@mnemom/mnemom 0.16.2 → 0.16.3

package/README.md

@@ -43,6 +43,7 @@ That's it. `mnemom init` detects your configured AI provider API keys (Anthropic
 | `mnemom card show`            | Display active alignment card                        |
 | `mnemom card publish <file>`  | Publish alignment card from JSON file                |
 | `mnemom card validate <file>` | Validate card JSON locally                           |
+| `mnemom usage --org <id>`     | Show per-person token and request consumption        |
 
 ## How It Works
 

package/dist/commands/agents.d.ts

@@ -35,3 +35,17 @@ export declare function deriveHashProof(apiKey: string, agentName?: string): str
  * listing your claimable orgs.
  */
 export declare function agentsClaimCommand(idOrName: string, options?: AgentsClaimOptions): Promise<void>;
+export interface AgentsMoveOptions {
+    /** Destination org slug or id — REQUIRED and always explicit (a move is an
+     * administrative action; it deliberately does NOT default to the active org). */
+    to?: string;
+    json?: boolean;
+}
+/**
+ * `mnemom agents move <id-or-name> --to <slug|id>`
+ *
+ * Role-based relocation between orgs (the counterpart to re-claim, which is
+ * possession-based). The server requires the caller to be an owner/admin of
+ * BOTH the agent's current org and the destination — no agent key involved.
+ */
+export declare function agentsMoveCommand(idOrName: string, options?: AgentsMoveOptions): Promise<void>;

package/dist/commands/agents.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
-import { listAgents, listOrgAgents, listMyOrgs, getAgent, getAgentByName, claimAgent, MnemomApiError, } from "../lib/api.js";
+import { listAgents, listOrgAgents, listMyOrgs, getAgent, getAgentByName, claimAgent, moveAgent, MnemomApiError, } from "../lib/api.js";
 import { requireAuth } from "../lib/auth.js";
+import { getActiveOrg } from "../lib/cli-config.js";
 import { fmt } from "../lib/format.js";
 export async function agentsListCommand(options = {}) {
     const cred = await requireAuth();
@@ -182,7 +183,11 @@ export async function agentsClaimCommand(idOrName, options = {}) {
         process.exit(1);
         return;
     }
-    // 3. Resolve --org slug → org_id (omit → server default / personal org).
+    // 3. Resolve the destination org. Precedence: explicit --org > the active
+    //    org (`mnemom org use`, lib/cli-config.ts) > server default (personal
+    //    org) — the last LOUDLY, because login binds no org and a silent
+    //    personal-org default is the classic "why is my agent in Personal?"
+    //    footgun.
     let orgId;
     let orgs = [];
     if (options.org) {
@@ -205,6 +210,24 @@ export async function agentsClaimCommand(idOrName, options = {}) {
             return;
         }
     }
+    else {
+        const active = getActiveOrg();
+        if (active) {
+            // Send the stored org_id directly (validated at `org use` time); if
+            // membership has since changed the server 403s with the teaching list.
+            orgId = active.org_id;
+            // stderr, and skipped in --json mode: stdout stays machine-readable.
+            if (!options.json) {
+                console.error(fmt.dim(`  Using active org ${active.name} (${active.slug}).`) + "\n");
+            }
+        }
+        else if (!options.json) {
+            console.error(fmt.warn("No --org and no active org set — this agent will land in your PERSONAL org.") +
+                "\n" +
+                fmt.dim("  Set a default with `mnemom org use <slug>`, or pass --org <slug> (see: mnemom org list).") +
+                "\n");
+        }
+    }
     // 4. Claim.
     let result;
     try {
@@ -311,3 +334,78 @@ export async function agentsClaimCommand(idOrName, options = {}) {
     }
     console.log();
 }
+/**
+ * `mnemom agents move <id-or-name> --to <slug|id>`
+ *
+ * Role-based relocation between orgs (the counterpart to re-claim, which is
+ * possession-based). The server requires the caller to be an owner/admin of
+ * BOTH the agent's current org and the destination — no agent key involved.
