@mnemom/mnemom 0.17.37 → 0.17.38-next.0

package/dist/commands/agent-run.d.ts

@@ -20,6 +20,7 @@ import { type GithubBases } from "../lib/runner/github-base.js";
 import type { JobDeps, Workspace } from "../lib/runner/job.js";
 import { type PhaseInvocation } from "../lib/runner/phases.js";
 import { type RunFlags } from "../lib/runner/options.js";
+import { type RecordCommitBody } from "../lib/commit-report.js";
 export interface RunDeps {
     env: NodeJS.ProcessEnv;
     fetch: FetchFn;
@@ -55,6 +56,16 @@ export declare function prepareWorkspace(git: Git, cloneUrl: string, sessionId:
 export declare function cleanupWorkspace(ws: Workspace): Promise<void>;
 /** Commits on the job branch that no origin ref has: the clone's base is origin's default branch. */
 export declare function commitsAhead(git: Git, ws: Workspace): Promise<number>;
+/**
+ * The working copy's HEAD; null only when the clone has no commit at all. Any other failure throws,
+ * so the job never mistakes an unreadable HEAD for "since the base" and re-reports earlier phases.
+ */
+export declare function headSha(git: Git, ws: Workspace): Promise<string | null>;
+/**
+ * RecordCommit/v1 bodies for the commits since `since` (null: since the base), oldest first. The
+ * repo is the job's: on a local lane origin is the fake GitHub, not github.com.
+ */
+export declare function commitBodies(git: Git, ws: Workspace, since: string | null, lineageKey: string, repo: string): Promise<RecordCommitBody[]>;
 /** Push the job branch and open its PR against the repo's default branch; resolves its URL. */
 export declare function openPr(git: Git, fetch: FetchFn, token: string | null, repo: string, ws: Workspace, title: string, body: string, apiBase?: string): Promise<string>;
 /** merge_on_green: GitHub's auto-merge on the PR (squash). */

package/dist/commands/agent-run.js

@@ -31,6 +31,7 @@ import { exitCodeFor, outcomeLine, refusedOutcome, USAGE_EXIT_CODE, } from "../l
 import { phaseEnv } from "../lib/runner/phases.js";
 import { resolveRunPlan } from "../lib/runner/options.js";
 import { startModelProxy } from "../lib/runner/proxy.js";
+import { commitBody, realGit } from "../lib/commit-report.js";
 import { resolveGithubToken } from "./agent-fuel.js";
 import { executorStatePath } from "../vendor/durable-contract/index.js";
 /** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
@@ -165,6 +166,40 @@ export async function commitsAhead(git, ws) {
         throw new Error(`git rev-list answered ${n}`);
     return n;
 }
+/**
+ * The working copy's HEAD; null only when the clone has no commit at all. Any other failure throws,
+ * so the job never mistakes an unreadable HEAD for "since the base" and re-reports earlier phases.
+ */
+export async function headSha(git, ws) {
+    let sha;
+    try {
+        sha = await git(ws.dir, ["rev-parse", "--verify", "--quiet", "HEAD"]);
+    }
+    catch (e) {
+        if ((await git(ws.dir, ["rev-list", "-n", "1", "--all"])) === "")
+            return null;
+        throw e;
+    }
+    if (!/^[0-9a-f]{40}$/.test(sha))
+        throw new Error(`git rev-parse answered ${sha.slice(0, 40)}`);
+    return sha;
+}
+/**
+ * RecordCommit/v1 bodies for the commits since `since` (null: since the base), oldest first. The
+ * repo is the job's: on a local lane origin is the fake GitHub, not github.com.
+ */
+export async function commitBodies(git, ws, since, lineageKey, repo) {
+    const range = since === null ? ["HEAD", "--not", "--remotes=origin"] : [`${since}..HEAD`];
+    const out = await git(ws.dir, ["rev-list", "--reverse", ...range]);
+    const local = realGit(ws.dir);
+    const bodies = [];
+    for (const sha of out.split("\n").filter(Boolean)) {
+        const built = commitBody(local, sha, lineageKey, repo);
+        if (built.ok)
+            bodies.push(built.body);
+    }
+    return bodies;
+}
 /** Push the job branch and open its PR against the repo's default branch; resolves its URL. */
 export async function openPr(git, fetch, token, repo, ws, title, body, apiBase = GITHUB_BASES.api) {
     await git(ws.dir, ["push", "--quiet", "origin", `HEAD:refs/heads/${ws.branch}`]);
@@ -239,6 +274,8 @@ export function liveJobDeps(api, opts) {
         runPhase: (inv, ws, modelUrl, signal) => runPhaseProcess(inv, ws, modelUrl, signal, opts.env),
         openPr: (repo, ws, title, body) => openPr(git, opts.fetch, token, repo, ws, title, body, gh.api),
         commitsAhead: (ws) => commitsAhead(git, ws),
+        headSha: (ws) => headSha(git, ws),
+        commitBodies: (ws, since, lineageKey, repo) => commitBodies(git, ws, since, lineageKey, repo),
         enableAutoMerge: (prUrl) => enableAutoMerge(opts.fetch, token, prUrl, gh),
         cleanup: cleanupWorkspace,
     };

