@mnemom/mnemom 0.17.37 → 0.17.38-next.1

package/dist/commands/scan.js

@@ -9,7 +9,8 @@ import { failureText } from "../lib/scan/failure.js";
 import { runLocalScan } from "../lib/scan/scan.js";
 import { askInput, askSelect } from "../lib/prompt.js";
 import { isSpendTiersEnabled, NOT_ENABLED_MSG, parseMonthlySpendUsd, selectSpend, SPEND_INVALID_MSG, SPEND_NO_TERMINAL_MSG, } from "../lib/scan/spend/spend-tiers.js";
-import { ADMIN_KEY_ENV, AnthropicUsageError, fetchMeasuredUsage, isAdminKeyShape, usageFailureText, } from "../lib/scan/spend/anthropic-usage.js";
+import { ADMIN_KEY_ENV, AnthropicUsageError, fetchMeasuredUsage, isAdminKeyShape, usageFailureText, bearerAuth, fetchMeasuredUsageWithAuth, } from "../lib/scan/spend/anthropic-usage.js";
+import { obtainWifAccessToken, readWifConfig, WIF_FALLBACK_NOTE, WifError, wifFailureText, } from "../lib/scan/spend/anthropic-wif.js";
 import { getAuthInfo } from "../lib/auth.js";
 import { listMyOrgs } from "../lib/api.js";
 import { getActiveOrg } from "../lib/cli-config.js";
@@ -27,29 +28,61 @@ export function parseRepoFlags(raw) {
         .filter(Boolean);
     return out.length > 0 && out.every(isValidRepoSlug) ? out : null;
 }
-const EMAIL = /^[^\s@]{1,64}@[^\s@]{1,255}\.[^\s@]{2,63}$/;
-export const isEmail = (v) => typeof v === "string" && v.length <= 320 && EMAIL.test(v.trim());
-/** The runner's email (mnemom login, else asked) and the CTO's (flag, else "are you the CTO?"). */
-export async function resolveRecipients(o) {
-    if (o.ctoEmail !== undefined && !isEmail(o.ctoEmail))
-        throw new Error("--cto-email must be a valid email address");
-    let runner = o.runnerEmail ?? getAuthInfo()?.email ?? "";
-    if (!isEmail(runner))
-        runner = (await askInput("Your email (the report is sent to you):")).trim();
-    if (!isEmail(runner))
-        throw new Error("a valid runner email is required");
-    runner = runner.trim();
-    if (o.ctoEmail !== undefined)
-        return { runner_email: runner, cto_email: o.ctoEmail.trim() };
-    const isCto = await askSelect("Are you the CTO?", ["Yes, I am the CTO", "No, someone else is"]);
-    if (isCto === null)
-        throw new Error("--cto-email is required when you are not the CTO");
-    if (isCto.startsWith("Yes"))
-        return { runner_email: runner, cto_email: runner };
-    const cto = (await askInput("CTO email (the report is sent to them too):")).trim();
-    if (!isEmail(cto))
-        throw new Error("--cto-email is required when you are not the CTO");
-    return { runner_email: runner, cto_email: cto };
+/**
+ * Same rule as the API: isPlainEmail in mnemom/mnemom-api src/org-scan/report-email/notifier.ts (no shared
+ * package, so this is a copy). Drift guard: the "plain-email rule edge" table in src/__tests__/scan.test.ts;
+ * change both together. No spaces, control chars or <>",; ; one @; every domain label non-empty; max 254. */
+const plainEmail = (a) => {
+    if (a.length === 0 || a.length > 254)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        const c = a.charCodeAt(i);
+        if (c <= 32 || c === 127 || '<>",;'.includes(a[i]))
+            return false;
+    }
+    const at = a.indexOf("@");
+    if (at < 1 || at !== a.lastIndexOf("@"))
+        return false;
+    const labels = a.slice(at + 1).split(".");
+    return labels.length >= 2 && labels.every((l) => l.length > 0);
+};
+export const isEmail = (v) => typeof v === "string" && plainEmail(v.trim());
+export const DELETE_CONTACT = "privacy@mnemom.ai";
+export const EMAIL_ONE_MSG = "Enter one email address, like you@company.com.";
+export const EMAIL_LIST_MSG = "Enter email addresses like you@company.com, separated by commas.";
+export const MAX_EXTRA_EMAILS = 10;
+/**
+ * The people to add to the report email (the runner and every org admin always get it). Comes from the
+ * repeatable --email flag (and its alias --cto-email), each value one address or a comma-separated list;
+ * on a terminal with none given, asks once (blank to skip). Plain-language errors; the value is never echoed.
+ */
+export async function resolveExtraEmails(o) {
+    const given = [...(o.email ?? []), ...(o.ctoEmail !== undefined ? [o.ctoEmail] : [])];
+    let raw = given;
+    if (given.length === 0) {
+        if (!(o.isTty ?? process.stdin.isTTY))
+            return [];
+        const typed = ((await askInput("Anyone else to email the report to? Enter addresses separated by commas, or press Enter to skip:")) ?? "").trim();
+        if (typed === "")
+            return [];
+        raw = [typed];
+    }
+    const list = raw
+        .flatMap((v) => v.split(","))
+        .map((v) => v.trim())
+        .filter(Boolean);
+    if (list.length === 0 || !list.every(isEmail))
+        throw new Error(raw.length > 1 || raw.some((v) => v.includes(",")) ? EMAIL_LIST_MSG : EMAIL_ONE_MSG);
+    const seen = new Set();
+    const unique = list.filter((a) => !seen.has(a.toLowerCase()) && seen.add(a.toLowerCase()));
+    if (unique.length > MAX_EXTRA_EMAILS)
+        throw new Error(`Add at most ${MAX_EXTRA_EMAILS} extra email addresses.`);
+    return unique;
+}
+/** The runner's own address from the Mnemom login, or undefined (the server resolves it for the email either way). */
+export function runnerEmailFromLogin(o) {
+    const e = (o.runnerEmail ?? getAuthInfo()?.email ?? "").trim();
+    return isEmail(e) ? e : undefined;
 }
 /** The CTO's figure in USD, or null for none. Throws fixed text only; the input is never echoed. */
 export async function resolveSelfReportedSpend(o) {
@@ -96,7 +129,37 @@ export const TIER1_FALLBACK_NOTE = "Tier 1 skipped: falling back to the next tie
  * fixed sentence: the key, the thrown value and the response never reach the terminal. The caller then falls
  * back to tier 2, then tier 3.
  */
-export async function resolveMeasuredUsage(o, period) {
+export const WIF_OK_NOTE = "Read Anthropic usage through workload identity federation.";
+/**
+ * Tier 1 through WIF (MNE-9706): Mnemom issues an identity token for the org, this machine exchanges it at
+ * Anthropic and reads only the two usage reports with the result. "not_configured" when the WIF ids are
+ * not set; "failed" (after printing a fixed sentence) for every failure, so the caller falls back to the key.
+ */
+export async function measuredUsageViaWif(o, orgId, period) {
+    let cfg;
+    try {
+        cfg = readWifConfig(o.env ?? process.env);
+    }
+    catch (e) {
+        console.log(wifFailureText(e instanceof WifError ? e.reason : "config_invalid"));
+        return "failed";
+    }
+    if (cfg === null)
+        return "not_configured";
+    try {
+        const token = await obtainWifAccessToken(orgId, cfg, o.wifDeps);
+        const usage = await fetchMeasuredUsageWithAuth(bearerAuth(token.accessToken), period, o.anthropicDeps);
+        console.log(WIF_OK_NOTE);
+        return usage;
+    }
+    catch (e) {
+        console.log(e instanceof WifError
+            ? wifFailureText(e.reason)
+            : usageFailureText(e instanceof AnthropicUsageError ? e.reason : "upstream"));
+        return "failed";
+    }
+}
+export async function resolveMeasuredUsage(o, period, orgId) {
     if (o.anthropicAdminKey && !isSpendTiersEnabled(o.env))
         throw new Error(NOT_ENABLED_MSG);
     if (!isSpendTiersEnabled(o.env) || o.noAnthropicUsage)
@@ -105,6 +168,20 @@ export async function resolveMeasuredUsage(o, period) {
     if (o.monthlySpend !== undefined && !o.anthropicAdminKey)
         return null;
     let key = (o.env ?? process.env)[ADMIN_KEY_ENV];
+    // MNE-9706: WIF first when it is set up, unless the user explicitly asked to paste a key.
+    let wifFailed = false;
+    if (!o.anthropicAdminKey && orgId !== undefined) {
+        const viaWif = await measuredUsageViaWif(o, orgId, period);
+        if (viaWif !== "not_configured" && viaWif !== "failed")
+            return viaWif;
+        wifFailed = viaWif === "failed";
+    }
+    if (wifFailed) {
+        const hasKey = key !== undefined && key.trim() !== "";
+        console.log(hasKey ? WIF_FALLBACK_NOTE : TIER1_FALLBACK_NOTE);
+        if (!hasKey)
+            return null;
+    }
     if (o.anthropicAdminKey) {
         if (!(o.isTty ?? process.stdin.isTTY))
             throw new Error(NO_ADMIN_KEY_TERMINAL_MSG);
@@ -193,16 +270,20 @@ export async function resolveRecordOutcome(o) {
 }
 export async function scanCommand(o) {
     if (o.share !== undefined && parseShareLevel(o.share) === null) {
-        throw new Error("--share must be one of: summary, full, none");
+        throw new Error("--share must be one of: full, analytics, none (summary also works, same as analytics)");
     }
     const noRepoFlag = o.repos.length === 0;
+    const interactive = Boolean(o.isTty ?? process.stdin.isTTY);
     // No --repo: on a terminal pick from the repos this GitHub login can read; otherwise the error stays, with a hint.
-    if (noRepoFlag && !(o.isTty ?? process.stdin.isTTY))
+    if (noRepoFlag && !interactive)
         throw new Error(`--repo owner/name is required (repeatable). ${REPO_PICKER_NO_TERMINAL_HINT}`);
+    // Consent comes first, before any data is processed (MNE-9634). The flag wins; on a terminal with no flag we
+    // ask (Full preselected); with no terminal and no flag the answer is Nothing (fail closed).
+    const level = parseShareLevel(o.share) ?? (interactive ? await promptShareLevel() : "none");
+    // The people added to the report email; the runner and every org admin always get it.
+    const extraEmails = await resolveExtraEmails(o);
     // The report is emailed on every scan, so resolve the org before any scan work; failure is loud.
     const emailOrg = await resolveScanOrg(o);
-    if (o.ctoEmail !== undefined && !isEmail(o.ctoEmail))
-        throw new Error("--cto-email must be a valid email address");
     const getCredential = async () => {
         const c = o.credential ?? (await resolveCredential().catch(() => null));
         if (!c)
@@ -218,7 +299,7 @@ export async function scanCommand(o) {
     const now = o.now ?? Date.now;
     const end = new Date(now()).toISOString().slice(0, 10);
     const period = o.period ?? { start: end, end };
-    const measured = await resolveMeasuredUsage(o, period);
+    const measured = await resolveMeasuredUsage(o, period, emailOrg);
     const credential = pickedCredential ?? (await getCredential());
     // Before the local scan: a refused credential fails closed without spending the GitHub reads.
     const record = await resolveRecordOutcome(o);
@@ -247,19 +328,23 @@ export async function scanCommand(o) {
     else if (record !== null)
         for (const line of renderRecordSection(record))
             console.log(line);
-    const level = parseShareLevel(o.share) ?? (await promptShareLevel());
     // Every successful scan emails the report to the person who ran it, at every share level, no opt-out.
     // Mnemom keeps nothing from a share=none send (the server sends the email and does nothing else).
-    const emailFailure = await emailReport(o, emailOrg, result, level, spend, period, resolveCostSpend(o, result, spend, measured));
-    if (level === "none") {
-        console.log("Share level: nothing. No share payload is built; Mnemom keeps nothing (the report email is only sent to you).");
-        if (emailFailure)
-            throw new ReportEmailError(emailFailure);
-        return;
+    const emailResult = await emailReport(o, emailOrg, result, level, spend, period, resolveCostSpend(o, result, spend, measured), extraEmails);
+    const emailFailure = emailResult === "not_sent" || emailResult === null ? null : emailResult;
+    // What was shared with Mnemom, and how to have it deleted (MNE-9634).
+    if (emailResult !== null) {
+        console.log("Kept on file by Mnemom: nothing, because the report was not sent.");
     }
-    const payload = buildSharePayload(level, result, await resolveRecipients(o), spend ? (spend.shareable ? spend.line : null) : undefined);
-    console.log(`Share level: ${level}. Upload is not wired in this build; this is what would be sent:`);
-    console.log(JSON.stringify(payload, null, 2));
+    else if (level === "none") {
+        console.log("Kept on file by Mnemom: nothing. The report was emailed and Mnemom keeps nothing on file; its email provider keeps only a delivery log.");
+    }
+    else {
+        const payload = buildSharePayload(level, result, { runner_email: runnerEmailFromLogin(o), extra_emails: extraEmails }, spend ? (spend.shareable ? spend.line : null) : undefined);
+        console.log(`Kept on file by Mnemom: ${level === "full" ? "the totals and the counts for each repo, by name" : "the team totals only, with no repo names"}. Mnemom may keep a run record of only this much on file; the full report was emailed, not stored:`);
+        console.log(JSON.stringify(payload, null, 2));
+    }
+    console.log(`To have anything Mnemom holds about this scan deleted, email ${DELETE_CONTACT}.`);
     if (emailFailure)
         throw new ReportEmailError(emailFailure);
 }
@@ -267,7 +352,7 @@ export async function scanCommand(o) {
  * Emails the report. Loud on every failure: prints the reason name, never the server's words, and
  * returns it so the caller exits non-zero after the local report is shown.
  */
-async function emailReport(o, org, result, level, spend, period, costSpend) {
+async function emailReport(o, org, result, level, spend, period, costSpend, extraEmails) {
     const fail = (f) => {
         console.log(failureMessage(f));
         return f;
@@ -279,17 +364,21 @@ async function emailReport(o, org, result, level, spend, period, costSpend) {
         period,
         costSpend,
     });
-    const body = buildEmailBody(report, level, result.coverage.complete, o.ctoEmail?.trim());
+    const body = buildEmailBody(report, level, result.coverage.complete, extraEmails);
     const outcome = await sendReportEmail(org, body, o.emailDeps);
     if (outcome.status === "failed")
         return fail(outcome.reason);
     if (outcome.status === "unavailable") {
         // Org Scan is off by default: the gate's 404 is not a failure and must not break the scan.
         console.log(UNAVAILABLE_MSG);
-        return null;
+        return "not_sent";
     }
     console.log(outcome.status === "dry_run"
         ? DRY_RUN_MSG
-        : `Report emailed to you (${outcome.recipients} recipient${outcome.recipients === 1 ? "" : "s"}).`);
-    return null;
+        : outcome.limited
+            ? "Report emailed in a limited form (your Mnemom service is older than this CLI): no per-repo counts, no org admins, and at most one added address."
+            : `Full report emailed to you, your org admins and anyone you added (${outcome.recipients} recipient${outcome.recipients === 1 ? "" : "s"}).`);
+    if (outcome.status === "sent" && outcome.adminsMissed)
+        console.log(`${outcome.adminsMissed} org admin${outcome.adminsMissed === 1 ? "" : "s"} could not be emailed because no email address is on file.`);
+    return outcome.status === "dry_run" ? "not_sent" : null;
 }

package/dist/commands/verify-card.d.ts

@@ -20,7 +20,8 @@
  *   3. Verify the JWS signature against the JWKS.
  *   4. Fetch the transparency-log row by log_index for the freshly-computed
  *      inclusion proof, plus /v1/transparency/root for the signed root.
- *   5. Verify the Merkle inclusion proof against the root.
+ *   5. Verify the signed root's Ed25519 signature (typ AAP-TransparencyRoot/v1)
+ *      with @mnemom/verify, then the Merkle inclusion proof against that root.
  *   6. Print a care-framed result.
  *
  * --strict mode bypasses the JWKS cache and exits non-zero on any
@@ -30,6 +31,7 @@
  * would-benefit-from vocabulary; stdout carries machine-readable
  * verification status.
  */
+import type * as AipVerify from "@mnemom/verify";
 interface JwkPublic {
     kty: "OKP";
     crv: "Ed25519";
@@ -69,6 +71,14 @@ interface MerkleProof {
         position: "left" | "right";
     }[];
 }
+interface SignedRoot {
+    typ?: string;
+    tree_size: number;
+    root_hash: string;
+    published_at: string;
+    signing_key_id: string;
+    signature: string;
+}
 export interface VerifyCardOptions {
     agentId: string;
     at?: string;
@@ -86,6 +96,19 @@ interface JwsVerification {
     error?: string;
 }
 declare function verifyJws(jws: string, jwks: Jwks): Promise<JwsVerification>;
+interface RootVerification {
+    ok: boolean;
+    kid?: string;
+    reasons: string[];
+}
+/**
+ * Verify the detached Ed25519 signature on GET /v1/transparency/root with the
+ * published offline verifier. `expectedTyp` pins the statement to
+ * AAP-TransparencyRoot/v1, so another signed statement cannot stand in for a
+ * root. A key missing from a cached JWKS reports key_not_found; --no-cache or
+ * --strict refetches it.
+ */
+declare function verifySignedRoot(root: SignedRoot, jwks: Jwks, load?: () => Promise<Pick<typeof AipVerify, "verifyStatement">>): Promise<RootVerification>;
 declare function verifyInclusionProof(proof: MerkleProof, expectedRoot: string): Promise<boolean>;
 declare function internalHash(left: string, right: string): Promise<string>;
 declare function base64urlDecode(s: string): Uint8Array;
@@ -98,5 +121,6 @@ export declare const __testing: {
     base64urlDecode: typeof base64urlDecode;
     base64urlDecodeString: typeof base64urlDecodeString;
     verifyJws: typeof verifyJws;
+    verifySignedRoot: typeof verifySignedRoot;
 };
 export {};

package/dist/commands/verify-card.js

@@ -20,7 +20,8 @@
  *   3. Verify the JWS signature against the JWKS.
  *   4. Fetch the transparency-log row by log_index for the freshly-computed
  *      inclusion proof, plus /v1/transparency/root for the signed root.
- *   5. Verify the Merkle inclusion proof against the root.
+ *   5. Verify the signed root's Ed25519 signature (typ AAP-TransparencyRoot/v1)
+ *      with @mnemom/verify, then the Merkle inclusion proof against that root.
  *   6. Print a care-framed result.
  *
  * --strict mode bypasses the JWKS cache and exits non-zero on any
@@ -65,7 +66,16 @@ export async function verifyCardCommand(options) {
             findings.push("merkle: transparency log is empty (no root to verify against)");
         }
         else {
-            // Step 5: verify the Merkle inclusion proof.
+            // Step 5a: the root is only worth folding into if Mnemom signed it.
+            const rootCheck = await verifySignedRoot(root, jwks);
+            if (!rootCheck.ok) {
+                findings.push(`root: signature did not verify (${rootCheck.reasons.join(", ")})`);
+                exitCode = 1;
+            }
+            else {
+                findings.push(`root: signature ok (kid=${rootCheck.kid}, tree_size=${root.tree_size})`);
+            }
+            // Step 5b: verify the Merkle inclusion proof.
             const proofOk = await verifyInclusionProof(target.inclusion_proof, root.root_hash);
             if (!proofOk) {
                 findings.push(`merkle: inclusion proof did not reconstruct root (log_index=${target.entry.log_index}, tree_size=${target.inclusion_proof.tree_size})`);
@@ -227,6 +237,22 @@ async function verifyJws(jws, jwks) {
     }
     return { ok: true, kid, payload };
 }
+// ── Signed root verification ─────────────────────────────────────────
+const ROOT_TYP = "AAP-TransparencyRoot/v1";
+/**
+ * Verify the detached Ed25519 signature on GET /v1/transparency/root with the
+ * published offline verifier. `expectedTyp` pins the statement to
+ * AAP-TransparencyRoot/v1, so another signed statement cannot stand in for a
+ * root. A key missing from a cached JWKS reports key_not_found; --no-cache or
+ * --strict refetches it.
+ */
+async function verifySignedRoot(root, jwks, load = () => import("@mnemom/verify")) {
+    const { verifyStatement } = await load();
+    const r = await verifyStatement(root, jwks, {
+        expectedTyp: ROOT_TYP,
+    });
+    return { ok: r.valid, kid: r.signing_key_id ?? undefined, reasons: r.reasons };
+}
 // ── Merkle proof verification ────────────────────────────────────────
 async function verifyInclusionProof(proof, expectedRoot) {
     let current = proof.leaf_hash;
@@ -282,6 +308,7 @@ export const __testing = {
     base64urlDecode,
     base64urlDecodeString,
     verifyJws,
+    verifySignedRoot,
 };
 // Silence "MNEMOM_DIR unused" if the cache code path is taken in tests.
 void MNEMOM_DIR;

package/dist/commands/wrap.js

@@ -20,6 +20,7 @@ import { mergeAgentConfig } from "../lib/agent-config.js";
 import { askSelect, askInput, isInteractive } from "../lib/prompt.js";
 import { getGatewayUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
+import { starterIntegrityMode } from "../lib/starter-integrity.js";
 import { OPENAI_WRAP_DEFAULT_MODEL, openaiBirthProbeBody } from "../lib/birth-probe.js";
 const AGENT_HEADER = "x-mnemom-agent";
 const PROVIDERS = {
@@ -98,7 +99,7 @@ export async function wrapCommand(options = {}) {
     say();
     say(`${fmt.badge("alignment", "cyan")} Seeding starter alignment card…`);
     try {
-        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId)), "application/json");
+        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId, await starterIntegrityMode(agentId))), "application/json");
         steps.push({ step: "alignment", status: "ok" });
         say(fmt.success("Alignment card set."));
     }
@@ -261,12 +262,12 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
     return agentId;
 }
 // ── Starter cards ─────────────────────────────────────────────────────────────
-function buildStarterAlignmentCard(agentId) {
+function buildStarterAlignmentCard(agentId, integrityMode) {
     return {
         card_version: "unified/2026-04-26",
         agent_id: agentId,
         autonomy_mode: "observe",
-        integrity_mode: "off",
+        integrity_mode: integrityMode, // the agent's own mode; observe for a new agent (MNE-9728)
         // No capability mappings here, so unmapped tools must pass or every turn fails.
         enforcement: { allow_unmapped_tools: true },
         principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },

package/dist/index.js

@@ -204,8 +204,8 @@ const agentCmd = program
     .option("--invite <token>", "Redeem a Mnemom Agent invitation (pinv_…): unlocks Mnemom Agent for you + credits your starter µ; launches too when a session name is given")
     .option("--setup", "Re-check the served agent and refresh its default cards before launch")
     .option("--no-setup", "Skip the default-card writes (the agent is still confirmed and claimed)")
-    .option("--governance [features]", "Turn governance ON for the agent's cards: AIP integrity analysis + Safe House screening, observe-only (default: off for new agents; autonomy policy checks are rules only and on either way). Pick features with a comma list: integrity, safe-house. Billed at cost on top of the agent fee")
-    .option("--no-governance", "Turn governance OFF for the agent's cards, autonomy policy checks included (by default new agents run autonomy observe, rules only; a card refresh otherwise keeps an existing agent's modes)")
+    .option("--governance [features]", "Choose the governance features for the agent's cards, observe-only: a comma list naming exactly the features to turn on: integrity, safe-house, all or none (default for new agents: integrity on, Safe House off; `--governance none` opts out of integrity; autonomy policy checks are rules only and on either way). Billed at cost on top of the agent fee")
+    .option("--no-governance", "Turn governance OFF for the agent's cards, autonomy policy checks included (by default new agents run autonomy observe, rules only, plus integrity observe; a card refresh otherwise keeps an existing agent's modes)")
     .option("--no-yolo", "Do NOT pass --dangerously-skip-permissions (yolo is on by default)")
     .option("--no-context-hint", "Do NOT seed Claude Code's context-hint feature flag before launch")
     // The Mnemom plugin lands dark: off by default and not in the published package, so its two
@@ -2383,14 +2383,15 @@ program
 });
 program
     .command("scan")
-    .description("Read-only local scan of GitHub PR metadata; the report is emailed to you every time (counts only, no repo names) and Mnemom keeps nothing at share level none")
+    .description("Read-only local scan of GitHub PR metadata; the full report, with the counts for each repo, is always emailed to you, your org admins and anyone you add. --share chooses what Mnemom may keep")
     .option("--repo <owner/name...>", "Repo to scan (repeatable or comma-separated; omit on a terminal to pick from your repos)")
     .option("--start <YYYY-MM-DD>", "Period start (default: today)")
     .option("--end <YYYY-MM-DD>", "Period end (default: today)")
-    .option("--share <level>", "summary | full | none (default: full when asked; none when not interactive)")
-    .option("--cto-email <email>", "CTO who receives the report (required unless you are the CTO; asked when omitted)")
+    .option("--share <level>", "What Mnemom may keep: full (totals and per-repo counts, default when asked) | analytics (team totals only, no repo names; summary is the old name) | none (nothing; the default when not interactive)")
+    .option("--email <address...>", "Also email the report to these people (repeatable or comma-separated, up to 10, on your organization's email domain or mnemom.ai). You and every org admin always get it")
+    .option("--cto-email <email>", "Same as --email (kept for older scripts)")
     .option("--monthly-spend <usd>", "Your own approximate monthly AI spend (self-reported; never sent or saved; needs MNEMOM_ORG_SCAN_MODE=true)")
-    .option("--anthropic-admin-key", "Ask (masked) for your Anthropic admin key and read measured usage with it, locally; or set ANTHROPIC_ADMIN_KEY. Never stored, logged or sent anywhere but api.anthropic.com (needs MNEMOM_ORG_SCAN_MODE=true)")
+    .option("--anthropic-admin-key", "Ask (masked) for your Anthropic admin key and read measured usage with it, locally; or set ANTHROPIC_ADMIN_KEY. Never stored, logged or sent anywhere but api.anthropic.com. Without this flag, workload identity federation is tried first when ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID and ANTHROPIC_SERVICE_ACCOUNT_ID are set (needs MNEMOM_ORG_SCAN_MODE=true)")
     .option("--no-anthropic-usage", "Decline Anthropic usage and be asked for a monthly figure (needs MNEMOM_ORG_SCAN_MODE=true)")
     .option("--org <org_id>", "Your org id; the report is emailed to you for this org (default: your only organization, else the scan stops and asks). Also selects the Record totals preview (needs MNEMOM_ORG_SCAN_MODE=true)")
     .action(async (options) => {
@@ -2405,6 +2406,7 @@ program
             period: { start: options.start ?? options.end ?? today, end: options.end ?? today },
             share: options.share,
             ctoEmail: options.ctoEmail,
+            email: options.email,
             monthlySpend: options.monthlySpend,
             noAnthropicUsage: options.anthropicUsage === false,
             anthropicAdminKey: options.anthropicAdminKey === true,

package/dist/lib/commit-report.d.ts

@@ -51,17 +51,8 @@ export declare function attributionSettings(conversationId: string, user: string
 };
 /** `owner/name` from a GitHub remote URL (https, ssh or scp form), or null. */
 export declare function parseRepoSlug(url: string): string | null;
-/** The commit index body's schema tag (shared with the fleet worker's reporter). */
-export declare const COMMIT_SCHEMA = "RecordCommit/v1";
-/** RecordCommit/v1: strings only, every field required; the route rejects an unknown field. */
-export interface RecordCommitBody {
-    schema: typeof COMMIT_SCHEMA;
-    lineage_key: string;
-    repo: string;
-    branch: string;
-    sha: string;
-    patch_id: string;
-}
+import { COMMIT_SCHEMA, type RecordCommitBody } from "./runner/record-commit.js";
+export { COMMIT_SCHEMA, type RecordCommitBody };
 /** Runs git in the session's repository; null on any failure. */
 export type Git = (args: string[], input?: string) => string | null;
 export declare function realGit(cwd: string): Git;
@@ -71,8 +62,11 @@ export declare function realGit(cwd: string): Git;
  * teammate's fetched commit is never reported as this session's.
  */
 export declare function sessionCommits(git: Git, sinceSec: number): string[];
-/** The body for one commit, or the fields that could not be read. */
-export declare function commitBody(git: Git, sha: string, lineageKey: string): {
+/**
+ * The body for one commit, or the fields that could not be read. `repo` overrides the slug read
+ * from `origin`: the runner knows its job's repo, and on a local lane `origin` is not github.com.
+ */
+export declare function commitBody(git: Git, sha: string, lineageKey: string, repoOverride?: string): {
     ok: true;
     body: RecordCommitBody;
 } | {

package/dist/lib/commit-report.js

@@ -65,8 +65,8 @@ export function parseRepoSlug(url) {
     const slug = `${m[1]}/${m[2]}`;
     return REPO_SLUG.test(slug) ? slug : null;
 }
-/** The commit index body's schema tag (shared with the fleet worker's reporter). */
-export const COMMIT_SCHEMA = "RecordCommit/v1";
+import { COMMIT_SCHEMA } from "./runner/record-commit.js";
+export { COMMIT_SCHEMA };
 export function realGit(cwd) {
     return (args, input) => {
         const r = spawnSync("git", args, { cwd, encoding: "utf8", input, timeout: 10_000 });
@@ -91,8 +91,11 @@ export function sessionCommits(git, sinceSec) {
         .filter(([sha, ce]) => sha !== undefined && HEX40.test(sha) && ce === email)
         .map(([sha]) => sha);
 }
-/** The body for one commit, or the fields that could not be read. */
-export function commitBody(git, sha, lineageKey) {
+/**
+ * The body for one commit, or the fields that could not be read. `repo` overrides the slug read
+ * from `origin`: the runner knows its job's repo, and on a local lane `origin` is not github.com.
+ */
+export function commitBody(git, sha, lineageKey, repoOverride) {
     const diff = git(["diff-tree", "-p", "--root", sha]);
     const patchId = diff
         ? (/^\s*([0-9a-f]{40})\b/.exec(git(["patch-id", "--stable"], diff) ?? "")?.[1] ?? "")
@@ -103,7 +106,11 @@ export function commitBody(git, sha, lineageKey) {
         .map((s) => s.trim())
         .filter(Boolean);
     const branch = holders.includes(current) ? current : (holders[0] ?? "");
-    const repo = parseRepoSlug(git(["remote", "get-url", "origin"]) ?? "") ?? "";
+    const repo = repoOverride !== undefined
+        ? REPO_SLUG.test(repoOverride)
+            ? repoOverride
+            : ""
+        : (parseRepoSlug(git(["remote", "get-url", "origin"]) ?? "") ?? "");
     const missing = [];
     if (!HEX40.test(sha))
         missing.push("sha");

package/dist/lib/conduct-receipt.d.ts

@@ -1,6 +1,9 @@
 /**
- * The conduct receipt (experimental `record`, Doors W1.2 / W1.3): the engineer's private view of
- * one session, printed when `mnemom agent` exits and when a durable session parks.
+ * The conduct receipt (Doors W1.2 / W1.3): the engineer's private view of one session, printed
+ * when `mnemom agent` exits and when a durable session parks. On by default since 0.17.38
+ * (MNE-9013; MNEMOM_AGENT_RECEIPT=0 opts out). It prints ONLY when the server returns tally data:
+ * an org outside the record cohort (404), a caller without the role (403), no captured lineage,
+ * or a read that never answers inside the deadline all print nothing.
  *
  *   Conduct receipt
  *     model cost  $0.42
@@ -13,7 +16,7 @@
  *
  * NEVER BLOCKS EXIT. The whole read, auth refresh included, races a hard deadline
  * (RECEIPT_DEADLINE_MS): with the API or the record builder down, exit takes at most that much
- * longer, and the receipt falls back to the link. The caller keeps its exit code; nothing here
+ * longer, and the receipt prints nothing. The caller keeps its exit code; nothing here
  * throws.
  *
  * The lineage key is the gateway's (x-mnemom-lineage-key, set on every response), captured by the
@@ -35,6 +38,8 @@ export type TotalsRead = {
     muChargedMmu: bigint | null;
 } | {
     kind: "unavailable";
+} | {
+    kind: "absent";
 };
 export interface ReceiptDeps {
     /** One totals read for the lineage; may throw or hang (both are "unavailable"). */