@mnemom/mnemom 0.17.38-next.0 → 0.17.38-next.1

package/dist/commands/agent-doctor.d.ts

@@ -10,7 +10,7 @@
  * (200 + the x-mnemom-verdict header that proves the governance pipeline is
  * live), Remote-Control capability (node + openssl + the --remote-control flag),
  * claude.ai login (informational — Remote Control needs it), the agent's governance
- * modes (off by default for new agents), and CLI auto-update status.
+ * modes (integrity observe, Safe House off for new agents), and CLI auto-update status.
  */
 type Mark = "ok" | "warn" | "miss" | "info";
 export interface DoctorOptions {
@@ -51,7 +51,7 @@ export interface GovernanceProbe {
 /**
  * The governance line: the composed (every layer, strictest wins) integrity and
  * Safe House modes of the agent a launch would use. Signed out, no such agent,
- * or an unreadable card → info with the off-by-default note, never a MISS
+ * or an unreadable card → info with the new-agent default note, never a MISS
  * (governance never blocks a launch). On → info naming the per-turn cost; a
  * stricter layer outranks the agent's own card (any rung up the ladder off <
  * observe < nudge < enforce, MNE-8612) → warn naming the layer.

package/dist/commands/agent-doctor.js

@@ -10,7 +10,7 @@
  * (200 + the x-mnemom-verdict header that proves the governance pipeline is
  * live), Remote-Control capability (node + openssl + the --remote-control flag),
  * claude.ai login (informational — Remote Control needs it), the agent's governance
- * modes (off by default for new agents), and CLI auto-update status.
+ * modes (integrity observe, Safe House off for new agents), and CLI auto-update status.
  */
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
@@ -119,7 +119,7 @@ export async function agentDoctorCommand(options = {}) {
             add("info", "claude.ai login: could not determine");
     }
     add(gate.mark, gate.text, gate.hint);
-    // ── governance (off by default for new agents) ──
+    // ── governance (integrity observe, Safe House off for new agents) ──
     const gov = await probeGovernance(options.agent);
     add(gov.mark, gov.text, gov.hint);
     // ── CLI auto-update ──
@@ -236,7 +236,7 @@ const OPT_IN_HINT = GOVERNANCE_OPT_IN_HINT.trim();
 /**
  * The governance line: the composed (every layer, strictest wins) integrity and
  * Safe House modes of the agent a launch would use. Signed out, no such agent,
- * or an unreadable card → info with the off-by-default note, never a MISS
+ * or an unreadable card → info with the new-agent default note, never a MISS
  * (governance never blocks a launch). On → info naming the per-turn cost; a
  * stricter layer outranks the agent's own card (any rung up the ladder off <
  * observe < nudge < enforce, MNE-8612) → warn naming the layer.
@@ -244,7 +244,7 @@ const OPT_IN_HINT = GOVERNANCE_OPT_IN_HINT.trim();
 export async function probeGovernance(agent) {
     const offByDefault = {
         mark: "info",
-        text: "governance: off by default for new agents (AIP integrity analysis, Safe House screening)",
+        text: "governance: new agents get AIP integrity analysis (observe); Safe House screening is off by default",
         hint: `${OPT_IN_HINT} Agents set up before this default keep their cards.`,
     };
     if (!(await isLoggedIn()))

package/dist/commands/agent-setup.d.ts

@@ -6,12 +6,13 @@
  * governed identity `agent-<handle>`. This module makes that identity REAL in
  * their Mnemom org: it births the agent through the gateway, claims it (so the
  * customer owns it), and publishes a sane default coding posture. Governance that
- * costs a model call is OFF by default (operator 2026-10-02: AIP integrity and
- * Safe House analysis are billed, so nobody pays for them until they turn them
- * on); governance that costs none stays ON (operator 2026-10-03: autonomy is
+ * costs a model call is split (operator 2026-11-04, MNE-9728, matching the API new-agent
+ * default): AIP integrity analysis is ON (observe) for a new agent so it is analyzed and can earn
+ * a reputation rating, billed at cost; Safe House screening stays OFF until asked for (operator
+ * 2026-10-02); governance that costs none stays ON (operator 2026-10-03: autonomy is
  * rules-only verification + policy). The goal contract is what nudges (re-anchor
  * on drift). Specifically:
- *   - alignment card: autonomy_mode = observe, integrity_mode = off, the agent's
+ *   - alignment card: autonomy_mode = observe, integrity_mode = observe, the agent's
  *     org as principal (delegated_authority), Claude Code tool names as bounded
  *     actions, coding forbidden actions, defined values, grace 0, and no default
  *     escalation trigger for irreversible operations (the customer adds their own);
@@ -22,8 +23,8 @@
  *   older default's content and keeps the agent's modes.
  *   - goal-alignment: nudge — sealed per-conversation via the goal contract
  *     (--goal …), graded and re-anchored by the gateway.
- * `--governance [integrity,safe-house]` opts a setup in (observe-only, billed at
- * cost on top of the agent fee); `--no-governance` turns every card off, autonomy
+ * `--governance [integrity,safe-house]` picks exactly those features on (observe-only,
+ * billed at cost on top of the agent fee; `--governance none` opts out of both); `--no-governance` turns every card off, autonomy
  * included; a refresh of an already-claimed agent keeps the
  * modes its own cards carry unless a --governance / --no-governance flag says otherwise.
  *
@@ -40,7 +41,8 @@ import { type CardSources, type CodeEntitlement } from "../lib/api.js";
 export type GovernanceMode = "off" | "observe";
 /**
  * The governance features a setup turns on. Each is a model call per turn that
- * the customer pays for at cost, so both are off unless asked for.
+ * the customer pays for at cost. Integrity is on for a new agent (opt out with `--governance none`
+ * or `--no-governance`); Safe House is off unless asked for.
  */
 export interface GovernanceOptIn {
     /**
@@ -58,7 +60,7 @@ export interface GovernanceOptIn {
 export declare const GOVERNANCE_FEATURES: readonly ["integrity", "safe-house"];
 /**
  * Parse the `--governance [features]` / `--no-governance` flag. undefined = not
- * given (new agents get autonomy only; a refresh keeps the agent's current modes),
+ * given (new agents get autonomy + integrity; a refresh keeps the agent's current modes),
  * true = every feature, false (`--no-governance`) = everything off, autonomy
  * included, a string = a comma-separated list of `integrity`, `safe-house`, `all`
  * or `none`, each keeping autonomy on. Throws on an unknown name.
@@ -140,7 +142,7 @@ interface ExistingCards {
     align: Record<string, unknown> | null;
     prot: Record<string, unknown> | null;
 }
-/** Printed when a setup ran without --governance: how to opt in, and what it costs. */
+/** Printed when a setup ran without --governance: what is on by default, how to change it, and what it costs. */
 export declare const GOVERNANCE_OPT_IN_HINT: string;
 /**
  * The default governed-agent slug for the current customer: `agent-<handle>`,

package/dist/commands/agent-setup.js

@@ -6,12 +6,13 @@
  * governed identity `agent-<handle>`. This module makes that identity REAL in
  * their Mnemom org: it births the agent through the gateway, claims it (so the
  * customer owns it), and publishes a sane default coding posture. Governance that
- * costs a model call is OFF by default (operator 2026-10-02: AIP integrity and
- * Safe House analysis are billed, so nobody pays for them until they turn them
- * on); governance that costs none stays ON (operator 2026-10-03: autonomy is
+ * costs a model call is split (operator 2026-11-04, MNE-9728, matching the API new-agent
+ * default): AIP integrity analysis is ON (observe) for a new agent so it is analyzed and can earn
+ * a reputation rating, billed at cost; Safe House screening stays OFF until asked for (operator
+ * 2026-10-02); governance that costs none stays ON (operator 2026-10-03: autonomy is
  * rules-only verification + policy). The goal contract is what nudges (re-anchor
  * on drift). Specifically:
- *   - alignment card: autonomy_mode = observe, integrity_mode = off, the agent's
+ *   - alignment card: autonomy_mode = observe, integrity_mode = observe, the agent's
  *     org as principal (delegated_authority), Claude Code tool names as bounded
  *     actions, coding forbidden actions, defined values, grace 0, and no default
  *     escalation trigger for irreversible operations (the customer adds their own);
@@ -22,8 +23,8 @@
  *   older default's content and keeps the agent's modes.
  *   - goal-alignment: nudge — sealed per-conversation via the goal contract
  *     (--goal …), graded and re-anchored by the gateway.
- * `--governance [integrity,safe-house]` opts a setup in (observe-only, billed at
- * cost on top of the agent fee); `--no-governance` turns every card off, autonomy
+ * `--governance [integrity,safe-house]` picks exactly those features on (observe-only,
+ * billed at cost on top of the agent fee; `--governance none` opts out of both); `--no-governance` turns every card off, autonomy
  * included; a refresh of an already-claimed agent keeps the
  * modes its own cards carry unless a --governance / --no-governance flag says otherwise.
  *
@@ -55,7 +56,7 @@ const say = (line = "") => console.error(line);
 export const GOVERNANCE_FEATURES = ["integrity", "safe-house"];
 /**
  * Parse the `--governance [features]` / `--no-governance` flag. undefined = not
- * given (new agents get autonomy only; a refresh keeps the agent's current modes),
+ * given (new agents get autonomy + integrity; a refresh keeps the agent's current modes),
  * true = every feature, false (`--no-governance`) = everything off, autonomy
  * included, a string = a comma-separated list of `integrity`, `safe-house`, `all`
  * or `none`, each keeping autonomy on. Throws on an unknown name.
@@ -219,15 +220,16 @@ export function newAgentModes(governance) {
     const autonomy = modeOf(governance?.autonomy ?? true);
     return {
         autonomy,
-        integrity: modeOf(governance?.integrity ?? false),
+        integrity: modeOf(governance?.integrity ?? true),
         protection: modeOf(governance?.safeHouse ?? false),
         allowUnmappedTools: autonomy === "observe" ? true : undefined,
     };
 }
 /**
  * The plan for refreshing an EXISTING agent: an explicit --governance /
- * --no-governance wins; else it keeps the modes its own cards carry. No agent-layer
- * card → the new-agent defaults (it never had one). A card with no mode field →
+ * --no-governance wins; else it keeps the modes its own cards carry. No agent-layer card → autonomy and Safe House get the
+ * new-agent defaults but integrity stays off (an existing agent is never silently opted in to billed
+ * analysis; MNE-9728). A card with no mode field →
  * observe (the prior CLI always wrote observe). A failed read → null: skip the refresh.
  */
 async function existingAgentPlan(agentId, governance) {
@@ -252,7 +254,7 @@ async function existingAgentPlan(agentId, governance) {
     return {
         modes: {
             autonomy: align ? (modeField(align, "autonomy_mode") ?? "observe") : fresh.autonomy,
-            integrity: align ? (modeField(align, "integrity_mode") ?? "observe") : fresh.integrity,
+            integrity: align ? (modeField(align, "integrity_mode") ?? "observe") : "off", // an existing agent with no card of its own is not silently opted in to billed analysis (MNE-9728)
             protection: prot ? (modeField(prot, "mode") ?? "observe") : fresh.protection,
             allowUnmappedTools: align
                 ? typeof ownAllow === "boolean"
@@ -263,9 +265,10 @@ async function existingAgentPlan(agentId, governance) {
         existing: { align, prot },
     };
 }
-/** Printed when a setup ran without --governance: how to opt in, and what it costs. */
-export const GOVERNANCE_OPT_IN_HINT = "  Governance (AIP integrity analysis, Safe House screening) is off by default. Turn it on with " +
-    "`mnemom agent setup --governance` (or --governance integrity / safe-house); it is billed at cost on top of the agent fee.";
+/** Printed when a setup ran without --governance: what is on by default, how to change it, and what it costs. */
+export const GOVERNANCE_OPT_IN_HINT = "  AIP integrity analysis is on (observe) for new agents; Safe House screening is off by default. " +
+    "Opt out of integrity with `mnemom agent setup --governance none` (or --no-governance); turn Safe House on with " +
+    "`--governance integrity,safe-house`. Both are billed at cost on top of the agent fee.";
 /**
  * The default governed-agent slug for the current customer: `agent-<handle>`,
  * where <handle> is the local-part of their mnemom login email (sanitised), or
@@ -457,8 +460,8 @@ async function confirmClaimed(opts, anchorKey, fp) {
             const plan = await existingAgentPlan(agentId, opts.governance);
             if (plan) {
                 if (!opts.governance) {
-                    say(fmt.dim(`  Keeping its current governance (${describeModes(plan.modes)}). New agents default to off; ` +
-                        "`--governance` turns it on, `--no-governance` turns it off."));
+                    say(fmt.dim(`  Keeping its current governance (${describeModes(plan.modes)}). New agents default to integrity observe; ` +
+                        "`--governance` picks features, `--no-governance` turns everything off."));
                 }
                 // The principal is the agent's own org, which a refresh may launch from another.
                 const ownOrg = await agentOrgId(agentId);
@@ -511,7 +514,7 @@ async function confirmClaimed(opts, anchorKey, fp) {
     }
     say(fmt.success(`mnemom agent: claimed '${slug}' (${agentId}) in ${opts.orgLabel}.`));
     await noteSameNamedAgent(slug, agentId);
-    // Publish the default cards (autonomy observe; integrity + Safe House off unless
+    // Publish the default cards (autonomy + integrity observe; Safe House off unless
     // --governance). A card write that can't complete does NOT undo the claim — the agent is
     // claimed and governed on whatever landed; we warn how to finish it.
     if (opts.setup !== false) {
@@ -1443,9 +1446,11 @@ function carryForward(card, kind) {
         return card;
     return upgradeInPlace(card, kind) ?? card;
 }
-export function buildCodeAlignmentCard(agentId, modes = {
+export function buildCodeAlignmentCard(agentId, 
+// Every production caller passes modes; the fallback's integrity matches the new-agent default (MNE-9728).
+modes = {
     autonomy: "off",
-    integrity: "off",
+    integrity: "observe",
 }, principal = UNSPECIFIED_PRINCIPAL) {
     return {
         card_version: "unified/2026-04-26",

package/dist/commands/card.js

@@ -885,7 +885,7 @@ export async function cardEditCommand(agentName, options = {}) {
             card_version: "unified/2026-04-26",
             agent_id: agentId,
             autonomy_mode: "observe",
-            integrity_mode: "off",
+            integrity_mode: "observe", // new-agent default (MNE-9728); set to off to opt out
             enforcement: { allow_unmapped_tools: true },
             principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },
             values: { declared: ["transparency", "safety", "honesty"] },

package/dist/commands/onboard.js

@@ -45,6 +45,7 @@ import { isInteractive, askInput, askYesNo } from "../lib/prompt.js";
 import { getWebsiteUrl } from "../lib/config.js";
 import { openBrowser } from "../lib/oauth.js";
 import { fmt } from "../lib/format.js";
+import { starterIntegrityMode } from "../lib/starter-integrity.js";
 const FULL_PROOF_RE = /^[0-9a-f]{64}$/;
 /**
  * Entry point for `mnemom onboard`. Throws on a fatal error (caught by the
@@ -94,7 +95,7 @@ export async function onboardCommand(options = {}) {
     say();
     say(`${fmt.badge("alignment", "cyan")} Declaring your alignment card…`);
     try {
-        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId)), "application/json", 
+        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId, await starterIntegrityMode(agentId))), "application/json", 
         // A STABLE key so a re-run replays the same server-side reservation
         // (idempotent no-op) rather than writing a divergent duplicate card.
         { idempotencyKey: `onboard-alignment-${agentId}` });
@@ -353,16 +354,16 @@ async function earnRating(agentId, steps, say) {
 // ── starter alignment card ──────────────────────────────────────────────────────
 /**
  * A starter alignment card: autonomy observe (rules only, no model call), integrity
- * `off` (alignment analysis is billed; the user turns it on) — the honest, minimal declaration
+ * as the agent's own card has it (observe for a new agent, MNE-9728; see lib/starter-integrity.ts) — the honest, minimal declaration
  * of intent for a freshly-onboarded agent. Mirrors the shape `wrap` seeds so the
  * two skill-runners produce a consistent first card.
  */
-function buildStarterAlignmentCard(agentId) {
+function buildStarterAlignmentCard(agentId, integrityMode) {
     return {
         card_version: "unified/2026-04-26",
         agent_id: agentId,
         autonomy_mode: "observe",
-        integrity_mode: "off",
+        integrity_mode: integrityMode, // the agent's own mode; observe for a new agent (MNE-9728)
         // No capability mappings here, so unmapped tools must pass or every turn fails.
         enforcement: { allow_unmapped_tools: true },
         principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },

package/dist/commands/scan.d.ts

@@ -13,7 +13,6 @@ import { type RecordDeps, type RecordOutcome } from "../lib/scan/record.js";
 import { type CostSpend } from "../lib/scan/cost-per-pr.js";
 import { type ReportEmailDeps } from "../lib/scan/report-email.js";
 import { type RepoListDeps } from "../lib/scan/repo-picker.js";
-import { type ReportRecipients } from "../lib/scan/share.js";
 export interface ScanCommandOptions {
     repos: string[];
     period?: {
@@ -21,8 +20,10 @@ export interface ScanCommandOptions {
         end: string;
     };
     share?: string;
-    /** Report recipient. Required unless the runner is the CTO (asked when omitted). */
+    /** Alias of one --email (kept for older scripts). */
     ctoEmail?: string;
+    /** Extra recipients of the report (repeatable; comma-separated accepted). The runner and every org admin always get it. */
+    email?: string[];
     /** Tier 2: the CTO's own monthly figure, as typed. Needs MNEMOM_ORG_SCAN_MODE=true. */
     monthlySpend?: string;
     /** Tier 2 without a figure on the command line: ask for one on the terminal. */
@@ -71,11 +72,24 @@ export interface ScanCommandOptions {
 /** Parses repeated/comma-separated `--repo owner/name`. Returns null on any invalid slug. */
 export declare function parseRepoFlags(raw: string[] | undefined): string[] | null;
 export declare const isEmail: (v: unknown) => v is string;
-/** The runner's email (mnemom login, else asked) and the CTO's (flag, else "are you the CTO?"). */
-export declare function resolveRecipients(o: {
-    runnerEmail?: string;
+export declare const DELETE_CONTACT = "privacy@mnemom.ai";
+export declare const EMAIL_ONE_MSG = "Enter one email address, like you@company.com.";
+export declare const EMAIL_LIST_MSG = "Enter email addresses like you@company.com, separated by commas.";
+export declare const MAX_EXTRA_EMAILS = 10;
+/**
+ * The people to add to the report email (the runner and every org admin always get it). Comes from the
+ * repeatable --email flag (and its alias --cto-email), each value one address or a comma-separated list;
+ * on a terminal with none given, asks once (blank to skip). Plain-language errors; the value is never echoed.
+ */
+export declare function resolveExtraEmails(o: {
+    email?: string[];
     ctoEmail?: string;
-}): Promise<ReportRecipients>;
+    isTty?: boolean;
+}): Promise<string[]>;
+/** The runner's own address from the Mnemom login, or undefined (the server resolves it for the email either way). */
+export declare function runnerEmailFromLogin(o: {
+    runnerEmail?: string;
+}): string | undefined;
 /** The CTO's figure in USD, or null for none. Throws fixed text only; the input is never echoed. */
 export declare function resolveSelfReportedSpend(o: ScanCommandOptions): Promise<number | null>;
 /**

package/dist/commands/scan.js

@@ -28,29 +28,61 @@ export function parseRepoFlags(raw) {
         .filter(Boolean);
     return out.length > 0 && out.every(isValidRepoSlug) ? out : null;
 }
-const EMAIL = /^[^\s@]{1,64}@[^\s@]{1,255}\.[^\s@]{2,63}$/;
-export const isEmail = (v) => typeof v === "string" && v.length <= 320 && EMAIL.test(v.trim());
-/** The runner's email (mnemom login, else asked) and the CTO's (flag, else "are you the CTO?"). */
-export async function resolveRecipients(o) {
-    if (o.ctoEmail !== undefined && !isEmail(o.ctoEmail))
-        throw new Error("--cto-email must be a valid email address");
-    let runner = o.runnerEmail ?? getAuthInfo()?.email ?? "";
-    if (!isEmail(runner))
-        runner = (await askInput("Your email (the report is sent to you):")).trim();
-    if (!isEmail(runner))
-        throw new Error("a valid runner email is required");
-    runner = runner.trim();
-    if (o.ctoEmail !== undefined)
-        return { runner_email: runner, cto_email: o.ctoEmail.trim() };
-    const isCto = await askSelect("Are you the CTO?", ["Yes, I am the CTO", "No, someone else is"]);
-    if (isCto === null)
-        throw new Error("--cto-email is required when you are not the CTO");
-    if (isCto.startsWith("Yes"))
-        return { runner_email: runner, cto_email: runner };
-    const cto = (await askInput("CTO email (the report is sent to them too):")).trim();
-    if (!isEmail(cto))
-        throw new Error("--cto-email is required when you are not the CTO");
-    return { runner_email: runner, cto_email: cto };
+/**
+ * Same rule as the API: isPlainEmail in mnemom/mnemom-api src/org-scan/report-email/notifier.ts (no shared
+ * package, so this is a copy). Drift guard: the "plain-email rule edge" table in src/__tests__/scan.test.ts;
+ * change both together. No spaces, control chars or <>",; ; one @; every domain label non-empty; max 254. */
+const plainEmail = (a) => {
+    if (a.length === 0 || a.length > 254)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        const c = a.charCodeAt(i);
+        if (c <= 32 || c === 127 || '<>",;'.includes(a[i]))
+            return false;
+    }
+    const at = a.indexOf("@");
+    if (at < 1 || at !== a.lastIndexOf("@"))
+        return false;
+    const labels = a.slice(at + 1).split(".");
+    return labels.length >= 2 && labels.every((l) => l.length > 0);
+};
+export const isEmail = (v) => typeof v === "string" && plainEmail(v.trim());
+export const DELETE_CONTACT = "privacy@mnemom.ai";
+export const EMAIL_ONE_MSG = "Enter one email address, like you@company.com.";
+export const EMAIL_LIST_MSG = "Enter email addresses like you@company.com, separated by commas.";
+export const MAX_EXTRA_EMAILS = 10;
+/**
+ * The people to add to the report email (the runner and every org admin always get it). Comes from the
+ * repeatable --email flag (and its alias --cto-email), each value one address or a comma-separated list;
+ * on a terminal with none given, asks once (blank to skip). Plain-language errors; the value is never echoed.
+ */
+export async function resolveExtraEmails(o) {
+    const given = [...(o.email ?? []), ...(o.ctoEmail !== undefined ? [o.ctoEmail] : [])];
+    let raw = given;
+    if (given.length === 0) {
+        if (!(o.isTty ?? process.stdin.isTTY))
+            return [];
+        const typed = ((await askInput("Anyone else to email the report to? Enter addresses separated by commas, or press Enter to skip:")) ?? "").trim();
+        if (typed === "")
+            return [];
+        raw = [typed];
+    }
+    const list = raw
+        .flatMap((v) => v.split(","))
+        .map((v) => v.trim())
+        .filter(Boolean);
+    if (list.length === 0 || !list.every(isEmail))
+        throw new Error(raw.length > 1 || raw.some((v) => v.includes(",")) ? EMAIL_LIST_MSG : EMAIL_ONE_MSG);
+    const seen = new Set();
+    const unique = list.filter((a) => !seen.has(a.toLowerCase()) && seen.add(a.toLowerCase()));
+    if (unique.length > MAX_EXTRA_EMAILS)
+        throw new Error(`Add at most ${MAX_EXTRA_EMAILS} extra email addresses.`);
+    return unique;
+}
+/** The runner's own address from the Mnemom login, or undefined (the server resolves it for the email either way). */
+export function runnerEmailFromLogin(o) {
+    const e = (o.runnerEmail ?? getAuthInfo()?.email ?? "").trim();
+    return isEmail(e) ? e : undefined;
 }
 /** The CTO's figure in USD, or null for none. Throws fixed text only; the input is never echoed. */
 export async function resolveSelfReportedSpend(o) {
@@ -238,16 +270,20 @@ export async function resolveRecordOutcome(o) {
 }
 export async function scanCommand(o) {
     if (o.share !== undefined && parseShareLevel(o.share) === null) {
-        throw new Error("--share must be one of: summary, full, none");
+        throw new Error("--share must be one of: full, analytics, none (summary also works, same as analytics)");
     }
     const noRepoFlag = o.repos.length === 0;
+    const interactive = Boolean(o.isTty ?? process.stdin.isTTY);
     // No --repo: on a terminal pick from the repos this GitHub login can read; otherwise the error stays, with a hint.
-    if (noRepoFlag && !(o.isTty ?? process.stdin.isTTY))
+    if (noRepoFlag && !interactive)
         throw new Error(`--repo owner/name is required (repeatable). ${REPO_PICKER_NO_TERMINAL_HINT}`);
+    // Consent comes first, before any data is processed (MNE-9634). The flag wins; on a terminal with no flag we
+    // ask (Full preselected); with no terminal and no flag the answer is Nothing (fail closed).
+    const level = parseShareLevel(o.share) ?? (interactive ? await promptShareLevel() : "none");
+    // The people added to the report email; the runner and every org admin always get it.
+    const extraEmails = await resolveExtraEmails(o);
     // The report is emailed on every scan, so resolve the org before any scan work; failure is loud.
     const emailOrg = await resolveScanOrg(o);
-    if (o.ctoEmail !== undefined && !isEmail(o.ctoEmail))
-        throw new Error("--cto-email must be a valid email address");
     const getCredential = async () => {
         const c = o.credential ?? (await resolveCredential().catch(() => null));
         if (!c)
@@ -292,19 +328,23 @@ export async function scanCommand(o) {
     else if (record !== null)
         for (const line of renderRecordSection(record))
             console.log(line);
-    const level = parseShareLevel(o.share) ?? (await promptShareLevel());
     // Every successful scan emails the report to the person who ran it, at every share level, no opt-out.
     // Mnemom keeps nothing from a share=none send (the server sends the email and does nothing else).
-    const emailFailure = await emailReport(o, emailOrg, result, level, spend, period, resolveCostSpend(o, result, spend, measured));
-    if (level === "none") {
-        console.log("Share level: nothing. No share payload is built; Mnemom keeps nothing (the report email is only sent to you).");
-        if (emailFailure)
-            throw new ReportEmailError(emailFailure);
-        return;
+    const emailResult = await emailReport(o, emailOrg, result, level, spend, period, resolveCostSpend(o, result, spend, measured), extraEmails);
+    const emailFailure = emailResult === "not_sent" || emailResult === null ? null : emailResult;
+    // What was shared with Mnemom, and how to have it deleted (MNE-9634).
+    if (emailResult !== null) {
+        console.log("Kept on file by Mnemom: nothing, because the report was not sent.");
+    }
+    else if (level === "none") {
+        console.log("Kept on file by Mnemom: nothing. The report was emailed and Mnemom keeps nothing on file; its email provider keeps only a delivery log.");
     }
-    const payload = buildSharePayload(level, result, await resolveRecipients(o), spend ? (spend.shareable ? spend.line : null) : undefined);
-    console.log(`Share level: ${level}. Upload is not wired in this build; this is what would be sent:`);
-    console.log(JSON.stringify(payload, null, 2));
+    else {
+        const payload = buildSharePayload(level, result, { runner_email: runnerEmailFromLogin(o), extra_emails: extraEmails }, spend ? (spend.shareable ? spend.line : null) : undefined);
+        console.log(`Kept on file by Mnemom: ${level === "full" ? "the totals and the counts for each repo, by name" : "the team totals only, with no repo names"}. Mnemom may keep a run record of only this much on file; the full report was emailed, not stored:`);
+        console.log(JSON.stringify(payload, null, 2));
+    }
+    console.log(`To have anything Mnemom holds about this scan deleted, email ${DELETE_CONTACT}.`);
     if (emailFailure)
         throw new ReportEmailError(emailFailure);
 }
@@ -312,7 +352,7 @@ export async function scanCommand(o) {
  * Emails the report. Loud on every failure: prints the reason name, never the server's words, and
  * returns it so the caller exits non-zero after the local report is shown.
  */
-async function emailReport(o, org, result, level, spend, period, costSpend) {
+async function emailReport(o, org, result, level, spend, period, costSpend, extraEmails) {
     const fail = (f) => {
         console.log(failureMessage(f));
         return f;
@@ -324,17 +364,21 @@ async function emailReport(o, org, result, level, spend, period, costSpend) {
         period,
         costSpend,
     });
-    const body = buildEmailBody(report, level, result.coverage.complete, o.ctoEmail?.trim());
+    const body = buildEmailBody(report, level, result.coverage.complete, extraEmails);
     const outcome = await sendReportEmail(org, body, o.emailDeps);
     if (outcome.status === "failed")
         return fail(outcome.reason);
     if (outcome.status === "unavailable") {
         // Org Scan is off by default: the gate's 404 is not a failure and must not break the scan.
         console.log(UNAVAILABLE_MSG);
-        return null;
+        return "not_sent";
     }
     console.log(outcome.status === "dry_run"
         ? DRY_RUN_MSG
-        : `Report emailed to you (${outcome.recipients} recipient${outcome.recipients === 1 ? "" : "s"}).`);
-    return null;
+        : outcome.limited
+            ? "Report emailed in a limited form (your Mnemom service is older than this CLI): no per-repo counts, no org admins, and at most one added address."
+            : `Full report emailed to you, your org admins and anyone you added (${outcome.recipients} recipient${outcome.recipients === 1 ? "" : "s"}).`);
+    if (outcome.status === "sent" && outcome.adminsMissed)
+        console.log(`${outcome.adminsMissed} org admin${outcome.adminsMissed === 1 ? "" : "s"} could not be emailed because no email address is on file.`);
+    return outcome.status === "dry_run" ? "not_sent" : null;
 }

package/dist/commands/verify-card.d.ts

@@ -20,7 +20,8 @@
  *   3. Verify the JWS signature against the JWKS.
  *   4. Fetch the transparency-log row by log_index for the freshly-computed
  *      inclusion proof, plus /v1/transparency/root for the signed root.
- *   5. Verify the Merkle inclusion proof against the root.
+ *   5. Verify the signed root's Ed25519 signature (typ AAP-TransparencyRoot/v1)
+ *      with @mnemom/verify, then the Merkle inclusion proof against that root.
  *   6. Print a care-framed result.
  *
  * --strict mode bypasses the JWKS cache and exits non-zero on any
@@ -30,6 +31,7 @@
  * would-benefit-from vocabulary; stdout carries machine-readable
  * verification status.
  */
+import type * as AipVerify from "@mnemom/verify";
 interface JwkPublic {
     kty: "OKP";
     crv: "Ed25519";
@@ -69,6 +71,14 @@ interface MerkleProof {
         position: "left" | "right";
     }[];
 }
+interface SignedRoot {
+    typ?: string;
+    tree_size: number;
+    root_hash: string;
+    published_at: string;
+    signing_key_id: string;
+    signature: string;
+}
 export interface VerifyCardOptions {
     agentId: string;
     at?: string;
@@ -86,6 +96,19 @@ interface JwsVerification {
     error?: string;
 }
 declare function verifyJws(jws: string, jwks: Jwks): Promise<JwsVerification>;
+interface RootVerification {
+    ok: boolean;
+    kid?: string;
+    reasons: string[];
+}
+/**
+ * Verify the detached Ed25519 signature on GET /v1/transparency/root with the
+ * published offline verifier. `expectedTyp` pins the statement to
+ * AAP-TransparencyRoot/v1, so another signed statement cannot stand in for a
+ * root. A key missing from a cached JWKS reports key_not_found; --no-cache or
+ * --strict refetches it.
+ */
+declare function verifySignedRoot(root: SignedRoot, jwks: Jwks, load?: () => Promise<Pick<typeof AipVerify, "verifyStatement">>): Promise<RootVerification>;
 declare function verifyInclusionProof(proof: MerkleProof, expectedRoot: string): Promise<boolean>;
 declare function internalHash(left: string, right: string): Promise<string>;
 declare function base64urlDecode(s: string): Uint8Array;
@@ -98,5 +121,6 @@ export declare const __testing: {
     base64urlDecode: typeof base64urlDecode;
     base64urlDecodeString: typeof base64urlDecodeString;
     verifyJws: typeof verifyJws;
+    verifySignedRoot: typeof verifySignedRoot;
 };
 export {};

package/dist/commands/verify-card.js

@@ -20,7 +20,8 @@
  *   3. Verify the JWS signature against the JWKS.
  *   4. Fetch the transparency-log row by log_index for the freshly-computed
  *      inclusion proof, plus /v1/transparency/root for the signed root.
- *   5. Verify the Merkle inclusion proof against the root.
+ *   5. Verify the signed root's Ed25519 signature (typ AAP-TransparencyRoot/v1)
+ *      with @mnemom/verify, then the Merkle inclusion proof against that root.
  *   6. Print a care-framed result.
  *
  * --strict mode bypasses the JWKS cache and exits non-zero on any
@@ -65,7 +66,16 @@ export async function verifyCardCommand(options) {
             findings.push("merkle: transparency log is empty (no root to verify against)");
         }
         else {
-            // Step 5: verify the Merkle inclusion proof.
+            // Step 5a: the root is only worth folding into if Mnemom signed it.
+            const rootCheck = await verifySignedRoot(root, jwks);
+            if (!rootCheck.ok) {
+                findings.push(`root: signature did not verify (${rootCheck.reasons.join(", ")})`);
+                exitCode = 1;
+            }
+            else {
+                findings.push(`root: signature ok (kid=${rootCheck.kid}, tree_size=${root.tree_size})`);
+            }
+            // Step 5b: verify the Merkle inclusion proof.
             const proofOk = await verifyInclusionProof(target.inclusion_proof, root.root_hash);
             if (!proofOk) {
                 findings.push(`merkle: inclusion proof did not reconstruct root (log_index=${target.entry.log_index}, tree_size=${target.inclusion_proof.tree_size})`);
@@ -227,6 +237,22 @@ async function verifyJws(jws, jwks) {
     }
     return { ok: true, kid, payload };
 }
+// ── Signed root verification ─────────────────────────────────────────
+const ROOT_TYP = "AAP-TransparencyRoot/v1";
+/**
+ * Verify the detached Ed25519 signature on GET /v1/transparency/root with the
+ * published offline verifier. `expectedTyp` pins the statement to
+ * AAP-TransparencyRoot/v1, so another signed statement cannot stand in for a
+ * root. A key missing from a cached JWKS reports key_not_found; --no-cache or
+ * --strict refetches it.
+ */
+async function verifySignedRoot(root, jwks, load = () => import("@mnemom/verify")) {
+    const { verifyStatement } = await load();
+    const r = await verifyStatement(root, jwks, {
+        expectedTyp: ROOT_TYP,
+    });
+    return { ok: r.valid, kid: r.signing_key_id ?? undefined, reasons: r.reasons };
+}
 // ── Merkle proof verification ────────────────────────────────────────
 async function verifyInclusionProof(proof, expectedRoot) {
     let current = proof.leaf_hash;
@@ -282,6 +308,7 @@ export const __testing = {
     base64urlDecode,
     base64urlDecodeString,
     verifyJws,
+    verifySignedRoot,
 };
 // Silence "MNEMOM_DIR unused" if the cache code path is taken in tests.
 void MNEMOM_DIR;

package/dist/commands/wrap.js

@@ -20,6 +20,7 @@ import { mergeAgentConfig } from "../lib/agent-config.js";
 import { askSelect, askInput, isInteractive } from "../lib/prompt.js";
 import { getGatewayUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
+import { starterIntegrityMode } from "../lib/starter-integrity.js";
 import { OPENAI_WRAP_DEFAULT_MODEL, openaiBirthProbeBody } from "../lib/birth-probe.js";
 const AGENT_HEADER = "x-mnemom-agent";
 const PROVIDERS = {
@@ -98,7 +99,7 @@ export async function wrapCommand(options = {}) {
     say();
     say(`${fmt.badge("alignment", "cyan")} Seeding starter alignment card…`);
     try {
-        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId)), "application/json");
+        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId, await starterIntegrityMode(agentId))), "application/json");
         steps.push({ step: "alignment", status: "ok" });
         say(fmt.success("Alignment card set."));
     }
@@ -261,12 +262,12 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
     return agentId;
 }
 // ── Starter cards ─────────────────────────────────────────────────────────────
-function buildStarterAlignmentCard(agentId) {
+function buildStarterAlignmentCard(agentId, integrityMode) {
     return {
         card_version: "unified/2026-04-26",
         agent_id: agentId,
         autonomy_mode: "observe",
-        integrity_mode: "off",
+        integrity_mode: integrityMode, // the agent's own mode; observe for a new agent (MNE-9728)
         // No capability mappings here, so unmapped tools must pass or every turn fails.
         enforcement: { allow_unmapped_tools: true },
         principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },

package/dist/index.js

@@ -204,8 +204,8 @@ const agentCmd = program
     .option("--invite <token>", "Redeem a Mnemom Agent invitation (pinv_…): unlocks Mnemom Agent for you + credits your starter µ; launches too when a session name is given")
     .option("--setup", "Re-check the served agent and refresh its default cards before launch")
     .option("--no-setup", "Skip the default-card writes (the agent is still confirmed and claimed)")
-    .option("--governance [features]", "Turn governance ON for the agent's cards: AIP integrity analysis + Safe House screening, observe-only (default: off for new agents; autonomy policy checks are rules only and on either way). Pick features with a comma list: integrity, safe-house. Billed at cost on top of the agent fee")
-    .option("--no-governance", "Turn governance OFF for the agent's cards, autonomy policy checks included (by default new agents run autonomy observe, rules only; a card refresh otherwise keeps an existing agent's modes)")
+    .option("--governance [features]", "Choose the governance features for the agent's cards, observe-only: a comma list naming exactly the features to turn on: integrity, safe-house, all or none (default for new agents: integrity on, Safe House off; `--governance none` opts out of integrity; autonomy policy checks are rules only and on either way). Billed at cost on top of the agent fee")
+    .option("--no-governance", "Turn governance OFF for the agent's cards, autonomy policy checks included (by default new agents run autonomy observe, rules only, plus integrity observe; a card refresh otherwise keeps an existing agent's modes)")
     .option("--no-yolo", "Do NOT pass --dangerously-skip-permissions (yolo is on by default)")
     .option("--no-context-hint", "Do NOT seed Claude Code's context-hint feature flag before launch")
     // The Mnemom plugin lands dark: off by default and not in the published package, so its two
@@ -2383,12 +2383,13 @@ program
 });
 program
     .command("scan")
-    .description("Read-only local scan of GitHub PR metadata; the report is emailed to you every time (counts only, no repo names) and Mnemom keeps nothing at share level none")
+    .description("Read-only local scan of GitHub PR metadata; the full report, with the counts for each repo, is always emailed to you, your org admins and anyone you add. --share chooses what Mnemom may keep")
     .option("--repo <owner/name...>", "Repo to scan (repeatable or comma-separated; omit on a terminal to pick from your repos)")
     .option("--start <YYYY-MM-DD>", "Period start (default: today)")
     .option("--end <YYYY-MM-DD>", "Period end (default: today)")
-    .option("--share <level>", "summary | full | none (default: full when asked; none when not interactive)")
-    .option("--cto-email <email>", "CTO who receives the report (required unless you are the CTO; asked when omitted)")
+    .option("--share <level>", "What Mnemom may keep: full (totals and per-repo counts, default when asked) | analytics (team totals only, no repo names; summary is the old name) | none (nothing; the default when not interactive)")
+    .option("--email <address...>", "Also email the report to these people (repeatable or comma-separated, up to 10, on your organization's email domain or mnemom.ai). You and every org admin always get it")
+    .option("--cto-email <email>", "Same as --email (kept for older scripts)")
     .option("--monthly-spend <usd>", "Your own approximate monthly AI spend (self-reported; never sent or saved; needs MNEMOM_ORG_SCAN_MODE=true)")
     .option("--anthropic-admin-key", "Ask (masked) for your Anthropic admin key and read measured usage with it, locally; or set ANTHROPIC_ADMIN_KEY. Never stored, logged or sent anywhere but api.anthropic.com. Without this flag, workload identity federation is tried first when ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID and ANTHROPIC_SERVICE_ACCOUNT_ID are set (needs MNEMOM_ORG_SCAN_MODE=true)")
     .option("--no-anthropic-usage", "Decline Anthropic usage and be asked for a monthly figure (needs MNEMOM_ORG_SCAN_MODE=true)")
@@ -2405,6 +2406,7 @@ program
             period: { start: options.start ?? options.end ?? today, end: options.end ?? today },
             share: options.share,
             ctoEmail: options.ctoEmail,
+            email: options.email,
             monthlySpend: options.monthlySpend,
             noAnthropicUsage: options.anthropicUsage === false,
             anthropicAdminKey: options.anthropicAdminKey === true,

package/dist/lib/scan/report-email.d.ts

@@ -56,6 +56,18 @@ export interface EmailReport {
      */
     cost_per_merged_pr?: CostPerPr["cost_per_merged_pr"];
     cost_by_pr_size?: CostPerPr["cost_by_pr_size"];
+    /**
+     * The per-repo counts, by name (MNE-9634). Always sent, at every share level: the emailed report is the full
+     * report. Optional on the wire so an API that predates it can be retried without it. Capped at 500 repos
+     * (busiest first), valid names only, each name once.
+     */
+    by_repo?: Array<{
+        repo: string;
+        pr_count: number;
+        revert_count: number;
+        automatable_count: number;
+        examined_count: number;
+    }>;
 }
 export interface ReportEmailBody {
     report: EmailReport;
@@ -63,6 +75,9 @@ export interface ReportEmailBody {
     coverage: {
         complete: boolean;
     };
+    /** The extra recipients the runner added. Absent when none. */
+    emails?: string[];
+    /** Only set on the retry to an API that predates `emails`: it reads one extra address under this name. */
     cto_email?: string;
 }
 /**
@@ -84,9 +99,9 @@ export declare function buildEmailReport(result: ScanResult, o: {
     /** The one spend source the cost figures are split from; null/absent leaves them out. */
     costSpend?: CostSpend | null;
 }): EmailReport;
-export declare function buildEmailBody(report: EmailReport, level: ShareLevel, complete: boolean, ctoEmail?: string): ReportEmailBody;
+export declare function buildEmailBody(report: EmailReport, level: ShareLevel, complete: boolean, extraEmails?: string[]): ReportEmailBody;
 /** Closed set of failure names; each has fixed text. */
-export type EmailFailure = "presend_check_failed" | "email_not_sent" | "not_signed_in" | "not_a_member" | "report_rejected" | "no_recipients" | "runner_not_emailed" | "network_error" | "unexpected_response";
+export type EmailFailure = "presend_check_failed" | "email_not_sent" | "not_signed_in" | "not_a_member" | "report_rejected" | "no_recipients" | "runner_not_emailed" | "emails_rejected" | "email_domain_not_allowed" | "admins_not_found" | "network_error" | "unexpected_response";
 export declare const failureMessage: (f: EmailFailure) => string;
 export declare const DRY_RUN_MSG = "Report email is in dry-run on this environment; nothing was sent.";
 export declare const UNAVAILABLE_MSG = "Report email is not available for this org yet; nothing was sent.";
@@ -97,6 +112,8 @@ export declare class ReportEmailError extends Error {
 export type EmailOutcome = {
     status: "sent";
     recipients: number;
+    adminsMissed?: number;
+    limited?: true;
 } | {
     status: "dry_run";
 } | {

package/dist/lib/scan/report-email.js

@@ -1,12 +1,13 @@
 /**
- * The report email: after every successful scan the person who ran it is emailed the report, with no
- * opt-out and at every share level. One call to `POST /v1/orgs/{org_id}/scan/report-email`
- * (mnemom-api#4270). The server resolves the runner's address from the signed-in identity, so the
- * request carries no runner address; `cto_email` is sent only when the user passed --cto-email.
+ * The report email: after every successful scan the full report, with the counts for each repo, is
+ * emailed to the person who ran it, every Org Admin of the org and anyone the runner added (MNE-9634),
+ * with no opt-out and at every share level. One call to `POST /v1/orgs/{org_id}/scan/report-email`.
+ * The server resolves the runner's address from the signed-in identity and the Org Admins from the org,
+ * so the request carries neither; `emails` holds only the extra addresses the runner added.
  *
- * The body is exactly the route's contract and nothing else: `report` (org-scan-report/1: team totals
- * and counts only), `share_level`, `coverage.complete` and the optional `cto_email`. No Record totals,
- * no repo names, no author, title, branch or body text, no credential.
+ * The body is exactly the route's contract and nothing else: `report` (org-scan-report/1: team totals,
+ * counts, and the per-repo counts `by_repo`), `share_level`, `coverage.complete` and the optional
+ * `emails`. No author, title, branch or body text, no credential.
  *
  * Every failure has a fixed name and fixed text. The server's body, the thrown value and the
  * credential never reach the terminal.
@@ -40,6 +41,7 @@ export function buildEmailReport(result, o) {
     // Only a scan that read every merged PR in the period gives an average that means anything.
     const exhaustive = coverage.complete && coverage.prsSkippedLarge === 0 && coverage.prsUnreadable === 0;
     const cost = buildCostPerPr(result.prSizes, o.period ?? { start: coverage.windowStart, end: coverage.windowEnd }, o.costSpend ?? null, exhaustive);
+    const byRepo = repoRows(result);
     return {
         schema_version: REPORT_SCHEMA_VERSION,
         org_id: o.orgId,
@@ -72,14 +74,38 @@ export function buildEmailReport(result, o) {
         },
         estimate: { name: ESTIMATE_NAME, value, unit, method_url: METHOD_URL },
         ...cost,
+        ...(byRepo.length > 0 ? { by_repo: byRepo } : {}),
     };
 }
-export function buildEmailBody(report, level, complete, ctoEmail) {
+const MAX_REPOS = 500;
+const REPO_NAME = /^[A-Za-z0-9._-]{1,100}\/[A-Za-z0-9._-]{1,100}$/;
+/** The per-repo rows for the report: valid names only, each once (any case), busiest first, at most 500. */
+function repoRows(result) {
+    const seen = new Set();
+    return [...result.byRepo]
+        .sort((a, b) => b.prs - a.prs || a.repo.localeCompare(b.repo))
+        .filter((r) => {
+        const k = r.repo.toLowerCase();
+        if (!REPO_NAME.test(r.repo) || seen.has(k))
+            return false;
+        seen.add(k);
+        return true;
+    })
+        .slice(0, MAX_REPOS)
+        .map((r) => ({
+        repo: r.repo,
+        pr_count: r.prs,
+        revert_count: r.reverts,
+        automatable_count: r.ciGreen,
+        examined_count: r.examined,
+    }));
+}
+export function buildEmailBody(report, level, complete, extraEmails = []) {
     return {
         report,
         share_level: level,
         coverage: { complete },
-        ...(ctoEmail !== undefined ? { cto_email: ctoEmail } : {}),
+        ...(extraEmails.length > 0 ? { emails: extraEmails } : {}),
     };
 }
 const FAILURE_TEXT = {
@@ -89,7 +115,10 @@ const FAILURE_TEXT = {
     not_a_member: "your account is not a member of the org passed to --org.",
     report_rejected: "Mnemom rejected the report as malformed.",
     no_recipients: "the server accepted the report but reported zero recipients.",
-    runner_not_emailed: "the report was not delivered to you (the person who ran the scan); it may have gone only to the CTO. Re-run the scan, and check that your account has a valid email address.",
+    runner_not_emailed: "the report was not delivered to you (the person who ran the scan); it may have gone only to the others. Re-run the scan, and check that your account has a valid email address.",
+    emails_rejected: "an address you added was not accepted. Add up to 10 valid email addresses.",
+    email_domain_not_allowed: "an address you added is not on your organization's email domain. Add addresses on your own domain or mnemom.ai.",
+    admins_not_found: "Mnemom could not look up your org admins, so no email was sent. Try again in a moment.",
     network_error: "Mnemom could not be reached.",
     unexpected_response: "Mnemom answered in an unexpected way.",
 };
@@ -118,11 +147,27 @@ function classifyStatus(status) {
         return "report_rejected";
     return "unexpected_response";
 }
-/** The body without the optional cost figures; the same object when it carries none. */
-function withoutCostFigures(body) {
-    const { cost_per_merged_pr: _a, cost_by_pr_size: _b, ...rest } = body.report;
-    return "cost_per_merged_pr" in body.report || "cost_by_pr_size" in body.report
-        ? { ...body, report: rest }
+/**
+ * The body an API that predates this contract understands: no cost figures, no per-repo rows, and the
+ * share level under its old name (`analytics` was `summary`; the meaning is the same, never upgraded).
+ * The same object when nothing needs changing.
+ */
+function legacyBody(body) {
+    const { cost_per_merged_pr: _a, cost_by_pr_size: _b, by_repo: _c, ...rest } = body.report;
+    const changed = "cost_per_merged_pr" in body.report ||
+        "cost_by_pr_size" in body.report ||
+        "by_repo" in body.report ||
+        body.share_level === "analytics" ||
+        (body.emails?.length ?? 0) > 0;
+    const { emails, ...top } = body;
+    const extra = emails?.[0];
+    return changed
+        ? {
+            ...top,
+            ...(extra ? { cto_email: extra } : {}),
+            report: rest,
+            share_level: body.share_level === "analytics" ? "summary" : body.share_level,
+        }
         : body;
 }
 /** Never throws. The thrown value, the response body and the credential are never surfaced. */
@@ -135,15 +180,23 @@ export async function sendReportEmail(orgId, body, deps = {}) {
     catch (e) {
         if (e instanceof MnemomApiError && e.effectiveStatus === 404)
             return { status: "unavailable" };
-        // An API that predates the cost figures rejects the unknown keys with a 400. The email must still
-        // go out, so retry once with the figures left off; any other failure is classified as below.
+        // An API that predates the cost figures, the per-repo rows or the analytics name rejects them with a 400. The email must still
+        // go out, so retry once in the old shape; any other failure is classified as below.
         if (e instanceof MnemomApiError && e.effectiveStatus === 400) {
-            const bare = withoutCostFigures(body);
-            if (bare !== body)
-                return sendReportEmail(orgId, bare, deps);
+            const bare = legacyBody(body);
+            if (bare !== body && !/email|admin/i.test(e.code ?? "")) {
+                const r = await sendReportEmail(orgId, bare, deps);
+                return r.status === "sent" ? { ...r, limited: true } : r;
+            }
         }
         if (e instanceof MnemomApiError) {
             // A 4xx that names the runner (the API refuses a send that would skip the runner) gets its own text.
+            if (e.code === "email_domain_not_allowed")
+                return { status: "failed", reason: "email_domain_not_allowed" };
+            if (/emails/i.test(e.code ?? ""))
+                return { status: "failed", reason: "emails_rejected" };
+            if (e.code === "admin_lookup_failed")
+                return { status: "failed", reason: "admins_not_found" };
             if (e.effectiveStatus >= 400 && e.effectiveStatus < 500 && /runner/i.test(e.code ?? ""))
                 return { status: "failed", reason: "runner_not_emailed" };
             return { status: "failed", reason: classifyStatus(e.effectiveStatus) };
@@ -158,8 +211,11 @@ export async function sendReportEmail(orgId, body, deps = {}) {
         return { status: "failed", reason: "unexpected_response" };
     if (recipients === 0)
         return { status: "failed", reason: "no_recipients" };
-    // `skipped` lists the roles ("runner", "cto") that got no copy. The runner must always get the report.
+    // `skipped` lists the roles ("runner", "admin", "added", "cto") that got no copy. The runner must always get the report.
     if (Array.isArray(o.skipped) && o.skipped.includes("runner"))
         return { status: "failed", reason: "runner_not_emailed" };
-    return o.status === "dry_run" ? { status: "dry_run" } : { status: "sent", recipients };
+    const adminsMissed = Array.isArray(o.skipped) ? o.skipped.filter((s) => s === "admin").length : 0;
+    return o.status === "dry_run"
+        ? { status: "dry_run" }
+        : { status: "sent", recipients, ...(adminsMissed > 0 ? { adminsMissed } : {}) };
 }

package/dist/lib/scan/scan.d.ts

@@ -43,6 +43,8 @@ export interface RepoTotals {
     prs: number;
     reverts: number;
     ciGreen: number;
+    /** PRs read and counted (not reverts, not skipped); the per-repo base of the CI-green share. */
+    examined: number;
 }
 export interface ScanResult {
     coverage: Coverage;

package/dist/lib/scan/scan.js

@@ -104,7 +104,7 @@ export async function runLocalScan(deps, input) {
         const bucket = (repo) => {
             let b = byRepo.get(repo);
             if (!b)
-                byRepo.set(repo, (b = { repo, prs: 0, reverts: 0, ciGreen: 0 }));
+                byRepo.set(repo, (b = { repo, prs: 0, reverts: 0, ciGreen: 0, examined: 0 }));
             return b;
         };
         const totals = { prs: 0, reverts: 0, ciGreen: 0, examined: 0 };
@@ -142,6 +142,7 @@ export async function runLocalScan(deps, input) {
             }
             totals.prs += 1;
             totals.examined += 1;
+            bucket(repo).examined += 1;
             bucket(repo).prs += 1;
             if (rec.ci === "success") {
                 totals.ciGreen += 1;

package/dist/lib/scan/share.d.ts

@@ -1,20 +1,21 @@
 import type { ScanResult } from "./scan.js";
-export type ShareLevel = "summary" | "full" | "none";
+export type ShareLevel = "full" | "analytics" | "none";
 /** The level preselected at the prompt (Enter picks it). */
 export declare const DEFAULT_SHARE_LEVEL: ShareLevel;
 export declare const SHARE_OPTIONS: ReadonlyArray<{
     level: ShareLevel;
     label: string;
 }>;
-/** Shown just above the share prompt, so pressing Enter is an informed choice. */
+/** Shown just above the prompt. The full report, repo names included, is emailed whatever is chosen here. */
 export declare const SHARE_DISCLOSURE: string;
 /** Asks the user, with Full preselected. Anything but a recognised answer (cancel, EOF, noise) is "none": fail closed. */
 export declare function promptShareLevel(): Promise<ShareLevel>;
+/** `summary` is the old name for `analytics`; the meaning is unchanged. */
 export declare function parseShareLevel(v: string | undefined): ShareLevel | null;
-/** Who receives the report. Sent only with a non-"none" share level. */
+/** Who receives the report. The runner comes from the Mnemom login; the server resolves the Org Admins. */
 export interface ReportRecipients {
-    runner_email: string;
-    cto_email: string;
+    runner_email?: string;
+    extra_emails: string[];
 }
 export interface SharePayload {
     recipients: ReportRecipients;
@@ -30,6 +31,7 @@ export interface SharePayload {
     coverage_complete: boolean;
     /** Absent when no spend line may be shown. */
     spend_line?: string;
+    /** Present at "full" only. */
     repos?: Array<{
         repo: string;
         prs: number;
@@ -37,6 +39,6 @@ export interface SharePayload {
         ci_green: number;
     }>;
 }
-/** Builds only what the level allows. Never includes authors, titles, branches, bodies or tokens. The only person data is the two report recipients. */
+/** Builds only what the level allows. Never includes authors, titles, branches, bodies or tokens. The only person data is the report recipients. */
 export declare function buildSharePayload(level: Exclude<ShareLevel, "none">, r: ScanResult, recipients: ReportRecipients, spendLine?: string | null): SharePayload;
 export declare function buildSharePayload(level: ShareLevel, r: ScanResult, recipients: ReportRecipients, spendLine?: string | null): SharePayload | null;

package/dist/lib/scan/share.js

@@ -1,32 +1,49 @@
 /**
- * Share level: what, if anything, may leave the machine. Asked before any output is built for sharing.
- * Full is the preselected choice (MNE-9619): pressing Enter at the prompt picks it. "none" yields no
- * payload at all, and is what a cancelled, empty-piped or non-interactive prompt resolves to (fail closed).
+ * "What may Mnemom keep on file?" (MNE-9634). This is a retention choice only; it never changes what is emailed. It is asked at
+ * the start, before any scan work. The scan itself is always complete: the full report, with the counts
+ * for each repo, is emailed to the runner, every Org Admin and anyone the runner adds, at every level.
+ *
+ *   full       Mnemom keeps the totals and the counts for each repo, by name, on file (the default).
+ *   analytics  Mnemom keeps the team totals only, with no repo names. `summary` is the old name for this
+ *              and is accepted as an alias; it is never upgraded to full.
+ *   none       Mnemom keeps nothing on file. The report is still emailed.
+ *
+ * "none" is what a cancelled, empty-piped or non-interactive prompt resolves to (fail closed).
+ * Storing the shared payload on Mnemom's side is not built yet; the CLI only prints it.
  */
 import { askSelect } from "../prompt.js";
 /** The level preselected at the prompt (Enter picks it). */
 export const DEFAULT_SHARE_LEVEL = "full";
 export const SHARE_OPTIONS = [
-    { level: "summary", label: "Summary metrics only (counts and one estimate line)" },
-    { level: "full", label: "Full report (summary plus per-repo counts; default)" },
-    { level: "none", label: "Nothing (keep results on this machine)" },
+    {
+        level: "full",
+        label: "Full report (default): Mnemom keeps the totals and the counts for each repo, by name, on file",
+    },
+    {
+        level: "analytics",
+        label: "Analytics: Mnemom keeps the team totals only on file, with no repo names",
+    },
+    { level: "none", label: "Nothing: Mnemom keeps nothing on file" },
 ];
-/** Shown just above the share prompt, so pressing Enter is an informed choice. */
+/** Shown just above the prompt. The full report, repo names included, is emailed whatever is chosen here. */
 export const SHARE_DISCLOSURE = [
-    "Pressing Enter shares the Full report: the whole report, including your repo names and per-repo counts.",
-    "It is emailed to the report recipients. To share less, choose 1 (Summary: counts only, no repo names) or 3 (Nothing).",
+    "Whatever you choose, the full report, including repo names, is emailed to you, your org's admins and any addresses you added.",
+    "The next question is only about what Mnemom keeps on file. Pressing Enter chooses the Full report.",
 ].join("\n");
 /** Asks the user, with Full preselected. Anything but a recognised answer (cancel, EOF, noise) is "none": fail closed. */
 export async function promptShareLevel() {
     // eslint-disable-next-line no-console -- consent text must show on stdout directly above the prompt (askSelect also prints with console.log)
     console.log(SHARE_DISCLOSURE);
-    const answer = await askSelect("What may leave this machine?", SHARE_OPTIONS.map((o) => o.label), SHARE_OPTIONS.findIndex((o) => o.level === DEFAULT_SHARE_LEVEL));
+    const answer = await askSelect("What may Mnemom keep on file?", SHARE_OPTIONS.map((o) => o.label), SHARE_OPTIONS.findIndex((o) => o.level === DEFAULT_SHARE_LEVEL));
     if (answer === null)
         return "none";
     return SHARE_OPTIONS.find((o) => o.label === answer)?.level ?? "none";
 }
+/** `summary` is the old name for `analytics`; the meaning is unchanged. */
 export function parseShareLevel(v) {
-    return v === "summary" || v === "full" || v === "none" ? v : null;
+    if (v === "summary")
+        return "analytics";
+    return v === "analytics" || v === "full" || v === "none" ? v : null;
 }
 export function buildSharePayload(level, r, recipients, 
 /** undefined: the legacy line; null: no spend line; string: that line. */

package/dist/lib/starter-integrity.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The integrity_mode `wrap` and `onboard` write into their starter alignment card.
+ *
+ * Both commands re-publish the starter card on every run, including a re-run on an agent that
+ * already exists (wrap: the same key + name returns the same agent; onboard: an already-claimed
+ * agent). The card must never change an existing agent's stored mode, so the mode comes from the
+ * agent's own (agent-layer) card when it has one — the same rule `mnemom agent setup` applies to
+ * an existing agent (agent-setup.ts existingAgentPlan):
+ *
+ *   - own card with an integrity_mode   → keep it (off stays off; nudge/enforce stay put)
+ *   - own card without the field        → observe (what the card already resolved to)
+ *   - no own card                       → off   (never silently opt an agent in to billed analysis)
+ *
+ * A newly born agent has its own card: mnemom-api stamps an observe birth card (ADR-API-003), and
+ * the gateway's card-less bootstrap writes observe too, so a new agent keeps observe (MNE-9728).
+ *
+ * THROWS when the read fails (anything but a 404): the caller then skips the card write rather
+ * than guess a mode in either direction.
+ */
+export declare function starterIntegrityMode(agentId: string): Promise<string>;

package/dist/lib/starter-integrity.js

@@ -0,0 +1,28 @@
+/**
+ * The integrity_mode `wrap` and `onboard` write into their starter alignment card.
+ *
+ * Both commands re-publish the starter card on every run, including a re-run on an agent that
+ * already exists (wrap: the same key + name returns the same agent; onboard: an already-claimed
+ * agent). The card must never change an existing agent's stored mode, so the mode comes from the
+ * agent's own (agent-layer) card when it has one — the same rule `mnemom agent setup` applies to
+ * an existing agent (agent-setup.ts existingAgentPlan):
+ *
+ *   - own card with an integrity_mode   → keep it (off stays off; nudge/enforce stay put)
+ *   - own card without the field        → observe (what the card already resolved to)
+ *   - no own card                       → off   (never silently opt an agent in to billed analysis)
+ *
+ * A newly born agent has its own card: mnemom-api stamps an observe birth card (ADR-API-003), and
+ * the gateway's card-less bootstrap writes observe too, so a new agent keeps observe (MNE-9728).
+ *
+ * THROWS when the read fails (anything but a 404): the caller then skips the card write rather
+ * than guess a mode in either direction.
+ */
+import { getCardSources } from "./api.js";
+export async function starterIntegrityMode(agentId) {
+    const sources = await getCardSources("alignment", agentId);
+    const own = sources?.agent?.card_json ?? null;
+    if (!own)
+        return "off";
+    const mode = own.integrity_mode;
+    return typeof mode === "string" && mode ? mode : "observe";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.38-next.0",
+  "version": "0.17.38-next.1",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@mnemom/policy-engine": "^0.3.0",
-    "@mnemom/verify": "0.6.2",
+    "@mnemom/verify": "0.6.3",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
     "js-yaml": "^4.3.2",