@mnemom/mnemom 0.17.39-next.1 → 0.17.39-next.3

package/dist/commands/auth.d.ts

@@ -1,5 +1,50 @@
+/**
+ * `mnemom whoami --json`: who is logged in, and which org is active, as ONE
+ * JSON object for a program to read. It carries identity only, never a
+ * credential: no access or refresh token, no API key, no scope string.
+ *
+ *   {"logged_in": bool, "user_id": str|null, "email": str|null,
+ *    "key_id": str|null, "org_id": str|null,
+ *    "active_org": {"org_id", "slug", "name"}|null, "expires_at": ISO|null,
+ *    "api_url": the API origin this identity was resolved against}
+ *
+ * A person (an OAuth login) is user_id + email, read from GET /v1/auth/session.
+ * An API key is key_id + org_id (its own org), read from GET
+ * /v1/api-keys/whoami; its user_id is always null, because a key's owning
+ * person is not the caller and a reader must key a key on key_id, never on
+ * that person. When the identity read fails, user_id, email, key_id and org_id
+ * are null: never a stale stored value.
+ *
+ * api_url is getApiUrl() in this process (--api / MNEMOM_API_URL > MNEMOM_RING
+ * > MNEMOM_ENV). Identities never cross environments (test, us-1 and
+ * production each have their own), so a reader pins one origin and refuses a
+ * whoami whose api_url is not it.
+ *
+ * A reader beside the CLI must never read ~/.mnemom/auth.json or call the API
+ * with the stored token itself: the CLI refreshes and rotates its tokens under
+ * a lock (MNE-9232), and a second token handler would race that refresh. This
+ * is the read such a reader uses instead (develop's install and every acting
+ * develop verb, which take their operator and tenant from the login).
+ */
+export interface WhoamiJson {
+    logged_in: boolean;
+    user_id: string | null;
+    email: string | null;
+    key_id: string | null;
+    org_id: string | null;
+    active_org: {
+        org_id: string;
+        slug: string;
+        name: string | null;
+    } | null;
+    expires_at: string | null;
+    api_url: string;
+}
+export declare function whoamiJson(): Promise<WhoamiJson>;
 export declare function loginCommand(options?: {
     noBrowser?: boolean;
 }): Promise<void>;
 export declare function logoutCommand(): Promise<void>;
-export declare function whoamiCommand(): Promise<void>;
+export declare function whoamiCommand(options?: {
+    json?: boolean;
+}): Promise<void>;

package/dist/commands/auth.js

@@ -1,6 +1,51 @@
 import { getAuthInfo, clearAuthTokens, loginWithBrowser, loginWithDeviceFlow, resolveAuth, } from "../lib/auth.js";
-import { getMe } from "../lib/api.js";
+import { getApiKeyWhoami, getMe, getSession } from "../lib/api.js";
+import { getActiveOrg } from "../lib/cli-config.js";
+import { getApiUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
+export async function whoamiJson() {
+    const active = getActiveOrg();
+    const active_org = active
+        ? { org_id: active.org_id, slug: active.slug, name: active.name ?? null }
+        : null;
+    const out = {
+        logged_in: false,
+        user_id: null,
+        email: null,
+        key_id: null,
+        org_id: null,
+        active_org,
+        expires_at: null,
+        api_url: getApiUrl(),
+    };
+    const cred = await resolveAuth();
+    if (cred.type === "none")
+        return out;
+    if (cred.type === "api-key") {
+        // A key is keyed on its own id and org, never on its owner's user id.
+        const key = await getApiKeyWhoami().catch(() => null);
+        return { ...out, logged_in: true, key_id: key?.key_id ?? null, org_id: key?.org_id ?? null };
+    }
+    if (!getAuthInfo())
+        return out;
+    // The OAuth token carries no identity: ask the API (GET /v1/auth/session, a
+    // pure read, unlike /v1/auth/me's billing and SSO JIT writes), which goes
+    // through the CLI's own refresh. A failed read leaves the identity null: a
+    // stored legacy value could belong to another session or environment.
+    const session = await getSession().catch(() => null);
+    const me = session ? { user_id: session.user.id, email: session.user.email ?? null } : null;
+    // Read the grant after that call: a refresh inside it moves expiresAt.
+    const auth = getAuthInfo();
+    if (!auth)
+        return out;
+    return {
+        ...out,
+        logged_in: true,
+        user_id: me?.user_id ?? null,
+        email: me?.email ?? null,
+        expires_at: new Date(auth.expiresAt * 1000).toISOString(),
+    };
+}
 export async function loginCommand(options = {}) {
     try {
         // --no-browser → RFC 8628 device flow (headless / SSH / no local browser).
@@ -53,7 +98,11 @@ export async function logoutCommand() {
     clearAuthTokens();
     console.log(fmt.success("Logged out."));
 }
-export async function whoamiCommand() {
+export async function whoamiCommand(options = {}) {
+    if (options.json) {
+        console.log(JSON.stringify(await whoamiJson()));
+        return;
+    }
     const cred = await resolveAuth();
     if (cred.type === "none") {
         console.log("\nNot logged in. Run `mnemom login` to authenticate.\n");

