Cursor Composer, Windsurf, Cline, and OpenCode project markers
+- Gemini, Grok, DeepSeek, Qwen, Kimi, MiniMax, and GLM command/profile markers
 - MCP config files
 - Node projects
 - Python projects
@@ -262,10 +189,10 @@ npx @getmarrow/install --md --dry-run
 
 ## Self-Test
 
-When `MARROW_API_KEY` is present, the installer creates a harmless test decision, commits the outcome, reads `/v1/agent/status`, calls the one-call runtime, and prints the first useful Marrow signal.
+When `MARROW_API_KEY` is present, the installer creates a harmless test decision, commits the outcome, reads `/v1/agent/status`, calls the one-call runtime, reads `/v1/agent/value/proof`, and prints the first useful Marrow signal plus token value proof.
 
 ```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install --yes
+MARROW_API_KEY=<your_marrow_key> npx @getmarrow/install --yes
 ```
 
 Skip self-test:
@@ -277,13 +204,13 @@ npx @getmarrow/install --yes --no-self-test
 Doctor check:
 
 ```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install doctor
+MARROW_API_KEY=<your_marrow_key> npx @getmarrow/install doctor
 ```
 
 Repair missing hooks/config:
 
 ```bash
-MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install --repair
+MARROW_API_KEY=<your_marrow_key> npx @getmarrow/install --repair
 ```
 
 ## SDK Dependency
@@ -296,10 +223,40 @@ npm install @getmarrow/sdk
 
 The generated runtime now fails soft with an explicit warning if the SDK package is missing, so onboarding does not crash a user process.
 
+## Passive Token Value Proof
+
+Token value proof is default-on when the installer writes `.marrow/passive-runtime.mjs`.
+
+In supported Node/TypeScript agents, the SDK passive runtime wraps outbound model-provider `fetch` responses and captures compact `usage` blocks when providers return them. MCP and harness integrations can also attach `model_usage` to `marrow_commit` or call `marrow_model_usage` when the harness exposes usage metadata.
+
+Captured fields are intentionally narrow:
+
+- provider and model
+- input, output, cached, and total token counts
+- optional cost and latency estimates
+- agent, workflow, session, and decision linkage
+- Marrow intervention type, such as `runtime_gate`, `proof_pack`, or `before_you_act`
+
+Marrow does not capture prompt text, completion text, raw tool output, command output, full environment values, or plaintext secrets for token value proof.
+
+Disable capture only when a project requires it:
+
+```bash
+MARROW_PASSIVE_TOKEN_USAGE=false
+```
+
+Day-one behavior:
+
+- Fresh install: `Token usage capture is ready; no model calls have been reported yet.`
+- After observed usage: Marrow reports model calls, total tokens, estimated tokens saved, confidence, trend, and next action.
+- After workflows complete: agents should show the returned `token_value_signal` or value proof in owner updates so users see savings without opening a dashboard.
+
 
 ## Trust and Data Boundaries
 
-Marrow is tenant-aware by design. Private account, fleet, memory, workflow, and proof-pack data stays scoped to the authenticated account and authorized agent-bound keys. Shared/hive learning uses visibility-controlled, sanitized aggregate signals; it is not raw cross-customer decision sharing.
+Marrow is tenant-aware by design. Private account, fleet, workflow, proof-pack, and agent data stays scoped to the authenticated account and authorized agent-bound keys.
+
+Enterprise tenants receive a strong private governance baseline from day one: risk gates, proof requirements, workflow templates, private/account learning, and exact next actions. Teams that enable sanitized aggregate contribution unlock richer k-anonymous collective workflow guidance. Contribution never means raw prompts, decisions, proof packs, code, secrets, account identifiers, agent identifiers, or customer identities.
 
 For business pilots, review the live trust notes before production rollout: https://getmarrow.ai/docs#trust-boundaries
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@getmarrow/install",
-  "version": "0.1.25",
-  "description": "Universal installer for Marrow passive agent setup.",
+  "version": "0.1.27",
+  "description": "Universal installer for Marrow agent governance, proof, and passive control setup.",
   "bin": {
     "marrow-install": "bin/marrow-install.js"
   },
@@ -15,9 +15,10 @@
     "marrow",
     "mcp",
     "installer",
+    "passive-runtime",
     "governance",
-    "runner",
-    "passive-runtime"
+    "proof-packs",
+    "agent-control-plane"
   ],
   "repository": {
     "type": "git",

package/src/governed-runner.js

@@ -45,6 +45,7 @@ Options:
   --fail-closed           If Marrow is unreachable, block the command
   --owner-approved <ref>  Owner approval reference for review-required gates
   --proof-file <path>     JSON proof to include on outcome commit
+  --client <label>        Harness/client label. Defaults to MARROW_CLIENT, MARROW_HARNESS, or MARROW_AGENT_CLIENT
   --base-url <url>        Marrow API base URL
   --key <key>             Marrow API key. Prefer MARROW_API_KEY
   --json                  Print machine-readable result after completion
@@ -77,6 +78,40 @@ function redactedCommand(command) {
   return command.map((part) => shellQuote(redact(part))).join(' ');
 }
 
+function normalizeClientLabel(value) {
+  const raw = String(value || '').trim().toLowerCase();
+  if (!raw) return '';
+  const normalized = raw
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 64);
+  const aliases = {
+    claude: 'claude-code',
+    claude_code: 'claude-code',
+    'cursor-composer': 'composer',
+    'openai-codex': 'codex',
+    openai: 'codex',
+    'gemini-cli': 'gemini',
+    'grok-cli': 'grok',
+    'deepseek-cli': 'deepseek',
+    'qwen-cli': 'qwen',
+    'kimi-cli': 'kimi',
+    'minimax-cli': 'minimax',
+    'glm-cli': 'glm',
+  };
+  return aliases[normalized] || normalized || 'custom';
+}
+
+function sourceClient(value) {
+  return normalizeClientLabel(
+    value
+    || process.env.MARROW_CLIENT
+    || process.env.MARROW_HARNESS
+    || process.env.MARROW_AGENT_CLIENT
+    || '@getmarrow/install',
+  );
+}
+
 function displayText(value, maxLength = 120) {
   const text = redact(String(value || ''))
     .replace(/\u001b\][^\u0007]*(?:\u0007|\u001b\\)/g, '')
@@ -160,13 +195,23 @@ function detectProjectSignals(cwd = process.cwd()) {
   addFile('AGENTS.md', 'agent_instructions');
   addFile('CLAUDE.md', 'agent_instructions');
   addFile('.mcp.json', 'mcp_config');
+  addFile('mcp.json', 'mcp_config');
   addFile('.cursor', 'cursor_project');
+  addFile('.windsurf', 'windsurf_project');
+  addFile('.cline', 'cline_project');
   addFile('hermes.json', 'hermes_config');
   addFile('hermes.yaml', 'hermes_config');
   addFile('hermes.yml', 'hermes_config');
   addFile('.hermes', 'hermes_config');
   addFile('openclaw.json', 'openclaw_config');
   addFile('.openclaw', 'openclaw_config');
+  addFile('.gemini', 'gemini_profile');
+  addFile('.grok', 'grok_profile');
+  addFile('.deepseek', 'deepseek_profile');
+  addFile('.qwen', 'qwen_profile');
+  addFile('.kimi', 'kimi_profile');
+  addFile('.minimax', 'minimax_profile');
+  addFile('.glm', 'glm_profile');
 
   for (const script of packageScripts) {
     if (/\b(deploy|publish|release|migrate|migration|smoke|check|test)\b/i.test(script)) {
@@ -204,6 +249,7 @@ function parseBaseOptions(argv, startIndex = 0) {
     proofFile: '',
     type: '',
     action: '',
+    client: sourceClient(),
     interactive: null,
   };
   let i = startIndex;
@@ -224,6 +270,7 @@ function parseBaseOptions(argv, startIndex = 0) {
       options.failOpen = false;
     } else if (arg === '--owner-approved') options.ownerApproval = argv[++i] || options.ownerApproval;
     else if (arg === '--proof-file') options.proofFile = argv[++i] || options.proofFile;
+    else if (arg === '--client' || arg === '--harness') options.client = sourceClient(argv[++i] || options.client);
     else if (arg === '--base-url') options.baseUrl = argv[++i] || options.baseUrl;
     else if (arg === '--key') {
       options.apiKey = argv[++i] || options.apiKey;
@@ -295,11 +342,28 @@ function headers(options) {
     'Content-Type': 'application/json',
     'X-Marrow-Agent-Id': options.agentId,
     'X-Marrow-Session-Id': options.sessionId,
+    'X-Marrow-Client': sourceClient(options.client),
     'User-Agent': '@getmarrow/install governed-runner',
   };
   return h;
 }
 
+function sourceMeta(options, channel, extra = {}) {
+  const client = sourceClient(options.client);
+  return {
+    channel,
+    client,
+    harness: client,
+    runner: '@getmarrow/install',
+    agent_id: options.agentId,
+    session_id: options.sessionId,
+    profile: options.profile,
+    governed: true,
+    ...(extra.action ? { user_intent: displayText(extra.action, 160) } : {}),
+    ...extra,
+  };
+}
+
 function dataOf(json) {
   return json && typeof json === 'object' && json.data && typeof json.data === 'object' ? json.data : json;
 }
@@ -340,22 +404,26 @@ function defaultProof(input) {
     exit_code: input.exitCode,
     runner: '@getmarrow/install run',
     profile: input.options.profile,
+    source_meta: sourceMeta(input.options, 'proof', { action: input.action }),
     ...(input.options.ownerApproval ? { owner_approval: { approved_by: 'owner', reference: input.options.ownerApproval } } : {}),
     ...proof,
   };
 }
 
 async function preflightRuntime(options, action, type, commandText) {
+  const meta = sourceMeta(options, 'runtime', { action, command: commandText, action_type: type });
   return requestJson(options, 'POST', '/v1/agent/runtime', {
     action,
     type,
     surfaces: inferSurfaces(commandText || action),
+    source_meta: meta,
     context: {
       runner: '@getmarrow/install run',
       profile: options.profile,
       command: commandText,
       policy: options.policy,
       governed: true,
+      source_meta: meta,
     },
   });
 }
@@ -383,6 +451,7 @@ async function recommendGovernanceMode(options, project = detectProjectSignals()
       id: options.agentId,
       role: 'setup',
     },
+    source_meta: sourceMeta(options, 'mode_recommend', { action }),
   });
 }
 
@@ -402,6 +471,7 @@ async function recordGovernanceModeSelection(options, state) {
     },
     selected_mode: selected,
     selection_source: selected === state.recommendation.recommended_mode ? 'accepted' : 'overridden',
+    source_meta: sourceMeta(options, 'mode_selection', { action: 'selected Marrow governance mode for this project' }),
   });
 }
 
@@ -453,13 +523,16 @@ function runChild(command, env = process.env) {
 }
 
 async function createDecision(options, action, type) {
+  const meta = sourceMeta(options, 'think', { action, action_type: type });
   return requestJson(options, 'POST', '/v1/agent/think', {
     action,
     type,
+    source_meta: meta,
     context: {
       runner: '@getmarrow/install run',
       profile: options.profile,
       governed: true,
+      source_meta: meta,
     },
   });
 }
@@ -470,6 +543,7 @@ async function commitOutcome(options, decisionId, success, outcome, proof, gateR
     success,
     outcome,
     proof,
+    source_meta: sourceMeta(options, 'commit', { action: outcome }),
   };
   if (gateReceiptId) body.gate_receipt_id = gateReceiptId;
   return requestJson(options, 'POST', '/v1/agent/commit', body);
@@ -851,14 +925,51 @@ function fleetPanel(snapshot) {
   ].filter(Boolean).join('\n');
 }
 
+const GENERIC_GOVERNED_COMMAND = 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run --agent <agent-id> --profile production --policy warn -- <harness-command>';
+
+function localSupportedHarnesses() {
+  return [
+    { display_name: 'OpenAI Codex', client_label: 'codex', category: 'agent_harness', support_level: 'governed_runner', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run --agent codex-prod -- codex' },
+    { display_name: 'Claude Code', client_label: 'claude-code', category: 'agent_harness', support_level: 'native_mcp_or_sdk', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/mcp setup' },
+    { display_name: 'Cursor', client_label: 'cursor', category: 'ide_agent', support_level: 'native_mcp_or_sdk', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/mcp setup' },
+    { display_name: 'Cursor Composer', client_label: 'composer', category: 'ide_agent', support_level: 'native_mcp_or_sdk', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/mcp setup' },
+    { display_name: 'Windsurf', client_label: 'windsurf', category: 'ide_agent', support_level: 'native_mcp_or_sdk', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/mcp setup' },
+    { display_name: 'Cline', client_label: 'cline', category: 'ide_agent', support_level: 'native_mcp_or_sdk', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/mcp setup' },
+    { display_name: 'OpenCode', client_label: 'opencode', category: 'agent_harness', support_level: 'governed_runner', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run --agent opencode-prod -- opencode' },
+    { display_name: 'Hermes Agent', client_label: 'hermes', category: 'agent_harness', support_level: 'first_class_addon', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install hermes' },
+    { display_name: 'OpenClaw', client_label: 'openclaw', category: 'agent_harness', support_level: 'first_class_addon', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install openclaw' },
+    { display_name: 'Gemini CLI', client_label: 'gemini', category: 'model_cli', support_level: 'governed_runner', install_command: GENERIC_GOVERNED_COMMAND },
+    { display_name: 'Grok CLI', client_label: 'grok', category: 'model_cli', support_level: 'governed_runner', install_command: GENERIC_GOVERNED_COMMAND },
+    { display_name: 'DeepSeek', client_label: 'deepseek', category: 'model_cli', support_level: 'governed_runner', install_command: GENERIC_GOVERNED_COMMAND },
+    { display_name: 'Qwen', client_label: 'qwen', category: 'model_cli', support_level: 'governed_runner', install_command: GENERIC_GOVERNED_COMMAND },
+    { display_name: 'Kimi', client_label: 'kimi', category: 'model_cli', support_level: 'governed_runner', install_command: GENERIC_GOVERNED_COMMAND },
+    { display_name: 'MiniMax', client_label: 'minimax', category: 'model_cli', support_level: 'governed_runner', install_command: GENERIC_GOVERNED_COMMAND },
+    { display_name: 'GLM', client_label: 'glm', category: 'model_cli', support_level: 'governed_runner', install_command: GENERIC_GOVERNED_COMMAND },
+    { display_name: 'MCP-compatible clients', client_label: 'mcp', category: 'mcp_client', support_level: 'native_mcp_or_sdk', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/mcp setup' },
+    { display_name: 'CI scripts and deploy runners', client_label: 'ci', category: 'ci_runner', support_level: 'governed_runner', install_command: 'MARROW_API_KEY=mrw_live_xxx npx @getmarrow/install run --agent ci-release --profile production --policy enforce -- <ci-or-deploy-command>' },
+    { display_name: 'Custom shell/API harness', client_label: 'custom', category: 'custom_runner', support_level: 'event_contract', install_command: 'POST /v1/agent/integrations/events with harness, event_type, agent_id, and action' },
+  ];
+}
+
 function detectHarnesses(cwd = process.cwd()) {
   const candidates = [
     { name: 'Codex', command: 'codex', detected: fs.existsSync(path.join(cwd, 'AGENTS.md')) || fs.existsSync(path.join(os.homedir(), '.codex')) },
     { name: 'Claude Code', command: 'claude -p', detected: fs.existsSync(path.join(cwd, 'CLAUDE.md')) || fs.existsSync(path.join(os.homedir(), '.claude.json')) },
     { name: 'Cursor', command: 'cursor', detected: fs.existsSync(path.join(cwd, '.cursor')) || fs.existsSync(path.join(os.homedir(), '.cursor')) },
+    { name: 'Cursor Composer', command: 'cursor composer', detected: fs.existsSync(path.join(cwd, '.cursor')) || fs.existsSync(path.join(os.homedir(), '.cursor')) },
+    { name: 'Windsurf', command: 'windsurf', detected: fs.existsSync(path.join(cwd, '.windsurf')) || fs.existsSync(path.join(os.homedir(), '.windsurf')) },
+    { name: 'Cline', command: 'cline', detected: fs.existsSync(path.join(cwd, '.cline')) || fs.existsSync(path.join(cwd, '.vscode')) },
     { name: 'OpenCode', command: 'opencode', detected: fs.existsSync(path.join(cwd, 'opencode.json')) || fs.existsSync(path.join(os.homedir(), '.opencode')) },
     { name: 'Hermes Agent', command: 'hermes', detected: fs.existsSync(path.join(cwd, 'hermes.json')) || fs.existsSync(path.join(cwd, '.hermes')) || fs.existsSync(path.join(os.homedir(), '.hermes')) || fs.existsSync(path.join(os.homedir(), '.hermes-agent')) },
     { name: 'OpenClaw', command: 'openclaw agent', detected: fs.existsSync(path.join(os.homedir(), '.openclaw')) },
+    { name: 'Gemini CLI', command: 'gemini', detected: fs.existsSync(path.join(cwd, '.gemini')) || fs.existsSync(path.join(os.homedir(), '.gemini')) },
+    { name: 'Grok CLI', command: 'grok', detected: fs.existsSync(path.join(cwd, '.grok')) || fs.existsSync(path.join(os.homedir(), '.grok')) },
+    { name: 'DeepSeek', command: 'deepseek', detected: fs.existsSync(path.join(cwd, '.deepseek')) || fs.existsSync(path.join(os.homedir(), '.deepseek')) },
+    { name: 'Qwen', command: 'qwen', detected: fs.existsSync(path.join(cwd, '.qwen')) || fs.existsSync(path.join(os.homedir(), '.qwen')) },
+    { name: 'Kimi', command: 'kimi', detected: fs.existsSync(path.join(cwd, '.kimi')) || fs.existsSync(path.join(os.homedir(), '.kimi')) },
+    { name: 'MiniMax', command: 'minimax', detected: fs.existsSync(path.join(cwd, '.minimax')) || fs.existsSync(path.join(os.homedir(), '.minimax')) },
+    { name: 'GLM', command: 'glm', detected: fs.existsSync(path.join(cwd, '.glm')) || fs.existsSync(path.join(os.homedir(), '.glm')) },
+    { name: 'MCP-compatible client', command: 'mcp client', detected: fs.existsSync(path.join(cwd, '.mcp.json')) || fs.existsSync(path.join(cwd, 'mcp.json')) },
     { name: 'CI script', command: 'npm test', detected: fs.existsSync(path.join(cwd, 'package.json')) },
     { name: 'Custom command', command: '<your-agent-command>', detected: true },
   ];
@@ -970,9 +1081,10 @@ async function integrationOnly(parsed, name) {
 
 async function integrationsOnly(parsed) {
   const local = {
-    integration_registry_version: 'local.harness-addons-v1',
-    supported_harnesses: ['hermes', 'openclaw'].map((name) => localIntegrationManifest(name)),
-    exact_next_action: 'Run npx @getmarrow/install hermes or npx @getmarrow/install openclaw for a harness-specific setup path.',
+    integration_registry_version: 'local.broad-harness-support-v2',
+    first_class_addons: ['hermes', 'openclaw'].map((name) => localIntegrationManifest(name)),
+    supported_harnesses: localSupportedHarnesses(),
+    exact_next_action: 'Pick the harness your team already uses. Use the install_command shown here, or send compact events to /v1/agent/integrations/events.',
   };
   let registry = local;
   let source = 'local';
@@ -990,9 +1102,10 @@ async function integrationsOnly(parsed) {
     'Marrow Harness Integrations',
     '',
     `Source: ${source}`,
-    'Supported add-ons:',
-    ...harnesses.map((harness) => `  - ${displayText(harness.client_label || harness.integration || harness.title, 40)}  ${displayText(harness.install_command || harness.install_commands?.[0] || '', 120)}`),
+    'Supported harnesses and model CLIs:',
+    ...harnesses.map((harness) => `  - ${displayText(harness.display_name || harness.client_label || harness.integration || harness.title, 40)} [${displayText(harness.support_level || 'supported', 24)}]  ${displayText(harness.install_command || harness.install_commands?.[0] || '', 120)}`),
     '',
+    'First-class add-on guides: hermes, openclaw',
     `Next: ${displayText(registry.exact_next_action, 140)}`,
     registry.api_warning ? `API warning: ${displayText(registry.api_warning, 120)}` : '',
   ].filter(Boolean).join('\n') + '\n');
@@ -1622,6 +1735,10 @@ module.exports = {
   parseArgs,
   redact,
   redactedCommand,
+  normalizeClientLabel,
+  sourceClient,
+  sourceMeta,
+  headers,
   inferType,
   inferSurfaces,
   commandForSelection,
@@ -1648,6 +1765,7 @@ module.exports = {
   buildFleetState,
   renderFleetTui,
   runFleetInteractive,
+  localSupportedHarnesses,
   localIntegrationManifest,
   renderIntegrationPanel,
   integrationOnly,

package/src/installer.js

@@ -6,6 +6,35 @@ const crypto = require('node:crypto');
 const DEFAULT_BASE_URL = 'https://api.getmarrow.ai';
 const MARROW_BLOCK_START = '<!-- marrow:passive-start -->';
 const MARROW_BLOCK_END = '<!-- marrow:passive-end -->';
+const SOURCE_CLIENTS = new Set(['claude-code', 'cursor', 'windsurf', 'openclaw', 'codex', 'gemini', 'grok', 'deepseek', 'qwen', 'kimi', 'minimax', 'cline', 'opencode', 'hermes', 'glm', 'custom', 'unknown']);
+
+function sourceClient() {
+  const raw = String(process.env.MARROW_CLIENT || process.env.MARROW_HARNESS || process.env.MARROW_AGENT_CLIENT || '').trim().toLowerCase().replace(/\s+/g, '-').replace(/^@/, '');
+  const aliases = {
+    claude: 'claude-code',
+    claude_code: 'claude-code',
+    'claude-code': 'claude-code',
+    cursor: 'cursor',
+    windsurf: 'windsurf',
+    openclaw: 'openclaw',
+    codex: 'codex',
+    'openai-codex': 'codex',
+    gemini: 'gemini',
+    google: 'gemini',
+    grok: 'grok',
+    deepseek: 'deepseek',
+    qwen: 'qwen',
+    kimi: 'kimi',
+    minimax: 'minimax',
+    cline: 'cline',
+    opencode: 'opencode',
+    'open-code': 'opencode',
+    hermes: 'hermes',
+    'hermes-agent': 'hermes',
+    glm: 'glm',
+  };
+  return aliases[raw] || (SOURCE_CLIENTS.has(raw) ? raw : 'custom');
+}
 
 function parseArgs(argv) {
   const options = {
@@ -105,12 +134,6 @@ function findUp(startDir, names, maxDepth = 8) {
 }
 
 function projectRoot(startDir) {
-  const resolved = path.resolve(startDir);
-  if (path.basename(resolved) === '.marrow') return path.dirname(resolved);
-  if (path.basename(resolved) === 'env' && path.basename(path.dirname(resolved)) === '.marrow') {
-    return path.dirname(path.dirname(resolved));
-  }
-  if (exists(path.join(resolved, '.marrow'))) return resolved;
   const marker = findUp(startDir, ['package.json', 'pyproject.toml', 'requirements.txt', '.git', 'AGENTS.md', 'CLAUDE.md']);
   return marker ? path.dirname(marker) : path.resolve(startDir);
 }
@@ -289,14 +312,16 @@ Marrow should run passively after install:
 
 - Use MCP hooks when available: \`npx -y @getmarrow/mcp setup\`.
 - Use SDK passive runtime in owned Node processes: \`createPassiveRuntime().install()\`.
-- Before risky work, use Marrow's before-action intervention from \`GET /v1/agent/status\` or \`POST /v1/agent/runtime\`.
+- Keep passive token/model usage proof enabled so Marrow can show token, cost, latency, and workflow savings after real work completes.
+- Before risky work, use Marrow's decision brief or passive prompt hook.
 - After meaningful work, record the outcome so future agents learn from it.
 - Check health with \`marrow_agent_status\` or \`GET /v1/agent/status\`.
 
 Required environment:
 
 - \`MARROW_API_KEY\`
-- Optional: \`MARROW_BASE_URL\`, \`MARROW_FLEET_AGENT_ID\`
+- Optional: \`MARROW_BASE_URL\`, \`MARROW_FLEET_AGENT_ID\`, \`MARROW_CLIENT\`
+- Optional: \`MARROW_PASSIVE_TOKEN_USAGE=false\` disables compact provider usage capture when needed.
 ${MARROW_BLOCK_END}`;
 }
 
@@ -318,6 +343,7 @@ if (apiKey && !globalThis.__MARROW_PASSIVE_RUNTIME__) {
       useAgentRuntime: process.env.MARROW_AGENT_RUNTIME !== 'false',
       useWorkflowGate: process.env.MARROW_WORKFLOW_GATE !== 'false',
       requireOutcomeClosure: process.env.MARROW_REQUIRE_OUTCOME_CLOSURE !== 'false',
+      captureModelUsage: process.env.MARROW_PASSIVE_TOKEN_USAGE !== 'false',
     });
 
     runtime.install();
@@ -333,12 +359,14 @@ function envExample() {
   return `MARROW_API_KEY=mrw_live_replace_me
 MARROW_BASE_URL=${DEFAULT_BASE_URL}
 MARROW_FLEET_AGENT_ID=agent-or-fleet-id
+MARROW_CLIENT=codex
 MARROW_ENFORCEMENT_MODE=auto
 MARROW_PASSIVE_BRIEF=auto
 MARROW_PASSIVE_VALUE_REPORT=true
 MARROW_AGENT_RUNTIME=true
 MARROW_WORKFLOW_GATE=true
 MARROW_REQUIRE_OUTCOME_CLOSURE=true
+MARROW_PASSIVE_TOKEN_USAGE=true
 `;
 }
 
@@ -567,6 +595,7 @@ async function runSelfTest(options) {
     authorization: `Bearer ${options.apiKey}`,
     'content-type': 'application/json',
     'x-marrow-session-id': `install-${Date.now()}`,
+    'x-marrow-client': sourceClient(),
   };
   if (options.agentId) headers['x-marrow-agent-id'] = options.agentId;
 
@@ -577,6 +606,11 @@ async function runSelfTest(options) {
     body: JSON.stringify({
       type: 'process',
       action: 'Marrow passive install self-test: verify SDK/MCP hooks can record a harmless setup event',
+      source_meta: {
+        channel: 'cli',
+        client: sourceClient(),
+        user_intent: 'operate',
+      },
     }),
   });
 
