@mnemom/mnemom 0.17.38 → 0.17.39-next.1

package/dist/commands/agent-run.js

@@ -72,6 +72,8 @@ export async function agentRunCommand(flags, deps) {
             apiUrl: deps.apiUrl,
             requestUrl: plan.credential.requestUrl,
             requestToken: plan.credential.requestToken,
+            // Amendment 66: set by the action from the wake-up's adopt-ticket input; empty sends none.
+            adoptTicket: deps.env.MNEMOM_ADOPT_TICKET?.trim() || null,
         });
         if (!ex.ok) {
             // No job is held yet: fail closed whatever --fail-mode says (34.12 (6)).

package/dist/commands/agent-setup.js

@@ -43,7 +43,7 @@ import { getApiUrl, getGatewayUrl, getWebsiteUrl, MNEMOM_DIR } from "../lib/conf
 import { fmt } from "../lib/format.js";
 import { askYesNo, isInteractive } from "../lib/prompt.js";
 import { malformedAgentIdMessage, parseAgentRef, resolveAnthropicDoor, resolveGatewayHost, sanitizeAgentName, singleCellError, } from "../lib/agent.js";
-import { readMnemomKey, resolveAgentAuth, resolveSubscriptionMnemomKey, sayRetiredConsoleNotice, } from "../lib/subscription-login.js";
+import { mnemomKeyRejectedFix, readMnemomKey, resolveAgentAuth, resolveSubscriptionMnemomKey, sayRetiredConsoleNotice, } from "../lib/subscription-login.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { IdentityRouteMissingError, resolveServedIdentity, resolveServedIdentityDetail, } from "../lib/agent-identity-route.js";
 import { readConfirmedAgent, readServedAgent, servedFingerprint, writeConfirmedAgent, writeServedAgent, } from "../lib/served-agent-cache.js";
@@ -431,7 +431,7 @@ export async function ensureClaimedServedAgent(opts) {
     }
     catch (err) {
         if (err instanceof MnemomKeyRejectedError) {
-            say(fmt.warn("mnemom agent: the gateway rejected your stored Mnemom API key — launching without it (fix: `mnemom agent config` / re-run subscription setup, or unset MNEMOM_AGENT_MNEMOM_KEY)."));
+            say(fmt.warn(`mnemom agent: the gateway rejected your Mnemom API key — launching without it. ${mnemomKeyRejectedFix(getApiUrl(), process.env)}`));
             const retried = await ensureClaimedServedAgent({ ...opts, mnemomKey: undefined });
             return { ...retried, mnemomKeyRejected: true };
         }
@@ -560,6 +560,15 @@ async function resolveServedAgent(opts, fp) {
         if (opts.anthropicKey && opts.mnemomKey && isRejectedMnemomKey(err)) {
             throw new MnemomKeyRejectedError();
         }
+        // A subscription launch whose Mnemom key the gateway rejected (401, e.g. invalid_mnemom_key):
+        // most often a key saved for another cell. Name the cell and the exact fix.
+        if (!opts.anthropicKey &&
+            opts.mnemomKey &&
+            err instanceof MnemomApiError &&
+            err.effectiveStatus === 401) {
+            throw new UnclaimedAgentError(`mnemom agent: the gateway rejected the Mnemom API key this launch sent (${err.code ?? "401"}), so it can't confirm '${slug}' is claimed. ` +
+                mnemomKeyRejectedFix(getApiUrl(), process.env));
+        }
         if (err instanceof IdentityRouteMissingError) {
             throw new UnclaimedAgentError(`mnemom agent: ${err.message}, so it can't confirm '${slug}' is claimed. ` +
                 "Launch with an Anthropic API key instead (`--auth api-key`), or try again once the gateway is updated.");
@@ -736,7 +745,7 @@ function pinRefusal(err, pin, slug) {
     }
     if (code === "mnemom_api_key_required" || status === 401) {
         return (`${head}: a pin needs a valid Mnemom API key (${code ?? "401"}). ` +
-            "Set MNEMOM_AGENT_MNEMOM_KEY, or delete mnemom_api_key from ~/.mnemom/launcher.json so the next pinned launch mints a fresh one.");
+            mnemomKeyRejectedFix(getApiUrl(), process.env));
     }
     return `${head} (${describeApiError(err)}). A pinned launch never falls back to another agent.`;
 }

package/dist/commands/agent.d.ts

@@ -265,7 +265,7 @@ export declare function recordSessionLaunch(ctx: {
     compactAt: number | null;
 }): void;
 /** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
-export declare function defaultMnemomKeyDeps(storePath?: string): MnemomKeyDeps;
+export declare function defaultMnemomKeyDeps(storePath?: string, apiUrl?: string): MnemomKeyDeps;
 /**
  * Resolve the Anthropic key with NO 1Password dependency (built for external
  * customer adoption), in order:

package/dist/commands/agent.js

@@ -41,7 +41,7 @@ import { createApiKey } from "../lib/api.js";
 import { recordOrgFor } from "../lib/record-org.js";
 import { httpDoorAllowed } from "../durable/test-mode.mjs";
 import { defaultSessionKeyDeps, mintSessionGatewayKey, revokeSessionGatewayKey, startSessionKeyRenewal, } from "../lib/session-key.js";
-import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, launchChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { mnemomKeyStorePatch, storedMnemomKeyForCell, resolveAgentAuth, sayRetiredConsoleNotice, readMnemomKey, resolveSubscriptionMnemomKey, launchChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
 import { clearLaunching, liveLaunchingDeps, markLaunching } from "../lib/durable/launching.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
 import { isLoggedIn } from "../lib/auth.js";
@@ -55,7 +55,7 @@ import { authConfigured, chooseAuth, detectClaudeLogin, readClaudeLoginState, }
 import { goalAlignmentLine, resolveSessionSetup } from "./agent-session.js";
 import { defaultAgentSlug, ensureClaimedServedAgent, ensureSessionAndBalance, isQuietPreambleExit, readComposedProtection, resolveDefaultSlug, resolvePinnedAgent, resolvePreflightedAccount, } from "./agent-setup.js";
 import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfig, buildSessionConfigB64, assertCompactAtCompatible, assertOffProfileCompatible, compactAtWindowWarning, describeCompactAt, launchWindow, resolveCompactAt, applyGatewayHintHeaders, resolveCompactionIntercept, resolveContextHandoff, resolveContextProfile, resolveHandoffGatewayHost, resolveUsageSavings, HANDOFF_RC_KEY_ENV_NAME, HANDOFF_RC_MNEMOM_KEY_ENV_NAME, malformedAgentIdMessage, parseAgentRef, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, applyToolSearchDefault, DISABLE_1M_ENV, readCcSettings, passthroughModel, resolveWindowModel, resolveAnthropicDoor, resolveLaunchModel, resolveConversationId, resolveGatewayHost, singleCellError, resolveLaunchShape, resolveRemoteControlShape, liftPassthroughName, passthroughName, sanitizeAgentName, resumeCommand, sessionDisplayName, SESSION_NAME_ENV, SESSION_CONFIG_HEADER, stripOwnerCredentialEnv, } from "../lib/agent.js";
-import { LAUNCHER_STORE_PATH, mergeStore } from "../lib/launcher-store.js";
+import { LAUNCHER_STORE_PATH, mergeStore, readStore } from "../lib/launcher-store.js";
 import { slackChannelArgs } from "../lib/slack-launch.js";
 import { appendPluginDirsEnv, applyPluginEnv, pluginEnabled, pluginPlanLine, resolvePluginDir, } from "../lib/claude-plugin.js";
 import { CLI_VERSION } from "../version.js";
@@ -1146,21 +1146,17 @@ export function recordSessionLaunch(ctx) {
 // Credential resolution (zero 1Password)
 // ───────────────────────────────────────────────────────────────────────────
 /** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
-export function defaultMnemomKeyDeps(storePath = CODE_STORE) {
+export function defaultMnemomKeyDeps(storePath = CODE_STORE, apiUrl = getApiUrl()) {
     return {
         env: process.env,
+        // The key is per cell (keyed by the API origin): a key minted on one cell is rejected by
+        // another cell's gateway (401), so it is never read for, or sent to, a different cell.
         readStored: () => {
-            try {
-                const data = JSON.parse(readFileSync(storePath, "utf8"));
-                const v = data[MNEMOM_KEY_STORE_FIELD];
-                return typeof v === "string" ? stripCrlf(v) : undefined;
-            }
-            catch {
-                return undefined;
-            }
+            const v = storedMnemomKeyForCell(readStore(storePath), apiUrl);
+            return v === undefined ? undefined : stripCrlf(v);
         },
         mint: async () => (await createApiKey(`mnemom-agent ${hostname()}`, ["gateway"])).key,
-        store: (key) => mergeStore({ [MNEMOM_KEY_STORE_FIELD]: key }, storePath),
+        store: (key) => mergeStore(mnemomKeyStorePatch(readStore(storePath), apiUrl, key), storePath),
         say,
     };
 }

package/dist/lib/runner/oidc.d.ts

@@ -30,10 +30,15 @@ export declare function actionsIdToken(fetch: FetchFn, requestUrl: string, reque
     ok: false;
     detail: string;
 }>;
-/** Fetch the ID token and exchange it for a one-lease executor key. */
+/**
+ * Fetch the ID token and exchange it for a one-lease executor key. `adoptTicket` (Amendment 66) is
+ * the ticket the api's wake-up passed this run as the adopt-ticket input; it rides in the body
+ * beside the token, and like the token it never reaches a log line or an outcome.
+ */
 export declare function exchangeOidc(opts: {
     fetch: FetchFn;
     apiUrl: string;
     requestUrl: string;
     requestToken: string;
+    adoptTicket?: string | null;
 }): Promise<OidcExchange>;

package/dist/lib/runner/oidc.js

@@ -54,7 +54,11 @@ export async function actionsIdToken(fetch, requestUrl, requestToken) {
         return { ok: false, detail: `ID token request failed: ${e.message}` };
     }
 }
-/** Fetch the ID token and exchange it for a one-lease executor key. */
+/**
+ * Fetch the ID token and exchange it for a one-lease executor key. `adoptTicket` (Amendment 66) is
+ * the ticket the api's wake-up passed this run as the adopt-ticket input; it rides in the body
+ * beside the token, and like the token it never reaches a log line or an outcome.
+ */
 export async function exchangeOidc(opts) {
     const id = await actionsIdToken(opts.fetch, opts.requestUrl, opts.requestToken);
     if (!id.ok)
@@ -65,7 +69,9 @@ export async function exchangeOidc(opts) {
         res = await opts.fetch(`${base}${routePath("exec_oidc_exchange")}`, {
             method: "POST",
             headers: { accept: "application/json", "content-type": "application/json" },
-            body: JSON.stringify({ oidc_token: id.token }),
+            body: JSON.stringify(opts.adoptTicket
+                ? { oidc_token: id.token, adopt_ticket: opts.adoptTicket }
+                : { oidc_token: id.token }),
         });
     }
     catch (e) {

package/dist/lib/subscription-login.d.ts

@@ -38,8 +38,31 @@ export declare function sayRetiredConsoleNotice(flag: string | undefined, env: R
 export declare const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
 /** Env override for the Mnemom key a subscription launch sends. */
 export declare const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
+/**
+ * LEGACY field in ~/.mnemom/launcher.json (0600): the single, cell-blind key every launcher
+ * before the per-cell store saved. Every such key was minted against production, so it is read
+ * ONLY when the CLI points at the production API and is never sent to another cell.
+ */
 export declare const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
+/** Field in ~/.mnemom/launcher.json (0600): the minted keys per cell, `{ "<api origin>": key }`. */
+export declare const MNEMOM_KEYS_STORE_FIELD = "mnemom_api_keys";
+/** The production API origin: the only cell the legacy flat field may be used for. */
+export declare const PRODUCTION_API_ORIGIN = "https://api.mnemom.ai";
+/**
+ * The cell a Mnemom key belongs to: the API base's origin, lowercased. An unparseable base
+ * gives null, and every caller then fails closed (no stored key is read, none is saved).
+ */
+export declare function mnemomKeyCell(apiUrl: string): string | null;
+/**
+ * The stored Mnemom key for the cell `apiUrl` names, from the launcher.json object `data`:
+ * the per-cell entry, else (production only) the legacy flat field, else undefined. Pure.
+ */
+export declare function storedMnemomKeyForCell(data: Record<string, unknown>, apiUrl: string): string | undefined;
+/**
+ * The launcher.json patch that saves `key` for the cell `apiUrl` names, keeping every other
+ * cell's entry. Throws on an unparseable base, so nothing is saved under a cell we can't name.
+ */
+export declare function mnemomKeyStorePatch(data: Record<string, unknown>, apiUrl: string, key: string): Record<string, unknown>;
 export declare function coerceAgentAuth(raw: string): AgentAuth;
 /**
  * launcher.toml `auth`: the retired `console` is kept as-is (never a load error); it folds into
@@ -48,6 +71,13 @@ export declare function coerceAgentAuth(raw: string): AgentAuth;
 export declare function parseSavedAgentAuth(raw: string): SavedAgentAuth;
 /** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here; a saved retired `console` → api-key) > api-key. */
 export declare function resolveAgentAuth(flag: string | undefined, env: Record<string, string | undefined>): AgentAuth;
+/**
+ * The fix line for a gateway 401 on the Mnemom key this launch sent. The saved key is per cell
+ * (keyed by the API origin), so the line names the cell and the exact remedy: a key set in
+ * MNEMOM_AGENT_MNEMOM_KEY must come from this cell; a saved one is removed from this cell's
+ * entry so the next launch mints one here. Pure.
+ */
+export declare function mnemomKeyRejectedFix(apiUrl: string, env: Record<string, string | undefined>): string;
 export interface MnemomKeyDeps {
     env: Record<string, string | undefined>;
     readStored(): string | undefined;