package/dist/durable/turn-chain.js

@@ -86,7 +86,9 @@ export function entryProducer(e) {
     return typeof p === "string" && TURN_PRODUCER_RE.test(p) ? p : undefined;
 }
 /** Claude Code's open tag for a bracketed paste, which may lead a pasted prompt's text. */
-const PASTE_OPEN_RE = /^<pasted_content id="[^"\n]{0,128}">\n?/;
+// Claude Code may record the paste after blank lines ("\n\n<pasted_content id=...>"); a delivery the marker
+// misses there is never confirmed and gets pasted again (seen live: 4 pastes of one message).
+const PASTE_OPEN_RE = /^\n*<pasted_content id="[^"\n]{0,128}">\n?/;
 /**
  * The inbox sha an entry answers (S1 amendment 60): the `[mnemom inbox <sha>]` marker on the first
  * line of the entry's first text (after Claude Code's paste open tag, as the host daemon delivers by

package/dist/host/commands.js

@@ -69,7 +69,8 @@ export function registerHostCommands(agent, hidden) {
         .command("enroll")
         .description("Enroll this machine as an executor (device step); `install` does this when needed")
         .option("--org <org_id>", "Join this organization (you must be a member); defaults to the active org, else your personal org")
-        .action(async (o) => guarded(false, (io) => hostEnroll(io, { org: o.org })));
+        .option("--scope <scope>", "personal (default): run your own sessions. org: run the org's pool jobs (`mnemom agent run`); an org owner or admin approves it, and the org must have org runners turned on", "personal")
+        .action(async (o) => guarded(false, (io) => hostEnroll(io, { org: o.org, scope: o.scope })));
     host
         .command("renew")
         .description("Renew this machine's executor grant (device step)")

package/dist/host/inbox-delivery.js

@@ -72,7 +72,9 @@ export const HANDLED_MAX = 32;
 /** claude's input line, and the footer it shows while a turn runs. */
 const PROMPT_MARK = "❯";
 const RUNNING_RE = /esc to interrupt/i;
-const PASTE_OPEN_RE = /^<pasted_content id="[^"\n]{0,128}">\n?/;
+// Claude Code may record the paste after blank lines ("\n\n<pasted_content id=...>"); a delivery the marker
+// misses there is never confirmed and gets pasted again (seen live: 4 pastes of one message).
+const PASTE_OPEN_RE = /^\n*<pasted_content id="[^"\n]{0,128}">\n?/;
 function firstText(r) {
     const c = r.message?.content;
     if (typeof c === "string")

package/dist/host/owner.d.ts

@@ -13,6 +13,8 @@ export interface OwnerApi {
         machine_label?: string;
         /** Ruling 34.03.4: the org this host joins; the api checks membership. */
         org_id?: string;
+        /** The any-machine amendment: "org" enrolls this host as a runner of org_id's pool. */
+        scope?: "org";
     }): Promise<OwnerHttp>;
     enrollPoll(pollSecret: string, approvalId: string | null): Promise<OwnerHttp>;
     list(): Promise<OwnerHttp>;