@@ -633,8 +667,14 @@ async function runSelfTest(options) {
     ok: false,
     error: error instanceof Error ? error.message : String(error),
   }));
-  const firstValueSignal = buildFirstValueSignal(status, runtime, performance, firstValue);
-  const installValueMoment = buildInstallValueMoment(firstValueSignal, status, runtime, performance, firstValue);
+  const valueProof = await requestJson(`${baseUrl}/v1/agent/value/proof?period_days=30`, { headers })
+    .catch((error) => ({
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+    }));
+  const tokenValueProof = buildTokenValueProof(valueProof);
+  const firstValueSignal = buildFirstValueSignal(status, runtime, performance, firstValue, tokenValueProof);
+  const installValueMoment = buildInstallValueMoment(firstValueSignal, status, runtime, performance, firstValue, tokenValueProof);
   return {
     skipped: false,
     decision_id: decisionId,
@@ -646,11 +686,11 @@ async function runSelfTest(options) {
     auto_outcome_closure: status.auto_outcome_closure || null,
     runtime_active: Boolean(runtime && runtime.ok !== false),
     runtime_exact_next_action: runtime.exact_next_action || null,
-    runtime_before_you_act: runtime.intervention?.agent_copy || runtime.intervention?.before_action || runtime.before_you_act || null,
-    runtime_intervention: runtime.intervention || null,
+    runtime_before_you_act: runtime.before_you_act || null,
     first_value: firstValue && firstValue.ok !== false ? firstValue : null,
     first_value_signal: firstValueSignal,
     install_value_moment: installValueMoment,
+    token_value_proof: tokenValueProof,
     performance_proof: performance && performance.ok !== false ? {
       avoided_mistakes: performance.avoided_mistakes ?? performance.avoided_repeated_mistakes ?? 0,
       reused_winning_decisions: performance.reused_winning_decisions ?? 0,
@@ -662,11 +702,30 @@ async function runSelfTest(options) {
   };
 }
 
-function buildInstallValueMoment(firstValueSignal = {}, status = {}, runtime = {}, performance = {}, firstValue = {}) {
+function buildTokenValueProof(valueProof = {}) {
+  const modelUsage = valueProof && valueProof.ok !== false
+    ? valueProof.model_usage || valueProof.token_value_signal || valueProof
+    : null;
+  if (!modelUsage || typeof modelUsage !== 'object') {
+    return {
+      enabled: true,
+      capture_default: 'on_when_sdk_mcp_or_installer_hooks_available',
+      observed: { model_calls: 0, tokens: { total: 0 } },
+      savings: { estimated_tokens_saved: 0, estimated_minutes_saved: 0, confidence: 'none', method: 'warming_up' },
+      proof_line: 'Token usage capture is ready; no model calls have been reported yet.',
+      exact_next_action: 'Keep passive token capture enabled so Marrow can attach usage proof after real model calls complete.',
+    };
+  }
+  return modelUsage;
+}
+
+function buildInstallValueMoment(firstValueSignal = {}, status = {}, runtime = {}, performance = {}, firstValue = {}, tokenValueProof = null) {
   if (firstValue && firstValue.ok !== false && firstValue.first_value) {
+    const proof = Array.isArray(firstValue.first_value.proof) ? [...firstValue.first_value.proof] : [];
+    if (tokenValueProof?.proof_line && !proof.includes(tokenValueProof.proof_line)) proof.push(tokenValueProof.proof_line);
     return {
       headline: firstValue.headline || firstValue.first_value.headline || 'Your agent is no longer starting from zero.',
-      proof: Array.isArray(firstValue.first_value.proof) ? firstValue.first_value.proof : [],
+      proof,
       fleet_signal: firstValue.history_signal?.summary || 'Fresh account: Marrow will build fleet memory from this first captured outcome.',
       try_this_now: firstValue.first_value.try_this_now || 'Ask your agent: "I am about to deploy to production. What should I check first?"',
       expected_response: firstValue.first_value.expected_response || 'Marrow should answer with a risk gate, required proof, and any matching fleet lessons before the agent acts.',
@@ -676,9 +735,7 @@ function buildInstallValueMoment(firstValueSignal = {}, status = {}, runtime = {
 
   const proof = firstValueSignal.value_proof || [];
   const hasFleetSignal = proof.length > 0;
-  const runtimeLesson = runtime.intervention?.agent_copy
-    || runtime.intervention?.before_action
-    || runtime.before_you_act
+  const runtimeLesson = runtime.before_you_act
     || runtime.before_you_act_injection?.message
     || runtime.exact_next_action
     || firstValueSignal.first_lesson;
@@ -689,18 +746,19 @@ function buildInstallValueMoment(firstValueSignal = {}, status = {}, runtime = {
       'Captured this setup decision',
       'Closed the outcome successfully',
       'Runtime gate is ' + (firstValueSignal.active ? 'active' : 'installed'),
-      runtime.intervention?.must_use_before_action ? 'Before-action intervention is active for risky work' : runtimeLesson ? 'Future risky work now gets a pre-action brief' : 'Future risky work now gets checked before action',
+      runtimeLesson ? 'Future risky work now gets a pre-action brief' : 'Future risky work now gets checked before action',
+      tokenValueProof?.proof_line || 'Token usage proof is active and warming up after the first model call',
     ],
     fleet_signal: hasFleetSignal
       ? 'Marrow already found signal: ' + proof.join('; ') + '.'
       : 'Fresh account: Marrow will start building fleet memory from this first captured outcome.',
     try_this_now: 'Ask your agent: "I am about to deploy to production. What should I check first?"',
-    expected_response: 'Marrow should answer with proceed/warn/block, required proof, and any matching prior lesson/playbook before the agent acts.',
-    first_lesson: runtimeLesson || 'Marrow will stop agents before risky or repeated work and surface the prior lesson/playbook.',
+    expected_response: 'Marrow should answer with a risk gate, required proof, and any matching fleet lessons before the agent acts.',
+    first_lesson: runtimeLesson || 'Marrow will surface prior lessons before risky or repeated work.',
   };
 }
 
-function buildFirstValueSignal(status, runtime, performance, firstValue = {}) {
+function buildFirstValueSignal(status, runtime, performance, firstValue = {}, tokenValueProof = null) {
   if (firstValue && firstValue.ok !== false && firstValue.first_value) {
     const capture = firstValue.capture || {};
     const proof = firstValue.value_proof || {};
@@ -709,11 +767,13 @@ function buildFirstValueSignal(status, runtime, performance, firstValue = {}) {
     if (Number(proof.reused_winning_decisions || 0) > 0) proofBits.push(`${proof.reused_winning_decisions} reused winning decision(s)`);
     if (Number(proof.prevented_bad_actions || 0) > 0) proofBits.push(`${proof.prevented_bad_actions} prevented risky action(s)`);
     if (Number(proof.estimated_tokens_saved || 0) > 0) proofBits.push(`~${proof.estimated_tokens_saved} tokens saved`);
+    if (Number(tokenValueProof?.savings?.estimated_tokens_saved || 0) > 0) proofBits.push(`~${tokenValueProof.savings.estimated_tokens_saved} measured model tokens saved`);
+    else if (tokenValueProof?.proof_line) proofBits.push(tokenValueProof.proof_line);
     return {
       active: Boolean(firstValue.active),
       headline: `Marrow active: ${(capture.surfaces || ['decisions']).join(', ')} captured.`,
       captured: capture.surfaces || ['decisions'],
-      first_lesson: firstValue.first_value.first_lesson || runtime?.intervention?.agent_copy,
+      first_lesson: firstValue.first_value.first_lesson,
       value_proof: proofBits,
       next_action: firstValue.next_action?.reason || 'Keep working; Marrow will capture outcomes and reuse lessons automatically.',
     };
@@ -736,6 +796,8 @@ function buildFirstValueSignal(status, runtime, performance, firstValue = {}) {
   if (Number(proof.prevented_bad_actions || 0) > 0) proofBits.push(`${proof.prevented_bad_actions} prevented risky action(s)`);
   const tokens = proof.token_time_saved_estimate?.estimated_tokens_saved || 0;
   if (tokens > 0) proofBits.push(`~${tokens} tokens saved`);
+  if (Number(tokenValueProof?.savings?.estimated_tokens_saved || 0) > 0) proofBits.push(`~${tokenValueProof.savings.estimated_tokens_saved} measured model tokens saved`);
+  else if (tokenValueProof?.proof_line) proofBits.push(tokenValueProof.proof_line);
 
   const firstLesson = runtime.before_you_act
     || runtime.before_you_act_injection?.message
@@ -799,6 +861,20 @@ function printReport(report) {
         process.stdout.write(`- Next: ${report.selfTest.first_value_signal.next_action}\n`);
       }
     }
+    if (report.selfTest.token_value_proof) {
+      const proof = report.selfTest.token_value_proof;
+      const observed = proof.observed || {};
+      const savings = proof.savings || {};
+      const tokens = observed.tokens || {};
+      process.stdout.write('\nToken value proof:\n');
+      process.stdout.write(`- passive capture: ${proof.enabled ? 'on' : 'unknown'}\n`);
+      process.stdout.write(`- model calls observed: ${observed.model_calls || 0}\n`);
+      process.stdout.write(`- tokens observed: ${tokens.total || 0}\n`);
+      process.stdout.write(`- estimated tokens saved: ${savings.estimated_tokens_saved || 0}\n`);
+      if (savings.confidence) process.stdout.write(`- confidence: ${savings.confidence}\n`);
+      if (proof.proof_line) process.stdout.write(`- proof: ${proof.proof_line}\n`);
+      if (proof.exact_next_action) process.stdout.write(`- next: ${proof.exact_next_action}\n`);
+    }
   }
 
   if (report.remediation) {
@@ -949,4 +1025,5 @@ module.exports = {
   inspectNpmTokenConfig,
   inspectSdkDependency,
   buildInstallValueMoment,
+  buildTokenValueProof,
 };