@mnemom/mnemom 0.17.37 → 0.17.38-next.1

package/dist/commands/agent-doctor.d.ts

@@ -10,7 +10,7 @@
  * (200 + the x-mnemom-verdict header that proves the governance pipeline is
  * live), Remote-Control capability (node + openssl + the --remote-control flag),
  * claude.ai login (informational — Remote Control needs it), the agent's governance
- * modes (off by default for new agents), and CLI auto-update status.
+ * modes (integrity observe, Safe House off for new agents), and CLI auto-update status.
  */
 type Mark = "ok" | "warn" | "miss" | "info";
 export interface DoctorOptions {
@@ -51,7 +51,7 @@ export interface GovernanceProbe {
 /**
  * The governance line: the composed (every layer, strictest wins) integrity and
  * Safe House modes of the agent a launch would use. Signed out, no such agent,
- * or an unreadable card → info with the off-by-default note, never a MISS
+ * or an unreadable card → info with the new-agent default note, never a MISS
  * (governance never blocks a launch). On → info naming the per-turn cost; a
  * stricter layer outranks the agent's own card (any rung up the ladder off <
  * observe < nudge < enforce, MNE-8612) → warn naming the layer.

package/dist/commands/agent-doctor.js

@@ -10,7 +10,7 @@
  * (200 + the x-mnemom-verdict header that proves the governance pipeline is
  * live), Remote-Control capability (node + openssl + the --remote-control flag),
  * claude.ai login (informational — Remote Control needs it), the agent's governance
- * modes (off by default for new agents), and CLI auto-update status.
+ * modes (integrity observe, Safe House off for new agents), and CLI auto-update status.
  */
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
@@ -119,7 +119,7 @@ export async function agentDoctorCommand(options = {}) {
             add("info", "claude.ai login: could not determine");
     }
     add(gate.mark, gate.text, gate.hint);
-    // ── governance (off by default for new agents) ──
+    // ── governance (integrity observe, Safe House off for new agents) ──
     const gov = await probeGovernance(options.agent);
     add(gov.mark, gov.text, gov.hint);
     // ── CLI auto-update ──
@@ -236,7 +236,7 @@ const OPT_IN_HINT = GOVERNANCE_OPT_IN_HINT.trim();
 /**
  * The governance line: the composed (every layer, strictest wins) integrity and
  * Safe House modes of the agent a launch would use. Signed out, no such agent,
- * or an unreadable card → info with the off-by-default note, never a MISS
+ * or an unreadable card → info with the new-agent default note, never a MISS
  * (governance never blocks a launch). On → info naming the per-turn cost; a
  * stricter layer outranks the agent's own card (any rung up the ladder off <
  * observe < nudge < enforce, MNE-8612) → warn naming the layer.
@@ -244,7 +244,7 @@ const OPT_IN_HINT = GOVERNANCE_OPT_IN_HINT.trim();
 export async function probeGovernance(agent) {
     const offByDefault = {
         mark: "info",
-        text: "governance: off by default for new agents (AIP integrity analysis, Safe House screening)",
+        text: "governance: new agents get AIP integrity analysis (observe); Safe House screening is off by default",
         hint: `${OPT_IN_HINT} Agents set up before this default keep their cards.`,
     };
     if (!(await isLoggedIn()))

package/dist/commands/agent-run.d.ts

@@ -20,6 +20,7 @@ import { type GithubBases } from "../lib/runner/github-base.js";
 import type { JobDeps, Workspace } from "../lib/runner/job.js";
 import { type PhaseInvocation } from "../lib/runner/phases.js";
 import { type RunFlags } from "../lib/runner/options.js";
+import { type RecordCommitBody } from "../lib/commit-report.js";
 export interface RunDeps {
     env: NodeJS.ProcessEnv;
     fetch: FetchFn;
@@ -55,6 +56,16 @@ export declare function prepareWorkspace(git: Git, cloneUrl: string, sessionId:
 export declare function cleanupWorkspace(ws: Workspace): Promise<void>;
 /** Commits on the job branch that no origin ref has: the clone's base is origin's default branch. */
 export declare function commitsAhead(git: Git, ws: Workspace): Promise<number>;
+/**
+ * The working copy's HEAD; null only when the clone has no commit at all. Any other failure throws,
+ * so the job never mistakes an unreadable HEAD for "since the base" and re-reports earlier phases.
+ */
+export declare function headSha(git: Git, ws: Workspace): Promise<string | null>;
+/**
+ * RecordCommit/v1 bodies for the commits since `since` (null: since the base), oldest first. The
+ * repo is the job's: on a local lane origin is the fake GitHub, not github.com.
+ */
+export declare function commitBodies(git: Git, ws: Workspace, since: string | null, lineageKey: string, repo: string): Promise<RecordCommitBody[]>;
 /** Push the job branch and open its PR against the repo's default branch; resolves its URL. */
 export declare function openPr(git: Git, fetch: FetchFn, token: string | null, repo: string, ws: Workspace, title: string, body: string, apiBase?: string): Promise<string>;
 /** merge_on_green: GitHub's auto-merge on the PR (squash). */

