@mnemom/mnemom 0.17.34-next.2 → 0.17.34-next.3

package/dist/lib/durable/launch.js

@@ -332,17 +332,30 @@ export async function planDurableLaunch(i, deps) {
         }
     }
 }
+// ---- a tracked spawn with no terminal on stdin (durable gate on) -------------------------------
+/**
+ * The one stderr line a gate-on launch prints before its tracked Claude Code spawn when stdin is
+ * not a TTY and the passthrough has no -p/--print: Claude Code started that way waits forever and
+ * draws nothing. The spawn itself stays as today (C02-R23 a, b, f fallback); gate off prints
+ * nothing (C17-R11). No command line in it, so no placeholder (C11-R27). Null: print nothing.
+ */
+export function trackedNoTtyLine(i) {
+    if (!i.gateOn || i.stdinIsTTY || i.cliName !== "claude")
+        return null;
+    if (i.passthrough.some((a) => a === "-p" || a === "--print" || a.startsWith("--print=")))
+        return null;
+    return `${i.name}: Claude Code needs a terminal on stdin and will wait without one; run this from a terminal, or pass Claude's -p flag after --.`;
+}
 // ---- lock refused on the launcher path (C02-R23 c, e; C02-R24) ---------------------------------
 /**
- * What a launcher does after its lock attempt refused: a durable-only agent gets the
- * durable_only_agent refusal and exit 1, never a tracked spawn (C02-R24, final F02); any other
- * agent prints the lock refusal and its fix, then spawns tracked (exit null).
+ * What a launcher does after its lock attempt refused: it exits non-zero with the refusal's own fix
+ * line and never falls back to an attended (tracked) spawn, for every agent (Durable lead ruling
+ * 2026-10-30 on C02-R23 c, e). A durable-only agent gets the durable_only_agent refusal (C02-R24,
+ * final F02); any other agent prints the lock refusal itself.
  */
 export function afterLockRefusal(refusal, durableOnly, launcherKey, name) {
-    if (!durableOnly)
-        return { print: refusal, exit: null };
-    // cwd_untrusted is CLI-local (no S1 precondition clause): a durable-only launch prints it as itself,
-    // its fix shaped for the launch (rerun it), not for `mnemom agent lock`.
+    // cwd_untrusted is CLI-local (no S1 precondition clause): a launch prints it as itself, its fix
+    // shaped for the launch (rerun it), not for `mnemom agent lock`.
     const root = refusal.details.cwd;
     if (refusal.code === "cwd_untrusted" && typeof root === "string") {
         const r = new DurableRefusal({
@@ -353,21 +366,26 @@ export function afterLockRefusal(refusal, durableOnly, launcherKey, name) {
         });
         return { print: r, exit: r.exit };
     }
+    if (!durableOnly)
+        return { print: refusal, exit: refusal.exit };
     const r = durableOnlyRefusal(launcherKey, name, refusal, refusal.fixParams);
     return { print: r, exit: r.exit };
 }
-// ---- lock after the first turn (dogfood B5) -----------------------------------------------------
+// ---- a new session locks before claude starts (ruling A) --------------------------------------
 /**
- * A lock on a NEW Claude Code session (no transcript yet) waits for the session's first turn: the
- * seat resumes the transcript, so a lock before it exists fails transcript_lost. The launcher
- * spawns claude attended and locks once that turn has completed (lib/durable/first-turn.ts). A
- * continued session already has its transcript and locks instead of spawning, as before.
+ * A lock on a NEW Claude Code session (no transcript yet) is a create-and-lock (ruling A, which
+ * widens B5a to every agent): the session is born locked and its seat starts the transcript, so no
+ * attended claude ever runs first. A continued session already has its transcript and locks its
+ * registered row instead of spawning, as before.
  */
-export function locksAfterFirstTurn(plan) {
+export function locksAtCreate(plan) {
     return plan.lock && plan.newCcSessionId !== null;
 }
-/** The row the first-turn lock commits: the registered row, naming the CC session this launch pins. */
-export function firstTurnRow(row, plan) {
+/**
+ * The registered row of a tracked launch, naming the CC session this launch pins: what a later lock
+ * from another terminal hands over (C02-R26).
+ */
+export function launchRow(row, plan) {
     return typeof row.cc_session_id === "string"
         ? row
         : { ...row, cc_session_id: plan.newCcSessionId };

package/dist/lib/durable/live.d.ts

@@ -15,7 +15,6 @@ import { type DurableLaunchPlan, type PlanDeps, type RegistryReads, type SeatDep
 import { type HandoverDeps } from "./handover.js";
 import { type HostInstance } from "../../host/instance.js";
 import { type OwnerHttp } from "../../host/owner.js";
-import { type FirstTurnLock } from "./first-turn.js";
 import type { HomeFacts } from "./view.js";
 export declare function liveDurableApi(): DurableApi;
 /** launcher.toml `durable`, defaulting to off (only read while the gate is on); unreadable is off. */
@@ -156,19 +155,24 @@ export interface LockInsteadDeps {
     lockDeps: LockDeps;
     seat: SeatDeps;
 }
-export declare function lockInsteadOfSpawn(row: RegistryRow, name: string, launcherKey: LauncherKey, durableOnly: true, d?: LockInsteadDeps): Promise<number>;
-export declare function lockInsteadOfSpawn(row: RegistryRow, name: string, launcherKey: LauncherKey, durableOnly: boolean, d?: LockInsteadDeps): Promise<number | null>;
+export declare function lockInsteadOfSpawn(row: RegistryRow, name: string, launcherKey: LauncherKey, durableOnly: boolean, d?: LockInsteadDeps): Promise<number>;
+/** The api's create-and-lock refusal before migration 06a (or after its rollback): falls back to tracked. */
+export declare const PRE_06A_CREATE_LOCK_CODE = "create_lock_not_durable_only";
 /** The row a create-and-lock is about to make: what the idle-source lock reads (cwd, cc id). */
 export declare function bornRow(plan: Extract<DurableLaunchPlan, {
     kind: "spawn";
 }>, name: string, agentId: string, cwd: string): RegistryRow;
 /**
- * B5a (as amended): `--new` under `always` on a durable-only agent creates the session locked in
- * one request (the create route with the lock verb's body; the api commits both in one
- * transaction), then attaches to the seat like any lock instead of spawning. No tracked row, no
- * attended claude, so no turn ever runs on a plain key. The lock is the lock verb's own
- * (lockResolvedRow: cwd rule, executor id, spec); only its POST goes to the create route. A
- * refusal is the durable_only_agent refusal and exit 1 (C02-R24), never a tracked spawn.
+ * Ruling A (B5a as amended, widened to every agent): a NEW session under `always` / ask-yes is
+ * created locked in one request (the create route with the lock verb's body; the api commits both
+ * in one transaction), then attaches to the seat like any lock instead of spawning. No tracked row,
+ * no attended claude, so no turn runs before the lock. The lock is the lock verb's own
+ * (lockResolvedRow: cwd rule, executor id, spec); only its POST goes to the create route. A refusal
+ * leaves no row and exits 1: on a durable-only agent with the durable_only_agent refusal (C02-R24),
+ * on any other agent with the lock refusal and its fix; the launcher never spawns tracked instead,
+ * with one exception (ruling 2026-10-31, option 1): an api without migration 06a, or with it rolled
+ * back, answers create_lock_not_durable_only for an agent that is not durable-only. That answer
+ * resolves to null, and the launch registers tracked and spawns exactly as before ruling A.
  *
  * No claude runs before the lock, so the spec cannot be read from a live original as the lock after
  * the first turn does: the launch's own `--model` / `--effort` stand in for it (a passthrough
@@ -181,14 +185,6 @@ export declare function createLockedInsteadOfSpawn(plan: Extract<DurableLaunchPl
     model?: string;
     effort?: string;
     trimMcp?: boolean;
-}, d?: LockInsteadDeps & {
+}, durableOnly: boolean, d?: LockInsteadDeps & {
     api: Pick<DurableApi, "createSession">;
-}): Promise<number>;
-/**
- * Dogfood B5: the live lock after the first turn of a new session (lib/durable/first-turn.ts). The
- * transcript is read under `${CLAUDE_CONFIG_DIR:-~/.claude}/projects`; the lock is the lock verb's
- * (cwd rule, transcript slug check, executor id) under the running-session handover, so a commit
- * freezes the attended claude, waits for the seat's hello and ends it, and the launcher's exit path
- * attaches to the seat (C02-R26 step 7). A refusal is printed with its fix line; claude goes on.
- */
-export declare function liveLockAfterFirstTurn(row: RegistryRow, name: string, launcherKey: LauncherKey, childAlive: () => boolean): Promise<FirstTurnLock>;
+}): Promise<number | null>;

package/dist/lib/durable/live.js

@@ -4,7 +4,7 @@
  * every decision lives in the injected modules and is unit-tested there.
  */
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { getAccessToken, resolveAuth } from "../auth.js";
@@ -24,11 +24,9 @@ import { liveCwdProbe, liveTranscriptDirs, liveTrustProbe, lockFactsOf, lockReso
 import { DurableApi, RegistryUnavailable, } from "./api.js";
 import { afterLockRefusal, attachToSeat, createBody, createOutcome, flagValue, } from "./launch.js";
 import { helloLanded, ledgerCcSessionIdFrom, lockCommitted, parentAfterChildEnded, processTree, sessionRowOf, } from "./handover.js";
-import { ccProjectsDir } from "../../host/transcript.js";
 import { resolveInstance } from "../../host/instance.js";
 import { ownerApi, parseExecutorList } from "../../host/owner.js";
 import { seatTmuxSession } from "../../host/tmux.js";
-import { lockAfterFirstTurn, transcriptReader } from "./first-turn.js";
 import { DurableRefusal, printDurableRefusal } from "./refusal.js";
 export function liveDurableApi() {
     return new DurableApi({
@@ -530,28 +528,37 @@ function liveLockInsteadDeps(launcherKey) {
         seat: liveSeatDeps(launcherKey),
     };
 }
+// A launch that locks never falls back to a spawn: afterLockRefusal always names its exit.
 export async function lockInsteadOfSpawn(row, name, launcherKey, durableOnly, d = liveLockInsteadDeps(launcherKey)) {
-    const deps = d.lockDeps;
-    const o = await d.lockRow(row, name, deps);
-    if (!o.ok) {
-        const next = afterLockRefusal(o.refusal, durableOnly, launcherKey, name);
-        printDurableRefusal(next.print, false, deps);
-        return next.exit;
-    }
+    const o = await d.lockRow(row, name, d.lockDeps);
+    if (!o.ok)
+        return printLockRefusal(o.refusal, durableOnly, launcherKey, name, d.lockDeps);
+    return attachLocked(o, row, name, d);
+}
+/** A lock refusal: printed with its fix; the exit status afterLockRefusal gives. */
+function printLockRefusal(refusal, durableOnly, launcherKey, name, deps) {
+    const next = afterLockRefusal(refusal, durableOnly, launcherKey, name);
+    printDurableRefusal(next.print, false, deps);
+    return next.exit;
+}
+/** A landed lock: print it (interactive), then attach to the seat. */
+async function attachLocked(o, row, name, d) {
     const seat = d.seat;
     if (seat.interactive)
-        printLocked(o, row, name, deps.out);
+        printLocked(o, row, name, d.lockDeps.out);
     const dropped = lockFactsOf(o.body, row, name, o.dropped).droppedFlags;
     try {
         return await attachToSeat(row, name, dropped, seat);
     }
     catch (e) {
         if (e instanceof DurableRefusal)
-            return printDurableRefusal(e, false, deps);
+            return printDurableRefusal(e, false, d.lockDeps);
         throw e;
     }
 }
 // ---- create-and-lock (ruling B5a as amended) ----------------------------------------------------
+/** The api's create-and-lock refusal before migration 06a (or after its rollback): falls back to tracked. */
+export const PRE_06A_CREATE_LOCK_CODE = "create_lock_not_durable_only";
 /** The row a create-and-lock is about to make: what the idle-source lock reads (cwd, cc id). */
 export function bornRow(plan, name, agentId, cwd) {
     return {
@@ -565,19 +572,23 @@ export function bornRow(plan, name, agentId, cwd) {
     };
 }
 /**
- * B5a (as amended): `--new` under `always` on a durable-only agent creates the session locked in
- * one request (the create route with the lock verb's body; the api commits both in one
- * transaction), then attaches to the seat like any lock instead of spawning. No tracked row, no
- * attended claude, so no turn ever runs on a plain key. The lock is the lock verb's own
- * (lockResolvedRow: cwd rule, executor id, spec); only its POST goes to the create route. A
- * refusal is the durable_only_agent refusal and exit 1 (C02-R24), never a tracked spawn.
+ * Ruling A (B5a as amended, widened to every agent): a NEW session under `always` / ask-yes is
