@mnemom/mnemom 0.17.39-next.2 → 0.17.39-next.3

package/dist/host/commands.js

@@ -69,7 +69,8 @@ export function registerHostCommands(agent, hidden) {
         .command("enroll")
         .description("Enroll this machine as an executor (device step); `install` does this when needed")
         .option("--org <org_id>", "Join this organization (you must be a member); defaults to the active org, else your personal org")
-        .action(async (o) => guarded(false, (io) => hostEnroll(io, { org: o.org })));
+        .option("--scope <scope>", "personal (default): run your own sessions. org: run the org's pool jobs (`mnemom agent run`); an org owner or admin approves it, and the org must have org runners turned on", "personal")
+        .action(async (o) => guarded(false, (io) => hostEnroll(io, { org: o.org, scope: o.scope })));
     host
         .command("renew")
         .description("Renew this machine's executor grant (device step)")

package/dist/host/owner.d.ts

@@ -13,6 +13,8 @@ export interface OwnerApi {
         machine_label?: string;
         /** Ruling 34.03.4: the org this host joins; the api checks membership. */
         org_id?: string;
+        /** The any-machine amendment: "org" enrolls this host as a runner of org_id's pool. */
+        scope?: "org";
     }): Promise<OwnerHttp>;
     enrollPoll(pollSecret: string, approvalId: string | null): Promise<OwnerHttp>;
     list(): Promise<OwnerHttp>;

package/dist/host/verbs.d.ts

@@ -52,16 +52,26 @@ export declare function enrollOrg(io: VerbIo, opts: {
     orgId: string;
     from: "flag" | "active";
 } | null;
+/**
+ * `host enroll --scope`: personal (the default) enrolls this machine for its user's own sessions;
+ * org enrolls it as a runner of the org's pool (the any-machine amendment, Wassim 2026-11-09:
+ * S1 ORG_SCOPE_EXECUTOR_KINDS includes host). The org owner or admin's device-step approval is the
+ * guard, and the api also requires the org on DURABLE_POOL_CLAIM.
+ */
+export declare const ENROLL_SCOPES: readonly ["personal", "org"];
+export type EnrollScope = (typeof ENROLL_SCOPES)[number];
 /** The device step: start, show the code, poll, write the state file. Returns an exit code. */
 export declare function enrollDevice(io: VerbIo, opts?: {
     label?: string;
     org?: string;
+    scope?: EnrollScope;
 }): Promise<number>;
 /** Write the plist and (re)load the job. */
 export declare function writeAndLoad(io: VerbIo): Promise<number>;
 export declare function hostInstall(io: VerbIo): Promise<number>;
 export declare function hostEnroll(io: VerbIo, opts?: {
     org?: string;
+    scope?: EnrollScope;
 }): Promise<number>;
 export declare function hostRenew(io: VerbIo): Promise<number>;
 export declare function hostUninstall(io: VerbIo): Promise<number>;