package/dist/host/verbs.d.ts

@@ -52,16 +52,26 @@ export declare function enrollOrg(io: VerbIo, opts: {
     orgId: string;
     from: "flag" | "active";
 } | null;
+/**
+ * `host enroll --scope`: personal (the default) enrolls this machine for its user's own sessions;
+ * org enrolls it as a runner of the org's pool (the any-machine amendment, Wassim 2026-11-09:
+ * S1 ORG_SCOPE_EXECUTOR_KINDS includes host). The org owner or admin's device-step approval is the
+ * guard, and the api also requires the org on DURABLE_POOL_CLAIM.
+ */
+export declare const ENROLL_SCOPES: readonly ["personal", "org"];
+export type EnrollScope = (typeof ENROLL_SCOPES)[number];
 /** The device step: start, show the code, poll, write the state file. Returns an exit code. */
 export declare function enrollDevice(io: VerbIo, opts?: {
     label?: string;
     org?: string;
+    scope?: EnrollScope;
 }): Promise<number>;
 /** Write the plist and (re)load the job. */
 export declare function writeAndLoad(io: VerbIo): Promise<number>;
 export declare function hostInstall(io: VerbIo): Promise<number>;
 export declare function hostEnroll(io: VerbIo, opts?: {
     org?: string;
+    scope?: EnrollScope;
 }): Promise<number>;
 export declare function hostRenew(io: VerbIo): Promise<number>;
 export declare function hostUninstall(io: VerbIo): Promise<number>;

package/dist/host/verbs.js

@@ -80,8 +80,26 @@ function errorCode(body) {
     const code = e && typeof e === "object" ? e.code : undefined;
     return typeof code === "string" ? code : null;
 }
+/**
+ * `host enroll --scope`: personal (the default) enrolls this machine for its user's own sessions;
+ * org enrolls it as a runner of the org's pool (the any-machine amendment, Wassim 2026-11-09:
+ * S1 ORG_SCOPE_EXECUTOR_KINDS includes host). The org owner or admin's device-step approval is the
+ * guard, and the api also requires the org on DURABLE_POOL_CLAIM.
+ */
+export const ENROLL_SCOPES = ["personal", "org"];
 /** The device step: start, show the code, poll, write the state file. Returns an exit code. */
 export async function enrollDevice(io, opts = {}) {
+    const orgScope = opts.scope === "org";
+    if (opts.scope !== undefined && !ENROLL_SCOPES.includes(opts.scope)) {
+        io.err(`mnemom agent host: --scope must be ${ENROLL_SCOPES.join(" or ")}`);
+        return 1;
+    }
+    // An org runner names its org: --org, else the active org. The api requires it (34.03.3).
+    if (orgScope && !enrollOrg(io, opts)) {
+        io.err("mnemom agent host: --scope org needs the organization this machine will run jobs for.");
+        io.err("fix: `mnemom agent host enroll --scope org --org <org_id>` (`mnemom org list` shows them)");
+        return 1;
+    }
     const { paths } = ctx(io);
     const lock = (io.acquireLock ?? acquireHostLock)(path.join(paths.durableDir, "enroll.lock"));
     if (!lock.ok) {
@@ -96,13 +114,14 @@ export async function enrollDevice(io, opts = {}) {
             contract_version: EXECUTOR_CONTRACT,
             ...(opts.label ? { machine_label: opts.label } : {}),
             ...(o ? { org_id: o.orgId } : {}),
+            ...(orgScope ? { scope: "org" } : {}),
         });
         let st = await startWith(org);
         // An api from before 34.03.4 refuses org_id on a host start with its plain 400 invalid_scope
         // (34.03.2 (1); mnemom-api enroll.ts "org_id is only accepted with scope org"; recorded beside
         // exec_enroll in S1 codes.ts). An org taken from the active org then falls back to the start this
         // CLI made before; an explicit --org cannot.
-        if (org && st.status === 400 && errorCode(st.body) === "invalid_scope") {
+        if (!orgScope && org && st.status === 400 && errorCode(st.body) === "invalid_scope") {
             if (org.from === "flag") {
                 io.err(`mnemom agent host: this Mnemom server cannot enroll a machine into ${org.orgId} yet.`);
                 io.err("fix: `mnemom agent host enroll` without --org (joins your personal org)");
@@ -115,6 +134,21 @@ export async function enrollDevice(io, opts = {}) {
         const start = st.status === 202 || st.status === 200 || st.status === 201
             ? parseEnrollStart(st.body)
             : null;
+        if (!start && orgScope && org) {
+            const code = errorCode(st.body);
+            if (code === CODE.durable_approval_not_eligible) {
+                // 34.03.3: only an owner or admin of the org may enroll an org runner.
+                io.err(`mnemom agent host: only an owner or admin of ${org.orgId} can enroll a machine as its runner.`);
+                io.err(`fix: ask an owner or admin of ${org.orgId} to run \`mnemom agent host enroll --scope org --org ${org.orgId}\` on this machine`);
+                return 1;
+            }
+            if (code === CODE.kind_not_allowed) {
+                // The org is not on the server's pool-claim list, or the server predates host org runners.
+                io.err(`mnemom agent host: this Mnemom server does not accept this machine as a runner for ${org.orgId} (org runners are not turned on for it, or the server does not take host runners yet).`);
+                io.err("fix: `mnemom agent host enroll` without --scope org enrolls it for your own sessions");
+                return 1;
+            }
+        }
         if (!start && org && errorCode(st.body) === CODE.durable_approval_not_eligible) {
             // 34.03.4: only a member of the org may enroll a machine into it.
             io.err(`mnemom agent host: you are not a member of ${org.orgId}, so this machine cannot join it.`);
@@ -173,7 +207,15 @@ export async function enrollDevice(io, opts = {}) {
                 boot_id: io.bootId(),
             });
             if (io.json)
-                io.out(JSON.stringify({ event: "enrolled", executor_id: p.executorId }));
+                io.out(JSON.stringify({
+                    event: "enrolled",
+                    executor_id: p.executorId,
+                    ...(orgScope ? { scope: "org" } : {}),
+                }));
+            else if (orgScope && org) {
+                io.out(`Enrolled this machine as a runner for ${org.orgId} (executor ${p.executorId.slice(0, 8)}).`);
+                io.out(`To claim its pool jobs: \`mnemom agent run --watch\` with MNEMOM_EXECUTOR_KEY set to executor_key in ${paths.stateFile}`);
+            }
             else
                 io.out(`Enrolled this machine (executor ${p.executorId.slice(0, 8)}).`);
             return 0;

package/dist/index.js

@@ -1976,9 +1976,10 @@ program
 program
     .command("whoami")
     .description("Show current authentication status")
-    .action(async () => {
+    .option("--json", "Print who is logged in as one JSON object: {logged_in, user_id, email, active_org, expires_at} (never a token)")
+    .action(async (options) => {
     try {
-        await whoamiCommand();
+        await whoamiCommand({ json: options.json });
     }
     catch (error) {
         console.error("Error:", error instanceof Error ? error.message : error);

package/dist/lib/api.d.ts

@@ -426,6 +426,25 @@ export interface MeResponse {
     } | null;
 }
 export declare function getMe(): Promise<MeResponse>;
+/** Who the credential belongs to — `GET /v1/auth/session`. A pure read for a
+ *  bearer (no billing-account ensure and no SSO JIT provisioning, which
+ *  `GET /v1/auth/me` runs on every call), so an identity check changes nothing. */
+export interface SessionResponse {
+    user: {
+        id: string;
+        email?: string | null;
+    };
+    method?: string;
+}
+export declare function getSession(): Promise<SessionResponse>;
+/** What an API key is — `GET /v1/api-keys/whoami` (ADR-049). A read; the key's
+ *  own id and org, which is how a reader keys a key caller. */
+export interface ApiKeyWhoamiResponse {
+    key_id: string | null;
+    org_id: string | null;
+    auth_method?: string;
+}
+export declare function getApiKeyWhoami(): Promise<ApiKeyWhoamiResponse>;
 /**
  * The org's Mnemom Units (MU) balance — `GET /v1/billing/mu` (the frozen mu
  * v0.1 balance, values as decimal strings). Amounts come in both whole MU

package/dist/lib/api.js

@@ -440,6 +440,14 @@ export async function getMyPersonalOrg() {
 export async function getMe() {
     return gFetch("/v1/auth/me", {}, { fallback: "Could not read your identity" });
 }
+export async function getSession() {
+    return gFetch("/v1/auth/session", {}, { fallback: "Could not read your identity" });
+}
+export async function getApiKeyWhoami() {
+    return gFetch("/v1/api-keys/whoami", {}, {
+        fallback: "Could not read your API key's identity",
+    });
+}
 export async function getRecordTotals(orgId, lineageKey, signal) {
     return gFetch(`/v1/orgs/${encodeURIComponent(orgId)}/record/totals?lineage_key=${encodeURIComponent(lineageKey)}`, signal ? { signal } : {}, { notFoundLabel: "Record totals", fallback: "Could not read record totals" });
 }

package/dist/vendor/durable-contract/index.js

@@ -1664,8 +1664,9 @@ var M1_CLI_SURFACE = Object.freeze([
   entry(["agent", "done"], ["--json"]),
   // BACKBONE C2 (`mnemom agent host` replaces `mnemom host`, amendment 2; design-v3 row 7).
   entry(["agent", "host"]),
-  // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to).
-  entry(["agent", "host", "enroll"], ["--org"]),
+  // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to);
+  // --scope: the any-machine amendment (Wassim 2026-11-09; `--scope org` enrolls an org runner).
+  entry(["agent", "host", "enroll"], ["--org", "--scope"]),
   // BACKBONE C2 install/status/uninstall; --json: C04 (`mnemom agent host install --json`),
   // ruling 32.31.
   entry(["agent", "host", "install"], ["--json"]),
@@ -2379,7 +2380,7 @@ function poolClaimOrgs(flagValue) {
   return [...new Set(orgs)];
 }
 var EXECUTOR_SCOPES = ["user", "org"];
-var ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet"];
+var ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet", "host"];
 var OIDC_EXCHANGE_REFUSALS = [
   "bad_issuer",
   "repo_not_enrolled",
@@ -2406,6 +2407,8 @@ var OIDC_EXCHANGE_BODY_KEYS = ["oidc_token", "adopt_ticket"];
 var OIDC_TOKEN_MAX = 8192;
 var OIDC_WORKFLOW_ENV = "DISPATCH_WAKEUP_WORKFLOW";
 var OIDC_WORKFLOW_FILE_RE = /^[A-Za-z0-9_.-]{1,100}\.ya?ml$/;
+var OIDC_WORKFLOW_SET_ENV = "DURABLE_OIDC_WORKFLOWS";
+var OIDC_WORKFLOW_SET_MAX = 8;
 function adoptTicketOk(t) {
   return typeof t === "string" && ADOPT_TICKET_RE.test(t);
 }
@@ -2422,9 +2425,22 @@ function oidcPinnedWorkflow(envValue) {
   const wf = envValue?.trim() ?? "";
   return OIDC_WORKFLOW_FILE_RE.test(wf) ? wf : null;
 }
+function oidcWorkflowSet(setValue, pinValue) {
+  if (setValue === void 0) {
+    const pin = oidcPinnedWorkflow(pinValue);
+    return pin === null ? null : [pin];
+  }
+  const names = setValue.split(",").map((n) => n.trim());
+  if (names.some((n) => !OIDC_WORKFLOW_FILE_RE.test(n) || n.includes(".."))) return null;
+  const set = [...new Set(names)];
+  return set.length > OIDC_WORKFLOW_SET_MAX ? null : set;
+}
 function jobWorkflowRefOk(jobWorkflowRef, repository, workflowFile, defaultBranch) {
   return typeof jobWorkflowRef === "string" && jobWorkflowRef === `${repository}/.github/workflows/${workflowFile}@refs/heads/${defaultBranch}`;
 }
+function jobWorkflowRefInSet(jobWorkflowRef, repository, workflowFiles, defaultBranch) {
+  return workflowFiles.some((f2) => jobWorkflowRefOk(jobWorkflowRef, repository, f2, defaultBranch));
+}
 var ORG_POLICY_LIMIT_KEYS = ["per_session_budget_usd", "live_lease_cap"];
 var LIVE_LEASE_CAP_MIN = 1;
 var LIVE_LEASE_CAP_MAX = 1e3;
@@ -5908,6 +5924,8 @@ var FREEZE_RECORD = Object.freeze({
   OIDC_TOKEN_MAX,
   OIDC_WORKFLOW_ENV,
   OIDC_WORKFLOW_FILE_PATTERN: OIDC_WORKFLOW_FILE_RE.source,
+  OIDC_WORKFLOW_SET_ENV,
+  OIDC_WORKFLOW_SET_MAX,
   READY_SESSIONS_LIMIT_MIN,
   READY_SESSIONS_LIMIT_MAX,
   // amendment 64
@@ -6616,6 +6634,8 @@ export {
   OIDC_TOKEN_MAX,
   OIDC_WORKFLOW_ENV,
   OIDC_WORKFLOW_FILE_RE,
+  OIDC_WORKFLOW_SET_ENV,
+  OIDC_WORKFLOW_SET_MAX,
   OLD_ROUTE_BRANCH,
   OLD_ROUTE_REFRESH,
   ORG_CAP_LOCK_PREFIX,
@@ -6928,6 +6948,7 @@ export {
   isValidSessionName,
   isValidStateReason,
   isWellFormedLeaseKey,
+  jobWorkflowRefInSet,
   jobWorkflowRefOk,
   lagBucket,
   lintDurableOnly,
@@ -6943,6 +6964,7 @@ export {
   oidcExchangeBodyOk,
   oidcPinnedWorkflow,
   oidcRunClaimsOk,
+  oidcWorkflowSet,
   openContract,
   ownerSessionViewOk,
   ownerVerbDecision,