package/dist/lib/subscription-login.js

@@ -39,8 +39,64 @@ export function sayRetiredConsoleNotice(flag, env, say) {
 export const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
 /** Env override for the Mnemom key a subscription launch sends. */
 export const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
+/**
+ * LEGACY field in ~/.mnemom/launcher.json (0600): the single, cell-blind key every launcher
+ * before the per-cell store saved. Every such key was minted against production, so it is read
+ * ONLY when the CLI points at the production API and is never sent to another cell.
+ */
 export const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
+/** Field in ~/.mnemom/launcher.json (0600): the minted keys per cell, `{ "<api origin>": key }`. */
+export const MNEMOM_KEYS_STORE_FIELD = "mnemom_api_keys";
+/** The production API origin: the only cell the legacy flat field may be used for. */
+export const PRODUCTION_API_ORIGIN = "https://api.mnemom.ai";
+/**
+ * The cell a Mnemom key belongs to: the API base's origin, lowercased. An unparseable base
+ * gives null, and every caller then fails closed (no stored key is read, none is saved).
+ */
+export function mnemomKeyCell(apiUrl) {
+    try {
+        const origin = new URL(apiUrl).origin.toLowerCase();
+        return origin && origin !== "null" ? origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The stored Mnemom key for the cell `apiUrl` names, from the launcher.json object `data`:
+ * the per-cell entry, else (production only) the legacy flat field, else undefined. Pure.
+ */
+export function storedMnemomKeyForCell(data, apiUrl) {
+    const cell = mnemomKeyCell(apiUrl);
+    if (cell === null)
+        return undefined;
+    const map = data[MNEMOM_KEYS_STORE_FIELD];
+    if (map && typeof map === "object" && !Array.isArray(map)) {
+        const v = map[cell];
+        if (typeof v === "string" && v.trim())
+            return v;
+    }
+    if (cell === PRODUCTION_API_ORIGIN) {
+        const legacy = data[MNEMOM_KEY_STORE_FIELD];
+        if (typeof legacy === "string")
+            return legacy;
+    }
+    return undefined;
+}
+/**
+ * The launcher.json patch that saves `key` for the cell `apiUrl` names, keeping every other
+ * cell's entry. Throws on an unparseable base, so nothing is saved under a cell we can't name.
+ */
+export function mnemomKeyStorePatch(data, apiUrl, key) {
+    const cell = mnemomKeyCell(apiUrl);
+    if (cell === null)
+        throw new Error(`cannot tell which cell the API base '${apiUrl}' is`);
+    const current = data[MNEMOM_KEYS_STORE_FIELD];
+    const kept = current && typeof current === "object" && !Array.isArray(current)
+        ? current
+        : {};
+    return { [MNEMOM_KEYS_STORE_FIELD]: { ...kept, [cell]: key } };
+}
 /**
  * The key is spliced into the newline-joined ANTHROPIC_CUSTOM_HEADERS block, so an embedded
  * CR/LF (a multi-line paste, a bad env value) would inject extra header lines.
@@ -72,6 +128,30 @@ export function resolveAgentAuth(flag, env) {
     const fromEnv = (env[AGENT_AUTH_ENV] ?? "").trim();
     return fromEnv ? coerceAgentAuth(fromEnv) : "api-key";
 }
+/**
+ * The fix line for a gateway 401 on the Mnemom key this launch sent. The saved key is per cell
+ * (keyed by the API origin), so the line names the cell and the exact remedy: a key set in
+ * MNEMOM_AGENT_MNEMOM_KEY must come from this cell; a saved one is removed from this cell's
+ * entry so the next launch mints one here. Pure.
+ */
+export function mnemomKeyRejectedFix(apiUrl, env) {
+    const cell = mnemomKeyCell(apiUrl);
+    const where = cell ?? `the API base '${apiUrl}'`;
+    const create = "`mnemom api-key create --name mnemom-agent --scopes gateway` while the CLI points at it";
+    if (headerSafe(env[MNEMOM_KEY_ENV] ?? "")) {
+        return (`The Mnemom API key in ${MNEMOM_KEY_ENV} is not valid on this cell (${where}); a key from another cell is rejected here. ` +
+            `Set ${MNEMOM_KEY_ENV} to a key from this cell (${create}), or unset it so the launcher uses or mints this cell's own key.`);
+    }
+    if (cell === null) {
+        return (`The Mnemom API key is not valid on ${where}, and the launcher can't tell which cell that is. ` +
+            `Set ${MNEMOM_KEY_ENV} to a key from that cell (${create}).`);
+    }
+    const legacy = cell === PRODUCTION_API_ORIGIN
+        ? ` (and the older top-level "${MNEMOM_KEY_STORE_FIELD}" field)`
+        : "";
+    return (`The saved Mnemom API key is per cell, and this cell (${cell}) rejected the one saved for it. ` +
+        `Set ${MNEMOM_KEY_ENV} to a key from this cell (${create}), or remove the "${cell}" entry under "${MNEMOM_KEYS_STORE_FIELD}"${legacy} in ~/.mnemom/launcher.json so the next launch mints one.`);
+}
 /**
  * The Mnemom key this machine already has — MNEMOM_AGENT_MNEMOM_KEY, else the stored key — or
  * undefined. NEVER mints. An unpinned api-key launch sends it (`x-mnemom-api-key`) alongside its
@@ -108,7 +188,7 @@ export async function resolveSubscriptionMnemomKey(deps, purpose = "subscription
         throw new Error("mnemom agent: the API returned an empty Mnemom key.");
     try {
         deps.store(minted);
-        deps.say(`mnemom agent: minted a gateway-only Mnemom API key for ${purpose} (saved to ~/.mnemom/launcher.json, 0600).`);
+        deps.say(`mnemom agent: minted a gateway-only Mnemom API key for ${purpose} (saved for this cell to ~/.mnemom/launcher.json, 0600).`);
     }
     catch {
         deps.say("mnemom agent: minted a gateway-only Mnemom API key for this launch but could not save it — the next launch mints another.");

package/dist/vendor/durable-contract/index.js

@@ -238,12 +238,20 @@ var WAIT_REASONS = [
   "mnemom_unavailable",
   "ci",
   "question",
-  "budget"
+  "budget",
+  "awaiting_issue_run",
+  "repo_arm_unreadable"
 ];
 var PARKED_ONLY_WAIT_REASONS = [
   "ci",
   "question",
-  "budget"
+  "budget",
+  "awaiting_issue_run",
+  "repo_arm_unreadable"
+];
+var DISPATCH_PARK_WAIT_REASONS = [
+  "awaiting_issue_run",
+  "repo_arm_unreadable"
 ];
 function isSessionState(v) {
   return typeof v === "string" && SESSION_STATES.includes(v);
@@ -1066,6 +1074,7 @@ var CLAIM_UNAVAILABLE_CAUSES = [
   "lease_cap_config"
 ];
 var SEAL_REPO_MISMATCH_CAUSES = ["no_repo_claim", "no_seal_repo", "repo_mismatch"];
+var ADOPT_REFUSED_CAUSES = ["no_parked_seal", "not_parked"];
 var UNSUPPORTED_FEATURES = [
   "tool_classes",
   "launch_spec_change",
@@ -1179,6 +1188,9 @@ var DURABLE_CODES = {
   // durable_claim_ineligible reason: the session is claimable, only not by this executor, and a
   // runner never skips past it to another session. cause is a SEAL_REPO_MISMATCH_CAUSES value.
   seal_repo_mismatch: { status: 403, surfaces: ["api"], fields: ["cause"] },
+  // S1 amendment 64 (mnemom-test#1336): exec_adopt found nothing it may unpark for this run. Nothing
+  // is written. cause is an ADOPT_REFUSED_CAUSES value.
+  adopt_refused: { status: 409, surfaces: ["api"], fields: ["cause"] },
   // ---- api journal (C10-R0 (i), (j), (k)) ----
   /** Lost CAS race on (session_id, seq). */
   durable_append_conflict: { status: 409, surfaces: ["api"], fields: ["tip_seq"] },
@@ -2372,9 +2384,47 @@ var OIDC_EXCHANGE_REFUSALS = [
   "bad_issuer",
   "repo_not_enrolled",
   "ref_not_allowed",
-  "pool_flag_off"
+  "pool_flag_off",
+  "adopt_ticket_invalid",
+  "token_replayed",
+  "run_already_exchanged"
 ];
+var OIDC_EXCHANGE_RUN_CLAIMS = ["jti", "run_id", "run_attempt"];
+var OIDC_JTI_MAX = 200;
+var OIDC_RUN_NUMBER_RE = /^[1-9][0-9]{0,15}$/;
+var OIDC_EXCHANGE_RETENTION_DAYS = 35;
+function oidcRunClaimsOk(claims) {
+  const { jti, run_id, run_attempt } = claims;
+  return typeof jti === "string" && jti.length >= 1 && jti.length <= OIDC_JTI_MAX && typeof run_id === "string" && OIDC_RUN_NUMBER_RE.test(run_id) && typeof run_attempt === "string" && OIDC_RUN_NUMBER_RE.test(run_attempt);
+}
 var OIDC_EXCHANGE_AUDIENCE = "mnemom-executor";
+var ADOPT_TICKET_INPUT = "adopt-ticket";
+var WAKEUP_SESSION_INPUT = "session-id";
+var ADOPT_TICKET_RE = /^mnm_at_[A-Za-z0-9_-]{43}$/;
+var ADOPT_TICKET_TTL_S = 900;
+var OIDC_EXCHANGE_BODY_KEYS = ["oidc_token", "adopt_ticket"];
+var OIDC_TOKEN_MAX = 8192;
+var OIDC_WORKFLOW_ENV = "DISPATCH_WAKEUP_WORKFLOW";
+var OIDC_WORKFLOW_FILE_RE = /^[A-Za-z0-9_.-]{1,100}\.ya?ml$/;
+function adoptTicketOk(t) {
+  return typeof t === "string" && ADOPT_TICKET_RE.test(t);
+}
+function oidcExchangeBodyOk(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const o = v;
+  const keys = Object.keys(o);
+  if (keys.some((k) => !OIDC_EXCHANGE_BODY_KEYS.includes(k))) return false;
+  if (typeof o.oidc_token !== "string" || o.oidc_token === "" || o.oidc_token.length > OIDC_TOKEN_MAX)
+    return false;
+  return !("adopt_ticket" in o) || typeof o.adopt_ticket === "string";
+}
+function oidcPinnedWorkflow(envValue) {
+  const wf = envValue?.trim() ?? "";
+  return OIDC_WORKFLOW_FILE_RE.test(wf) ? wf : null;
+}
+function jobWorkflowRefOk(jobWorkflowRef, repository, workflowFile, defaultBranch) {
+  return typeof jobWorkflowRef === "string" && jobWorkflowRef === `${repository}/.github/workflows/${workflowFile}@refs/heads/${defaultBranch}`;
+}
 var ORG_POLICY_LIMIT_KEYS = ["per_session_budget_usd", "live_lease_cap"];
 var LIVE_LEASE_CAP_MIN = 1;
 var LIVE_LEASE_CAP_MAX = 1e3;
@@ -2408,14 +2458,15 @@ var CREATE_READY_SESSION_REFUSALS = [
   // 34.10.1 (4): the api-built charter v1 or its envelope does not match the seal; nothing written
   "charter_mismatch"
 ];
-var CREATE_READY_SESSION_OUTCOMES = ["created", "existing", "refused"];
+var CREATE_READY_SESSION_OUTCOMES = ["created", "existing", "refused", "parked"];
 function isUserCreator(createdBy) {
   return typeof createdBy === "string" && createdBy !== "" && !createdBy.includes(":");
 }
 var CREATE_READY_SESSION_ANSWERS = Object.freeze({
   created: ["outcome", "session_id"],
   existing: ["outcome", "session_id"],
-  refused: ["outcome", "reason"]
+  refused: ["outcome", "reason"],
+  parked: ["outcome", "session_id", "wait_reason"]
 });
 function createReadySessionAnswerOk(v) {
   if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
@@ -2424,7 +2475,11 @@ function createReadySessionAnswerOk(v) {
     return false;