+ */
+export async function agentsMoveCommand(idOrName, options = {}) {
+    await requireAuth();
+    if (!options.to) {
+        console.log(fmt.error("--to <org-slug-or-id> is required.") + "\n");
+        console.log(fmt.dim("  A move is explicit by design — it never defaults to the active org. See: mnemom org list") + "\n");
+        process.exit(1);
+        return;
+    }
+    // Resolve the agent. Moves act on agents already in your fleet, so a
+    // name-shaped arg resolves through the fleet like `agents list` sees it.
+    let agentId = idOrName;
+    if (!AGENT_ID_RE.test(idOrName)) {
+        const found = await getAgentByName(idOrName).catch(() => null);
+        if (!found) {
+            console.log(fmt.error(`Could not resolve '${idOrName}' to an agent in your fleet.`) + "\n");
+            process.exit(1);
+            return;
+        }
+        agentId = found.id;
+    }
+    // Resolve --to against the caller's memberships (teaching error otherwise).
+    let orgs;
+    try {
+        orgs = await listMyOrgs();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to read your orgs: ${msg}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    let destOrgId;
+    try {
+        destOrgId = resolveOrgId(options.to, orgs);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(msg) + "\n");
+        process.exit(1);
+        return;
+    }
+    try {
+        const result = await moveAgent(agentId, destOrgId);
+        if (options.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (!result.moved) {
+            console.log(fmt.warn(`Agent ${agentId} is already in ${options.to} — nothing to do.`) + "\n");
+            return;
+        }
+        console.log(fmt.success(`Moved ${agentId}.`));
+        console.log(fmt.label("  From:", result.from_org_id ?? "(unknown)"));
+        console.log(fmt.label("  To:  ", result.to_org_id ?? destOrgId));
+        console.log(fmt.dim("  Note: the destination org's template can floor/cap the agent's composed card — its effective posture may have changed.") + "\n");
+    }
+    catch (err) {
+        if (err instanceof MnemomApiError && err.effectiveStatus === 403) {
+            console.log(fmt.error("Move denied: you must be an owner/admin of BOTH the agent's current org and the destination org.") + "\n");
+            console.log(fmt.dim("  Check your roles with `mnemom org list`. If you hold the agent's key instead, re-claim can move it: mnemom agents claim <id> --org <slug> --key <key>.") + "\n");
+            process.exit(1);
+            return;
+        }
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Move failed: ${msg}`) + "\n");
+        process.exit(1);
+    }
+}

package/dist/commands/card.d.ts

@@ -33,6 +33,49 @@ export declare function cardValidateCommand(file: string, opts?: {
     offline?: boolean;
     agent?: string;
 }): Promise<void>;
+/**
+ * Strip system-managed / server-derived keys from a fetched card so it can be
+ * round-tripped back into a PUT.
+ *
+ * `card edit`/`card evaluate` read the server-COMPOSED card, which the composer
+ * decorates with system-managed fields (today: `_composition`). The
+ * inbound-card validator REJECTS those on write ("System-managed field — cannot
+ * be set on inbound cards"), so re-PUTting the composed card verbatim is refused
+ * and the edit never persists (MNE-1726). Edit the *inbound* projection, not the
+ * *composed* one.
+ *
+ * Convention: every system-managed key is `_`-prefixed. We strip by prefix (not
+ * by an explicit `_composition` allowlist) so future server-added `_`-fields
+ * round-trip safely too — the forward-compat lesson from MNE-908, where editors
+ * fought the composer over fields the user never authored.
+ */
+export declare function stripSystemManagedFields(card: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Reconcile the ADR-039 unmapped-tool vocabulary with the embedded policy
+ * engine, at the CLI's own validator↔engine boundary.
+ *
+ * The card validator MANDATES the ADR-039 fields
+ * (`enforcement.allow_unmapped_tools` + `enforcement.default_unmapped_severity`)
+ * and REJECTS the legacy `enforcement.unmapped_tool_action`. But the embedded
+ * `@mnemom/policy-engine` still derives its policy from that legacy field, so a
+ * validator-passing card leaves the engine at its `allow` default: `evaluate`
+ * never warns/denies on an unmapped tool, even under `--strict` (MNE-1727). The
+ * two field vocabularies never met.
+ *
+ * Project the ADR-039 fields onto the legacy action the engine reads. Severity
+ * selects the verdict tier the operator declared:
+ *
+ *   allow_unmapped_tools=true                          → allow  (PASS)
+ *   allow_unmapped_tools=false + severity high|critical → deny   (FAIL, always non-zero)
+ *   allow_unmapped_tools=false + severity medium|low    → warn   (WARN, non-zero under --strict)
+ *   allow_unmapped_tools=false + severity unset         → deny   (fail-closed default)
+ *   allow_unmapped_tools unset                          → card returned untouched
+ *
+ * Returns a shallow clone (the user's card is never mutated); called AFTER
+ * validation, so the legacy field is only ever seen by the engine, never
+ * re-emitted onto an inbound card.
+ */
+export declare function bridgeUnmappedToolPolicy(card: Record<string, unknown>): Record<string, unknown>;
 export declare function cardEditCommand(agentName?: string, options?: {
     idempotencyKey?: string;
 }): Promise<void>;

package/dist/commands/card.js

@@ -552,6 +552,43 @@ export function validateUnifiedCard(card) {
 /** @deprecated Use validateUnifiedCard instead */
 export const validateCardJson = (raw) => validateUnifiedCard(JSON.parse(raw));
 // ============================================================================
+// Private helpers
+// ============================================================================
+function exitWithError(msg) {
+    console.log("\n" + fmt.error(msg) + "\n");
+    process.exit(1);
+    return undefined; // unreachable; satisfies `never` when process lacks type declarations
+}
+function loadCard(file, noun = "File") {
+    const filePath = path.resolve(file);
+    if (!fs.existsSync(filePath)) {
+        exitWithError(`${noun} not found: ${filePath}`);
+    }
+    try {
+        return parseCardFile(filePath);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        exitWithError(`Could not parse ${noun.toLowerCase()}: ${msg}`);
+    }
+}
+function printChecks(checks) {
+    for (const check of checks) {
+        if (check.passed) {
+            console.log(fmt.success(`${check.name}: ${check.message}`));
+        }
+        else {
+            console.log(fmt.error(`${check.name}: ${check.message}`));
+        }
+    }
+}
+function checkCardBytes(body) {
+    const bodyBytes = Buffer.byteLength(body, "utf-8");
+    if (bodyBytes > ALIGNMENT_CARD_MAX_BYTES) {
+        exitWithError(`Alignment card is ${bodyBytes} bytes; limit is ${ALIGNMENT_CARD_MAX_BYTES} bytes (128 KB). The API will return 413.`);
+    }
+}
+// ============================================================================
 // Subcommands
 // ============================================================================
 export async function cardShowCommand(agentName) {
@@ -581,42 +618,20 @@ export async function cardShowCommand(agentName) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        console.log("\n" + fmt.error(`Failed to fetch card: ${message}`) + "\n");
-        process.exit(1);
+        exitWithError(`Failed to fetch card: ${message}`);
     }
 }
 export async function cardPublishCommand(file, agentName, options = {}) {
     const agentId = await resolveAgentId(agentName);
-    // Resolve file path
-    const filePath = path.resolve(file);
-    if (!fs.existsSync(filePath)) {
-        console.log("\n" + fmt.error(`File not found: ${filePath}`) + "\n");
-        process.exit(1);
-    }
     // Parse file (JSON or YAML)
-    let parsed;
-    try {
-        parsed = parseCardFile(filePath);
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        console.log("\n" + fmt.error(`Could not parse file: ${msg}`) + "\n");
-        process.exit(1);
-    }
+    const parsed = loadCard(file);
     // Validate locally
     const checks = validateUnifiedCard(parsed.parsed);
     const allPassed = checks.every((c) => c.passed);
     console.log(fmt.header("Card Validation"));
     console.log(fmt.label("  Format:", ` ${parsed.format.toUpperCase()}`));