package/dist/vendor/shared/durable-contract/cli-surface.js

@@ -36,8 +36,9 @@ export const M1_CLI_SURFACE = Object.freeze([
     entry(["agent", "done"], ["--json"]),
     // BACKBONE C2 (`mnemom agent host` replaces `mnemom host`, amendment 2; design-v3 row 7).
     entry(["agent", "host"]),
-    // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to).
-    entry(["agent", "host", "enroll"], ["--org"]),
+    // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to);
+    // --scope: the any-machine amendment (Wassim 2026-11-09; `--scope org` enrolls an org runner).
+    entry(["agent", "host", "enroll"], ["--org", "--scope"]),
     // BACKBONE C2 install/status/uninstall; --json: C04 (`mnemom agent host install --json`),
     // ruling 32.31.
     entry(["agent", "host", "install"], ["--json"]),

package/dist/vendor/shared/durable-contract/doors.d.ts

@@ -31,8 +31,13 @@ export declare function isPoolSession(s: PoolSessionFacts, flagValue: string | u
 export declare function poolClaimOrgs(flagValue: string | undefined): string[];
 export declare const EXECUTOR_SCOPES: readonly ["user", "org"];
 export type ExecutorScope = (typeof EXECUTOR_SCOPES)[number];
-/** Only these executor kinds may enroll with scope org. */
-export declare const ORG_SCOPE_EXECUTOR_KINDS: readonly ["container", "fleet"];
+/**
+ * Only these executor kinds may enroll with scope org. The any-machine amendment (Wassim, 2026-11-09):
+ * any enrolled machine may be an org runner, so `host` (a Mac mini, laptop or VM) joins container and
+ * fleet, appended. The guard is the org owner or admin's aal2 device-step approval at enrollment
+ * and the org's DURABLE_POOL_CLAIM entry, not the machine kind.
+ */
+export declare const ORG_SCOPE_EXECUTOR_KINDS: readonly ["container", "fleet", "host"];
 /**
  * exec_oidc_exchange refusals (ruling 34.03's S1 changes), each 403, checked in this order.
  * Amendment 65 (mnemom-test#1331) appends the two single-use codes, checked in the same transaction
@@ -83,6 +88,16 @@ export declare const OIDC_TOKEN_MAX = 8192;
 export declare const OIDC_WORKFLOW_ENV = "DISPATCH_WAKEUP_WORKFLOW";
 /** A workflow file name under .github/workflows: no path, no query. */
 export declare const OIDC_WORKFLOW_FILE_RE: RegExp;
+/**
+ * Amendment 66, part 2 (Durable lead ruling (a), 2026-11-09): the api env var naming the set of
+ * workflow files the exchange accepts, comma-separated bare file names. Unset, the set is
+ * OIDC_WORKFLOW_ENV's one file, exactly as before. Set, it replaces that pin for the exchange only
+ * (the wake-up still dispatches OIDC_WORKFLOW_ENV's file), and a set that is empty or holds any
+ * entry that is not a workflow file name (a wildcard, a "/", a "..") turns the exchange dark.
+ */
+export declare const OIDC_WORKFLOW_SET_ENV = "DURABLE_OIDC_WORKFLOWS";
+/** The most workflow files the set may name. */
+export declare const OIDC_WORKFLOW_SET_MAX = 8;
 /** True when `t` has an adopt ticket's shape. */
 export declare function adoptTicketOk(t: unknown): t is string;
 /**
@@ -93,6 +108,14 @@ export declare function adoptTicketOk(t: unknown): t is string;
 export declare function oidcExchangeBodyOk(v: unknown): boolean;
 /** The pinned workflow file from the env value, or null (then the exchange is dark). */
 export declare function oidcPinnedWorkflow(envValue: string | undefined): string | null;
+/**
+ * The workflow files the exchange accepts, or null (then the exchange is dark).
+ * `setValue` is OIDC_WORKFLOW_SET_ENV's value, `pinValue` OIDC_WORKFLOW_ENV's. With the set unset
+ * the answer is the one pinned file, as oidcPinnedWorkflow reads it. With it set, every
+ * comma-separated entry, trimmed, must be a workflow file name with no "..", and there must be one
+ * to OIDC_WORKFLOW_SET_MAX of them; anything else is null, never a partial set. Duplicates collapse.
+ */
+export declare function oidcWorkflowSet(setValue: string | undefined, pinValue: string | undefined): readonly string[] | null;
 /**
  * The workflow pin: the token's job_workflow_ref must be exactly
  * `<repository>/.github/workflows/<pinned file>@refs/heads/<default branch>`, with `repository`
@@ -100,6 +123,8 @@ export declare function oidcPinnedWorkflow(envValue: string | undefined): string
  * branch, a tag or sha ref) is refused ref_not_allowed.
  */
 export declare function jobWorkflowRefOk(jobWorkflowRef: unknown, repository: string, workflowFile: string, defaultBranch: string): boolean;
+/** jobWorkflowRefOk for any one file of an oidcWorkflowSet answer (amendment 66, part 2). */
+export declare function jobWorkflowRefInSet(jobWorkflowRef: unknown, repository: string, workflowFiles: readonly string[], defaultBranch: string): boolean;
 /** durable_org_policy.limits keys (34.05 (1)); live_lease_cap is optional. */
 export declare const ORG_POLICY_LIMIT_KEYS: readonly ["per_session_budget_usd", "live_lease_cap"];
 /** live_lease_cap and the registry default share this range. */

package/dist/vendor/shared/durable-contract/doors.js

@@ -43,8 +43,13 @@ export function poolClaimOrgs(flagValue) {
 }
 // ---- Executor scope (ruling 34.03 (1)) ------------------------------------------------------
 export const EXECUTOR_SCOPES = ["user", "org"];
-/** Only these executor kinds may enroll with scope org. */
-export const ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet"];
+/**
+ * Only these executor kinds may enroll with scope org. The any-machine amendment (Wassim, 2026-11-09):
+ * any enrolled machine may be an org runner, so `host` (a Mac mini, laptop or VM) joins container and
+ * fleet, appended. The guard is the org owner or admin's aal2 device-step approval at enrollment
+ * and the org's DURABLE_POOL_CLAIM entry, not the machine kind.
+ */
+export const ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet", "host"];
 /**
  * exec_oidc_exchange refusals (ruling 34.03's S1 changes), each 403, checked in this order.
  * Amendment 65 (mnemom-test#1331) appends the two single-use codes, checked in the same transaction
@@ -113,6 +118,16 @@ export const OIDC_TOKEN_MAX = 8192;
 export const OIDC_WORKFLOW_ENV = "DISPATCH_WAKEUP_WORKFLOW";
 /** A workflow file name under .github/workflows: no path, no query. */
 export const OIDC_WORKFLOW_FILE_RE = /^[A-Za-z0-9_.-]{1,100}\.ya?ml$/;
+/**
+ * Amendment 66, part 2 (Durable lead ruling (a), 2026-11-09): the api env var naming the set of
+ * workflow files the exchange accepts, comma-separated bare file names. Unset, the set is
+ * OIDC_WORKFLOW_ENV's one file, exactly as before. Set, it replaces that pin for the exchange only
+ * (the wake-up still dispatches OIDC_WORKFLOW_ENV's file), and a set that is empty or holds any
+ * entry that is not a workflow file name (a wildcard, a "/", a "..") turns the exchange dark.
+ */
+export const OIDC_WORKFLOW_SET_ENV = "DURABLE_OIDC_WORKFLOWS";
+/** The most workflow files the set may name. */
+export const OIDC_WORKFLOW_SET_MAX = 8;
 /** True when `t` has an adopt ticket's shape. */
 export function adoptTicketOk(t) {
     return typeof t === "string" && ADOPT_TICKET_RE.test(t);
@@ -138,6 +153,24 @@ export function oidcPinnedWorkflow(envValue) {
     const wf = envValue?.trim() ?? "";
     return OIDC_WORKFLOW_FILE_RE.test(wf) ? wf : null;
 }
+/**
+ * The workflow files the exchange accepts, or null (then the exchange is dark).
+ * `setValue` is OIDC_WORKFLOW_SET_ENV's value, `pinValue` OIDC_WORKFLOW_ENV's. With the set unset
+ * the answer is the one pinned file, as oidcPinnedWorkflow reads it. With it set, every
+ * comma-separated entry, trimmed, must be a workflow file name with no "..", and there must be one
+ * to OIDC_WORKFLOW_SET_MAX of them; anything else is null, never a partial set. Duplicates collapse.
+ */
+export function oidcWorkflowSet(setValue, pinValue) {
+    if (setValue === undefined) {
+        const pin = oidcPinnedWorkflow(pinValue);
+        return pin === null ? null : [pin];
+    }
+    const names = setValue.split(",").map((n) => n.trim());
+    if (names.some((n) => !OIDC_WORKFLOW_FILE_RE.test(n) || n.includes("..")))
+        return null;
+    const set = [...new Set(names)];
+    return set.length > OIDC_WORKFLOW_SET_MAX ? null : set;
+}
 /**
  * The workflow pin: the token's job_workflow_ref must be exactly
  * `<repository>/.github/workflows/<pinned file>@refs/heads/<default branch>`, with `repository`
@@ -148,6 +181,10 @@ export function jobWorkflowRefOk(jobWorkflowRef, repository, workflowFile, defau
     return (typeof jobWorkflowRef === "string" &&
         jobWorkflowRef === `${repository}/.github/workflows/${workflowFile}@refs/heads/${defaultBranch}`);
 }
+/** jobWorkflowRefOk for any one file of an oidcWorkflowSet answer (amendment 66, part 2). */
+export function jobWorkflowRefInSet(jobWorkflowRef, repository, workflowFiles, defaultBranch) {
+    return workflowFiles.some((f) => jobWorkflowRefOk(jobWorkflowRef, repository, f, defaultBranch));
+}
 // ---- Per-org live-lease cap (rulings 34.05, 34.05.1) ----------------------------------------
 /** durable_org_policy.limits keys (34.05 (1)); live_lease_cap is optional. */
 export const ORG_POLICY_LIMIT_KEYS = ["per_session_budget_usd", "live_lease_cap"];

package/dist/vendor/shared/durable-contract/freeze-record.d.ts

@@ -128,6 +128,8 @@ export declare const FREEZE_RECORD: Readonly<{
     OIDC_TOKEN_MAX: 8192;
     OIDC_WORKFLOW_ENV: "DISPATCH_WAKEUP_WORKFLOW";
     OIDC_WORKFLOW_FILE_PATTERN: string;
+    OIDC_WORKFLOW_SET_ENV: "DURABLE_OIDC_WORKFLOWS";
+    OIDC_WORKFLOW_SET_MAX: 8;
     READY_SESSIONS_LIMIT_MIN: 1;
     READY_SESSIONS_LIMIT_MAX: 50;
     ADOPT_SOURCE_REF_MAX: 500;
@@ -748,7 +750,7 @@ export declare const FREEZE_STRUCTURED: Readonly<{
     }>;
     CLEAR_WAIT_OUTCOMES: readonly ["cleared", "stale_ref", "already_clear"];
     EXECUTOR_SCOPES: readonly ["user", "org"];
-    ORG_SCOPE_EXECUTOR_KINDS: readonly ["container", "fleet"];
+    ORG_SCOPE_EXECUTOR_KINDS: readonly ["container", "fleet", "host"];
     OIDC_EXCHANGE_REFUSALS: readonly ["bad_issuer", "repo_not_enrolled", "ref_not_allowed", "pool_flag_off", "adopt_ticket_invalid", "token_replayed", "run_already_exchanged"];
     OIDC_EXCHANGE_BODY_KEYS: readonly ["oidc_token", "adopt_ticket"];
     OIDC_EXCHANGE_RUN_CLAIMS: readonly ["jti", "run_id", "run_attempt"];

package/dist/vendor/shared/durable-contract/freeze-record.js

@@ -159,6 +159,8 @@ export const FREEZE_RECORD = Object.freeze({
     OIDC_TOKEN_MAX: D.OIDC_TOKEN_MAX,
     OIDC_WORKFLOW_ENV: D.OIDC_WORKFLOW_ENV,
     OIDC_WORKFLOW_FILE_PATTERN: D.OIDC_WORKFLOW_FILE_RE.source,
+    OIDC_WORKFLOW_SET_ENV: D.OIDC_WORKFLOW_SET_ENV,
+    OIDC_WORKFLOW_SET_MAX: D.OIDC_WORKFLOW_SET_MAX,
     READY_SESSIONS_LIMIT_MIN: D.READY_SESSIONS_LIMIT_MIN,
     READY_SESSIONS_LIMIT_MAX: D.READY_SESSIONS_LIMIT_MAX,
     // amendment 64

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.39-next.1",
+  "version": "0.17.39-next.3",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {