@mnemom/mnemom 0.17.31 → 0.17.32-next.0

package/dist/commands/agent.js

@@ -31,7 +31,9 @@ import { randomUUID } from "node:crypto";
 import { tmpdir, homedir, hostname } from "node:os";
 import { basename, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { MEASURED_ENV, statuslineLaunch } from "../lib/statusline.js";
+import { FEED_ENV, statuslineLaunch } from "../lib/statusline.js";
+import { startFeed } from "../lib/statusline-feed.js";
+import { isPrerelease } from "../lib/update/semver.js";
 import { ALLOW_AUTOCOMPACT_OFF_ENV, dropAutocompactOffEnv, hasOwnSettingsFlag, mergedSettingsArgs, planAutocompactGuard, } from "../lib/autocompact-guard.js";
 import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
 import { createApiKey } from "../lib/api.js";
@@ -41,6 +43,7 @@ import { isLoggedIn } from "../lib/auth.js";
 import { loadCliConfig } from "../lib/cli-config.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { experimentalNotice } from "../lib/experimental.js";
+import { conductReceiptFor } from "../lib/conduct-receipt.js";
 import { fmt } from "../lib/format.js";
 import { askInput, askSelect, askYesNo, isInteractive } from "../lib/prompt.js";
 import { authConfigured, chooseAuth, detectClaudeLogin, readClaudeLoginState, } from "../lib/login-detect.js";
@@ -169,7 +172,8 @@ export async function agentCommand(scenarioArg, options = {}) {
     liftPassthroughName(options.passthrough ?? []);
     // ── session name + goal ── (a bare `mnemom agent` in a terminal asks for the name;
     // goal alignment is resolved upstream: --goal seals a contract, implicit alignment
-    // is on by default only while the `implicit` experimental feature is on.
+    // is on by default while the `implicit` experimental feature is on, and on a `next`
+    // build for every launch but `-p` (T16).
     const session = await resolveSessionSetup({
         scenario: scenarioArg,
         goal: options.goal,
@@ -729,6 +733,10 @@ export async function agentCommand(scenarioArg, options = {}) {
             }),
             knownCcSessionId: cc.id ?? continuedCcSessionId,
             plugin,
+            receipt: experimental.includes("record")
+                ? { orgId: account.orgId, agentId: servedAgentId }
+                : undefined,
+            orgId: account.orgId,
         });
         return; // launchTerminal exits the process
     }
@@ -1237,6 +1245,7 @@ function launchTerminal(ctx) {
     // A subscription launch (no Anthropic key) sets NO auth token: Claude Code then sends its
     // own claude.ai login to the gateway (lib/subscription-login.ts).
     let childEnv;
+    let feed = null;
     if (ctx.anthropicKey) {
         childEnv = { ...process.env };
         delete childEnv.ANTHROPIC_API_KEY;
@@ -1262,10 +1271,8 @@ function launchTerminal(ctx) {
     applyGatewayHintHeaders(childEnv);
     if (ctx.options.slack)
         args.push(...slackChannelArgs(sessionName));
-    // The status-bar savings counter (lib/statusline.ts). Claude Code only; the
-    // user's own statusLine keeps running in front of it. Measured mode is this launch's
-    // decision alone: a value inherited from an outer `mnemom agent` session never rides along.
-    Reflect.deleteProperty(childEnv, MEASURED_ENV);
+    // The status-bar segment (lib/statusline.ts). Claude Code only; the user's own
+    // statusLine keeps running in front of it.
     if (ctx.cli.name === "claude") {
         const passthrough = ctx.options.passthrough ?? [];
         const sl = statuslineLaunch({
@@ -1274,10 +1281,17 @@ function launchTerminal(ctx) {
             cwd: process.cwd(),
             node: process.execPath,
             bin: join(dirname(fileURLToPath(import.meta.url)), "..", "lib", "statusline-bin.js"),
-            measured: ctx.usageSavings,
         });
         if (sl)
             Object.assign(childEnv, sl.env);
+        feed = prepareStatuslineFeed({
+            statusline: sl !== null,
+            orgId: ctx.orgId,
+            version: CLI_VERSION,
+            goalMode: Boolean(ctx.goalMode),
+            env: process.env,
+            childEnv,
+        });
         // Autocompact guard (lib/autocompact-guard.ts): one --settings carries both layers.
         const guard = applyAutocompactGuard(childEnv, ctx.options, !hasOwnSettingsFlag(passthrough));
         args.push(...mergedSettingsArgs(guard, sl?.settings ?? null));
@@ -1287,6 +1301,7 @@ function launchTerminal(ctx) {
         childEnv.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
         childEnv.CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF = "1";
     }
+    let recordStatePath;
     const run = () => {
         const child = spawn(ctx.cli.bin, args, { stdio: "inherit", env: childEnv });
         child.on("error", (err) => {
@@ -1296,33 +1311,84 @@ function launchTerminal(ctx) {
         child.on("exit", (code, signal) => {
             if (signal)
                 process.kill(process.pid, signal);
-            else {
-                // Claude Code's own last line is "Resume this session with: claude --resume <id>",
-                // which reopens it OUTSIDE Mnemom (ungoverned, unbilled). Ours goes after it, last.
-                if (code === 0 && ctx.resumeHint && wantsResumeHint(ctx.cli, args)) {
-                    const id = ctx.knownCcSessionId ?? newestCcSessionIn(process.cwd(), process.env);
-                    say(ctx.resumeHint(id));
-                }
-                process.exit(code ?? 0);
-            }
+            else
+                void (async () => {
+                    // The conduct receipt never blocks exit (a hard deadline inside) and never changes
+                    // the exit code.
+                    if (ctx.receipt)
+                        await sayConductReceipt({ ...ctx.receipt, statePath: recordStatePath });
+                    // Claude Code's own last line is "Resume this session with: claude --resume <id>",
+                    // which reopens it OUTSIDE Mnemom (ungoverned, unbilled). Ours goes after it, last.
+                    if (code === 0 && ctx.resumeHint && wantsResumeHint(ctx.cli, args)) {
+                        const id = ctx.knownCcSessionId ?? newestCcSessionIn(process.cwd(), process.env);
+                        say(ctx.resumeHint(id));
+                    }
+                    process.exit(code ?? 0);
+                })();
         });
     };
     // Implicit goal mode: put the local base-URL proxy in front of the door so each main request
     // carries x-mnemom-turn (where each recent user turn came from, read from Claude Code's own
     // transcript — base-url-proxy.mjs / turn-origin.mjs). The prompt id it joins on comes from the
-    // gateway hint headers set above. Fail-open: no proxy → the door directly, as before.
-    if (!ctx.goalMode || !turnProxyWanted(process.env)) {
+    // gateway hint headers set above. Experimental `record` runs it too (turn header off unless
+    // implicit), to capture the lineage key the conduct receipt reads. Fail-open: no proxy → the
+    // door directly, as before, and a receipt that links instead of giving figures.
+    const turnHeader = Boolean(ctx.goalMode) && turnProxyWanted(process.env);
+    if (!turnHeader && !ctx.receipt) {
         run();
         return;
     }
-    startBaseUrlProxy(ctx.door, (baseUrl) => {
-        if (baseUrl) {
-            childEnv.ANTHROPIC_BASE_URL = baseUrl;
-            // An inherited HTTPS_PROXY must not carry the loopback hop.
-            exemptLoopbackFromProxy(childEnv);
-        }
+    startBaseUrlProxy(ctx.door, (baseUrl, statePath) => {
+        if (baseUrl)
+            recordStatePath = statePath;
+        onBaseUrlProxyReady(baseUrl, statePath, childEnv, feed && ctx.orgId ? { ...feed, orgId: ctx.orgId } : null);
         run();
-    });
+    }, { turnHeader, recordState: wantsRecordState(Boolean(ctx.receipt), feed !== null) });
+}
+/**
+ * Whether the proxy captures the gateway's record state: the conduct receipt reads it at exit,
+ * and the fed status line reads its lineage key while the session runs.
+ */
+export function wantsRecordState(receipt, fed) {
+    return receipt || fed;
+}
+/**
+ * Point Claude Code at a ready proxy and, on a fed launch, start the status-line feed on the
+ * proxy's record state (no state file, no feed: the line stays "mnemom").
+ */
+export function onBaseUrlProxyReady(baseUrl, recordStateFile, childEnv, feed, start = startFeed) {
+    if (!baseUrl)
+        return;
+    childEnv.ANTHROPIC_BASE_URL = baseUrl;
+    // An inherited HTTPS_PROXY must not carry the loopback hop.
+    exemptLoopbackFromProxy(childEnv);
+    if (feed && recordStateFile)
+        start({ ...feed, recordStateFile });
+}
+/**
+ * The status-line feed file for a fed launch (and FEED_ENV set on the child), or null: the
+ * segment off, no billing org, or {@link fedStatuslineWanted} false.
+ */
+export function prepareStatuslineFeed(o) {
+    if (!o.statusline || !o.orgId || !fedStatuslineWanted(o.version, o.goalMode, o.env))
+        return null;
+    const feed = (o.files ?? fedStatuslineFiles)();
+    o.childEnv[FEED_ENV] = feed.feedFile;
+    return feed;
+}
+/**
+ * Whether this launch feeds the status line measured model cost and μ (W1.4): prerelease
+ * builds only (stable stays "mnemom", decision 14), and only when the turn proxy runs, since
+ * the proxy is what learns the gateway's lineage key for the session.
+ */
+export function fedStatuslineWanted(version, goalMode, env) {
+    return isPrerelease(version) && goalMode && turnProxyWanted(env);
+}
+/** A private per-session dir holding the feed (launcher → bin). */
+function fedStatuslineFiles() {
+    const dir = mkdtempSync(join(tmpdir(), "mnemom-statusline."));
+    process.on("exit", () => rmSync(dir, { recursive: true, force: true }));
+    return { feedFile: join(dir, "feed.json") };
 }
 /**
  * Add 127.0.0.1 and localhost to BOTH NO_PROXY and no_proxy (proxy clients disagree on which one
@@ -1334,6 +1400,20 @@ export function exemptLoopbackFromProxy(env) {
     env.NO_PROXY = [upper, "127.0.0.1,localhost"].filter(Boolean).join(",");
     env.no_proxy = [lower, "127.0.0.1,localhost"].filter(Boolean).join(",");
 }
+/**
+ * Print the conduct receipt (experimental `record`) — the exit call site here, and the one a
+ * durable park calls. Never throws: a failure is one warning line, and the caller's exit code
+ * is untouched.
+ */
+export async function sayConductReceipt(launch, trigger = "exit", receipt = conductReceiptFor) {
+    try {
+        for (const line of await receipt(launch, trigger))
+            say(line);
+    }
+    catch (err) {
+        say(fmt.warn(`mnemom agent: no conduct receipt (${err instanceof Error ? err.message : String(err)})`));
+    }
+}
 /** Whether a terminal implicit launch runs the turn-origin proxy (MNEMOM_AGENT_TURN_HEADER=0 opts out). */
 export function turnProxyWanted(env) {
     const raw = (env.MNEMOM_AGENT_TURN_HEADER ?? "").trim().toLowerCase();
@@ -1350,6 +1430,9 @@ export function startBaseUrlProxy(door, done, opts = {}) {
     const script = opts.script ?? join(dirname(fileURLToPath(import.meta.url)), "..", "base-url-proxy.mjs");
     // The log carries method / path / status / latency / turn note only (never a header value or body).
     const logDir = mkdtempSync(join(tmpdir(), "mnemom-turn-proxy."));
+    // The receipt's record state (lineage key, record URL: non-secret) lives beside the log and is
+    // removed with it on exit, after the receipt has read it.
+    const recordStatePath = opts.recordState ? join(logDir, "record.json") : undefined;
     const proxy = spawn(opts.node ?? process.execPath, [script], {
         env: {
             ...process.env,
@@ -1357,6 +1440,8 @@ export function startBaseUrlProxy(door, done, opts = {}) {
             MNEMOM_AGENT_BU_CWD: process.cwd(),
             MNEMOM_AGENT_BU_LOG: process.env.MNEMOM_AGENT_TURN_PROXY_LOG || join(logDir, "proxy.log"),
             MNEMOM_AGENT_BU_PARENT_PID: String(process.pid),
+            ...(opts.turnHeader === false ? { MNEMOM_AGENT_TURN_HEADER: "0" } : {}),
+            ...(recordStatePath ? { MNEMOM_AGENT_BU_RECORD_STATE: recordStatePath } : {}),
         },
         stdio: ["ignore", "pipe", "ignore"],
     });
@@ -1375,7 +1460,7 @@ export function startBaseUrlProxy(door, done, opts = {}) {
         if (!url) {
             say(fmt.warn(`mnemom agent: turn-origin proxy unavailable (${why}) — launching straight to the gateway; the gateway reads turn origins from the wire only.`));
         }
-        done(url);
+        done(url, url ? recordStatePath : undefined);
     };
     const timeoutMs = opts.readyTimeoutMs ?? 5000;
     const timer = setTimeout(() => finish(null, `no READY within ${timeoutMs}ms`), timeoutMs);

package/dist/commands/status.js

@@ -138,7 +138,7 @@ async function checkApiConnectivity(agentId) {
     catch (error) {
         // 404 = agent not registered yet. Branch on effectiveStatus (enforce hook may
         // rewrite an undocumented 404 → synthetic 500 + spec_deviation.original_status;
-        // effectiveStatus === status when documented). getAgent → fetchApi → MnemomApiError.
+        // effectiveStatus === status when documented). getAgent → readApiError → MnemomApiError.
         if (error instanceof MnemomApiError && error.effectiveStatus === 404) {
             return {
                 name: "API",

package/dist/commands/update.js

@@ -43,7 +43,9 @@ export function formatUpdateResult(result, current) {
         lines.push(`  Try manually: ${manual(action.version)}`);
     }
     else if (action.kind === "notify") {
-        lines.push(`mnemom ${action.version} is available on ${result.channel} (you have ${current}).`);
+        lines.push(result.movedBack
+            ? `mnemom ${current} was withdrawn; ${result.channel} is back on ${action.version}.`
+            : `mnemom ${action.version} is available on ${result.channel} (you have ${current}).`);
         lines.push(`  Run: ${canSelfUpdate(result.method ?? "unknown") ? "mnemom update" : manual(action.version)}`);
     }
     else {

package/dist/commands/validate.d.ts

@@ -1,6 +1,6 @@
 /**
  * `mnemom validate ...` commands — Safe House Hardening T1-4 (CI gate
- * integration). Surface for engineers to check whether staging is safe
+ * integration). Surface for engineers to check whether the test cell is safe
  * to promote to production based on the most recent harness run state.
  *
  *   mnemom validate safe-house [--against=test] [--max-age=24h]

package/dist/commands/validate.js

@@ -1,6 +1,6 @@
 /**
  * `mnemom validate ...` commands — Safe House Hardening T1-4 (CI gate
- * integration). Surface for engineers to check whether staging is safe
+ * integration). Surface for engineers to check whether the test cell is safe
  * to promote to production based on the most recent harness run state.
  *
  *   mnemom validate safe-house [--against=test] [--max-age=24h]

package/dist/index.js

@@ -16,6 +16,7 @@ import { agentsListCommand, agentsClaimCommand, agentsMoveCommand } from "./comm
 import { agentExportCommand, liveExportDeps } from "./commands/agent-export.js";
 import { agentSessionsCommand, agentShowCommand, liveSessionDeps, } from "./commands/agent-sessions.js";
 import { agentGoalPinCommand, agentGoalResetCommand, agentGoalShowCommand, liveGoalDeps, } from "./commands/agent-goal.js";
+import { agentFuelCommand, liveFuelDeps } from "./commands/agent-fuel.js";
 import { orgListCommand, orgShowCommand, orgUseCommand } from "./commands/org.js";
 import { teamListCommand, teamShowCommand, teamTemplateCommand, teamPreviewComposeCommand, teamAdminGrantCommand, teamAdminRevokeCommand, teamAdminListCommand, teamCoverageCommand, } from "./commands/team.js";
 import { advisoriesListCommand, advisoriesShowCommand } from "./commands/advisories.js";
@@ -33,11 +34,13 @@ import { agentDoctorCommand } from "./commands/agent-doctor.js";
 import { agentSetupCommand, parseGovernanceFlag } from "./commands/agent-setup.js";
 import { agentInviteCommand, runAgentInvocation } from "./commands/agent-invite.js";
 import { agentFirstRunCommand, offerFirstRunOnLaunch } from "./commands/agent-first-run.js";
+import { showImplicitDefaultNoticeOnce } from "./commands/agent-implicit-notice.js";
+import { isPrerelease } from "./lib/update/semver.js";
 import { applyConfigToEnv, launcherEntries, loadLauncherConfig, withoutDisabledExperimental, } from "./lib/launcher-config.js";
 import { loadExperimentalState } from "./lib/cli-config.js";
-import { assertEnabled, EXPERIMENTAL_CONTRACT, gateCheck, ignoredSettingLines, reportCliError, } from "./lib/experimental.js";
+import { assertEnabled, availableFeatures, EXPERIMENTAL_CONTRACT, gateCheck, ignoredSettingLines, reportCliError, } from "./lib/experimental.js";
 import { experimentalDisableCommand, experimentalEnableCommand, experimentalListCommand, runExperimentalMigration, } from "./commands/experimental.js";
-import { parseCompactAt, parseContextProfile, resolveImplicit, selectLaunchAgent, splitSessionArg, } from "./lib/agent.js";
+import { parseCompactAt, parseContextProfile, passthroughIsPrint, resolveImplicitSource, selectLaunchAgent, splitSessionArg, } from "./lib/agent.js";
 import { wrapCommand } from "./commands/wrap.js";
 import { onboardCommand } from "./commands/onboard.js";
 import { skillsListCommand, skillsDescribeCommand } from "./commands/skills.js";
@@ -114,11 +117,14 @@ program
 // ── experimental features (lib/experimental.ts) ── While a feature is off its flags and
 // commands are hidden from --help (decided once, at load) and using one fails with a
 // pointer to `mnemom experimental enable <id>` (decided per invocation, in the action).
-const experimentalAtLoad = loadExperimentalState().enabled;
+// A prerelease (`next`) build also makes PRERELEASE_AVAILABLE usable (door one's T16).
+const PRERELEASE_BUILD = isPrerelease(CLI_VERSION);
+const loadAvailableFeatures = () => availableFeatures(loadExperimentalState().enabled, PRERELEASE_BUILD);
+const experimentalAtLoad = loadAvailableFeatures();
 const hiddenUnless = (id) => !experimentalAtLoad.includes(id);
 /** preAction guard for a gated command: print the guidance and exit 2 while `id` is off. */
 function requireExperimental(what, id) {
-    const message = gateCheck(what, id, loadExperimentalState().enabled);
+    const message = gateCheck(what, id, loadAvailableFeatures());
     if (message) {
         console.error(message);
         process.exit(2);
@@ -161,7 +167,7 @@ const agentCmd = program
     "platform cards (strictest wins). See `mnemom protection` for that mode.")
     .option("--lead-directed", "Seal the standard lead-directed requirement: own-branch push and draft/ready PR creation, " +
     "from a git worktree, on the lead's direction — not merging. Requires --goal; idempotent.")
-    .addOption(new Option("--implicit", "EXPERIMENTAL (`mnemom experimental enable implicit`): implicit goal alignment — the gateway infers the goal from your messages and revises it as you steer (the default while the feature is on; not combinable with --goal/--requirement/--allow/--forbid/--goal-id/--mode/--lead-directed; the guardrail ceilings still apply)").hideHelp(hiddenUnless("implicit")))
+    .addOption(new Option("--implicit", "EXPERIMENTAL (`mnemom experimental enable implicit`): implicit goal alignment — the gateway infers the goal from your messages and revises it as you steer (the default while the feature is on, and on a `next` build for every launch but `-p`; not combinable with --goal/--requirement/--allow/--forbid/--goal-id/--mode/--lead-directed; the guardrail ceilings still apply)").hideHelp(hiddenUnless("implicit")))
     .option("--no-implicit", "Turn implicit goal alignment OFF for this launch (overrides launcher.toml goal_mode = implicit)")
     .option("--conversation-id <id>", "x-mnemom-conversation-id (default: auto-generated)")
     .option("--cli <name|path>", "Coding-agent CLI to launch: a name or full path (default: claude)")
@@ -259,6 +265,8 @@ const agentCmd = program
     }
     async function launchAgent(scenario) {
         const experimental = loadExperimentalState().enabled;
+        // What a flag, key or command may use: the enabled features, plus implicit on `next`.
+        const available = availableFeatures(experimental, PRERELEASE_BUILD);
         // The one place the flag's raw string becomes `number | null` (see the argParser's
         // comment for why commander can't carry `null` through parseArg directly). Already
         // validated by the argParser, so this never throws.
@@ -266,7 +274,7 @@ const agentCmd = program
         // Sub-verb: `mnemom agent config …` manages persistent settings and never
         // launches. (A scenario literally named "config" is reserved for this.)
         if (scenario === "config") {
-            await agentConfigCommand(passthrough, { enabled: experimental });
+            await agentConfigCommand(passthrough, { enabled: available });
             return;
         }
         // Sub-verb: `mnemom agent slack …` posts/receives Slack messages as this
@@ -286,7 +294,7 @@ const agentCmd = program
                 used: opts.contextHandoff === true,
             },
             { what: "--implicit", id: "implicit", used: opts.implicit === true },
-        ], experimental);
+        ], available);
         if (opts.gateway)
             process.env.MNEMOM_AGENT_GATEWAY = opts.gateway;
         // Persistent settings (~/.mnemom/launcher.toml) sit UNDER env and flags:
@@ -299,11 +307,11 @@ const agentCmd = program
         for (const line of ignoredSettingLines({
             entries: launcherEntries(rawCfg),
             env: process.env,
-            enabled: experimental,
+            enabled: available,
         })) {
             console.error(line);
         }
-        const cfg = withoutDisabledExperimental(rawCfg, experimental);
+        const cfg = withoutDisabledExperimental(rawCfg, available);
         applyConfigToEnv(cfg, process.env);
         // Sub-verb: `mnemom agent doctor` runs a read-only preflight and never
         // launches. Placed after config load so it reports the effective settings.
@@ -334,14 +342,22 @@ const agentCmd = program
         const numToStr = (n) => n === undefined ? undefined : String(n);
         // Implicit mode: --implicit / --no-implicit win; a --goal statement seals
         // (the standing config default never overrides it); else launcher.toml
-        // `goal_mode`; else implicit while the `implicit` feature is on, off while it is
-        // off. Pure + unit-tested in lib/agent.ts.
-        const implicit = resolveImplicit({
+        // `goal_mode`; else implicit while the `implicit` feature is on; else, on a
+        // `next` build, implicit unless the launch is headless `-p` (T16); else off.
+        // Pure + unit-tested in lib/agent.ts.
+        const goalMode = resolveImplicitSource({
             goal: opts.goal,
             implicit: opts.implicit,
             configGoalMode: cfg.goalMode,
             experimentalOn: experimental.includes("implicit"),
+            prerelease: PRERELEASE_BUILD,
+            print: passthroughIsPrint(passthrough),
         });
+        const implicit = goalMode.implicit;
+        // The T16 default tells the user once, the first time it applies.
+        if (implicit && goalMode.source === "prerelease") {
+            showImplicitDefaultNoticeOnce({ dryRun: opts.dryRun });
+        }
         // Config guardrails apply only when goal alignment is actually intended (a
         // --goal is present, or implicit mode — where they ride on the mode header),
         // so a saved ceiling never forces an unrequested contract (which would
@@ -935,6 +951,29 @@ agentCmd
         process.exit(1);
     }
 });
+// `mnemom agent fuel <file>` — the fuel step (Doors W3.2): one confirmation seals a batch of job
+// contracts through the batch-seal endpoint and commits them to the repo.
+agentCmd
+    .command("fuel <file>", { hidden: hiddenUnless("fuel") })
+    .description("EXPERIMENTAL (`mnemom experimental enable fuel`): seal a batch of job contracts with one confirmation. " +
+    '`file` is a JSON array of contracts (or `{ "contracts": [...] }`; `-` reads stdin); each is sealed, ' +
+    "then written to .mnemom/contracts/<sha256>.json and committed")
+    .option("--repo <owner/name>", "The repo the jobs run against (default: the GitHub origin remote)")
+    .option("--org <org_id>", "The org to seal under (default: your only organization)")
+    .option("--yes", "Seal without the confirmation prompt")
+    .option("--no-commit", "Seal only; do not write or commit the contract files")
+    .option("--json", "Output the batch-seal response, the files and the commit as JSON")
+    .option("--key <idempotency-key>", "Replay a batch already sealed with this key (printed when committing its files failed)")
+    .hook("preAction", () => requireExperimental("`mnemom agent fuel`", "fuel"))
+    .action(async (file, opts) => {
+    try {
+        await agentFuelCommand(file, opts, liveFuelDeps);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    }
+});
 // `mnemom agent goal show|pin|reset` — the implicit goal the gateway inferred for a session
 // (implicit-goal CLI). The handlers set process.exitCode themselves (1 / 2); the catch is for
 // the unexpected.

package/dist/lib/agent.d.ts

@@ -359,13 +359,7 @@ export declare function resolveConversationId(raw: string | undefined): string;
 export declare function isPositiveInt(value: unknown): boolean;
 /** A strictly-positive finite number (rejects 0, negatives, NaN, Infinity, non-numeric). */
 export declare function isPositiveNumber(value: unknown): boolean;
-/**
- * Canonical JSON — object keys sorted recursively, arrays in order, no
- * whitespace, `undefined` keys dropped. Byte-identical to the gateway's
- * `canonicalJson` (gateway/src/goal-contract.ts), so the base64 we send and the
- * sha we print match what the gateway seals.
- */
-export declare function canonicalJson(value: unknown): string;
+export { canonicalJson } from "./canonical-json.js";
 /** sha256 hex (first 16 chars) of a string — the operator-eyeball contract hash. */
 export declare function sha256Hex16(text: string): string;
 /**
@@ -447,7 +441,8 @@ export declare const COMPACTION_INTERCEPT_KEY = "GATEWAY_COMPACTION_INTERCEPT";
 /**
  * The gateway env key that has it measure each request's saving for a single session and put
  * it in the client-facing usage (`mnemom_savings` in the read `usage.iterations` entry), where
- * the status bar reads it from Claude Code's transcript. Default OFF on the gateway; sent `"on"`
+ * it lands in Claude Code's transcript. The status bar never shows it (decision 14: never
+ * "saved"). Default OFF on the gateway; sent `"on"`
  * only while the `measured-savings` experimental feature is on and the launched CLI is Claude
  * Code (`resolveUsageSavings`). Independent of folding, so every profile sends it — `off` too,
  * where the measured saving is honestly $0.00.
@@ -834,9 +829,9 @@ export declare function resolveCompactionIntercept(opts: {
     env?: NodeJS.ProcessEnv;
 }): boolean;
 /**
- * Does the gateway measure this launch's saving (`GATEWAY_USAGE_SAVINGS` in the header, and the
- * status bar in measured mode)? Only with the `measured-savings` experimental feature on, and
- * only for Claude Code — the one CLI whose status bar reads the measurement. No flag or
+ * Does the gateway measure this launch's saving (`GATEWAY_USAGE_SAVINGS` in the header)? Only
+ * with the `measured-savings` experimental feature on, and only for Claude Code, whose
+ * transcript keeps the measurement. No flag or
  * launcher.toml key: `mnemom experimental enable measured-savings` is the switch.
  */
 export declare function resolveUsageSavings(opts: {
@@ -921,29 +916,47 @@ export declare function buildHandoffMcpConfigJson(p: HandoffMcpParams): string;
  * per-session statement, so it is always a per-launch `--goal`.
  */
 export type GoalModeDefault = "implicit" | "off";
+/**
+ * Where a launch's goal mode came from (`resolveImplicitSource`). `prerelease` is door
+ * one's T16 default (decisions 12 and 22): implicit by default on a `-next.N` build with
+ * nothing configured. It is the only source that shows the one-time notice.
+ */
+export type ImplicitSource = "flag" | "goal" | "config" | "experimental" | "prerelease" | "default";
+/** Does a Claude Code passthrough run headless (`-p` / `--print`)? */
+export declare function passthroughIsPrint(passthrough: readonly string[]): boolean;
 /**
  * Is this launch implicit-mode? Precedence, highest wins:
  *   1. an explicit flag — `--implicit` (true) or `--no-implicit` (false);
  *   2. a `--goal` statement — a sealed contract is a per-launch choice that the
- *      standing config default must never silently override;
+ *      standing config default must never silently override, so a launch never
+ *      runs both modes;
  *   3. the config default `goal_mode` — `"off"` turns alignment off, `"implicit"`
  *      keeps it implicit;
- *   4. with the `implicit` experimental feature ON, IMPLICIT: the gateway infers
- *      the goal from the user's own messages (turn it off for a launch with
- *      `--no-implicit`, or standing with `goal_mode = "off"`); with it OFF (the
- *      default), OFF.
+ *   4. with the `implicit` experimental feature ON, IMPLICIT (as before T16);
+ *   5. on a prerelease (`next`) build, IMPLICIT for an interactive or Remote Control
+ *      launch and OFF for a headless `-p` one (OD-13: T16 never covers `-p`);
+ *   6. otherwise OFF — stable without the experimental feature behaves as today.
  * Pure so every arm is unit-tested; the caller passes the resolved value on to
  * `assembleContract` / `buildGoalModeHeader` (which still refuse `--implicit`
  * combined with a contract flag — that conflict is EXPLICIT and is reported).
  */
-export declare function resolveImplicit(opts: {
+export declare function resolveImplicitSource(opts: {
     goal?: string;
     implicit?: boolean;
     configGoalMode?: GoalModeDefault;
     /**
      * Is the `implicit` experimental feature on? Off ⇒ the default is OFF and
      * `goal_mode = implicit` is ignored (`--implicit` is refused upstream, before
-     * this runs). Omitted ⇒ on.
+     * this runs), unless this is a prerelease build. Omitted ⇒ on.
      */
     experimentalOn?: boolean;
-}): boolean;
+    /** Is this a prerelease (`-next.N`) CLI build? `isPrerelease(CLI_VERSION)`. Omitted ⇒ no. */
+    prerelease?: boolean;
+    /** Does the launch run Claude Code headless (`-p`)? `passthroughIsPrint`. */
+    print?: boolean;
+}): {
+    implicit: boolean;
+    source: ImplicitSource;
+};
+/** `resolveImplicitSource(opts).implicit`. */
+export declare function resolveImplicit(opts: Parameters<typeof resolveImplicitSource>[0]): boolean;

package/dist/lib/agent.js

@@ -22,6 +22,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+import { canonicalJson } from "./canonical-json.js";
 import { getGatewayUrl } from "./config.js";
 import { normSession } from "./slack-route.js";
 /** The us-2/prod gateway host. The default door — never any other cell silently. */
@@ -438,6 +439,7 @@ export const AGENT_SUB_VERBS = new Set([
     "move",
     "export",
     "sessions",
+    "fuel",
     "show",
     "goal",
 ]);
@@ -480,23 +482,7 @@ export function isPositiveNumber(value) {
     const n = Number(s);
     return Number.isFinite(n) && n > 0;
 }
-/**
- * Canonical JSON — object keys sorted recursively, arrays in order, no
- * whitespace, `undefined` keys dropped. Byte-identical to the gateway's
- * `canonicalJson` (gateway/src/goal-contract.ts), so the base64 we send and the
- * sha we print match what the gateway seals.
- */
-export function canonicalJson(value) {
-    if (value === null || typeof value !== "object")
-        return JSON.stringify(value);
-    if (Array.isArray(value))
-        return `[${value.map(canonicalJson).join(",")}]`;
-    const obj = value;
-    const keys = Object.keys(obj)
-        .filter((k) => obj[k] !== undefined)
-        .sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
-}
+export { canonicalJson } from "./canonical-json.js";
 /** sha256 hex (first 16 chars) of a string — the operator-eyeball contract hash. */
 export function sha256Hex16(text) {
     return createHash("sha256").update(text, "utf8").digest("hex").slice(0, 16);
@@ -652,7 +638,8 @@ export const COMPACTION_INTERCEPT_KEY = "GATEWAY_COMPACTION_INTERCEPT";
 /**
  * The gateway env key that has it measure each request's saving for a single session and put
  * it in the client-facing usage (`mnemom_savings` in the read `usage.iterations` entry), where
- * the status bar reads it from Claude Code's transcript. Default OFF on the gateway; sent `"on"`
+ * it lands in Claude Code's transcript. The status bar never shows it (decision 14: never
+ * "saved"). Default OFF on the gateway; sent `"on"`
  * only while the `measured-savings` experimental feature is on and the launched CLI is Claude
  * Code (`resolveUsageSavings`). Independent of folding, so every profile sends it — `off` too,
  * where the measured saving is honestly $0.00.
@@ -1283,9 +1270,9 @@ export function resolveCompactionIntercept(opts) {
     return !(raw === "0" || raw === "false" || raw === "off" || raw === "no");
 }
 /**
- * Does the gateway measure this launch's saving (`GATEWAY_USAGE_SAVINGS` in the header, and the
- * status bar in measured mode)? Only with the `measured-savings` experimental feature on, and
- * only for Claude Code — the one CLI whose status bar reads the measurement. No flag or
+ * Does the gateway measure this launch's saving (`GATEWAY_USAGE_SAVINGS` in the header)? Only
+ * with the `measured-savings` experimental feature on, and only for Claude Code, whose
+ * transcript keeps the measurement. No flag or
  * launcher.toml key: `mnemom experimental enable measured-savings` is the switch.
  */
 export function resolveUsageSavings(opts) {
@@ -1333,27 +1320,42 @@ export function buildHandoffMcpConfig(p) {
 export function buildHandoffMcpConfigJson(p) {
     return JSON.stringify(buildHandoffMcpConfig(p));
 }
+/** Does a Claude Code passthrough run headless (`-p` / `--print`)? */
+export function passthroughIsPrint(passthrough) {
+    return passthrough.some((a) => a === "-p" || a === "--print" || a.startsWith("--print="));
+}
 /**
  * Is this launch implicit-mode? Precedence, highest wins:
  *   1. an explicit flag — `--implicit` (true) or `--no-implicit` (false);
  *   2. a `--goal` statement — a sealed contract is a per-launch choice that the
- *      standing config default must never silently override;
+ *      standing config default must never silently override, so a launch never
+ *      runs both modes;
  *   3. the config default `goal_mode` — `"off"` turns alignment off, `"implicit"`
  *      keeps it implicit;
- *   4. with the `implicit` experimental feature ON, IMPLICIT: the gateway infers
- *      the goal from the user's own messages (turn it off for a launch with
- *      `--no-implicit`, or standing with `goal_mode = "off"`); with it OFF (the
- *      default), OFF.
+ *   4. with the `implicit` experimental feature ON, IMPLICIT (as before T16);
+ *   5. on a prerelease (`next`) build, IMPLICIT for an interactive or Remote Control
+ *      launch and OFF for a headless `-p` one (OD-13: T16 never covers `-p`);
+ *   6. otherwise OFF — stable without the experimental feature behaves as today.
  * Pure so every arm is unit-tested; the caller passes the resolved value on to
  * `assembleContract` / `buildGoalModeHeader` (which still refuse `--implicit`
  * combined with a contract flag — that conflict is EXPLICIT and is reported).
  */
-export function resolveImplicit(opts) {
+export function resolveImplicitSource(opts) {
     if (opts.implicit !== undefined)
-        return opts.implicit;
+        return { implicit: opts.implicit, source: "flag" };
     if (hasText(opts.goal))
-        return false;
-    if (opts.experimentalOn === false)
-        return false;
-    return opts.configGoalMode !== "off";
+        return { implicit: false, source: "goal" };
+    const experimentalOn = opts.experimentalOn !== false;
+    if (!experimentalOn && !opts.prerelease)
+        return { implicit: false, source: "default" };
+    if (opts.configGoalMode !== undefined) {
+        return { implicit: opts.configGoalMode === "implicit", source: "config" };
+    }
+    if (experimentalOn)
+        return { implicit: true, source: "experimental" };
+    return { implicit: !opts.print, source: opts.print ? "default" : "prerelease" };
+}
+/** `resolveImplicitSource(opts).implicit`. */
+export function resolveImplicit(opts) {
+    return resolveImplicitSource(opts).implicit;
 }