     console.log();
-    for (const check of checks) {
-        if (check.passed) {
-            console.log(fmt.success(`${check.name}: ${check.message}`));
-        }
-        else {
-            console.log(fmt.error(`${check.name}: ${check.message}`));
-        }
-    }
+    printChecks(checks);
     console.log();
     if (!allPassed) {
         console.log(fmt.error("Validation failed. Fix the errors above before publishing.") + "\n");
@@ -637,13 +652,7 @@ export async function cardPublishCommand(file, agentName, options = {}) {
         console.log("\nPublishing alignment card...");
         const contentType = parsed.format === "yaml" ? "text/yaml" : "application/json";
         const body = parsed.format === "yaml" ? parsed.raw : JSON.stringify(parsed.parsed);
-        const bodyBytes = Buffer.byteLength(body, "utf-8");
-        if (bodyBytes > ALIGNMENT_CARD_MAX_BYTES) {
-            console.log("\n" +
-                fmt.error(`Alignment card is ${bodyBytes} bytes; limit is ${ALIGNMENT_CARD_MAX_BYTES} bytes (128 KB). The API will return 413.`) +
-                "\n");
-            process.exit(1);
-        }
+        checkCardBytes(body);
         const result = await putAlignmentCard(agentId, body, contentType, {
             idempotencyKey: options.idempotencyKey,
         });
@@ -656,22 +665,19 @@ export async function cardPublishCommand(file, agentName, options = {}) {
     catch (error) {
         if (error instanceof MnemomApiError) {
             if (error.effectiveStatus === 404) {
-                console.log("\n" +
-                    fmt.error("Agent found but not writable: you can see this agent locally, but cannot publish to it in its current organization context.") +
-                    "\n");
+                exitWithError("Agent found but not writable: you can see this agent locally, but cannot publish to it in its current organization context.");
             }
             else if (error.effectiveStatus === 401) {
-                console.log("\n" + fmt.error(`Authentication failed: ${error.message}`) + "\n");
+                exitWithError(`Authentication failed: ${error.message}`);
             }
             else {
-                console.log("\n" + fmt.error(`Failed to publish card: ${error.message}`) + "\n");
+                exitWithError(`Failed to publish card: ${error.message}`);
             }
         }
         else {
             const message = error instanceof Error ? error.message : String(error);
-            console.log("\n" + fmt.error(`Failed to publish card: ${message}`) + "\n");
+            exitWithError(`Failed to publish card: ${message}`);
         }
-        process.exit(1);
     }
 }
 const AGENT_ID_RE = /^(smolt-[0-9a-f]{8}|mnm-[0-9a-f-]{36})$/;
@@ -695,22 +701,9 @@ async function softResolveAgentId(agent) {
     }
 }
 export async function cardValidateCommand(file, opts = {}) {
-    // Resolve file path
-    const filePath = path.resolve(file);
-    if (!fs.existsSync(filePath)) {
-        console.log("\n" + fmt.error(`File not found: ${filePath}`) + "\n");
-        process.exit(1);
-    }
     // Parse file (JSON or YAML)
-    let parsed;
-    try {
-        parsed = parseCardFile(filePath);
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        console.log("\n" + fmt.error(`Could not parse file: ${msg}`) + "\n");
-        process.exit(1);
-    }
+    const filePath = path.resolve(file);
+    const parsed = loadCard(file);
     // Prefer server-authoritative validation (composes against the agent's
     // org/platform floor — catches conflicts the offline validator cannot) when
     // online + an agent is available. Fall back to the local validator on
@@ -727,8 +720,7 @@ export async function cardValidateCommand(file, opts = {}) {
             catch (err) {
                 if (err instanceof MnemomApiError && err.status !== 401) {
                     // 403 / 5xx — a genuine server error, not the offline-fallback case.
-                    console.log("\n" + fmt.error(`Server validation failed: ${err.message}`) + "\n");
-                    process.exit(1);
+                    exitWithError(`Server validation failed: ${err.message}`);
                 }
                 // 401 or network error → fall through to offline validation.
                 process.stderr.write(fmt.warn("offline validation — server rules may differ") + "\n");
@@ -749,14 +741,7 @@ export async function cardValidateCommand(file, opts = {}) {
     console.log(fmt.label("  File:", ` ${filePath}`));
     console.log(fmt.label("  Format:", ` ${parsed.format.toUpperCase()}`));
     console.log();
-    for (const check of checks) {
-        if (check.passed) {
-            console.log(fmt.success(`${check.name}: ${check.message}`));
-        }
-        else {
-            console.log(fmt.error(`${check.name}: ${check.message}`));
-        }
-    }
+    printChecks(checks);
     console.log();
     if (allPassed) {
         console.log(fmt.success(`All ${passCount} checks passed`) + "\n");
@@ -798,6 +783,76 @@ function renderServerCardValidation(result, filePath, format) {
     console.log();
     process.exit(1);
 }
+/**
+ * Strip system-managed / server-derived keys from a fetched card so it can be
+ * round-tripped back into a PUT.
+ *
+ * `card edit`/`card evaluate` read the server-COMPOSED card, which the composer
+ * decorates with system-managed fields (today: `_composition`). The
+ * inbound-card validator REJECTS those on write ("System-managed field — cannot
+ * be set on inbound cards"), so re-PUTting the composed card verbatim is refused
+ * and the edit never persists (MNE-1726). Edit the *inbound* projection, not the
+ * *composed* one.
+ *
+ * Convention: every system-managed key is `_`-prefixed. We strip by prefix (not
+ * by an explicit `_composition` allowlist) so future server-added `_`-fields
+ * round-trip safely too — the forward-compat lesson from MNE-908, where editors
+ * fought the composer over fields the user never authored.
+ */
+export function stripSystemManagedFields(card) {
+    const clean = {};
+    for (const [key, value] of Object.entries(card)) {
+        if (key.startsWith("_"))
+            continue;
+        clean[key] = value;
+    }
+    return clean;
+}
+/**
+ * Reconcile the ADR-039 unmapped-tool vocabulary with the embedded policy
+ * engine, at the CLI's own validator↔engine boundary.
+ *
+ * The card validator MANDATES the ADR-039 fields
+ * (`enforcement.allow_unmapped_tools` + `enforcement.default_unmapped_severity`)
+ * and REJECTS the legacy `enforcement.unmapped_tool_action`. But the embedded
+ * `@mnemom/policy-engine` still derives its policy from that legacy field, so a
+ * validator-passing card leaves the engine at its `allow` default: `evaluate`
+ * never warns/denies on an unmapped tool, even under `--strict` (MNE-1727). The
+ * two field vocabularies never met.
+ *
+ * Project the ADR-039 fields onto the legacy action the engine reads. Severity
+ * selects the verdict tier the operator declared:
+ *
+ *   allow_unmapped_tools=true                          → allow  (PASS)
+ *   allow_unmapped_tools=false + severity high|critical → deny   (FAIL, always non-zero)
+ *   allow_unmapped_tools=false + severity medium|low    → warn   (WARN, non-zero under --strict)
+ *   allow_unmapped_tools=false + severity unset         → deny   (fail-closed default)
+ *   allow_unmapped_tools unset                          → card returned untouched
+ *
+ * Returns a shallow clone (the user's card is never mutated); called AFTER
+ * validation, so the legacy field is only ever seen by the engine, never
+ * re-emitted onto an inbound card.
+ */
+export function bridgeUnmappedToolPolicy(card) {
+    const enforcement = card.enforcement;
+    if (!isObj(enforcement))
+        return card;
+    const allow = enforcement.allow_unmapped_tools;
+    if (typeof allow !== "boolean")
+        return card;
+    let action;
+    if (allow) {
+        action = "allow";
+    }
+    else {
+        const severity = String(enforcement.default_unmapped_severity ?? "");
+        action = severity === "medium" || severity === "low" ? "warn" : "deny";
+    }
+    return {
+        ...card,
+        enforcement: { ...enforcement, unmapped_tool_action: action },
+    };
+}
 export async function cardEditCommand(agentName, options = {}) {
     const agentId = await resolveAgentId(agentName);
     await requireAuth();
@@ -807,8 +862,26 @@ export async function cardEditCommand(agentName, options = {}) {
     if (!original) {
         console.log(fmt.warn("No alignment card found. Creating a template..."));
     }
-    const cardYaml = original ||
-        yaml.dump({
+    // The GET returns the server-COMPOSED card, decorated with system-managed
+    // `_`-fields (e.g. `_composition`) the inbound-card validator forbids on
+    // write. Strip them so the user edits — and re-PUTs — the inbound projection,
+    // otherwise the round-trip PUT is rejected and the edit never persists
+    // (MNE-1726).
+    let cardYaml;
+    if (original) {
+        let parsedOriginal;
+        try {
+            parsedOriginal = yaml.load(original);
+        }
+        catch {
+            parsedOriginal = undefined;
+        }
+        cardYaml = isObj(parsedOriginal)
+            ? yaml.dump(stripSystemManagedFields(parsedOriginal), { lineWidth: 120, noRefs: true })
+            : original;
+    }
+    else {
+        cardYaml = yaml.dump({
             card_version: "unified/2026-04-26",
             agent_id: agentId,
             autonomy_mode: "observe",
@@ -822,6 +895,7 @@ export async function cardEditCommand(agentName, options = {}) {
             },
             audit: { retention_days: 30, queryable: false, trace_format: "otel" },
         }, { lineWidth: 120, noRefs: true });
+    }
     // Write to a per-invocation temp dir created with mkdtemp (mode 0700,
     // unpredictable suffix) so the editor file can't be pre-created or
     // symlink-raced by another user in the shared os.tmpdir().
@@ -833,14 +907,13 @@ export async function cardEditCommand(agentName, options = {}) {
     console.log(`Opening ${editor}...`);
     const result = spawnSync(editor, [tmpFile], { stdio: "inherit" });
     if (result.status !== 0) {
-        console.log("\n" + fmt.error("Editor exited with an error") + "\n");
         try {
             fs.unlinkSync(tmpFile);
         }
         catch {
             /* ignore */
         }
-        process.exit(1);
+        exitWithError("Editor exited with an error");
     }
     // Read back and compare
     const edited = fs.readFileSync(tmpFile, "utf-8");
@@ -863,8 +936,7 @@ export async function cardEditCommand(agentName, options = {}) {
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        console.log("\n" + fmt.error(`Invalid YAML: ${msg}`) + "\n");
-        process.exit(1);
+        exitWithError(`Invalid YAML: ${msg}`);
     }
     const checks = validateUnifiedCard(parsed);
     const allPassed = checks.every((c) => c.passed);
@@ -875,8 +947,7 @@ export async function cardEditCommand(agentName, options = {}) {
             console.log(fmt.error(`${check.name}: ${check.message}`));
         }
         console.log();
-        console.log(fmt.error("Validation failed. Card not published.") + "\n");
-        process.exit(1);
+        exitWithError("Validation failed. Card not published.");
     }
     // Confirm and publish
     if (isInteractive()) {
@@ -888,13 +959,7 @@ export async function cardEditCommand(agentName, options = {}) {
     }
     try {
         console.log("\nPublishing alignment card...");
-        const editedBytes = Buffer.byteLength(edited, "utf-8");
-        if (editedBytes > ALIGNMENT_CARD_MAX_BYTES) {
-            console.log("\n" +
-                fmt.error(`Alignment card is ${editedBytes} bytes; limit is ${ALIGNMENT_CARD_MAX_BYTES} bytes (128 KB). The API will return 413.`) +
-                "\n");
-            process.exit(1);
-        }
+        checkCardBytes(edited);
         const putResult = await putAlignmentCard(agentId, edited, "text/yaml", {
             idempotencyKey: options.idempotencyKey,
         });
@@ -906,8 +971,7 @@ export async function cardEditCommand(agentName, options = {}) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        console.log("\n" + fmt.error(`Failed to publish card: ${message}`) + "\n");
-        process.exit(1);
+        exitWithError(`Failed to publish card: ${message}`);
     }
 }
 /**
@@ -920,19 +984,7 @@ export async function cardEditCommand(agentName, options = {}) {
 export async function cardEvaluateCommand(file, options) {
     // 1. Read + validate card file
     const cardPath = path.resolve(file);
-    if (!fs.existsSync(cardPath)) {
-        console.log("\n" + fmt.error(`Card file not found: ${cardPath}`) + "\n");
-        process.exit(1);
-    }
-    let parsed;
-    try {
-        parsed = parseCardFile(cardPath);
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        console.log("\n" + fmt.error(`Could not parse card file: ${msg}`) + "\n");
-        process.exit(1);
-    }
+    const parsed = loadCard(file, "Card file");
     const checks = validateUnifiedCard(parsed.parsed);
     const allPassed = checks.every((c) => c.passed);
     if (!allPassed) {
@@ -954,8 +1006,7 @@ export async function cardEvaluateCommand(file, options) {
     else if (options.toolManifest) {
         const manifestPath = path.resolve(options.toolManifest);
         if (!fs.existsSync(manifestPath)) {
-            console.log("\n" + fmt.error(`Tool manifest file not found: ${manifestPath}`) + "\n");
-            process.exit(1);
+            exitWithError(`Tool manifest file not found: ${manifestPath}`);
         }
         try {
             const manifestRaw = fs.readFileSync(manifestPath, "utf-8");
@@ -966,18 +1017,18 @@ export async function cardEvaluateCommand(file, options) {
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
-            console.log("\n" + fmt.error(`Could not read tool manifest: ${msg}`) + "\n");
-            process.exit(1);
+            exitWithError(`Could not read tool manifest: ${msg}`);
         }
     }
     if (tools.length === 0) {
-        console.log("\n" + fmt.error("No tools specified. Use --tools or --tool-manifest") + "\n");
-        process.exit(1);
+        exitWithError("No tools specified. Use --tools or --tool-manifest");
     }
-    // 3. Run evaluation -- card IS the policy source
+    // 3. Run evaluation -- card IS the policy source. Bridge the ADR-039
+    // unmapped-tool fields onto the legacy action the embedded engine reads so
+    // `--strict` actually surfaces unmapped-tool warnings (MNE-1727).
     const result = evaluatePolicy({
         context: "cicd",
-        card: parsed.parsed,
+        card: bridgeUnmappedToolPolicy(parsed.parsed),
         tools,
     });
     // 4. Display results

package/dist/commands/logs.js

@@ -46,7 +46,17 @@ function displayTrace(trace) {
     // (The old flat `trace.verified` was always undefined on the nested wire → every
     // trace was mis-flagged [VIOLATION] and the action rendered as "[object Object]".)
     const verified = trace.verification?.verified ?? true;
-    const statusMsg = verified ? fmt.success(timestamp) : fmt.error(`${timestamp} [VIOLATION]`);
+    // MNE-596 — AAP flagged a structural violation, but the observer's DDR
+    // cross-check confirmed AIP independently saw `clear` and no bounded action
+    // was ever executed: the agent was attacked and correctly refused. Render
+    // this distinctly from a real [VIOLATION] — it's good behavior, not bad —
+    // while still surfacing it (never silently swallowed).
+    const isBoundedRefusal = trace.verification?.classification === "bounded_refusal";
+    const statusMsg = verified
+        ? fmt.success(timestamp)
+        : isBoundedRefusal
+            ? fmt.warn(`${timestamp} [BOUNDED REFUSAL — policy-enforced, not counted]`)
+            : fmt.error(`${timestamp} [VIOLATION]`);
     console.log(`\n  ${statusMsg}`);
     // action.name is the canonical label (the tool name lives here in the AIP-nested
     // shape); fall back to the action type, then a dash.