package/dist/host/verbs.js

@@ -80,8 +80,26 @@ function errorCode(body) {
     const code = e && typeof e === "object" ? e.code : undefined;
     return typeof code === "string" ? code : null;
 }
+/**
+ * `host enroll --scope`: personal (the default) enrolls this machine for its user's own sessions;
+ * org enrolls it as a runner of the org's pool (the any-machine amendment, Wassim 2026-11-09:
+ * S1 ORG_SCOPE_EXECUTOR_KINDS includes host). The org owner or admin's device-step approval is the
+ * guard, and the api also requires the org on DURABLE_POOL_CLAIM.
+ */
+export const ENROLL_SCOPES = ["personal", "org"];
 /** The device step: start, show the code, poll, write the state file. Returns an exit code. */
 export async function enrollDevice(io, opts = {}) {
+    const orgScope = opts.scope === "org";
+    if (opts.scope !== undefined && !ENROLL_SCOPES.includes(opts.scope)) {
+        io.err(`mnemom agent host: --scope must be ${ENROLL_SCOPES.join(" or ")}`);
+        return 1;
+    }
+    // An org runner names its org: --org, else the active org. The api requires it (34.03.3).
+    if (orgScope && !enrollOrg(io, opts)) {
+        io.err("mnemom agent host: --scope org needs the organization this machine will run jobs for.");
+        io.err("fix: `mnemom agent host enroll --scope org --org <org_id>` (`mnemom org list` shows them)");
+        return 1;
+    }
     const { paths } = ctx(io);
     const lock = (io.acquireLock ?? acquireHostLock)(path.join(paths.durableDir, "enroll.lock"));
     if (!lock.ok) {
@@ -96,13 +114,14 @@ export async function enrollDevice(io, opts = {}) {
             contract_version: EXECUTOR_CONTRACT,
             ...(opts.label ? { machine_label: opts.label } : {}),
             ...(o ? { org_id: o.orgId } : {}),
+            ...(orgScope ? { scope: "org" } : {}),
         });
         let st = await startWith(org);
         // An api from before 34.03.4 refuses org_id on a host start with its plain 400 invalid_scope
         // (34.03.2 (1); mnemom-api enroll.ts "org_id is only accepted with scope org"; recorded beside
         // exec_enroll in S1 codes.ts). An org taken from the active org then falls back to the start this
         // CLI made before; an explicit --org cannot.
-        if (org && st.status === 400 && errorCode(st.body) === "invalid_scope") {
+        if (!orgScope && org && st.status === 400 && errorCode(st.body) === "invalid_scope") {
             if (org.from === "flag") {
                 io.err(`mnemom agent host: this Mnemom server cannot enroll a machine into ${org.orgId} yet.`);
                 io.err("fix: `mnemom agent host enroll` without --org (joins your personal org)");
@@ -115,6 +134,21 @@ export async function enrollDevice(io, opts = {}) {
         const start = st.status === 202 || st.status === 200 || st.status === 201
             ? parseEnrollStart(st.body)
             : null;
+        if (!start && orgScope && org) {
+            const code = errorCode(st.body);
+            if (code === CODE.durable_approval_not_eligible) {
+                // 34.03.3: only an owner or admin of the org may enroll an org runner.
+                io.err(`mnemom agent host: only an owner or admin of ${org.orgId} can enroll a machine as its runner.`);
+                io.err(`fix: ask an owner or admin of ${org.orgId} to run \`mnemom agent host enroll --scope org --org ${org.orgId}\` on this machine`);
+                return 1;
+            }
+            if (code === CODE.kind_not_allowed) {
+                // The org is not on the server's pool-claim list, or the server predates host org runners.
+                io.err(`mnemom agent host: this Mnemom server does not accept this machine as a runner for ${org.orgId} (org runners are not turned on for it, or the server does not take host runners yet).`);
+                io.err("fix: `mnemom agent host enroll` without --scope org enrolls it for your own sessions");
+                return 1;
+            }
+        }
         if (!start && org && errorCode(st.body) === CODE.durable_approval_not_eligible) {
             // 34.03.4: only a member of the org may enroll a machine into it.
             io.err(`mnemom agent host: you are not a member of ${org.orgId}, so this machine cannot join it.`);
@@ -173,7 +207,15 @@ export async function enrollDevice(io, opts = {}) {
                 boot_id: io.bootId(),
             });
             if (io.json)
-                io.out(JSON.stringify({ event: "enrolled", executor_id: p.executorId }));
+                io.out(JSON.stringify({
+                    event: "enrolled",
+                    executor_id: p.executorId,
+                    ...(orgScope ? { scope: "org" } : {}),
+                }));
+            else if (orgScope && org) {
+                io.out(`Enrolled this machine as a runner for ${org.orgId} (executor ${p.executorId.slice(0, 8)}).`);
+                io.out(`To claim its pool jobs: \`mnemom agent run --watch\` with MNEMOM_EXECUTOR_KEY set to executor_key in ${paths.stateFile}`);
+            }
             else
                 io.out(`Enrolled this machine (executor ${p.executorId.slice(0, 8)}).`);
             return 0;

package/dist/vendor/durable-contract/index.js

@@ -1664,8 +1664,9 @@ var M1_CLI_SURFACE = Object.freeze([
   entry(["agent", "done"], ["--json"]),
   // BACKBONE C2 (`mnemom agent host` replaces `mnemom host`, amendment 2; design-v3 row 7).
   entry(["agent", "host"]),
-  // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to).
-  entry(["agent", "host", "enroll"], ["--org"]),
+  // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to);
+  // --scope: the any-machine amendment (Wassim 2026-11-09; `--scope org` enrolls an org runner).
+  entry(["agent", "host", "enroll"], ["--org", "--scope"]),
   // BACKBONE C2 install/status/uninstall; --json: C04 (`mnemom agent host install --json`),
   // ruling 32.31.
   entry(["agent", "host", "install"], ["--json"]),
@@ -2379,7 +2380,7 @@ function poolClaimOrgs(flagValue) {
   return [...new Set(orgs)];
 }
 var EXECUTOR_SCOPES = ["user", "org"];
-var ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet"];
+var ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet", "host"];
 var OIDC_EXCHANGE_REFUSALS = [
   "bad_issuer",
   "repo_not_enrolled",

package/dist/vendor/shared/durable-contract/cli-surface.js

@@ -36,8 +36,9 @@ export const M1_CLI_SURFACE = Object.freeze([
     entry(["agent", "done"], ["--json"]),
     // BACKBONE C2 (`mnemom agent host` replaces `mnemom host`, amendment 2; design-v3 row 7).
     entry(["agent", "host"]),
-    // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to).
-    entry(["agent", "host", "enroll"], ["--org"]),
+    // BACKBONE C2 enroll (device step); --org: ruling 34.03.4 (a host joins an org its user belongs to);
+    // --scope: the any-machine amendment (Wassim 2026-11-09; `--scope org` enrolls an org runner).
+    entry(["agent", "host", "enroll"], ["--org", "--scope"]),
     // BACKBONE C2 install/status/uninstall; --json: C04 (`mnemom agent host install --json`),
     // ruling 32.31.
     entry(["agent", "host", "install"], ["--json"]),

package/dist/vendor/shared/durable-contract/doors.d.ts

@@ -31,8 +31,13 @@ export declare function isPoolSession(s: PoolSessionFacts, flagValue: string | u
 export declare function poolClaimOrgs(flagValue: string | undefined): string[];
 export declare const EXECUTOR_SCOPES: readonly ["user", "org"];
 export type ExecutorScope = (typeof EXECUTOR_SCOPES)[number];
-/** Only these executor kinds may enroll with scope org. */
-export declare const ORG_SCOPE_EXECUTOR_KINDS: readonly ["container", "fleet"];
+/**
+ * Only these executor kinds may enroll with scope org. The any-machine amendment (Wassim, 2026-11-09):
+ * any enrolled machine may be an org runner, so `host` (a Mac mini, laptop or VM) joins container and
+ * fleet, appended. The guard is the org owner or admin's aal2 device-step approval at enrollment
+ * and the org's DURABLE_POOL_CLAIM entry, not the machine kind.
+ */
+export declare const ORG_SCOPE_EXECUTOR_KINDS: readonly ["container", "fleet", "host"];
 /**
  * exec_oidc_exchange refusals (ruling 34.03's S1 changes), each 403, checked in this order.
  * Amendment 65 (mnemom-test#1331) appends the two single-use codes, checked in the same transaction

package/dist/vendor/shared/durable-contract/doors.js

@@ -43,8 +43,13 @@ export function poolClaimOrgs(flagValue) {
 }
 // ---- Executor scope (ruling 34.03 (1)) ------------------------------------------------------
 export const EXECUTOR_SCOPES = ["user", "org"];
-/** Only these executor kinds may enroll with scope org. */
-export const ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet"];
+/**
+ * Only these executor kinds may enroll with scope org. The any-machine amendment (Wassim, 2026-11-09):
+ * any enrolled machine may be an org runner, so `host` (a Mac mini, laptop or VM) joins container and
+ * fleet, appended. The guard is the org owner or admin's aal2 device-step approval at enrollment
+ * and the org's DURABLE_POOL_CLAIM entry, not the machine kind.
+ */
+export const ORG_SCOPE_EXECUTOR_KINDS = ["container", "fleet", "host"];
 /**
  * exec_oidc_exchange refusals (ruling 34.03's S1 changes), each 403, checked in this order.
  * Amendment 65 (mnemom-test#1331) appends the two single-use codes, checked in the same transaction

package/dist/vendor/shared/durable-contract/freeze-record.d.ts

@@ -750,7 +750,7 @@ export declare const FREEZE_STRUCTURED: Readonly<{
     }>;
     CLEAR_WAIT_OUTCOMES: readonly ["cleared", "stale_ref", "already_clear"];
     EXECUTOR_SCOPES: readonly ["user", "org"];
-    ORG_SCOPE_EXECUTOR_KINDS: readonly ["container", "fleet"];
+    ORG_SCOPE_EXECUTOR_KINDS: readonly ["container", "fleet", "host"];
     OIDC_EXCHANGE_REFUSALS: readonly ["bad_issuer", "repo_not_enrolled", "ref_not_allowed", "pool_flag_off", "adopt_ticket_invalid", "token_replayed", "run_already_exchanged"];
     OIDC_EXCHANGE_BODY_KEYS: readonly ["oidc_token", "adopt_ticket"];
     OIDC_EXCHANGE_RUN_CLAIMS: readonly ["jti", "run_id", "run_attempt"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.39-next.2",
+  "version": "0.17.39-next.3",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {