@mnemom/mnemom 0.17.38-next.0 → 0.17.38-next.2

package/dist/commands/scan.js

@@ -15,7 +15,7 @@ import { getAuthInfo } from "../lib/auth.js";
 import { listMyOrgs } from "../lib/api.js";
 import { getActiveOrg } from "../lib/cli-config.js";
 import { fetchRecordTotals, isOrgId, } from "../lib/scan/record.js";
-import { modelledSpend } from "../lib/scan/cost-per-pr.js";
+import { costSpendFor, sendsSpendRange } from "../vendor/shared/org-scan-core/report-build.js";
 import { RECORD_NO_ORG_NOTE, renderRecordSection } from "../lib/scan/report.js";
 import { buildEmailBody, buildEmailReport, DRY_RUN_MSG, UNAVAILABLE_MSG, failureMessage, ReportEmailError, sendReportEmail, } from "../lib/scan/report-email.js";
 import { pickRepos, REPO_PICKER_NO_TERMINAL_HINT, } from "../lib/scan/repo-picker.js";
@@ -28,29 +28,61 @@ export function parseRepoFlags(raw) {
         .filter(Boolean);
     return out.length > 0 && out.every(isValidRepoSlug) ? out : null;
 }
-const EMAIL = /^[^\s@]{1,64}@[^\s@]{1,255}\.[^\s@]{2,63}$/;
-export const isEmail = (v) => typeof v === "string" && v.length <= 320 && EMAIL.test(v.trim());
-/** The runner's email (mnemom login, else asked) and the CTO's (flag, else "are you the CTO?"). */
-export async function resolveRecipients(o) {
-    if (o.ctoEmail !== undefined && !isEmail(o.ctoEmail))
-        throw new Error("--cto-email must be a valid email address");
-    let runner = o.runnerEmail ?? getAuthInfo()?.email ?? "";
-    if (!isEmail(runner))
-        runner = (await askInput("Your email (the report is sent to you):")).trim();
-    if (!isEmail(runner))
-        throw new Error("a valid runner email is required");
-    runner = runner.trim();
-    if (o.ctoEmail !== undefined)
-        return { runner_email: runner, cto_email: o.ctoEmail.trim() };
-    const isCto = await askSelect("Are you the CTO?", ["Yes, I am the CTO", "No, someone else is"]);
-    if (isCto === null)
-        throw new Error("--cto-email is required when you are not the CTO");
-    if (isCto.startsWith("Yes"))
-        return { runner_email: runner, cto_email: runner };
-    const cto = (await askInput("CTO email (the report is sent to them too):")).trim();
-    if (!isEmail(cto))
-        throw new Error("--cto-email is required when you are not the CTO");
-    return { runner_email: runner, cto_email: cto };
+/**
+ * Same rule as the API: isPlainEmail in mnemom/mnemom-api src/org-scan/report-email/notifier.ts (no shared
+ * package, so this is a copy). Drift guard: the "plain-email rule edge" table in src/__tests__/scan.test.ts;
+ * change both together. No spaces, control chars or <>",; ; one @; every domain label non-empty; max 254. */
+const plainEmail = (a) => {
+    if (a.length === 0 || a.length > 254)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        const c = a.charCodeAt(i);
+        if (c <= 32 || c === 127 || '<>",;'.includes(a[i]))
+            return false;
+    }
+    const at = a.indexOf("@");
+    if (at < 1 || at !== a.lastIndexOf("@"))
+        return false;
+    const labels = a.slice(at + 1).split(".");
+    return labels.length >= 2 && labels.every((l) => l.length > 0);
+};
+export const isEmail = (v) => typeof v === "string" && plainEmail(v.trim());
+export const DELETE_CONTACT = "privacy@mnemom.ai";
+export const EMAIL_ONE_MSG = "Enter one email address, like you@company.com.";
+export const EMAIL_LIST_MSG = "Enter email addresses like you@company.com, separated by commas.";
+export const MAX_EXTRA_EMAILS = 10;
+/**
+ * The people to add to the report email (the runner and every org admin always get it). Comes from the
+ * repeatable --email flag (and its alias --cto-email), each value one address or a comma-separated list;
+ * on a terminal with none given, asks once (blank to skip). Plain-language errors; the value is never echoed.
+ */
+export async function resolveExtraEmails(o) {
+    const given = [...(o.email ?? []), ...(o.ctoEmail !== undefined ? [o.ctoEmail] : [])];
+    let raw = given;
+    if (given.length === 0) {
+        if (!(o.isTty ?? process.stdin.isTTY))
+            return [];
+        const typed = ((await askInput("Anyone else to email the report to? Enter addresses separated by commas, or press Enter to skip:")) ?? "").trim();
+        if (typed === "")
+            return [];
+        raw = [typed];
+    }
+    const list = raw
+        .flatMap((v) => v.split(","))
+        .map((v) => v.trim())
+        .filter(Boolean);
+    if (list.length === 0 || !list.every(isEmail))
+        throw new Error(raw.length > 1 || raw.some((v) => v.includes(",")) ? EMAIL_LIST_MSG : EMAIL_ONE_MSG);
+    const seen = new Set();
+    const unique = list.filter((a) => !seen.has(a.toLowerCase()) && seen.add(a.toLowerCase()));
+    if (unique.length > MAX_EXTRA_EMAILS)
+        throw new Error(`Add at most ${MAX_EXTRA_EMAILS} extra email addresses.`);
+    return unique;
+}
+/** The runner's own address from the Mnemom login, or undefined (the server resolves it for the email either way). */
+export function runnerEmailFromLogin(o) {
+    const e = (o.runnerEmail ?? getAuthInfo()?.email ?? "").trim();
+    return isEmail(e) ? e : undefined;
 }
 /** The CTO's figure in USD, or null for none. Throws fixed text only; the input is never echoed. */
 export async function resolveSelfReportedSpend(o) {
@@ -78,15 +110,8 @@ export async function resolveSelfReportedSpend(o) {
  * tiers off) the modelled range. Sources are never mixed.
  */
 export function resolveCostSpend(o, result, spend, measured) {
-    if (spend === null)
-        return modelledSpend(result.spend);
-    if (spend.tier === 1) {
-        const usd = measured?.usd ?? o.anthropicUsageUsd;
-        return typeof usd === "number" ? { source: "anthropic_usage", usd } : null;
-    }
-    if (spend.tier === 2)
-        return null;
-    return spend.tier === 3 ? modelledSpend(result.spend) : null;
+    // Shared with the Mnemom-side run (MNE-9752): same spend source, same cost figures.
+    return costSpendFor(result, spend, measured?.usd ?? o.anthropicUsageUsd);
 }
 export const NO_ADMIN_KEY_TERMINAL_MSG = "Set ANTHROPIC_ADMIN_KEY (there is no terminal to ask on).";
 export const TIER1_FALLBACK_NOTE = "Tier 1 skipped: falling back to the next tier.";
@@ -238,16 +263,20 @@ export async function resolveRecordOutcome(o) {
 }
 export async function scanCommand(o) {
     if (o.share !== undefined && parseShareLevel(o.share) === null) {
-        throw new Error("--share must be one of: summary, full, none");
+        throw new Error("--share must be one of: full, analytics, none (summary also works, same as analytics)");
     }
     const noRepoFlag = o.repos.length === 0;
+    const interactive = Boolean(o.isTty ?? process.stdin.isTTY);
     // No --repo: on a terminal pick from the repos this GitHub login can read; otherwise the error stays, with a hint.
-    if (noRepoFlag && !(o.isTty ?? process.stdin.isTTY))
+    if (noRepoFlag && !interactive)
         throw new Error(`--repo owner/name is required (repeatable). ${REPO_PICKER_NO_TERMINAL_HINT}`);
+    // Consent comes first, before any data is processed (MNE-9634). The flag wins; on a terminal with no flag we
+    // ask (Full preselected); with no terminal and no flag the answer is Nothing (fail closed).
+    const level = parseShareLevel(o.share) ?? (interactive ? await promptShareLevel() : "none");
+    // The people added to the report email; the runner and every org admin always get it.
+    const extraEmails = await resolveExtraEmails(o);
     // The report is emailed on every scan, so resolve the org before any scan work; failure is loud.
     const emailOrg = await resolveScanOrg(o);
-    if (o.ctoEmail !== undefined && !isEmail(o.ctoEmail))
-        throw new Error("--cto-email must be a valid email address");
     const getCredential = async () => {
         const c = o.credential ?? (await resolveCredential().catch(() => null));
         if (!c)
@@ -292,19 +321,23 @@ export async function scanCommand(o) {
     else if (record !== null)
         for (const line of renderRecordSection(record))
             console.log(line);
-    const level = parseShareLevel(o.share) ?? (await promptShareLevel());
     // Every successful scan emails the report to the person who ran it, at every share level, no opt-out.
     // Mnemom keeps nothing from a share=none send (the server sends the email and does nothing else).
-    const emailFailure = await emailReport(o, emailOrg, result, level, spend, period, resolveCostSpend(o, result, spend, measured));
-    if (level === "none") {
-        console.log("Share level: nothing. No share payload is built; Mnemom keeps nothing (the report email is only sent to you).");
-        if (emailFailure)
-            throw new ReportEmailError(emailFailure);
-        return;
+    const emailResult = await emailReport(o, emailOrg, result, level, spend, period, resolveCostSpend(o, result, spend, measured), extraEmails);
+    const emailFailure = emailResult === "not_sent" || emailResult === null ? null : emailResult;
+    // What was shared with Mnemom, and how to have it deleted (MNE-9634).
+    if (emailResult !== null) {
+        console.log("Kept on file by Mnemom: nothing, because the report was not sent.");
     }
-    const payload = buildSharePayload(level, result, await resolveRecipients(o), spend ? (spend.shareable ? spend.line : null) : undefined);
-    console.log(`Share level: ${level}. Upload is not wired in this build; this is what would be sent:`);
-    console.log(JSON.stringify(payload, null, 2));
+    else if (level === "none") {
+        console.log("Kept on file by Mnemom: nothing. The report was emailed and Mnemom keeps nothing on file; its email provider keeps only a delivery log.");
+    }
+    else {
+        const payload = buildSharePayload(level, result, { runner_email: runnerEmailFromLogin(o), extra_emails: extraEmails }, spend ? (spend.shareable ? spend.line : null) : undefined);
+        console.log(`Kept on file by Mnemom: ${level === "full" ? "the totals and the counts for each repo, by name" : "the team totals only, with no repo names"}. Mnemom may keep a run record of only this much on file; the full report was emailed, not stored:`);
+        console.log(JSON.stringify(payload, null, 2));
+    }
+    console.log(`To have anything Mnemom holds about this scan deleted, email ${DELETE_CONTACT}.`);
     if (emailFailure)
         throw new ReportEmailError(emailFailure);
 }
@@ -312,29 +345,33 @@ export async function scanCommand(o) {
  * Emails the report. Loud on every failure: prints the reason name, never the server's words, and
  * returns it so the caller exits non-zero after the local report is shown.
  */
-async function emailReport(o, org, result, level, spend, period, costSpend) {
-    const fail = (f) => {
-        console.log(failureMessage(f));
+async function emailReport(o, org, result, level, spend, period, costSpend, extraEmails) {
+    const fail = (f, retryAfterMs) => {
+        console.log(failureMessage(f, retryAfterMs));
         return f;
     };
     const report = buildEmailReport(result, {
         orgId: org,
         now: o.now ?? Date.now,
-        sendSpendRange: spend ? spend.shareable && spend.tier === 3 : true,
+        sendSpendRange: sendsSpendRange(spend),
         period,
         costSpend,
     });
-    const body = buildEmailBody(report, level, result.coverage.complete, o.ctoEmail?.trim());
+    const body = buildEmailBody(report, level, result.coverage.complete, extraEmails);
     const outcome = await sendReportEmail(org, body, o.emailDeps);
     if (outcome.status === "failed")
-        return fail(outcome.reason);
+        return fail(outcome.reason, outcome.retryAfterMs);
     if (outcome.status === "unavailable") {
         // Org Scan is off by default: the gate's 404 is not a failure and must not break the scan.
         console.log(UNAVAILABLE_MSG);
-        return null;
+        return "not_sent";
     }
     console.log(outcome.status === "dry_run"
         ? DRY_RUN_MSG
-        : `Report emailed to you (${outcome.recipients} recipient${outcome.recipients === 1 ? "" : "s"}).`);
-    return null;
+        : outcome.limited
+            ? "Report emailed in a limited form (your Mnemom service is older than this CLI): no per-repo counts, no org admins, and at most one added address."
+            : `Full report emailed to you, your org admins and anyone you added (${outcome.recipients} recipient${outcome.recipients === 1 ? "" : "s"}).`);
+    if (outcome.status === "sent" && outcome.adminsMissed)
+        console.log(`${outcome.adminsMissed} org admin${outcome.adminsMissed === 1 ? "" : "s"} could not be emailed because no email address is on file.`);
+    return outcome.status === "dry_run" ? "not_sent" : null;
 }

package/dist/commands/verify-card.d.ts

@@ -20,7 +20,8 @@
  *   3. Verify the JWS signature against the JWKS.
  *   4. Fetch the transparency-log row by log_index for the freshly-computed
  *      inclusion proof, plus /v1/transparency/root for the signed root.
- *   5. Verify the Merkle inclusion proof against the root.
+ *   5. Verify the signed root's Ed25519 signature (typ AAP-TransparencyRoot/v1)
+ *      with @mnemom/verify, then the Merkle inclusion proof against that root.
  *   6. Print a care-framed result.
  *
  * --strict mode bypasses the JWKS cache and exits non-zero on any
@@ -30,6 +31,7 @@
  * would-benefit-from vocabulary; stdout carries machine-readable
  * verification status.
  */
+import type * as AipVerify from "@mnemom/verify";
 interface JwkPublic {
     kty: "OKP";
     crv: "Ed25519";
@@ -69,6 +71,14 @@ interface MerkleProof {
         position: "left" | "right";
     }[];
 }
+interface SignedRoot {
+    typ?: string;
+    tree_size: number;
+    root_hash: string;
+    published_at: string;
+    signing_key_id: string;
+    signature: string;
+}
 export interface VerifyCardOptions {
     agentId: string;
     at?: string;
@@ -86,6 +96,19 @@ interface JwsVerification {
     error?: string;
 }
 declare function verifyJws(jws: string, jwks: Jwks): Promise<JwsVerification>;
+interface RootVerification {
+    ok: boolean;
+    kid?: string;
+    reasons: string[];
+}
+/**
+ * Verify the detached Ed25519 signature on GET /v1/transparency/root with the
+ * published offline verifier. `expectedTyp` pins the statement to
+ * AAP-TransparencyRoot/v1, so another signed statement cannot stand in for a
+ * root. A key missing from a cached JWKS reports key_not_found; --no-cache or
+ * --strict refetches it.
+ */
+declare function verifySignedRoot(root: SignedRoot, jwks: Jwks, load?: () => Promise<Pick<typeof AipVerify, "verifyStatement">>): Promise<RootVerification>;
 declare function verifyInclusionProof(proof: MerkleProof, expectedRoot: string): Promise<boolean>;
 declare function internalHash(left: string, right: string): Promise<string>;
 declare function base64urlDecode(s: string): Uint8Array;
@@ -98,5 +121,6 @@ export declare const __testing: {
     base64urlDecode: typeof base64urlDecode;
     base64urlDecodeString: typeof base64urlDecodeString;
     verifyJws: typeof verifyJws;
+    verifySignedRoot: typeof verifySignedRoot;
 };
 export {};

package/dist/commands/verify-card.js

@@ -20,7 +20,8 @@
  *   3. Verify the JWS signature against the JWKS.
  *   4. Fetch the transparency-log row by log_index for the freshly-computed
  *      inclusion proof, plus /v1/transparency/root for the signed root.
- *   5. Verify the Merkle inclusion proof against the root.
+ *   5. Verify the signed root's Ed25519 signature (typ AAP-TransparencyRoot/v1)
+ *      with @mnemom/verify, then the Merkle inclusion proof against that root.
  *   6. Print a care-framed result.
  *
  * --strict mode bypasses the JWKS cache and exits non-zero on any
@@ -65,7 +66,16 @@ export async function verifyCardCommand(options) {
             findings.push("merkle: transparency log is empty (no root to verify against)");
         }
         else {
-            // Step 5: verify the Merkle inclusion proof.
+            // Step 5a: the root is only worth folding into if Mnemom signed it.
+            const rootCheck = await verifySignedRoot(root, jwks);
+            if (!rootCheck.ok) {
+                findings.push(`root: signature did not verify (${rootCheck.reasons.join(", ")})`);
+                exitCode = 1;
+            }
+            else {
+                findings.push(`root: signature ok (kid=${rootCheck.kid}, tree_size=${root.tree_size})`);
+            }
+            // Step 5b: verify the Merkle inclusion proof.
             const proofOk = await verifyInclusionProof(target.inclusion_proof, root.root_hash);
             if (!proofOk) {
                 findings.push(`merkle: inclusion proof did not reconstruct root (log_index=${target.entry.log_index}, tree_size=${target.inclusion_proof.tree_size})`);
@@ -227,6 +237,22 @@ async function verifyJws(jws, jwks) {
     }
     return { ok: true, kid, payload };
 }
+// ── Signed root verification ─────────────────────────────────────────
+const ROOT_TYP = "AAP-TransparencyRoot/v1";
+/**
+ * Verify the detached Ed25519 signature on GET /v1/transparency/root with the
+ * published offline verifier. `expectedTyp` pins the statement to
+ * AAP-TransparencyRoot/v1, so another signed statement cannot stand in for a
+ * root. A key missing from a cached JWKS reports key_not_found; --no-cache or
+ * --strict refetches it.
+ */
+async function verifySignedRoot(root, jwks, load = () => import("@mnemom/verify")) {
+    const { verifyStatement } = await load();
+    const r = await verifyStatement(root, jwks, {
+        expectedTyp: ROOT_TYP,
+    });
+    return { ok: r.valid, kid: r.signing_key_id ?? undefined, reasons: r.reasons };
+}
 // ── Merkle proof verification ────────────────────────────────────────
 async function verifyInclusionProof(proof, expectedRoot) {
     let current = proof.leaf_hash;
@@ -282,6 +308,7 @@ export const __testing = {
     base64urlDecode,
     base64urlDecodeString,
     verifyJws,
+    verifySignedRoot,
 };
 // Silence "MNEMOM_DIR unused" if the cache code path is taken in tests.
 void MNEMOM_DIR;

package/dist/commands/wrap.js

@@ -20,6 +20,7 @@ import { mergeAgentConfig } from "../lib/agent-config.js";
 import { askSelect, askInput, isInteractive } from "../lib/prompt.js";
 import { getGatewayUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
+import { starterIntegrityMode } from "../lib/starter-integrity.js";
 import { OPENAI_WRAP_DEFAULT_MODEL, openaiBirthProbeBody } from "../lib/birth-probe.js";
 const AGENT_HEADER = "x-mnemom-agent";
 const PROVIDERS = {
@@ -98,7 +99,7 @@ export async function wrapCommand(options = {}) {
     say();
     say(`${fmt.badge("alignment", "cyan")} Seeding starter alignment card…`);
     try {
-        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId)), "application/json");
+        await putAlignmentCard(agentId, JSON.stringify(buildStarterAlignmentCard(agentId, await starterIntegrityMode(agentId))), "application/json");
         steps.push({ step: "alignment", status: "ok" });
         say(fmt.success("Alignment card set."));
     }
@@ -261,12 +262,12 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
     return agentId;
 }
 // ── Starter cards ─────────────────────────────────────────────────────────────
-function buildStarterAlignmentCard(agentId) {
+function buildStarterAlignmentCard(agentId, integrityMode) {
     return {
         card_version: "unified/2026-04-26",
         agent_id: agentId,
         autonomy_mode: "observe",
-        integrity_mode: "off",
+        integrity_mode: integrityMode, // the agent's own mode; observe for a new agent (MNE-9728)
         // No capability mappings here, so unmapped tools must pass or every turn fails.
         enforcement: { allow_unmapped_tools: true },
         principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },

package/dist/index.js

@@ -204,8 +204,8 @@ const agentCmd = program
     .option("--invite <token>", "Redeem a Mnemom Agent invitation (pinv_…): unlocks Mnemom Agent for you + credits your starter µ; launches too when a session name is given")
     .option("--setup", "Re-check the served agent and refresh its default cards before launch")
     .option("--no-setup", "Skip the default-card writes (the agent is still confirmed and claimed)")
-    .option("--governance [features]", "Turn governance ON for the agent's cards: AIP integrity analysis + Safe House screening, observe-only (default: off for new agents; autonomy policy checks are rules only and on either way). Pick features with a comma list: integrity, safe-house. Billed at cost on top of the agent fee")
-    .option("--no-governance", "Turn governance OFF for the agent's cards, autonomy policy checks included (by default new agents run autonomy observe, rules only; a card refresh otherwise keeps an existing agent's modes)")
+    .option("--governance [features]", "Choose the governance features for the agent's cards, observe-only: a comma list naming exactly the features to turn on: integrity, safe-house, all or none (default for new agents: integrity on, Safe House off; `--governance none` opts out of integrity; autonomy policy checks are rules only and on either way). Billed at cost on top of the agent fee")
+    .option("--no-governance", "Turn governance OFF for the agent's cards, autonomy policy checks included (by default new agents run autonomy observe, rules only, plus integrity observe; a card refresh otherwise keeps an existing agent's modes)")
     .option("--no-yolo", "Do NOT pass --dangerously-skip-permissions (yolo is on by default)")
     .option("--no-context-hint", "Do NOT seed Claude Code's context-hint feature flag before launch")
     // The Mnemom plugin lands dark: off by default and not in the published package, so its two
@@ -2383,12 +2383,13 @@ program
 });
 program
     .command("scan")
-    .description("Read-only local scan of GitHub PR metadata; the report is emailed to you every time (counts only, no repo names) and Mnemom keeps nothing at share level none")
+    .description("Read-only local scan of GitHub PR metadata; the full report, with the counts for each repo, is always emailed to you, your org admins and anyone you add. --share chooses what Mnemom may keep")
     .option("--repo <owner/name...>", "Repo to scan (repeatable or comma-separated; omit on a terminal to pick from your repos)")
     .option("--start <YYYY-MM-DD>", "Period start (default: today)")
     .option("--end <YYYY-MM-DD>", "Period end (default: today)")
-    .option("--share <level>", "summary | full | none (default: full when asked; none when not interactive)")
-    .option("--cto-email <email>", "CTO who receives the report (required unless you are the CTO; asked when omitted)")
+    .option("--share <level>", "What Mnemom may keep: full (totals and per-repo counts, default when asked) | analytics (team totals only, no repo names; summary is the old name) | none (nothing; the default when not interactive)")
+    .option("--email <address...>", "Also email the report to these people (repeatable or comma-separated, up to 10, on your organization's email domain or mnemom.ai). You and every org admin always get it")
+    .option("--cto-email <email>", "Same as --email (kept for older scripts)")
     .option("--monthly-spend <usd>", "Your own approximate monthly AI spend (self-reported; never sent or saved; needs MNEMOM_ORG_SCAN_MODE=true)")
     .option("--anthropic-admin-key", "Ask (masked) for your Anthropic admin key and read measured usage with it, locally; or set ANTHROPIC_ADMIN_KEY. Never stored, logged or sent anywhere but api.anthropic.com. Without this flag, workload identity federation is tried first when ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID and ANTHROPIC_SERVICE_ACCOUNT_ID are set (needs MNEMOM_ORG_SCAN_MODE=true)")
     .option("--no-anthropic-usage", "Decline Anthropic usage and be asked for a monthly figure (needs MNEMOM_ORG_SCAN_MODE=true)")
@@ -2405,6 +2406,7 @@ program
             period: { start: options.start ?? options.end ?? today, end: options.end ?? today },
             share: options.share,
             ctoEmail: options.ctoEmail,
+            email: options.email,
             monthlySpend: options.monthlySpend,
             noAnthropicUsage: options.anthropicUsage === false,
             anthropicAdminKey: options.anthropicAdminKey === true,

package/dist/lib/runner/executor-client.d.ts

@@ -34,6 +34,11 @@ export declare function errorDetails(body: unknown): Record<string, unknown>;
 export declare const JOB_READ_PATH: (sessionId: string) => string;
 /** The served bundle fetch, per claim (W-L12). */
 export declare const BUNDLE_FETCH_PATH: (sessionId: string) => string;
+/**
+ * The job's PR token (ruling 34.34): a Record App installation token narrowed to the seal's repo,
+ * contents and pull_requests write, fetched with the lease key. Never cached or logged.
+ */
+export declare const GITHUB_TOKEN_PATH: (sessionId: string) => string;
 export declare const JWKS_PATH = "/v1/.well-known/jwks.json";
 /** Record's commit index (ruling 34.05 (a)): the lease key may write the session's own commits. */
 export declare const RECORD_COMMITS_PATH: (orgId: string) => string;
@@ -65,6 +70,7 @@ export interface RunnerApi {
     fail(sessionId: string, body: Record<string, unknown>): Promise<HttpResult>;
     job(sessionId: string): Promise<HttpResult>;
     bundle(sessionId: string, leaseKey: string): Promise<HttpResult>;
+    githubToken(sessionId: string, leaseKey: string): Promise<HttpResult>;
     jwks(): Promise<HttpResult>;
     /** One RecordCommit/v1 body, with the lease key; the api pins it to the session's lineage. */
     recordCommit(orgId: string, body: RecordCommitBody, leaseKey: string): Promise<HttpResult>;

package/dist/lib/runner/executor-client.js

@@ -33,6 +33,11 @@ export function errorDetails(body) {
 export const JOB_READ_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/job`;
 /** The served bundle fetch, per claim (W-L12). */
 export const BUNDLE_FETCH_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/bundle`;
+/**
+ * The job's PR token (ruling 34.34): a Record App installation token narrowed to the seal's repo,
+ * contents and pull_requests write, fetched with the lease key. Never cached or logged.
+ */
+export const GITHUB_TOKEN_PATH = (sessionId) => `/v1/executor/sessions/${sessionId}/github-token`;
 export const JWKS_PATH = "/v1/.well-known/jwks.json";
 /** Record's commit index (ruling 34.05 (a)): the lease key may write the session's own commits. */
 export const RECORD_COMMITS_PATH = (orgId) => `/v1/orgs/${encodeURIComponent(orgId)}/record/commits`;
@@ -95,6 +100,7 @@ export function runnerApi(opts) {
         fail: (id, body) => call(routePath("exec_fail", scoped(id)), "POST", ex, body),
         job: (id) => call(JOB_READ_PATH(scoped(id)), "GET", ex),
         bundle: (id, leaseKey) => call(BUNDLE_FETCH_PATH(scoped(id)), "GET", leaseKey),
+        githubToken: (id, leaseKey) => call(GITHUB_TOKEN_PATH(scoped(id)), "POST", leaseKey),
         jwks: () => call(JWKS_PATH, "GET", null),
         recordCommit: (orgId, body, leaseKey) => {
             if (!ORG_ID_RE.test(orgId))

package/dist/lib/runner/job.d.ts

@@ -42,8 +42,11 @@ export interface JobDeps {
     prepareWorkspace(repo: string, sessionId: string): Promise<Workspace>;
     /** Run one phase's process; resolves its exit code. Rejects only when it could not start. */
     runPhase(inv: PhaseInvocation, ws: Workspace, modelUrl: string, signal: AbortSignal): Promise<number>;
-    /** Push the job branch and open its PR; resolves the PR URL. */
-    openPr(repo: string, ws: Workspace, title: string, body: string): Promise<string>;
+    /**
+     * Push the job branch and open its PR; resolves the PR URL. `token` is the job's PR token when
+     * `prTokenFromLease` is set; null means the runner's own GitHub token.
+     */
+    openPr(repo: string, ws: Workspace, title: string, body: string, token: string | null): Promise<string>;
     /** Commits on the job branch that the base does not have; 0 means there is nothing to open. */
     commitsAhead(ws: Workspace): Promise<number>;
     /** The working copy's HEAD sha before a phase runs; null only for a clone with no commit. Throws otherwise. */
@@ -53,7 +56,13 @@ export interface JobDeps {
      * first, under `lineageKey` and the job's repo. A commit that cannot be read is left out.
      */
     commitBodies(ws: Workspace, since: string | null, lineageKey: string, repo: string): Promise<RecordCommitBody[]>;
-    enableAutoMerge(prUrl: string): Promise<void>;
+    enableAutoMerge(prUrl: string, token: string | null): Promise<void>;
+    /**
+     * True when the credential is the --oidc exchange: the PR is pushed and opened with the job's PR
+     * token from the api (ruling 34.34), never the runner's own GitHub token, which in a sealed repo's
+     * Action is a GITHUB_TOKEN the org forbids from opening PRs. A refused token fails the job.
+     */
+    prTokenFromLease?: boolean;
     cleanup(ws: Workspace): Promise<void>;
 }
 export interface JobOptions {

package/dist/lib/runner/job.js

@@ -379,6 +379,7 @@ export async function runJob(sessionId, opts, deps) {
             });
         }
         if (opensPr) {
+            let prToken = null;
             try {
                 // Checked before the push, so an empty diff never reaches GitHub's 422 (amendment 59).
                 if ((await deps.commitsAhead(ws)) === 0) {
@@ -386,7 +387,13 @@ export async function runJob(sessionId, opts, deps) {
                     await reportFail(deps, sessionId, claim.epoch, "runner_failed", "pr_no_changes");
                     return { kind: "outcome", outcome: failedOutcome(facts, "pr_no_changes") };
                 }
-                facts.pr_url = await deps.openPr(job.repo, ws, `mnemom: ${bundle.workflow.id} job ${sessionId.slice(0, 8)}`, prBody(job));
+                if (deps.prTokenFromLease) {
+                    const t = await fetchPrToken(deps, sessionId, claim.leaseKey, job.repo);
+                    if (!t.ok)
+                        throw new Error(t.detail);
+                    prToken = t.token;
+                }
+                facts.pr_url = await deps.openPr(job.repo, ws, `mnemom: ${bundle.workflow.id} job ${sessionId.slice(0, 8)}`, prBody(job), prToken);
             }
             catch (e) {
                 deps.log(`opening the PR failed: ${e.message}`);
@@ -395,7 +402,7 @@ export async function runJob(sessionId, opts, deps) {
             }
             if (facts.merge_strategy === "merge_on_green") {
                 try {
-                    await deps.enableAutoMerge(facts.pr_url);
+                    await deps.enableAutoMerge(facts.pr_url, prToken);
                 }
                 catch (e) {
                     deps.log(`enabling auto-merge failed (the PR stays open): ${e.message}`);
@@ -469,6 +476,27 @@ export async function reportPhaseCommits(deps, report, p) {
         deps.log(`commit report failed: ${e.message}`);
     }
 }
+/**
+ * The job's PR token (ruling 34.34), fetched once per claim with the lease key. It must name the
+ * job's repo; the detail never carries the token.
+ */
+async function fetchPrToken(deps, sessionId, leaseKey, repo) {
+    const res = await deps.api.githubToken(sessionId, leaseKey);
+    if (res.status !== 200) {
+        return {
+            ok: false,
+            detail: `the PR token fetch answered ${res.code ?? res.networkError ?? res.status}`,
+        };
+    }
+    const b = (res.body ?? {});
+    if (typeof b.token !== "string" || b.token === "") {
+        return { ok: false, detail: "the PR token fetch answered 200 with no token" };
+    }
+    if (typeof b.repository !== "string" || b.repository.toLowerCase() !== repo.toLowerCase()) {
+        return { ok: false, detail: `the PR token names another repo than the job's ${repo}` };
+    }
+    return { ok: true, token: b.token };
+}
 async function fetchBundle(deps, sessionId, claim) {
     const [jwksRes, res] = await Promise.all([
         deps.api.jwks(),

package/dist/lib/scan/caps.d.ts

@@ -1,35 +1 @@
-/**
- * Coverage caps and sampling. Port of mnemom-api src/org-scan/scan/capped-scan.ts (PR #4208).
- *
- * Coverage decision (Shraddha, 2026-10-28): each scan covers the last 3 months OR the last 2,000 merged
- * PRs, whichever is MORE; above 2,000 in the window, an even deterministic sample of 2,000.
- */
-export declare const COVERAGE_MONTHS = 3;
-export interface ScanCaps {
-    maxPrs: number;
-    /** A PR with more additions+deletions than this is skipped, never read in full. */
-    maxPrSizeLines: number;
-    /** Upstream read calls. */
-    maxReads: number;
-    /** Wall-clock budget. */
-    maxMillis: number;
-}
-export declare const DEFAULT_SCAN_CAPS: ScanCaps;
-export type StopReason = "pr-cap" | "read-cap" | "time-cap";
-/** The day `months` calendar months before `end` (YYYY-MM-DD, UTC), clamped to the month's last day. */
-export declare function monthsBefore(end: string, months: number): string;
-/** `k` items spread evenly across `items` (order kept): index floor(i*n/k). Deterministic; n <= k returns all. */
-export declare function evenSample<T>(items: readonly T[], k: number): T[];
-export declare function sanitiseCaps(c: Partial<ScanCaps>): ScanCaps;
-/** Running read budget. Every call is told how many reads it may spend (`room`). */
-export declare class Budget {
-    private caps;
-    private now;
-    private startedAt;
-    reads: number;
-    constructor(caps: ScanCaps, now: () => number, startedAt: number);
-    block(n?: number): StopReason | null;
-    room(): number;
-    overrun(): StopReason | null;
-    charge(n: number): void;
-}
+export * from "../../vendor/shared/org-scan-core/caps.js";