package/dist/commands/agent-share-render.d.ts

@@ -1,13 +1,13 @@
 /**
- * Bridge from `mnemom agent share` to the aip verifier (`@mnemom/aip-verifier`, aip#192/#178):
+ * Bridge from `mnemom agent share` to the aip verifier (`@mnemom/verify`, aip#192/#178):
  * the renderer (`renderLines`) and claim-lint (`lintRendering`) are the ONLY source of what a
- * card may say. No word lists live here. The package is a runtime dependency pinned to the aip
- * release tarball and is loaded lazily, so the default CLI path never touches it; if it is
+ * card may say. No word lists live here. The package is a runtime dependency pinned to an exact
+ * npm registry version and is loaded lazily, so the default CLI path never touches it; if it is
  * absent at runtime the share command fails closed with a clear message.
  */
 import type { LineRenderer, SharedCardLine } from "./agent-share.js";
-import type * as AipMain from "@mnemom/aip-verifier";
-import type * as AipRender from "@mnemom/aip-verifier/render-lines";
+import type * as AipMain from "@mnemom/verify";
+import type * as AipRender from "@mnemom/verify/render-lines";
 export interface VerifierModules {
     lintRendering: typeof AipMain.lintRendering;
     renderLines: typeof AipRender.renderLines;

package/dist/commands/agent-share-render.js

@@ -1,14 +1,14 @@
 /**
- * Bridge from `mnemom agent share` to the aip verifier (`@mnemom/aip-verifier`, aip#192/#178):
+ * Bridge from `mnemom agent share` to the aip verifier (`@mnemom/verify`, aip#192/#178):
  * the renderer (`renderLines`) and claim-lint (`lintRendering`) are the ONLY source of what a
- * card may say. No word lists live here. The package is a runtime dependency pinned to the aip
- * release tarball and is loaded lazily, so the default CLI path never touches it; if it is
+ * card may say. No word lists live here. The package is a runtime dependency pinned to an exact
+ * npm registry version and is loaded lazily, so the default CLI path never touches it; if it is
  * absent at runtime the share command fails closed with a clear message.
  */
 const defaultLoader = async () => {
     const [main, render] = await Promise.all([
-        import("@mnemom/aip-verifier"),
-        import("@mnemom/aip-verifier/render-lines"),
+        import("@mnemom/verify"),
+        import("@mnemom/verify/render-lines"),
     ]);
     return { lintRendering: main.lintRendering, renderLines: render.renderLines };
 };
@@ -20,9 +20,11 @@ async function loadVerifier(load) {
     catch (error) {
         const e = error;
         if (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND") {
-            throw new Error("the aip verifier (@mnemom/aip-verifier) is not installed: it ships bundled inside @mnemom/mnemom, so reinstall with `npm install -g @mnemom/mnemom`", { cause: error });
+            throw new Error("the aip verifier (@mnemom/verify) is not installed: it is a dependency of @mnemom/mnemom, so reinstall with `npm install -g @mnemom/mnemom`", { cause: error });
         }
-        throw new Error(`the aip verifier (@mnemom/aip-verifier) failed to load: ${e.message ?? error}`, { cause: error });
+        throw new Error(`the aip verifier (@mnemom/verify) failed to load: ${e.message ?? error}`, {
+            cause: error,
+        });
     }
 }
 /**

package/dist/commands/agent-share-test-issuer.d.ts

@@ -23,7 +23,7 @@
  * TEST_SHARECARD_PUBLIC_KEY_HEX / TEST_SHARECARD_JWKS below, which a verifier must be given
  * explicitly as the trusted key; the production JWKS never contains it.
  */
-import type * as AipVerifier from "@mnemom/aip-verifier";
+import type * as AipVerifier from "@mnemom/verify";
 import type { AgentShareDeps, CardIssuer } from "./agent-share.js";
 /** aip test key id; ids of every test key start with this prefix. */
 export declare const TEST_KEY_ID = "test-sharecard-key-1";

package/dist/commands/agent-share-test-issuer.js

@@ -80,7 +80,7 @@ const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "he
 export function createTestCardIssuer(opts = {}) {
     const now = opts.now ?? (() => new Date());
     const cardId = opts.cardId ?? (() => `card-test-${randomBytes(6).toString("hex")}`);
-    const load = opts.loadVerifier ?? (() => import("@mnemom/aip-verifier"));
+    const load = opts.loadVerifier ?? (() => import("@mnemom/verify"));
     return {
         async issue(lines) {
             const { shareCardSigningInput } = await load();

package/dist/commands/agent.d.ts

@@ -401,11 +401,18 @@ export declare function fedStatuslineWanted(version: string): boolean;
  */
 export declare function exemptLoopbackFromProxy(env: NodeJS.ProcessEnv): void;
 /**
- * Print the conduct receipt (experimental `record`) — the exit call site here, and the one a
+ * Print the conduct receipt (on by default; MNEMOM_AGENT_RECEIPT=0 opts out) — the exit call site here, and the one a
  * durable park calls. Never throws: a failure is one warning line, and the caller's exit code
  * is untouched.
  */
 export declare function sayConductReceipt(launch: ReceiptLaunch, trigger?: "exit" | "park", receipt?: typeof conductReceiptFor): Promise<void>;
+/**
+ * Whether `mnemom agent` reads and prints the conduct receipt at exit (MNE-9013: on by default,
+ * graduated from experimental `record`; MNEMOM_AGENT_RECEIPT=0 opts out). Claude only: the
+ * receipt reads the lineage key the base-URL proxy captures, and that proxy fronts
+ * ANTHROPIC_BASE_URL alone, so another CLI would only gain a proxy that can capture nothing.
+ */
+export declare function receiptWanted(env: NodeJS.ProcessEnv): boolean;
 /** Whether a terminal implicit launch runs the turn-origin proxy (MNEMOM_AGENT_TURN_HEADER=0 opts out). */
 export declare function turnProxyWanted(env: NodeJS.ProcessEnv): boolean;
 /** The flag that lets base-url-proxy.mjs use an http door on a loopback literal (C17-R16 T3). */

package/dist/commands/agent.js

@@ -847,7 +847,7 @@ export async function agentCommand(scenarioArg, options = {}) {
     if (shape === "terminal") {
         // Record keys the lineage under the served agent's org, not the account org (lib/record-org).
         const recordOrgId = recordOrgWanted({
-            receipt: experimental.includes("record"),
+            receipt: cli.name === "claude" && receiptWanted(process.env),
             commitReport: cli.name === "claude" && commitReportEnabled(process.env[COMMIT_REPORT_ENV]),
             fedStatusline: cli.name === "claude" && fedStatuslineWanted(CLI_VERSION),
         }) && account.orgId
@@ -895,7 +895,8 @@ export async function agentCommand(scenarioArg, options = {}) {
                     },
                 }
                 : {}),
-            receipt: experimental.includes("record")
+            // On by default (MNE-9013); prints only when the org's record returns tally data.
+            receipt: cli.name === "claude" && Boolean(account.orgId) && receiptWanted(process.env)
                 ? { orgId: recordOrgId, agentId: servedAgentId }
                 : undefined,
             orgId: recordOrgId,
@@ -1671,7 +1672,7 @@ export function exemptLoopbackFromProxy(env) {
     env.no_proxy = [lower, "127.0.0.1,localhost"].filter(Boolean).join(",");
 }
 /**
- * Print the conduct receipt (experimental `record`) — the exit call site here, and the one a
+ * Print the conduct receipt (on by default; MNEMOM_AGENT_RECEIPT=0 opts out) — the exit call site here, and the one a
  * durable park calls. Never throws: a failure is one warning line, and the caller's exit code
  * is untouched.
  */
@@ -1684,6 +1685,16 @@ export async function sayConductReceipt(launch, trigger = "exit", receipt = cond
         say(fmt.warn(`mnemom agent: no conduct receipt (${err instanceof Error ? err.message : String(err)})`));
     }
 }
+/**
+ * Whether `mnemom agent` reads and prints the conduct receipt at exit (MNE-9013: on by default,
+ * graduated from experimental `record`; MNEMOM_AGENT_RECEIPT=0 opts out). Claude only: the
+ * receipt reads the lineage key the base-URL proxy captures, and that proxy fronts
+ * ANTHROPIC_BASE_URL alone, so another CLI would only gain a proxy that can capture nothing.
+ */
+export function receiptWanted(env) {
+    const raw = (env.MNEMOM_AGENT_RECEIPT ?? "").trim().toLowerCase();
+    return !["0", "off", "false", "no"].includes(raw);
+}
 /** Whether a terminal implicit launch runs the turn-origin proxy (MNEMOM_AGENT_TURN_HEADER=0 opts out). */
 export function turnProxyWanted(env) {
     const raw = (env.MNEMOM_AGENT_TURN_HEADER ?? "").trim().toLowerCase();

package/dist/commands/scan.d.ts

@@ -7,7 +7,8 @@
 import { type GitHubCredential } from "../lib/scan/credential.js";
 import { type ScanDeps, type ScanResult } from "../lib/scan/scan.js";
 import { selectSpend } from "../lib/scan/spend/spend-tiers.js";
-import { type AnthropicUsageDeps } from "../lib/scan/spend/anthropic-usage.js";
+import { type AnthropicUsageDeps, type MeasuredUsage } from "../lib/scan/spend/anthropic-usage.js";
+import { type WifDeps } from "../lib/scan/spend/anthropic-wif.js";
 import { type RecordDeps, type RecordOutcome } from "../lib/scan/record.js";
 import { type CostSpend } from "../lib/scan/cost-per-pr.js";
 import { type ReportEmailDeps } from "../lib/scan/report-email.js";
@@ -33,6 +34,8 @@ export interface ScanCommandOptions {
     anthropicOver200kShare?: number | null;
     /** Test seam: the fetch behind the two Anthropic reads. */
     anthropicDeps?: AnthropicUsageDeps;
+    /** Test seam: the WIF assertion mint and Anthropic token exchange (MNE-9706). */
+    wifDeps?: WifDeps;
     /**
      * The org the report is emailed for; inferred from the signed-in user's single non-personal org when
      * omitted (see resolveScanOrg). The Record totals preview (MNEMOM_ORG_SCAN_MODE=true) reads ONLY an
@@ -93,10 +96,20 @@ export declare const TIER1_FALLBACK_NOTE = "Tier 1 skipped: falling back to the
  * fixed sentence: the key, the thrown value and the response never reach the terminal. The caller then falls
  * back to tier 2, then tier 3.
  */
+export declare const WIF_OK_NOTE = "Read Anthropic usage through workload identity federation.";
+/**
+ * Tier 1 through WIF (MNE-9706): Mnemom issues an identity token for the org, this machine exchanges it at
+ * Anthropic and reads only the two usage reports with the result. "not_configured" when the WIF ids are
+ * not set; "failed" (after printing a fixed sentence) for every failure, so the caller falls back to the key.
+ */
+export declare function measuredUsageViaWif(o: ScanCommandOptions, orgId: string, period: {
+    start: string;
+    end: string;
+}): Promise<MeasuredUsage | "not_configured" | "failed">;
 export declare function resolveMeasuredUsage(o: ScanCommandOptions, period: {
     start: string;
     end: string;
-}): Promise<{
+}, orgId?: string): Promise<{
     usd: number;
     over200kShare: number | null;
 } | null>;

package/dist/commands/scan.js

@@ -9,7 +9,8 @@ import { failureText } from "../lib/scan/failure.js";
 import { runLocalScan } from "../lib/scan/scan.js";
 import { askInput, askSelect } from "../lib/prompt.js";
 import { isSpendTiersEnabled, NOT_ENABLED_MSG, parseMonthlySpendUsd, selectSpend, SPEND_INVALID_MSG, SPEND_NO_TERMINAL_MSG, } from "../lib/scan/spend/spend-tiers.js";
-import { ADMIN_KEY_ENV, AnthropicUsageError, fetchMeasuredUsage, isAdminKeyShape, usageFailureText, } from "../lib/scan/spend/anthropic-usage.js";
+import { ADMIN_KEY_ENV, AnthropicUsageError, fetchMeasuredUsage, isAdminKeyShape, usageFailureText, bearerAuth, fetchMeasuredUsageWithAuth, } from "../lib/scan/spend/anthropic-usage.js";
+import { obtainWifAccessToken, readWifConfig, WIF_FALLBACK_NOTE, WifError, wifFailureText, } from "../lib/scan/spend/anthropic-wif.js";
 import { getAuthInfo } from "../lib/auth.js";
 import { listMyOrgs } from "../lib/api.js";
 import { getActiveOrg } from "../lib/cli-config.js";
@@ -96,7 +97,37 @@ export const TIER1_FALLBACK_NOTE = "Tier 1 skipped: falling back to the next tie
  * fixed sentence: the key, the thrown value and the response never reach the terminal. The caller then falls
  * back to tier 2, then tier 3.
  */
-export async function resolveMeasuredUsage(o, period) {
+export const WIF_OK_NOTE = "Read Anthropic usage through workload identity federation.";
+/**
+ * Tier 1 through WIF (MNE-9706): Mnemom issues an identity token for the org, this machine exchanges it at
+ * Anthropic and reads only the two usage reports with the result. "not_configured" when the WIF ids are
+ * not set; "failed" (after printing a fixed sentence) for every failure, so the caller falls back to the key.
+ */
+export async function measuredUsageViaWif(o, orgId, period) {
+    let cfg;
+    try {
+        cfg = readWifConfig(o.env ?? process.env);
+    }
+    catch (e) {
+        console.log(wifFailureText(e instanceof WifError ? e.reason : "config_invalid"));
+        return "failed";
+    }
+    if (cfg === null)
+        return "not_configured";
+    try {
+        const token = await obtainWifAccessToken(orgId, cfg, o.wifDeps);
+        const usage = await fetchMeasuredUsageWithAuth(bearerAuth(token.accessToken), period, o.anthropicDeps);
+        console.log(WIF_OK_NOTE);
+        return usage;
+    }
+    catch (e) {
+        console.log(e instanceof WifError
+            ? wifFailureText(e.reason)
+            : usageFailureText(e instanceof AnthropicUsageError ? e.reason : "upstream"));
+        return "failed";
+    }
+}
+export async function resolveMeasuredUsage(o, period, orgId) {
     if (o.anthropicAdminKey && !isSpendTiersEnabled(o.env))
         throw new Error(NOT_ENABLED_MSG);
     if (!isSpendTiersEnabled(o.env) || o.noAnthropicUsage)
@@ -105,6 +136,20 @@ export async function resolveMeasuredUsage(o, period) {
     if (o.monthlySpend !== undefined && !o.anthropicAdminKey)
         return null;
     let key = (o.env ?? process.env)[ADMIN_KEY_ENV];
+    // MNE-9706: WIF first when it is set up, unless the user explicitly asked to paste a key.
+    let wifFailed = false;
+    if (!o.anthropicAdminKey && orgId !== undefined) {
+        const viaWif = await measuredUsageViaWif(o, orgId, period);
+        if (viaWif !== "not_configured" && viaWif !== "failed")
+            return viaWif;
+        wifFailed = viaWif === "failed";
+    }
+    if (wifFailed) {
+        const hasKey = key !== undefined && key.trim() !== "";
+        console.log(hasKey ? WIF_FALLBACK_NOTE : TIER1_FALLBACK_NOTE);
+        if (!hasKey)
+            return null;
+    }
     if (o.anthropicAdminKey) {
         if (!(o.isTty ?? process.stdin.isTTY))
             throw new Error(NO_ADMIN_KEY_TERMINAL_MSG);
@@ -218,7 +263,7 @@ export async function scanCommand(o) {
     const now = o.now ?? Date.now;
     const end = new Date(now()).toISOString().slice(0, 10);
     const period = o.period ?? { start: end, end };
-    const measured = await resolveMeasuredUsage(o, period);
+    const measured = await resolveMeasuredUsage(o, period, emailOrg);
     const credential = pickedCredential ?? (await getCredential());
     // Before the local scan: a refused credential fails closed without spending the GitHub reads.
     const record = await resolveRecordOutcome(o);

package/dist/index.js

@@ -2390,7 +2390,7 @@ program
     .option("--share <level>", "summary | full | none (default: full when asked; none when not interactive)")
     .option("--cto-email <email>", "CTO who receives the report (required unless you are the CTO; asked when omitted)")
     .option("--monthly-spend <usd>", "Your own approximate monthly AI spend (self-reported; never sent or saved; needs MNEMOM_ORG_SCAN_MODE=true)")
-    .option("--anthropic-admin-key", "Ask (masked) for your Anthropic admin key and read measured usage with it, locally; or set ANTHROPIC_ADMIN_KEY. Never stored, logged or sent anywhere but api.anthropic.com (needs MNEMOM_ORG_SCAN_MODE=true)")
+    .option("--anthropic-admin-key", "Ask (masked) for your Anthropic admin key and read measured usage with it, locally; or set ANTHROPIC_ADMIN_KEY. Never stored, logged or sent anywhere but api.anthropic.com. Without this flag, workload identity federation is tried first when ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID and ANTHROPIC_SERVICE_ACCOUNT_ID are set (needs MNEMOM_ORG_SCAN_MODE=true)")
     .option("--no-anthropic-usage", "Decline Anthropic usage and be asked for a monthly figure (needs MNEMOM_ORG_SCAN_MODE=true)")
     .option("--org <org_id>", "Your org id; the report is emailed to you for this org (default: your only organization, else the scan stops and asks). Also selects the Record totals preview (needs MNEMOM_ORG_SCAN_MODE=true)")
     .action(async (options) => {

package/dist/lib/commit-report.d.ts

@@ -51,17 +51,8 @@ export declare function attributionSettings(conversationId: string, user: string
 };
 /** `owner/name` from a GitHub remote URL (https, ssh or scp form), or null. */
 export declare function parseRepoSlug(url: string): string | null;
-/** The commit index body's schema tag (shared with the fleet worker's reporter). */
-export declare const COMMIT_SCHEMA = "RecordCommit/v1";
-/** RecordCommit/v1: strings only, every field required; the route rejects an unknown field. */
-export interface RecordCommitBody {
-    schema: typeof COMMIT_SCHEMA;
-    lineage_key: string;
-    repo: string;
-    branch: string;
-    sha: string;
-    patch_id: string;
-}
+import { COMMIT_SCHEMA, type RecordCommitBody } from "./runner/record-commit.js";
+export { COMMIT_SCHEMA, type RecordCommitBody };
 /** Runs git in the session's repository; null on any failure. */
 export type Git = (args: string[], input?: string) => string | null;
 export declare function realGit(cwd: string): Git;
@@ -71,8 +62,11 @@ export declare function realGit(cwd: string): Git;
  * teammate's fetched commit is never reported as this session's.
  */
 export declare function sessionCommits(git: Git, sinceSec: number): string[];
-/** The body for one commit, or the fields that could not be read. */
-export declare function commitBody(git: Git, sha: string, lineageKey: string): {
+/**
+ * The body for one commit, or the fields that could not be read. `repo` overrides the slug read
+ * from `origin`: the runner knows its job's repo, and on a local lane `origin` is not github.com.
+ */
+export declare function commitBody(git: Git, sha: string, lineageKey: string, repoOverride?: string): {
     ok: true;
     body: RecordCommitBody;
 } | {

package/dist/lib/commit-report.js

@@ -65,8 +65,8 @@ export function parseRepoSlug(url) {
     const slug = `${m[1]}/${m[2]}`;
     return REPO_SLUG.test(slug) ? slug : null;
 }
-/** The commit index body's schema tag (shared with the fleet worker's reporter). */
-export const COMMIT_SCHEMA = "RecordCommit/v1";
+import { COMMIT_SCHEMA } from "./runner/record-commit.js";
+export { COMMIT_SCHEMA };
 export function realGit(cwd) {
     return (args, input) => {
         const r = spawnSync("git", args, { cwd, encoding: "utf8", input, timeout: 10_000 });
@@ -91,8 +91,11 @@ export function sessionCommits(git, sinceSec) {
         .filter(([sha, ce]) => sha !== undefined && HEX40.test(sha) && ce === email)
         .map(([sha]) => sha);
 }
-/** The body for one commit, or the fields that could not be read. */
-export function commitBody(git, sha, lineageKey) {
+/**
+ * The body for one commit, or the fields that could not be read. `repo` overrides the slug read
+ * from `origin`: the runner knows its job's repo, and on a local lane `origin` is not github.com.
+ */
+export function commitBody(git, sha, lineageKey, repoOverride) {
     const diff = git(["diff-tree", "-p", "--root", sha]);
     const patchId = diff
         ? (/^\s*([0-9a-f]{40})\b/.exec(git(["patch-id", "--stable"], diff) ?? "")?.[1] ?? "")
@@ -103,7 +106,11 @@ export function commitBody(git, sha, lineageKey) {
         .map((s) => s.trim())
         .filter(Boolean);
     const branch = holders.includes(current) ? current : (holders[0] ?? "");
-    const repo = parseRepoSlug(git(["remote", "get-url", "origin"]) ?? "") ?? "";
+    const repo = repoOverride !== undefined
+        ? REPO_SLUG.test(repoOverride)
+            ? repoOverride
+            : ""
+        : (parseRepoSlug(git(["remote", "get-url", "origin"]) ?? "") ?? "");
     const missing = [];
     if (!HEX40.test(sha))
         missing.push("sha");

package/dist/lib/conduct-receipt.d.ts

@@ -1,6 +1,9 @@
 /**
- * The conduct receipt (experimental `record`, Doors W1.2 / W1.3): the engineer's private view of
- * one session, printed when `mnemom agent` exits and when a durable session parks.
+ * The conduct receipt (Doors W1.2 / W1.3): the engineer's private view of one session, printed
+ * when `mnemom agent` exits and when a durable session parks. On by default since 0.17.38
+ * (MNE-9013; MNEMOM_AGENT_RECEIPT=0 opts out). It prints ONLY when the server returns tally data:
+ * an org outside the record cohort (404), a caller without the role (403), no captured lineage,
+ * or a read that never answers inside the deadline all print nothing.
  *
  *   Conduct receipt
  *     model cost  $0.42
@@ -13,7 +16,7 @@
  *
  * NEVER BLOCKS EXIT. The whole read, auth refresh included, races a hard deadline
  * (RECEIPT_DEADLINE_MS): with the API or the record builder down, exit takes at most that much
- * longer, and the receipt falls back to the link. The caller keeps its exit code; nothing here
+ * longer, and the receipt prints nothing. The caller keeps its exit code; nothing here
  * throws.
  *
  * The lineage key is the gateway's (x-mnemom-lineage-key, set on every response), captured by the
@@ -35,6 +38,8 @@ export type TotalsRead = {
     muChargedMmu: bigint | null;
 } | {
     kind: "unavailable";
+} | {
+    kind: "absent";
 };
 export interface ReceiptDeps {
     /** One totals read for the lineage; may throw or hang (both are "unavailable"). */

package/dist/lib/conduct-receipt.js

@@ -1,6 +1,9 @@
 /**
- * The conduct receipt (experimental `record`, Doors W1.2 / W1.3): the engineer's private view of
- * one session, printed when `mnemom agent` exits and when a durable session parks.
+ * The conduct receipt (Doors W1.2 / W1.3): the engineer's private view of one session, printed
+ * when `mnemom agent` exits and when a durable session parks. On by default since 0.17.38
+ * (MNE-9013; MNEMOM_AGENT_RECEIPT=0 opts out). It prints ONLY when the server returns tally data:
+ * an org outside the record cohort (404), a caller without the role (403), no captured lineage,
+ * or a read that never answers inside the deadline all print nothing.
  *
  *   Conduct receipt
  *     model cost  $0.42
@@ -13,14 +16,14 @@
  *
  * NEVER BLOCKS EXIT. The whole read, auth refresh included, races a hard deadline
  * (RECEIPT_DEADLINE_MS): with the API or the record builder down, exit takes at most that much
- * longer, and the receipt falls back to the link. The caller keeps its exit code; nothing here
+ * longer, and the receipt prints nothing. The caller keeps its exit code; nothing here
  * throws.
  *
  * The lineage key is the gateway's (x-mnemom-lineage-key, set on every response), captured by the
  * local base-URL proxy into a state file: the CLI never derives one itself.
  */
 import { readFileSync } from "node:fs";
-import { getRecordTotals } from "./api.js";
+import { getRecordTotals, MnemomApiError } from "./api.js";
 import { getWebsiteUrl } from "./config.js";
 /** The hard ceiling on what the receipt adds to exit (W1.3: at most 2 s). */
 export const RECEIPT_DEADLINE_MS = 1800;
@@ -101,7 +104,7 @@ export function formatMu(mmu) {
 /** The receipt lines for what was read (pure). */
 export function receiptLines(read, link, trigger = "exit") {
     const head = trigger === "park" ? "Conduct receipt (parked)" : "Conduct receipt";
-    if (!read || read.kind === "unavailable") {
+    if (!read || read.kind !== "ok") {
         return [head, `  record not available yet: ${link}`];
     }
     const lines = [head, `  model cost  ${formatUsd(read.modelCostMmu)}`];
@@ -117,8 +120,9 @@ export function receiptLines(read, link, trigger = "exit") {
  */
 export async function buildConductReceipt(state, deps, trigger = "exit") {
     const link = state.recordUrl ?? deps.fallbackUrl;
+    // No lineage captured: nothing to read, so nothing to print.
     if (!state.lineageKey)
-        return receiptLines(null, link, trigger);
+        return [];
     const now = deps.now ?? Date.now;
     const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const deadline = now() + (deps.deadlineMs ?? RECEIPT_DEADLINE_MS);
@@ -130,6 +134,10 @@ export async function buildConductReceipt(state, deps, trigger = "exit") {
         if (left <= 0)
             break;
         const read = await readWithin(deps.readTotals, lineageKey, left);
+        // Not in the cohort, or no role to read it: stop at once, no exit delay. An earlier good read
+        // (the cohort or role changed mid-poll) still prints; otherwise nothing does.
+        if (read.kind === "absent")
+            break;
         // A later failure never hides an earlier good read.
         if (read.kind === "ok" || !last)
             last = read;
@@ -139,6 +147,9 @@ export async function buildConductReceipt(state, deps, trigger = "exit") {
             break;
         await sleep(pollMs);
     }
+    // Only tally data prints: every read failing or timing out stays silent.
+    if (!last || last.kind !== "ok")
+        return [];
     return receiptLines(last, link, trigger);
 }
 async function readWithin(readTotals, lineageKey, ms) {
@@ -171,7 +182,18 @@ export async function conductReceiptFor(launch, trigger = "exit", deps = {}) {
     return buildConductReceipt(readRecordState(launch.statePath), {
         ...deps,
         readTotals: deps.readTotals ??
-            (async (lineageKey, signal) => parseTotals(await getRecordTotals(launch.orgId, lineageKey, signal))),
+            (async (lineageKey, signal) => {
+                try {
+                    return parseTotals(await getRecordTotals(launch.orgId, lineageKey, signal));
+                }
+                catch (err) {
+                    // effectiveStatus, not status: the enforce hook may rewrite a 404 to a synthetic 500.
+                    if (err instanceof MnemomApiError && [403, 404].includes(err.effectiveStatus)) {
+                        return { kind: "absent" };
+                    }
+                    throw err;
+                }
+            }),
         fallbackUrl: deps.fallbackUrl ?? `${getWebsiteUrl()}/agents/${encodeURIComponent(launch.agentId)}`,
     }, trigger);
 }