   const keys = CREATE_READY_SESSION_ANSWERS[a.outcome];
   if (Object.keys(a).length !== keys.length || !keys.every((k) => k in a)) return false;
-  return a.outcome === "refused" ? CREATE_READY_SESSION_REFUSALS.includes(a.reason) : typeof a.session_id === "string" && UUID_RE.test(a.session_id);
+  if (a.outcome === "refused")
+    return CREATE_READY_SESSION_REFUSALS.includes(a.reason);
+  if (a.outcome === "parked" && !DISPATCH_PARK_WAIT_REASONS.includes(a.wait_reason))
+    return false;
+  return typeof a.session_id === "string" && UUID_RE.test(a.session_id);
 }
 function sealIdOk(sealId) {
   if (!UUID_RE.test(sealId)) throw new RangeError(`seal id must be a lowercase uuid: ${sealId}`);
@@ -2501,7 +2556,11 @@ var RUNNER_REFUSED_REASONS = [
   "oidc_ref_not_allowed",
   "oidc_pool_flag_off",
   "oidc_unavailable",
-  "api_unavailable"
+  "api_unavailable",
+  "oidc_adopt_ticket_invalid",
+  // amendment 65 (mnemom-test#1331): the two single-use exchange refusals, appended
+  "oidc_token_replayed",
+  "oidc_run_already_exchanged"
 ];
 var RUNNER_OPEN_MODE_TOLERATED = [
   "bundle_unavailable",
@@ -2747,7 +2806,9 @@ var DURABLE_EVENT_KINDS = [
   "session.waiting",
   "session.wait_cleared",
   "executor.turn_continued",
-  "inbox.acked"
+  "inbox.acked",
+  // S1 amendment 64: dispatch parked a seal (api-written; session.waiting stays executor-only)
+  "session.dispatch_parked"
 ];
 function isDurableEventKind(v) {
   return typeof v === "string" && DURABLE_EVENT_KINDS.includes(v);
@@ -2756,7 +2817,8 @@ var AMENDMENT_EVENT_GROUPS = Object.freeze({
   "session.ready": "lifecycle",
   "session.waiting": "lifecycle",
   "session.wait_cleared": "lifecycle",
-  "executor.turn_continued": "lease"
+  "executor.turn_continued": "lease",
+  "session.dispatch_parked": "lifecycle"
 });
 function eventGroupOf(kind) {
   if (Object.prototype.hasOwnProperty.call(AMENDMENT_EVENT_GROUPS, kind))
@@ -3006,10 +3068,16 @@ var KIND_REFS = {
     [
       { field: "wait_reason", equals: "ci", require: ["head_sha"], forbid: ["approval_id"] },
       { field: "wait_reason", equals: "question", require: ["approval_id"], forbid: ["head_sha"] },
-      { field: "wait_reason", equals: "budget", require: ["approval_id"], forbid: ["head_sha"] }
+      { field: "wait_reason", equals: "budget", require: ["approval_id"], forbid: ["head_sha"] },
+      // amendment 64: a dispatch park carries no commitment
+      { field: "wait_reason", equals: "awaiting_issue_run", forbid: ["head_sha", "approval_id"] },
+      { field: "wait_reason", equals: "repo_arm_unreadable", forbid: ["head_sha", "approval_id"] }
     ]
   ),
   "session.wait_cleared": obj({ wait_reason: ENUM(PARKED_ONLY_WAIT_REASONS) }),
+  // S1 amendment 64: the api's dispatch park. One writer per kind: the executor's park stays
+  // session.waiting; adopt and flip-to-runner journal session.wait_cleared + session.ready.
+  "session.dispatch_parked": obj({ wait_reason: ENUM(DISPATCH_PARK_WAIT_REASONS) }),
   // ---- lead ruling 2026-10-28: the spawn that sent the continue; a separate fact, so
   // executor.spawned's refs stay exactly {spawn_id} ----
   "executor.turn_continued": obj({ spawn_id: UUID }),
@@ -4341,12 +4409,14 @@ async function approvalSubjectHash(subject) {
   return sha256Hex(canonicalJson(subject));
 }
 var AGENT_SESSIONS_READY_CHECK = "state <> 'ready' OR (durable_mode = 'locked' AND state_reason IS NULL AND home_executor_id IS NULL AND lease_executor_id IS NULL AND lease_expires_at IS NULL AND spawn_id IS NULL AND hello_at IS NULL)";
-var AGENT_SESSIONS_WAIT_PARKED_CHECK = "CASE WHEN wait_reason IN ('ci','question','budget') THEN state = 'parked' AND wait_ref IS NOT NULL ELSE wait_ref IS NULL END";
+var AGENT_SESSIONS_WAIT_PARKED_CHECK = "CASE WHEN wait_reason IN ('ci','question','budget') THEN state = 'parked' AND wait_ref IS NOT NULL WHEN wait_reason IN ('awaiting_issue_run','repo_arm_unreadable') THEN state = 'parked' AND wait_ref IS NULL ELSE wait_ref IS NULL END";
 var AGENT_EXECUTORS_SCOPE_CHECK = "scope IN ('user','org')";
 function readyRowOk(row) {
   return row.state !== "ready" || row.durable_mode === "locked" && row.state_reason === null && row.home_executor_id === null && row.lease_executor_id === null && row.lease_expires_at === null && row.spawn_id === null && row.hello_at === null;
 }
 function waitParkedRowOk(row) {
+  if (row.wait_reason !== null && DISPATCH_PARK_WAIT_REASONS.includes(row.wait_reason))
+    return row.state === "parked" && row.wait_ref === null;
   return row.wait_reason !== null && PARKED_ONLY_WAIT_REASONS.includes(row.wait_reason) ? row.state === "parked" && row.wait_ref !== null : row.wait_ref === null;
 }
 
@@ -4852,6 +4922,16 @@ function executorStateOk(v) {
 }
 
 // ../shared/durable-contract/src/routes.ts
+var ADOPT_BODY_KEYS = ["source_ref", "nonce"];
+var ADOPT_SOURCE_REF_MAX = 500;
+function adoptBodyOk(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const b = v;
+  if (Object.keys(b).length !== 2 || typeof b.source_ref !== "string") return false;
+  if (typeof b.nonce !== "string" || b.nonce.length === 0) return false;
+  const r = b.source_ref;
+  return r !== "" && r === r.trim() && r.length <= ADOPT_SOURCE_REF_MAX;
+}
 var fixed = (method, auth, path) => Object.freeze({ method, auth, path });
 var scoped = (method, auth, pre, post) => Object.freeze({ method, auth, pre, post });
 var EXECUTORS = "/v1/executors";
@@ -4882,8 +4962,21 @@ var ROUTES = Object.freeze({
   // ---- Doors amendment (ruling 34.03) ----
   /** The org-scope executor's claimable pool sessions, oldest first; `?limit=` (READY_SESSIONS_LIMIT_MIN..MAX) is not part of the match. */
   exec_ready_list: fixed("GET", "executor_key", "/v1/executor/ready"),
-  /** Body {oidc_token}; answers a one-lease org-scope executor key or an OIDC_EXCHANGE_REFUSALS refusal. */
+  /**
+   * Body {oidc_token, adopt_ticket?} (doors.ts oidcExchangeBodyOk, Amendment 66). adopt_ticket comes
+   * only from a ticketed wake-up; it is used up before any key is minted and binds the key to one seal.
+   * Amendment 65: single-use per token jti and per run attempt (token_replayed, run_already_exchanged).
+   */
   exec_oidc_exchange: fixed("POST", "github_oidc", "/v1/executor/oidc/exchange"),
+  // ---- S1 amendment 64 (mnemom-test#1336) ----
+  /**
+   * Body {source_ref, nonce} (adoptBodyOk). The OIDC run's key unparks the parked dispatch seal whose
+   * source_ref is this run's own issue, in its own org and repo, and claims it in one transaction,
+   * and only the seal its adopt ticket was minted for (Amendment 66; a key with no ticket adopts none),
+   * fenced on the nonce (exec_claim's rule);
+   * answers the exec_claim answer, or adopt_refused / seal_repo_mismatch, changing nothing.
+   */
+  exec_adopt: fixed("POST", "executor_key", "/v1/executor/adopt"),
   // ---- inbox, executor side (S1 amendment 60) ----
   /** Content-free summary {admitted, delivered, oldest_admitted_at} (inboxSummaryResponseOk); marks nothing. */
   exec_inbox: scoped("GET", "executor_key", EXEC_SESSION_PRE, "/inbox"),
@@ -5807,8 +5900,22 @@ var FREEZE_RECORD = Object.freeze({
   DEFAULT_LEASE_CAP_ENV,
   DISPATCH_SESSION_CID_PREFIX,
   DISPATCH_SESSION_NAME_PREFIX,
+  // amendment 66
+  ADOPT_TICKET_INPUT,
+  WAKEUP_SESSION_INPUT,
+  ADOPT_TICKET_PATTERN: ADOPT_TICKET_RE.source,
+  ADOPT_TICKET_TTL_S,
+  OIDC_TOKEN_MAX,
+  OIDC_WORKFLOW_ENV,
+  OIDC_WORKFLOW_FILE_PATTERN: OIDC_WORKFLOW_FILE_RE.source,
   READY_SESSIONS_LIMIT_MIN,
   READY_SESSIONS_LIMIT_MAX,
+  // amendment 64
+  ADOPT_SOURCE_REF_MAX,
+  // amendment 65
+  OIDC_JTI_MAX,
+  OIDC_RUN_NUMBER_PATTERN: OIDC_RUN_NUMBER_RE.source,
+  OIDC_EXCHANGE_RETENTION_DAYS,
   READY_USER_TEXT,
   RUNNER_FAILED_PHASE_PATTERN: RUNNER_FAILED_PHASE_RE.source,
   AGENT_SESSIONS_READY_CHECK,
@@ -5921,11 +6028,17 @@ var FREEZE_STRUCTURED = Object.freeze({
   READY_CAUSES,
   WAIT_REASONS,
   PARKED_ONLY_WAIT_REASONS,
+  // amendment 64
+  DISPATCH_PARK_WAIT_REASONS,
+  ADOPT_REFUSED_CAUSES,
+  ADOPT_BODY_KEYS,
   WAIT_REF_KEYS,
   CLEAR_WAIT_OUTCOMES,
   EXECUTOR_SCOPES,
   ORG_SCOPE_EXECUTOR_KINDS,
   OIDC_EXCHANGE_REFUSALS,
+  OIDC_EXCHANGE_BODY_KEYS,
+  OIDC_EXCHANGE_RUN_CLAIMS,
   ORG_POLICY_LIMIT_KEYS,
   POOL_CLAIM_FIELDS,
   CREATE_READY_SESSION_REFUSALS,
@@ -6234,6 +6347,12 @@ export {
   ADMISSION_STEP_CODE,
   ADMIT_SWEEP_VALUES,
   ADMIT_SWEEP_VECTORS_PATH,
+  ADOPT_BODY_KEYS,
+  ADOPT_REFUSED_CAUSES,
+  ADOPT_SOURCE_REF_MAX,
+  ADOPT_TICKET_INPUT,
+  ADOPT_TICKET_RE,
+  ADOPT_TICKET_TTL_S,
   ADOPT_WITH_YOU_TEXT,
   AGENT_CONTAINED_STATUSES,
   AGENT_EXECUTORS_SCOPE_CHECK,
@@ -6315,6 +6434,7 @@ export {
   DEVICE_STEP_VERBS,
   DEVICE_VERIFY_AAL_DEFAULT,
   DEVICE_VERIFY_AAL_VALUES,
+  DISPATCH_PARK_WAIT_REASONS,
   DISPATCH_SESSION_CID_PREFIX,
   DISPATCH_SESSION_NAME_PREFIX,
   DONE_CLAUSE,
@@ -6487,7 +6607,15 @@ export {
   NON_TTY_LOCKED_TEMPLATE,
   NO_M1_EMITTER_KINDS,
   OIDC_EXCHANGE_AUDIENCE,
+  OIDC_EXCHANGE_BODY_KEYS,
   OIDC_EXCHANGE_REFUSALS,
+  OIDC_EXCHANGE_RETENTION_DAYS,
+  OIDC_EXCHANGE_RUN_CLAIMS,
+  OIDC_JTI_MAX,
+  OIDC_RUN_NUMBER_RE,
+  OIDC_TOKEN_MAX,
+  OIDC_WORKFLOW_ENV,
+  OIDC_WORKFLOW_FILE_RE,
   OLD_ROUTE_BRANCH,
   OLD_ROUTE_REFRESH,
   ORG_CAP_LOCK_PREFIX,
@@ -6665,11 +6793,14 @@ export {
   UUID_RE,
   WAIT_REASONS,
   WAIT_REF_KEYS,
+  WAKEUP_SESSION_INPUT,
   admissionStatusOf,
   admissionTruthTable,
   admit,
   admitSweepDigest,
   admitSweepText,
+  adoptBodyOk,
+  adoptTicketOk,
   amendDecision,
   answerFromChoice,
   answersOk,
@@ -6797,6 +6928,7 @@ export {
   isValidSessionName,
   isValidStateReason,
   isWellFormedLeaseKey,
+  jobWorkflowRefOk,
   lagBucket,
   lintDurableOnly,
   lintFixCatalogue,
@@ -6808,6 +6940,9 @@ export {
   normalizeCellId,
   normalizeQuestions,
   normalizeSessionName,
+  oidcExchangeBodyOk,
+  oidcPinnedWorkflow,
+  oidcRunClaimsOk,
   openContract,
   ownerSessionViewOk,
   ownerVerbDecision,