+ * created locked in one request (the create route with the lock verb's body; the api commits both
+ * in one transaction), then attaches to the seat like any lock instead of spawning. No tracked row,
+ * no attended claude, so no turn runs before the lock. The lock is the lock verb's own
+ * (lockResolvedRow: cwd rule, executor id, spec); only its POST goes to the create route. A refusal
+ * leaves no row and exits 1: on a durable-only agent with the durable_only_agent refusal (C02-R24),
+ * on any other agent with the lock refusal and its fix; the launcher never spawns tracked instead,
+ * with one exception (ruling 2026-10-31, option 1): an api without migration 06a, or with it rolled
+ * back, answers create_lock_not_durable_only for an agent that is not durable-only. That answer
+ * resolves to null, and the launch registers tracked and spawns exactly as before ruling A.
  *
  * No claude runs before the lock, so the spec cannot be read from a live original as the lock after
  * the first turn does: the launch's own `--model` / `--effort` stand in for it (a passthrough
  * `-- --model` / `--effort` first, as it comes last on claude's argv; else the flag, else
  * launcher.toml), with its `--trim-mcp`, so the seat runs as the launch chose, never the default.
  */
-export async function createLockedInsteadOfSpawn(plan, name, agentId, launcherKey, launch, d = {
+export async function createLockedInsteadOfSpawn(plan, name, agentId, launcherKey, launch, durableOnly, d = {
     ...liveLockInsteadDeps(launcherKey),
     api: liveDurableApi(),
 }) {
@@ -588,6 +599,10 @@ export async function createLockedInsteadOfSpawn(plan, name, agentId, launcherKe
     const lockRow = async (r, n, deps) => {
         const o = await d.lockRow(r, n, {
             ...deps,
+            // Nothing holds the name: the row is not registered until the create lands, and a live row
+            // under the name refuses the launch first (planDurableLaunch, session_name_in_use). So a
+            // refusal's fix line never sends the user to `mnemom agent done`, which would fail (C11-R27).
+            nameHeld: false,
             specDefaults: (row) => ({
                 ...deps.specDefaults(row),
                 ...(model ? { model } : {}),
@@ -608,28 +623,11 @@ export async function createLockedInsteadOfSpawn(plan, name, agentId, launcherKe
             r.id = sid;
         return o;
     };
-    return lockInsteadOfSpawn(row, name, launcherKey, true, { ...d, lockRow });
-}
-/**
- * Dogfood B5: the live lock after the first turn of a new session (lib/durable/first-turn.ts). The
- * transcript is read under `${CLAUDE_CONFIG_DIR:-~/.claude}/projects`; the lock is the lock verb's
- * (cwd rule, transcript slug check, executor id) under the running-session handover, so a commit
- * freezes the attended claude, waits for the seat's hello and ends it, and the launcher's exit path
- * attaches to the seat (C02-R26 step 7). A refusal is printed with its fix line; claude goes on.
- */
-export function liveLockAfterFirstTurn(row, name, launcherKey, childAlive) {
-    const dirs = liveTranscriptDirs(process.env);
-    const seat = liveSeatDeps(launcherKey);
-    return lockAfterFirstTurn({
-        name,
-        readTranscript: transcriptReader(ccProjectsDir(process.env), dirs, row.cc_session_id, (p) => readFileSync(p, "utf8")),
-        childAlive,
-        lock: () => lockResolvedRow(row, name, {}, {
-            ...liveLockDeps(),
-            handover: liveHandoverDeps(liveDurableApi()),
-            transcriptDirs: dirs,
-        }),
-        printRefusal: (r) => printDurableRefusal(r, false, seat),
-        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
-    });
+    const o = await lockRow(row, name, d.lockDeps);
+    if (o.ok)
+        return attachLocked(o, row, name, d);
+    // nothing printed: the caller registers tracked and spawns as before ruling A
+    if (o.refusal.code === PRE_06A_CREATE_LOCK_CODE)
+        return null;
+    return printLockRefusal(o.refusal, durableOnly, launcherKey, name, d.lockDeps);
 }

package/dist/lib/launcher-config.d.ts

@@ -98,6 +98,12 @@ export interface LauncherConfig {
         stallTurns?: number;
     };
 }
+/**
+ * The launcher key `durable` a launch uses: a valid MNEMOM_AGENT_DURABLE wins over launcher.toml
+ * (so `MNEMOM_AGENT_DURABLE=off` turns a configured `always` off for one launch), else the
+ * launcher.toml value, else `off`. Adopt reads the key the same way.
+ */
+export declare function durableLauncherKey(env: Readonly<Record<string, string | undefined>>, configured: LauncherKey | undefined): LauncherKey;
 /**
  * A settable key: its dotted config name, the getter/setter into a LauncherConfig,
  * and a one-line description for `config list`/help. Kept as data so get/set/list

package/dist/lib/launcher-config.js

@@ -34,6 +34,17 @@ function coerceDurable(raw) {
         return v;
     throw new Error(`durable must be one of ${LAUNCHER_KEYS.join(", ")} (got '${raw}').`);
 }
+/**
+ * The launcher key `durable` a launch uses: a valid MNEMOM_AGENT_DURABLE wins over launcher.toml
+ * (so `MNEMOM_AGENT_DURABLE=off` turns a configured `always` off for one launch), else the
+ * launcher.toml value, else `off`. Adopt reads the key the same way.
+ */
+export function durableLauncherKey(env, configured) {
+    const e = env.MNEMOM_AGENT_DURABLE?.trim().toLowerCase();
+    if (e !== undefined && LAUNCHER_KEYS.includes(e))
+        return e;
+    return configured ?? "off";
+}
 function coerceLaunch(raw) {
     const v = raw.trim();
     if (LAUNCH_SHAPES.includes(v))

package/dist/lib/runner/exec-append.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The exec_append body: exactly these keys, as frozen S1 has it (`refs`, and the boot-bound
+ * `nonce`). Every executor append (the daemon's executor.spawned and executor.turn_continued, and the
+ * thin runner's executor.spawned) sends this shape. It lives in lib/runner with no imports so the
+ * runner can load it inside its allow-listed closure (runner-no-prompts); host/s1-names re-exports it.
+ */
+export interface ExecAppendBody {
+    readonly kind: string;
+    readonly refs: Readonly<Record<string, unknown>>;
+    readonly idempotency_key: string;
+    readonly expected_epoch: number;
+    readonly nonce: string;
+}
+/** The executor.spawned idempotency key, one per (session, epoch, spawn). */
+export declare const spawnIdempotencyKey: (sessionId: string, epoch: number, spawnId: string) => string;

package/dist/lib/runner/exec-append.js

@@ -0,0 +1,2 @@
+/** The executor.spawned idempotency key, one per (session, epoch, spawn). */
+export const spawnIdempotencyKey = (sessionId, epoch, spawnId) => `spawn:${sessionId}:${epoch}:${spawnId}`;

package/dist/lib/runner/executor-client.d.ts

@@ -8,6 +8,7 @@
  * Nothing here decides an outcome: each call returns its status, body and error code, and the job
  * (job.ts) maps them to 34.12's reasons. Never throws: a network failure is status 0.
  */
+import type { ExecAppendBody } from "./exec-append.js";
 export interface HttpResult {
     readonly status: number;
     readonly body: unknown;
@@ -40,7 +41,7 @@ export interface RunnerApi {
         nonce: string;
         new_key?: true;
     }): Promise<HttpResult>;
-    append(sessionId: string, body: Record<string, unknown>): Promise<HttpResult>;
+    append(sessionId: string, body: ExecAppendBody): Promise<HttpResult>;
     hello(sessionId: string, body: {
         epoch: number;
         nonce: string;

package/dist/lib/runner/executor-state.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The enrolled executor's own id, from its executor-state.json (S1 24.14; Durable lead, Doors
+ * W-L13). S1's pool claim answer names no executor_id (POOL_CLAIM_FIELDS), so the runner binds the
+ * served bundle to its own: the bundle's claim.executor_id must still equal it.
+ *
+ * The file counts only when it is S1's closed shape and its executor_key is the key this run uses,
+ * so an id is never borrowed from another executor's state.
+ */
+/** executor_id from the file's text, or null when it is absent, malformed or another key's. */
+export declare function executorIdFromState(text: string | null, executorKey: string): string | null;

package/dist/lib/runner/executor-state.js

@@ -0,0 +1,24 @@
+/**
+ * The enrolled executor's own id, from its executor-state.json (S1 24.14; Durable lead, Doors
+ * W-L13). S1's pool claim answer names no executor_id (POOL_CLAIM_FIELDS), so the runner binds the
+ * served bundle to its own: the bundle's claim.executor_id must still equal it.
+ *
+ * The file counts only when it is S1's closed shape and its executor_key is the key this run uses,
+ * so an id is never borrowed from another executor's state.
+ */
+import { executorStateOk } from "../../vendor/durable-contract/index.js";
+/** executor_id from the file's text, or null when it is absent, malformed or another key's. */
+export function executorIdFromState(text, executorKey) {
+    if (text === null)
+        return null;
+    let v;
+    try {
+        v = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (!executorStateOk(v))
+        return null;
+    return v.executor_key === executorKey ? v.executor_id : null;
+}

package/dist/lib/runner/github-base.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Where `mnemom agent run` reaches GitHub.
+ *
+ * github.com for git and api.github.com for REST and GraphQL, always, except on a local Durable lane
+ * in test mode: there the fixture repos live on the lane's fake GitHub, the same one the api uses
+ * (DURABLE_TEST_GITHUB_API_BASE), which serves git and REST from one loopback origin. The test-mode
+ * module decides whether that base is honoured; outside test mode a set value is ignored with a
+ * warning and the runner stays on github.com. The runner's GitHub token only goes to these bases.
+ */
+export interface GithubBases {
+    /** git remotes and PR URLs: `${web}/${owner}/${repo}`. */
+    web: string;
+    /** REST and GraphQL: `${api}/repos/...`, `${api}/graphql`. */
+    api: string;
+}
+export declare const GITHUB_BASES: Readonly<GithubBases>;
+export declare const GITHUB_BASE_IGNORED = "mnemom agent run: DURABLE_TEST_GITHUB_API_BASE is ignored outside test mode; using github.com";
+/** The bases to use, and a warning when a lane base was set but not honoured. */
+export declare function resolveGithubBases(env: NodeJS.ProcessEnv): {
+    bases: GithubBases;
+    warning: string | null;
+};
+/** The PR URL pattern for a web base: `${web}/<owner>/<repo>/pull/<n>`. */
+export declare function prUrlPattern(web: string): RegExp;

package/dist/lib/runner/github-base.js

@@ -0,0 +1,27 @@
+/**
+ * Where `mnemom agent run` reaches GitHub.
+ *
+ * github.com for git and api.github.com for REST and GraphQL, always, except on a local Durable lane
+ * in test mode: there the fixture repos live on the lane's fake GitHub, the same one the api uses
+ * (DURABLE_TEST_GITHUB_API_BASE), which serves git and REST from one loopback origin. The test-mode
+ * module decides whether that base is honoured; outside test mode a set value is ignored with a
+ * warning and the runner stays on github.com. The runner's GitHub token only goes to these bases.
+ */
+import { testGithubBase } from "../../durable/test-mode.mjs";
+export const GITHUB_BASES = Object.freeze({
+    web: "https://github.com",
+    api: "https://api.github.com",
+});
+export const GITHUB_BASE_IGNORED = "mnemom agent run: DURABLE_TEST_GITHUB_API_BASE is ignored outside test mode; using github.com";
+/** The bases to use, and a warning when a lane base was set but not honoured. */
+export function resolveGithubBases(env) {
+    const t = testGithubBase(env);
+    if (t.base === null)
+        return { bases: GITHUB_BASES, warning: t.ignored ? GITHUB_BASE_IGNORED : null };
+    return { bases: { web: t.base, api: t.base }, warning: null };
+}
+/** The PR URL pattern for a web base: `${web}/<owner>/<repo>/pull/<n>`. */
+export function prUrlPattern(web) {
+    const esc = web.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`^${esc}/([^/]+/[^/]+)/pull/(\\d+)$`);
+}

package/dist/lib/runner/job.d.ts

@@ -25,6 +25,11 @@ export interface Workspace {
 }
 export interface JobDeps {
     api: RunnerApi;
+    /**
+     * This runner's executor id: MNEMOM_EXECUTOR_ID, else the OIDC exchange answer's, else the
+     * host's executor-state.json when it holds the key in use; null: the claim's.
+     */
+    executorId: string | null;
     /** One nonce per runner process, reused on every call (A3 fences on it). */
     nonce: string;
     newSpawnId(): string;
@@ -63,8 +68,8 @@ export declare function authRefusal(r: HttpResult): RefusedReason | null;
  */
 export declare function runJob(sessionId: string, opts: JobOptions, deps: JobDeps): Promise<JobResult>;
 /**
- * Report a failed or refused job after claim (34.12 (6), (10)). The fail reason vocabulary is the
- * Durable lead's to rule (A3 accepts only transcript_lost today); a refused report is logged and
- * never changes the outcome, because the lease lapses on its own.
+ * Report a failed job after claim (34.12 (6), (10)); a refusal releases the lease instead. The
+ * fail reason vocabulary is the Durable lead's to rule (A3 accepts only transcript_lost today); a
+ * fail the api refuses is logged and never changes the outcome, because the lease lapses on its own.
  */
-export declare function reportFail(deps: JobDeps, sessionId: string, epoch: number, kind: "runner_failed" | "runner_refused", reason: string): Promise<void>;
+export declare function reportFail(deps: JobDeps, sessionId: string, epoch: number, kind: "runner_failed", reason: string): Promise<void>;

package/dist/lib/runner/job.js

@@ -11,7 +11,8 @@
  * Every side effect is in `JobDeps`, so each arm is tested; `liveJobDeps` (commands/agent-run.ts)
  * is the thin driver.
  */
-import { RUNNER_OPEN_MODE_TOLERATED, claimNeedsKeyRetry, } from "../../vendor/durable-contract/index.js";
+import { EXECUTOR_WRITABLE_KINDS, RUNNER_OPEN_MODE_TOLERATED, claimNeedsKeyRetry, } from "../../vendor/durable-contract/index.js";
+import { spawnIdempotencyKey } from "./exec-append.js";
 import { canonicalJson } from "../canonical-json.js";
 import { verifyServedPhaseBundle } from "./bundle.js";
 import { sealedContractHeader } from "./contract-header.js";
@@ -133,6 +134,8 @@ async function claimSession(deps, sessionId) {
         },
     };
 }
+/** A header-safe agent id; the gateway compares it with the lease's session. */
+const AGENT_ID_RE = /^[A-Za-z0-9_.:-]{1,128}$/;
 function parseJob(body) {
     if (!body || typeof body !== "object")
         return null;
@@ -147,7 +150,11 @@ function parseJob(body) {
         return null;
     if (sha === null || version === null || typeof b.contract !== "string")
         return null;
-    return { repo, contract_sha256: sha, version, contract: b.contract };
+    // No agent id, no job: a model request without x-mnemom-agent-id would be refused anyway.
+    const agentId = str(b.agent_id);
+    if (agentId === null || !AGENT_ID_RE.test(agentId))
+        return null;
+    return { repo, agent_id: agentId, contract_sha256: sha, version, contract: b.contract };
 }
 /**
  * Run one candidate session to an outcome. Never throws for a Mnemom error: every one is an
@@ -189,15 +196,19 @@ export async function runJob(sessionId, opts, deps) {
     };
     const refuse = async (reason, detail) => {
         deps.log(`refused (${reason}): ${detail}`);
-        await reportFail(deps, sessionId, claim.epoch, "runner_refused", reason);
+        // A refusal hands the lease back: S1's fail reasons are closed, and the api refuses
+        // runner_refused as durable_reason_invalid, which left the session leased until it lapsed.
+        await release(deps, sessionId, claim.epoch);
         return { kind: "outcome", outcome: refusedOutcome(facts, reason) };
     };
     try {
         // Register the spawn, then hello: the session moves to running and the lease is ours.
         const ap = await deps.api.append(sessionId, {
-            kind: "executor.spawned",
-            detail: { spawn_id: spawnId },
+            kind: EXECUTOR_WRITABLE_KINDS[0], // executor.spawned
+            refs: { spawn_id: spawnId },
+            idempotency_key: spawnIdempotencyKey(sessionId, claim.epoch, spawnId),
             expected_epoch: claim.epoch,
+            nonce: deps.nonce,
         });
         if (!ok2xx(ap))
             return await refuse(routeRefusal(ap), `register spawn: ${ap.code ?? ap.status}`);
@@ -279,7 +290,11 @@ export async function runJob(sessionId, opts, deps) {
             await reportFail(deps, sessionId, claim.epoch, "runner_failed", reason);
             return { kind: "outcome", outcome: failedOutcome(facts, reason) };
         }
-        const state = { contractValue: header.value, leaseKey: claim.leaseKey };
+        const state = {
+            contractValue: header.value,
+            leaseKey: claim.leaseKey,
+            agentId: job.agent_id,
+        };
         proxy = await deps.startProxy(state);
         let opensPr = false;
         for (const phase of phases) {
@@ -309,7 +324,7 @@ export async function runJob(sessionId, opts, deps) {
                 if (proxy.contractMismatch && !amended) {
                     // 34.11: the charter moved. Continue only on a higher sealed version with both the job
                     // and a fresh bundle bound to it; then the phase runs again under the new seal.
-                    const next = await amendedSeal(deps, sessionId, claim, bundle);
+                    const next = await amendedSeal(deps, sessionId, claim, bundle, job.agent_id);
                     if (!next)