package/dist/lib/experimental.d.ts

@@ -12,7 +12,7 @@
  * Everything here is pure or dependency-injected; index.ts and the command
  * modules are the thin drivers.
  */
-export type ExperimentalId = "context-handoff" | "slack" | "implicit" | "measured-savings" | "record" | "fuel" | "durable" | "dispatch";
+export type ExperimentalId = "context-handoff" | "slack" | "implicit" | "measured-savings" | "fuel" | "durable" | "dispatch";
 /**
  * Features that used to be experimental and are now on by default for everyone. Their ids are
  * no longer in the registry, but `mnemom experimental enable|disable <id>` still accepts them

package/dist/lib/experimental.js

@@ -24,6 +24,7 @@ export const GRADUATED_FEATURES = {
         since: "0.17.23",
         optOut: "--no-compaction-intercept, `compaction_intercept = false` in launcher.toml, or MNEMOM_AGENT_COMPACTION_INTERCEPT=0",
     },
+    record: { since: "0.17.38", optOut: "MNEMOM_AGENT_RECEIPT=0" },
 };
 /** The one-line note for `mnemom experimental enable|disable <graduated id>`; null otherwise. */
 export function graduatedNote(id) {
@@ -85,18 +86,6 @@ export const EXPERIMENTAL_FEATURES = [
             env: [],
         },
     },
-    {
-        // No flag, launcher.toml key or env of its own: `mnemom experimental enable` is the switch.
-        id: "record",
-        summary: "Print the conduct receipt at exit: the session's measured model cost and μ, or the record link",
-        since: "0.17.32",
-        gates: {
-            flags: [],
-            configKeys: [],
-            commands: [],
-            env: [],
-        },
-    },
     {
         id: "fuel",
         summary: "The fuel step: `mnemom agent fuel <file>` seals a batch of job contracts with one confirmation and commits them to the repo",

package/dist/lib/runner/executor-client.d.ts

@@ -8,6 +8,7 @@
  * Nothing here decides an outcome: each call returns its status, body and error code, and the job
  * (job.ts) maps them to 34.12's reasons. Never throws: a network failure is status 0.
  */
+import type { RecordCommitBody } from "./record-commit.js";
 import type { ExecAppendBody } from "./exec-append.js";
 export interface HttpResult {
     readonly status: number;
@@ -34,6 +35,8 @@ export declare const JOB_READ_PATH: (sessionId: string) => string;
 /** The served bundle fetch, per claim (W-L12). */
 export declare const BUNDLE_FETCH_PATH: (sessionId: string) => string;
 export declare const JWKS_PATH = "/v1/.well-known/jwks.json";
+/** Record's commit index (ruling 34.05 (a)): the lease key may write the session's own commits. */
+export declare const RECORD_COMMITS_PATH: (orgId: string) => string;
 export interface RunnerApi {
     readyList(limit: number): Promise<HttpResult>;
     attest(sessionId: string, nonce: string): Promise<HttpResult>;
@@ -63,6 +66,8 @@ export interface RunnerApi {
     job(sessionId: string): Promise<HttpResult>;
     bundle(sessionId: string, leaseKey: string): Promise<HttpResult>;
     jwks(): Promise<HttpResult>;
+    /** One RecordCommit/v1 body, with the lease key; the api pins it to the session's lineage. */
+    recordCommit(orgId: string, body: RecordCommitBody, leaseKey: string): Promise<HttpResult>;
 }
 export declare function runnerApi(opts: {
     apiUrl: string;

package/dist/lib/runner/executor-client.js

@@ -34,6 +34,9 @@ export const JOB_READ_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/
 /** The served bundle fetch, per claim (W-L12). */
 export const BUNDLE_FETCH_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/bundle`;
 export const JWKS_PATH = "/v1/.well-known/jwks.json";
+/** Record's commit index (ruling 34.05 (a)): the lease key may write the session's own commits. */
+export const RECORD_COMMITS_PATH = (orgId) => `/v1/orgs/${encodeURIComponent(orgId)}/record/commits`;
+const ORG_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
 const SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 export function runnerApi(opts) {
     const base = opts.apiUrl.replace(/\/+$/, "");
@@ -93,5 +96,10 @@ export function runnerApi(opts) {
         job: (id) => call(JOB_READ_PATH(scoped(id)), "GET", ex),
         bundle: (id, leaseKey) => call(BUNDLE_FETCH_PATH(scoped(id)), "GET", leaseKey),
         jwks: () => call(JWKS_PATH, "GET", null),
+        recordCommit: (orgId, body, leaseKey) => {
+            if (!ORG_ID_RE.test(orgId))
+                throw new RangeError("org id is not a Mnemom org id");
+            return call(RECORD_COMMITS_PATH(orgId), "POST", leaseKey, body);
+        },
     };
 }