package/dist/commands/agent-run.js

@@ -31,6 +31,7 @@ import { exitCodeFor, outcomeLine, refusedOutcome, USAGE_EXIT_CODE, } from "../l
 import { phaseEnv } from "../lib/runner/phases.js";
 import { resolveRunPlan } from "../lib/runner/options.js";
 import { startModelProxy } from "../lib/runner/proxy.js";
+import { commitBody, realGit } from "../lib/commit-report.js";
 import { resolveGithubToken } from "./agent-fuel.js";
 import { executorStatePath } from "../vendor/durable-contract/index.js";
 /** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
@@ -165,6 +166,40 @@ export async function commitsAhead(git, ws) {
         throw new Error(`git rev-list answered ${n}`);
     return n;
 }
+/**
+ * The working copy's HEAD; null only when the clone has no commit at all. Any other failure throws,
+ * so the job never mistakes an unreadable HEAD for "since the base" and re-reports earlier phases.
+ */
+export async function headSha(git, ws) {
+    let sha;
+    try {
+        sha = await git(ws.dir, ["rev-parse", "--verify", "--quiet", "HEAD"]);
+    }
+    catch (e) {
+        if ((await git(ws.dir, ["rev-list", "-n", "1", "--all"])) === "")
+            return null;
+        throw e;
+    }
+    if (!/^[0-9a-f]{40}$/.test(sha))
+        throw new Error(`git rev-parse answered ${sha.slice(0, 40)}`);
+    return sha;
+}
+/**
+ * RecordCommit/v1 bodies for the commits since `since` (null: since the base), oldest first. The
+ * repo is the job's: on a local lane origin is the fake GitHub, not github.com.
+ */
+export async function commitBodies(git, ws, since, lineageKey, repo) {
+    const range = since === null ? ["HEAD", "--not", "--remotes=origin"] : [`${since}..HEAD`];
+    const out = await git(ws.dir, ["rev-list", "--reverse", ...range]);
+    const local = realGit(ws.dir);
+    const bodies = [];
+    for (const sha of out.split("\n").filter(Boolean)) {
+        const built = commitBody(local, sha, lineageKey, repo);
+        if (built.ok)
+            bodies.push(built.body);
+    }
+    return bodies;
+}
 /** Push the job branch and open its PR against the repo's default branch; resolves its URL. */
 export async function openPr(git, fetch, token, repo, ws, title, body, apiBase = GITHUB_BASES.api) {
     await git(ws.dir, ["push", "--quiet", "origin", `HEAD:refs/heads/${ws.branch}`]);
@@ -239,6 +274,8 @@ export function liveJobDeps(api, opts) {
         runPhase: (inv, ws, modelUrl, signal) => runPhaseProcess(inv, ws, modelUrl, signal, opts.env),
         openPr: (repo, ws, title, body) => openPr(git, opts.fetch, token, repo, ws, title, body, gh.api),
         commitsAhead: (ws) => commitsAhead(git, ws),
+        headSha: (ws) => headSha(git, ws),
+        commitBodies: (ws, since, lineageKey, repo) => commitBodies(git, ws, since, lineageKey, repo),
         enableAutoMerge: (prUrl) => enableAutoMerge(opts.fetch, token, prUrl, gh),
         cleanup: cleanupWorkspace,
     };

package/dist/commands/agent-setup.d.ts

@@ -6,12 +6,13 @@
  * governed identity `agent-<handle>`. This module makes that identity REAL in
  * their Mnemom org: it births the agent through the gateway, claims it (so the
  * customer owns it), and publishes a sane default coding posture. Governance that
- * costs a model call is OFF by default (operator 2026-10-02: AIP integrity and
- * Safe House analysis are billed, so nobody pays for them until they turn them
- * on); governance that costs none stays ON (operator 2026-10-03: autonomy is
+ * costs a model call is split (operator 2026-11-04, MNE-9728, matching the API new-agent
+ * default): AIP integrity analysis is ON (observe) for a new agent so it is analyzed and can earn
+ * a reputation rating, billed at cost; Safe House screening stays OFF until asked for (operator
+ * 2026-10-02); governance that costs none stays ON (operator 2026-10-03: autonomy is
  * rules-only verification + policy). The goal contract is what nudges (re-anchor
  * on drift). Specifically:
- *   - alignment card: autonomy_mode = observe, integrity_mode = off, the agent's
+ *   - alignment card: autonomy_mode = observe, integrity_mode = observe, the agent's
  *     org as principal (delegated_authority), Claude Code tool names as bounded
  *     actions, coding forbidden actions, defined values, grace 0, and no default
  *     escalation trigger for irreversible operations (the customer adds their own);
@@ -22,8 +23,8 @@
  *   older default's content and keeps the agent's modes.
  *   - goal-alignment: nudge — sealed per-conversation via the goal contract
  *     (--goal …), graded and re-anchored by the gateway.
- * `--governance [integrity,safe-house]` opts a setup in (observe-only, billed at
- * cost on top of the agent fee); `--no-governance` turns every card off, autonomy
+ * `--governance [integrity,safe-house]` picks exactly those features on (observe-only,
+ * billed at cost on top of the agent fee; `--governance none` opts out of both); `--no-governance` turns every card off, autonomy
  * included; a refresh of an already-claimed agent keeps the
  * modes its own cards carry unless a --governance / --no-governance flag says otherwise.
  *
@@ -40,7 +41,8 @@ import { type CardSources, type CodeEntitlement } from "../lib/api.js";
 export type GovernanceMode = "off" | "observe";
 /**
  * The governance features a setup turns on. Each is a model call per turn that
- * the customer pays for at cost, so both are off unless asked for.
+ * the customer pays for at cost. Integrity is on for a new agent (opt out with `--governance none`
+ * or `--no-governance`); Safe House is off unless asked for.
  */
 export interface GovernanceOptIn {
     /**
@@ -58,7 +60,7 @@ export interface GovernanceOptIn {
 export declare const GOVERNANCE_FEATURES: readonly ["integrity", "safe-house"];
 /**
  * Parse the `--governance [features]` / `--no-governance` flag. undefined = not
- * given (new agents get autonomy only; a refresh keeps the agent's current modes),
+ * given (new agents get autonomy + integrity; a refresh keeps the agent's current modes),
  * true = every feature, false (`--no-governance`) = everything off, autonomy
  * included, a string = a comma-separated list of `integrity`, `safe-house`, `all`
  * or `none`, each keeping autonomy on. Throws on an unknown name.
@@ -140,7 +142,7 @@ interface ExistingCards {
     align: Record<string, unknown> | null;
     prot: Record<string, unknown> | null;
 }
-/** Printed when a setup ran without --governance: how to opt in, and what it costs. */
+/** Printed when a setup ran without --governance: what is on by default, how to change it, and what it costs. */
 export declare const GOVERNANCE_OPT_IN_HINT: string;
 /**
  * The default governed-agent slug for the current customer: `agent-<handle>`,

package/dist/commands/agent-setup.js

@@ -6,12 +6,13 @@
  * governed identity `agent-<handle>`. This module makes that identity REAL in
  * their Mnemom org: it births the agent through the gateway, claims it (so the
  * customer owns it), and publishes a sane default coding posture. Governance that
- * costs a model call is OFF by default (operator 2026-10-02: AIP integrity and
- * Safe House analysis are billed, so nobody pays for them until they turn them
- * on); governance that costs none stays ON (operator 2026-10-03: autonomy is
+ * costs a model call is split (operator 2026-11-04, MNE-9728, matching the API new-agent
+ * default): AIP integrity analysis is ON (observe) for a new agent so it is analyzed and can earn
+ * a reputation rating, billed at cost; Safe House screening stays OFF until asked for (operator
+ * 2026-10-02); governance that costs none stays ON (operator 2026-10-03: autonomy is
  * rules-only verification + policy). The goal contract is what nudges (re-anchor
  * on drift). Specifically:
- *   - alignment card: autonomy_mode = observe, integrity_mode = off, the agent's
+ *   - alignment card: autonomy_mode = observe, integrity_mode = observe, the agent's
  *     org as principal (delegated_authority), Claude Code tool names as bounded
  *     actions, coding forbidden actions, defined values, grace 0, and no default
  *     escalation trigger for irreversible operations (the customer adds their own);
@@ -22,8 +23,8 @@
  *   older default's content and keeps the agent's modes.
  *   - goal-alignment: nudge — sealed per-conversation via the goal contract
  *     (--goal …), graded and re-anchored by the gateway.
- * `--governance [integrity,safe-house]` opts a setup in (observe-only, billed at
- * cost on top of the agent fee); `--no-governance` turns every card off, autonomy
+ * `--governance [integrity,safe-house]` picks exactly those features on (observe-only,
+ * billed at cost on top of the agent fee; `--governance none` opts out of both); `--no-governance` turns every card off, autonomy
  * included; a refresh of an already-claimed agent keeps the
  * modes its own cards carry unless a --governance / --no-governance flag says otherwise.
  *
@@ -55,7 +56,7 @@ const say = (line = "") => console.error(line);
 export const GOVERNANCE_FEATURES = ["integrity", "safe-house"];
 /**
  * Parse the `--governance [features]` / `--no-governance` flag. undefined = not
- * given (new agents get autonomy only; a refresh keeps the agent's current modes),
+ * given (new agents get autonomy + integrity; a refresh keeps the agent's current modes),
  * true = every feature, false (`--no-governance`) = everything off, autonomy
  * included, a string = a comma-separated list of `integrity`, `safe-house`, `all`
  * or `none`, each keeping autonomy on. Throws on an unknown name.
@@ -219,15 +220,16 @@ export function newAgentModes(governance) {
     const autonomy = modeOf(governance?.autonomy ?? true);
     return {
         autonomy,
-        integrity: modeOf(governance?.integrity ?? false),
+        integrity: modeOf(governance?.integrity ?? true),
         protection: modeOf(governance?.safeHouse ?? false),
         allowUnmappedTools: autonomy === "observe" ? true : undefined,
     };
 }
 /**
  * The plan for refreshing an EXISTING agent: an explicit --governance /
- * --no-governance wins; else it keeps the modes its own cards carry. No agent-layer
- * card → the new-agent defaults (it never had one). A card with no mode field →
+ * --no-governance wins; else it keeps the modes its own cards carry. No agent-layer card → autonomy and Safe House get the
+ * new-agent defaults but integrity stays off (an existing agent is never silently opted in to billed
+ * analysis; MNE-9728). A card with no mode field →
  * observe (the prior CLI always wrote observe). A failed read → null: skip the refresh.
  */
 async function existingAgentPlan(agentId, governance) {
@@ -252,7 +254,7 @@ async function existingAgentPlan(agentId, governance) {
     return {
         modes: {
             autonomy: align ? (modeField(align, "autonomy_mode") ?? "observe") : fresh.autonomy,
-            integrity: align ? (modeField(align, "integrity_mode") ?? "observe") : fresh.integrity,
+            integrity: align ? (modeField(align, "integrity_mode") ?? "observe") : "off", // an existing agent with no card of its own is not silently opted in to billed analysis (MNE-9728)
             protection: prot ? (modeField(prot, "mode") ?? "observe") : fresh.protection,
             allowUnmappedTools: align
                 ? typeof ownAllow === "boolean"
@@ -263,9 +265,10 @@ async function existingAgentPlan(agentId, governance) {
         existing: { align, prot },
     };
 }
-/** Printed when a setup ran without --governance: how to opt in, and what it costs. */
-export const GOVERNANCE_OPT_IN_HINT = "  Governance (AIP integrity analysis, Safe House screening) is off by default. Turn it on with " +
-    "`mnemom agent setup --governance` (or --governance integrity / safe-house); it is billed at cost on top of the agent fee.";
+/** Printed when a setup ran without --governance: what is on by default, how to change it, and what it costs. */
+export const GOVERNANCE_OPT_IN_HINT = "  AIP integrity analysis is on (observe) for new agents; Safe House screening is off by default. " +
+    "Opt out of integrity with `mnemom agent setup --governance none` (or --no-governance); turn Safe House on with " +
+    "`--governance integrity,safe-house`. Both are billed at cost on top of the agent fee.";
 /**
  * The default governed-agent slug for the current customer: `agent-<handle>`,
  * where <handle> is the local-part of their mnemom login email (sanitised), or
@@ -457,8 +460,8 @@ async function confirmClaimed(opts, anchorKey, fp) {
             const plan = await existingAgentPlan(agentId, opts.governance);
             if (plan) {
                 if (!opts.governance) {
-                    say(fmt.dim(`  Keeping its current governance (${describeModes(plan.modes)}). New agents default to off; ` +
-                        "`--governance` turns it on, `--no-governance` turns it off."));
+                    say(fmt.dim(`  Keeping its current governance (${describeModes(plan.modes)}). New agents default to integrity observe; ` +
+                        "`--governance` picks features, `--no-governance` turns everything off."));
                 }
                 // The principal is the agent's own org, which a refresh may launch from another.
                 const ownOrg = await agentOrgId(agentId);
@@ -511,7 +514,7 @@ async function confirmClaimed(opts, anchorKey, fp) {
     }
     say(fmt.success(`mnemom agent: claimed '${slug}' (${agentId}) in ${opts.orgLabel}.`));
     await noteSameNamedAgent(slug, agentId);
-    // Publish the default cards (autonomy observe; integrity + Safe House off unless
+    // Publish the default cards (autonomy + integrity observe; Safe House off unless
     // --governance). A card write that can't complete does NOT undo the claim — the agent is
     // claimed and governed on whatever landed; we warn how to finish it.
     if (opts.setup !== false) {
@@ -1443,9 +1446,11 @@ function carryForward(card, kind) {
         return card;
     return upgradeInPlace(card, kind) ?? card;
 }
-export function buildCodeAlignmentCard(agentId, modes = {
+export function buildCodeAlignmentCard(agentId, 
+// Every production caller passes modes; the fallback's integrity matches the new-agent default (MNE-9728).
+modes = {
     autonomy: "off",
-    integrity: "off",
+    integrity: "observe",
 }, principal = UNSPECIFIED_PRINCIPAL) {
     return {
         card_version: "unified/2026-04-26",

package/dist/commands/agent-share-render.d.ts

@@ -1,13 +1,13 @@
 /**
- * Bridge from `mnemom agent share` to the aip verifier (`@mnemom/aip-verifier`, aip#192/#178):
+ * Bridge from `mnemom agent share` to the aip verifier (`@mnemom/verify`, aip#192/#178):
  * the renderer (`renderLines`) and claim-lint (`lintRendering`) are the ONLY source of what a
- * card may say. No word lists live here. The package is a runtime dependency pinned to the aip
- * release tarball and is loaded lazily, so the default CLI path never touches it; if it is
+ * card may say. No word lists live here. The package is a runtime dependency pinned to an exact
+ * npm registry version and is loaded lazily, so the default CLI path never touches it; if it is
  * absent at runtime the share command fails closed with a clear message.
  */
 import type { LineRenderer, SharedCardLine } from "./agent-share.js";
-import type * as AipMain from "@mnemom/aip-verifier";
-import type * as AipRender from "@mnemom/aip-verifier/render-lines";
+import type * as AipMain from "@mnemom/verify";
+import type * as AipRender from "@mnemom/verify/render-lines";
 export interface VerifierModules {
     lintRendering: typeof AipMain.lintRendering;
     renderLines: typeof AipRender.renderLines;

package/dist/commands/agent-share-render.js

@@ -1,14 +1,14 @@
 /**
- * Bridge from `mnemom agent share` to the aip verifier (`@mnemom/aip-verifier`, aip#192/#178):
+ * Bridge from `mnemom agent share` to the aip verifier (`@mnemom/verify`, aip#192/#178):
  * the renderer (`renderLines`) and claim-lint (`lintRendering`) are the ONLY source of what a
- * card may say. No word lists live here. The package is a runtime dependency pinned to the aip
- * release tarball and is loaded lazily, so the default CLI path never touches it; if it is
+ * card may say. No word lists live here. The package is a runtime dependency pinned to an exact
+ * npm registry version and is loaded lazily, so the default CLI path never touches it; if it is
  * absent at runtime the share command fails closed with a clear message.
  */
 const defaultLoader = async () => {
     const [main, render] = await Promise.all([
-        import("@mnemom/aip-verifier"),
-        import("@mnemom/aip-verifier/render-lines"),
+        import("@mnemom/verify"),
+        import("@mnemom/verify/render-lines"),
     ]);
     return { lintRendering: main.lintRendering, renderLines: render.renderLines };
 };
@@ -20,9 +20,11 @@ async function loadVerifier(load) {
     catch (error) {
         const e = error;
         if (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND") {
-            throw new Error("the aip verifier (@mnemom/aip-verifier) is not installed: it ships bundled inside @mnemom/mnemom, so reinstall with `npm install -g @mnemom/mnemom`", { cause: error });
+            throw new Error("the aip verifier (@mnemom/verify) is not installed: it is a dependency of @mnemom/mnemom, so reinstall with `npm install -g @mnemom/mnemom`", { cause: error });
         }
-        throw new Error(`the aip verifier (@mnemom/aip-verifier) failed to load: ${e.message ?? error}`, { cause: error });
+        throw new Error(`the aip verifier (@mnemom/verify) failed to load: ${e.message ?? error}`, {
+            cause: error,
+        });
     }
 }
 /**

package/dist/commands/agent-share-test-issuer.d.ts

@@ -23,7 +23,7 @@
  * TEST_SHARECARD_PUBLIC_KEY_HEX / TEST_SHARECARD_JWKS below, which a verifier must be given
  * explicitly as the trusted key; the production JWKS never contains it.
  */
-import type * as AipVerifier from "@mnemom/aip-verifier";
+import type * as AipVerifier from "@mnemom/verify";
 import type { AgentShareDeps, CardIssuer } from "./agent-share.js";
 /** aip test key id; ids of every test key start with this prefix. */
 export declare const TEST_KEY_ID = "test-sharecard-key-1";

package/dist/commands/agent-share-test-issuer.js

@@ -80,7 +80,7 @@ const PKCS8_ED25519_PREFIX = Buffer.from("302e020100300506032b657004220420", "he
 export function createTestCardIssuer(opts = {}) {
     const now = opts.now ?? (() => new Date());
     const cardId = opts.cardId ?? (() => `card-test-${randomBytes(6).toString("hex")}`);
-    const load = opts.loadVerifier ?? (() => import("@mnemom/aip-verifier"));
+    const load = opts.loadVerifier ?? (() => import("@mnemom/verify"));
     return {
         async issue(lines) {
             const { shareCardSigningInput } = await load();

package/dist/commands/agent.d.ts

@@ -401,11 +401,18 @@ export declare function fedStatuslineWanted(version: string): boolean;
  */
 export declare function exemptLoopbackFromProxy(env: NodeJS.ProcessEnv): void;
 /**
- * Print the conduct receipt (experimental `record`) — the exit call site here, and the one a
+ * Print the conduct receipt (on by default; MNEMOM_AGENT_RECEIPT=0 opts out) — the exit call site here, and the one a
  * durable park calls. Never throws: a failure is one warning line, and the caller's exit code
  * is untouched.
  */
 export declare function sayConductReceipt(launch: ReceiptLaunch, trigger?: "exit" | "park", receipt?: typeof conductReceiptFor): Promise<void>;
+/**
+ * Whether `mnemom agent` reads and prints the conduct receipt at exit (MNE-9013: on by default,
+ * graduated from experimental `record`; MNEMOM_AGENT_RECEIPT=0 opts out). Claude only: the
+ * receipt reads the lineage key the base-URL proxy captures, and that proxy fronts
+ * ANTHROPIC_BASE_URL alone, so another CLI would only gain a proxy that can capture nothing.
+ */
+export declare function receiptWanted(env: NodeJS.ProcessEnv): boolean;
 /** Whether a terminal implicit launch runs the turn-origin proxy (MNEMOM_AGENT_TURN_HEADER=0 opts out). */
 export declare function turnProxyWanted(env: NodeJS.ProcessEnv): boolean;
 /** The flag that lets base-url-proxy.mjs use an http door on a loopback literal (C17-R16 T3). */

package/dist/commands/agent.js

@@ -847,7 +847,7 @@ export async function agentCommand(scenarioArg, options = {}) {
     if (shape === "terminal") {
         // Record keys the lineage under the served agent's org, not the account org (lib/record-org).
         const recordOrgId = recordOrgWanted({
-            receipt: experimental.includes("record"),
+            receipt: cli.name === "claude" && receiptWanted(process.env),
             commitReport: cli.name === "claude" && commitReportEnabled(process.env[COMMIT_REPORT_ENV]),
             fedStatusline: cli.name === "claude" && fedStatuslineWanted(CLI_VERSION),
         }) && account.orgId
@@ -895,7 +895,8 @@ export async function agentCommand(scenarioArg, options = {}) {
                     },
                 }
                 : {}),
-            receipt: experimental.includes("record")
+            // On by default (MNE-9013); prints only when the org's record returns tally data.
+            receipt: cli.name === "claude" && Boolean(account.orgId) && receiptWanted(process.env)
                 ? { orgId: recordOrgId, agentId: servedAgentId }
                 : undefined,
             orgId: recordOrgId,
@@ -1671,7 +1672,7 @@ export function exemptLoopbackFromProxy(env) {
     env.no_proxy = [lower, "127.0.0.1,localhost"].filter(Boolean).join(",");
 }
 /**
- * Print the conduct receipt (experimental `record`) — the exit call site here, and the one a
+ * Print the conduct receipt (on by default; MNEMOM_AGENT_RECEIPT=0 opts out) — the exit call site here, and the one a
  * durable park calls. Never throws: a failure is one warning line, and the caller's exit code
  * is untouched.
  */
@@ -1684,6 +1685,16 @@ export async function sayConductReceipt(launch, trigger = "exit", receipt = cond
         say(fmt.warn(`mnemom agent: no conduct receipt (${err instanceof Error ? err.message : String(err)})`));
     }
 }
+/**
+ * Whether `mnemom agent` reads and prints the conduct receipt at exit (MNE-9013: on by default,
+ * graduated from experimental `record`; MNEMOM_AGENT_RECEIPT=0 opts out). Claude only: the
+ * receipt reads the lineage key the base-URL proxy captures, and that proxy fronts
+ * ANTHROPIC_BASE_URL alone, so another CLI would only gain a proxy that can capture nothing.
+ */
+export function receiptWanted(env) {
+    const raw = (env.MNEMOM_AGENT_RECEIPT ?? "").trim().toLowerCase();
+    return !["0", "off", "false", "no"].includes(raw);
+}
 /** Whether a terminal implicit launch runs the turn-origin proxy (MNEMOM_AGENT_TURN_HEADER=0 opts out). */
 export function turnProxyWanted(env) {
     const raw = (env.MNEMOM_AGENT_TURN_HEADER ?? "").trim().toLowerCase();

package/dist/commands/card.js

@@ -885,7 +885,7 @@ export async function cardEditCommand(agentName, options = {}) {
             card_version: "unified/2026-04-26",
             agent_id: agentId,
             autonomy_mode: "observe",
-            integrity_mode: "off",
+            integrity_mode: "observe", // new-agent default (MNE-9728); set to off to opt out
             enforcement: { allow_unmapped_tools: true },
             principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },
             values: { declared: ["transparency", "safety", "honesty"] },

package/dist/commands/onboard.js

@@ -45,6 +45,7 @@ import { isInteractive, askInput, askYesNo } from "../lib/prompt.js";
 import { getWebsiteUrl } from "../lib/config.js";
 import { openBrowser } from "../lib/oauth.js";
 import { fmt } from "../lib/format.js";
+import { starterIntegrityMode } from "../lib/starter-integrity.js";
 const FULL_PROOF_RE = /^[0-9a-f]{64}$/;
 /**
  * Entry point for `mnemom onboard`. Throws on a fatal error (caught by the
@@ -94,7 +95,7 @@ export async function onboardCommand(options = {}) {
     say();
     say(`${fmt.badge("alignment", "cyan")} Declaring your alignment card…`);
     try {
-        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId)), "application/json", 
+        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId, await starterIntegrityMode(agentId))), "application/json", 
         // A STABLE key so a re-run replays the same server-side reservation
         // (idempotent no-op) rather than writing a divergent duplicate card.
         { idempotencyKey: `onboard-alignment-${agentId}` });
@@ -353,16 +354,16 @@ async function earnRating(agentId, steps, say) {
 // ── starter alignment card ──────────────────────────────────────────────────────
 /**
  * A starter alignment card: autonomy observe (rules only, no model call), integrity
- * `off` (alignment analysis is billed; the user turns it on) — the honest, minimal declaration
+ * as the agent's own card has it (observe for a new agent, MNE-9728; see lib/starter-integrity.ts) — the honest, minimal declaration
  * of intent for a freshly-onboarded agent. Mirrors the shape `wrap` seeds so the
  * two skill-runners produce a consistent first card.
  */
-function buildStarterAlignmentCard(agentId) {
+function buildStarterAlignmentCard(agentId, integrityMode) {
     return {
         card_version: "unified/2026-04-26",
         agent_id: agentId,
         autonomy_mode: "observe",
-        integrity_mode: "off",
+        integrity_mode: integrityMode, // the agent's own mode; observe for a new agent (MNE-9728)
         // No capability mappings here, so unmapped tools must pass or every turn fails.
         enforcement: { allow_unmapped_tools: true },
         principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },

package/dist/commands/scan.d.ts

@@ -7,12 +7,12 @@
 import { type GitHubCredential } from "../lib/scan/credential.js";
 import { type ScanDeps, type ScanResult } from "../lib/scan/scan.js";
 import { selectSpend } from "../lib/scan/spend/spend-tiers.js";
-import { type AnthropicUsageDeps } from "../lib/scan/spend/anthropic-usage.js";
+import { type AnthropicUsageDeps, type MeasuredUsage } from "../lib/scan/spend/anthropic-usage.js";
+import { type WifDeps } from "../lib/scan/spend/anthropic-wif.js";
 import { type RecordDeps, type RecordOutcome } from "../lib/scan/record.js";
 import { type CostSpend } from "../lib/scan/cost-per-pr.js";
 import { type ReportEmailDeps } from "../lib/scan/report-email.js";
 import { type RepoListDeps } from "../lib/scan/repo-picker.js";
-import { type ReportRecipients } from "../lib/scan/share.js";
 export interface ScanCommandOptions {
     repos: string[];
     period?: {
@@ -20,8 +20,10 @@ export interface ScanCommandOptions {
         end: string;
     };
     share?: string;
-    /** Report recipient. Required unless the runner is the CTO (asked when omitted). */
+    /** Alias of one --email (kept for older scripts). */
     ctoEmail?: string;
+    /** Extra recipients of the report (repeatable; comma-separated accepted). The runner and every org admin always get it. */
+    email?: string[];
     /** Tier 2: the CTO's own monthly figure, as typed. Needs MNEMOM_ORG_SCAN_MODE=true. */
     monthlySpend?: string;
     /** Tier 2 without a figure on the command line: ask for one on the terminal. */
@@ -33,6 +35,8 @@ export interface ScanCommandOptions {
     anthropicOver200kShare?: number | null;
     /** Test seam: the fetch behind the two Anthropic reads. */
     anthropicDeps?: AnthropicUsageDeps;
+    /** Test seam: the WIF assertion mint and Anthropic token exchange (MNE-9706). */
+    wifDeps?: WifDeps;
     /**
      * The org the report is emailed for; inferred from the signed-in user's single non-personal org when
      * omitted (see resolveScanOrg). The Record totals preview (MNEMOM_ORG_SCAN_MODE=true) reads ONLY an
@@ -68,11 +72,24 @@ export interface ScanCommandOptions {
 /** Parses repeated/comma-separated `--repo owner/name`. Returns null on any invalid slug. */
 export declare function parseRepoFlags(raw: string[] | undefined): string[] | null;
 export declare const isEmail: (v: unknown) => v is string;
-/** The runner's email (mnemom login, else asked) and the CTO's (flag, else "are you the CTO?"). */
-export declare function resolveRecipients(o: {
-    runnerEmail?: string;
+export declare const DELETE_CONTACT = "privacy@mnemom.ai";
+export declare const EMAIL_ONE_MSG = "Enter one email address, like you@company.com.";
+export declare const EMAIL_LIST_MSG = "Enter email addresses like you@company.com, separated by commas.";
+export declare const MAX_EXTRA_EMAILS = 10;
+/**
+ * The people to add to the report email (the runner and every org admin always get it). Comes from the
+ * repeatable --email flag (and its alias --cto-email), each value one address or a comma-separated list;
+ * on a terminal with none given, asks once (blank to skip). Plain-language errors; the value is never echoed.
+ */
+export declare function resolveExtraEmails(o: {
+    email?: string[];
     ctoEmail?: string;
-}): Promise<ReportRecipients>;
+    isTty?: boolean;
+}): Promise<string[]>;
+/** The runner's own address from the Mnemom login, or undefined (the server resolves it for the email either way). */
+export declare function runnerEmailFromLogin(o: {
+    runnerEmail?: string;
+}): string | undefined;
 /** The CTO's figure in USD, or null for none. Throws fixed text only; the input is never echoed. */
 export declare function resolveSelfReportedSpend(o: ScanCommandOptions): Promise<number | null>;
 /**
@@ -93,10 +110,20 @@ export declare const TIER1_FALLBACK_NOTE = "Tier 1 skipped: falling back to the
  * fixed sentence: the key, the thrown value and the response never reach the terminal. The caller then falls
  * back to tier 2, then tier 3.
  */
+export declare const WIF_OK_NOTE = "Read Anthropic usage through workload identity federation.";
+/**
+ * Tier 1 through WIF (MNE-9706): Mnemom issues an identity token for the org, this machine exchanges it at
+ * Anthropic and reads only the two usage reports with the result. "not_configured" when the WIF ids are
+ * not set; "failed" (after printing a fixed sentence) for every failure, so the caller falls back to the key.
+ */
+export declare function measuredUsageViaWif(o: ScanCommandOptions, orgId: string, period: {
+    start: string;
+    end: string;
+}): Promise<MeasuredUsage | "not_configured" | "failed">;
 export declare function resolveMeasuredUsage(o: ScanCommandOptions, period: {
     start: string;
     end: string;
-}): Promise<{
+}, orgId?: string): Promise<{
     usd: number;
     over200kShare: number | null;
 } | null>;