                         return await refuse("contract_mismatch_unrecoverable", "the amended seal did not check out");
                     state.contractValue = next.value;
@@ -381,19 +396,29 @@ async function fetchBundle(deps, sessionId, claim) {
             detail: `jwks: ${jwksRes.networkError ?? jwksRes.status}`,
         };
     }
-    if (claim.executorId === null) {
-        // No answer named this runner's executor id, so the bundle cannot be bound to the claim.
+    if (deps.executorId !== null &&
+        claim.executorId !== null &&
+        deps.executorId !== claim.executorId) {
+        return {
+            kind: "refused",
+            reason: "bundle_binding_mismatch",
+            detail: "the claim answer names another executor_id than this runner's",
+        };
+    }
+    const executorId = deps.executorId ?? claim.executorId;
+    if (executorId === null) {
+        // Neither the runner nor the claim answer names the executor id, so the bundle cannot be bound.
         return {
             kind: "refused",
             reason: "bundle_binding_mismatch",
-            detail: "the claim answer named no executor_id",
+            detail: `no executor_id: set MNEMOM_EXECUTOR_ID, the claim answer named none`,
         };
     }
     const v = verifyServedPhaseBundle(res.text, jwksRes.body, {
         org_id: orgOf(res.body),
         session_id: sessionId,
         epoch: claim.epoch,
-        executor_id: claim.executorId,
+        executor_id: executorId,
         contract_sha256: claim.contractSha256,
         contract_version: claim.contractVersion,
     }, { now: deps.now });
@@ -410,11 +435,14 @@ function orgOf(body) {
     const o = body?.org_id;
     return typeof o === "string" ? o : "";
 }
-async function amendedSeal(deps, sessionId, claim, running) {
+async function amendedSeal(deps, sessionId, claim, running, agentId) {
     const jr = await deps.api.job(sessionId);
     const job = jr.status === 200 ? parseJob(jr.body) : null;
     if (!job || job.version <= claim.contractVersion)
         return null;
+    // An amend never moves the session to another agent.
+    if (job.agent_id !== agentId)
+        return null;
     const fresh = await fetchBundle(deps, sessionId, {
         ...claim,
         contractSha256: job.contract_sha256,
@@ -438,9 +466,9 @@ function sameWork(a, b) {
         canonicalJson({ workflow: b.workflow, phases: b.phases }));
 }
 /**
- * Report a failed or refused job after claim (34.12 (6), (10)). The fail reason vocabulary is the
- * Durable lead's to rule (A3 accepts only transcript_lost today); a refused report is logged and
- * never changes the outcome, because the lease lapses on its own.
+ * Report a failed job after claim (34.12 (6), (10)); a refusal releases the lease instead. The
+ * fail reason vocabulary is the Durable lead's to rule (A3 accepts only transcript_lost today); a
+ * fail the api refuses is logged and never changes the outcome, because the lease lapses on its own.
  */
 export async function reportFail(deps, sessionId, epoch, kind, reason) {
     const r = await deps.api.fail(sessionId, {

package/dist/lib/runner/oidc.d.ts

@@ -8,14 +8,15 @@
  * is oidc_<code> for S1's OIDC_EXCHANGE_REFUSALS, anything else oidc_unavailable. The token never
  * reaches argv, a log line or an outcome.
  *
- * S1 names the route but not its answer's field; `executor_key` is this runner's reading, open
- * with the Durable lead until S1 freezes it (no api handler exists yet to read it from).
+ * S1 names the route but not its answer's fields; `executor_key` (and `executor_id`, which binds
+ * the bundle) is this runner's reading, open with the Durable lead until S1 freezes it (no api handler exists yet to read it from).
  */
 import { type FetchFn } from "./executor-client.js";
 import type { RefusedReason } from "./outcome.js";
 export type OidcExchange = {
     ok: true;
     executorKey: string;
+    executorId: string | null;
 } | {
     ok: false;
     reason: RefusedReason;