@mnemom/mnemom 0.17.7-next.2 → 0.17.8-next.0

package/dist/commands/agent-doctor.d.ts

@@ -2,13 +2,11 @@
  * `mnemom agent doctor` — a read-only preflight for `mnemom agent`. It checks the
  * things a governed launch needs and prints a checklist with clear, actionable
  * remediation, so a customer can see at a glance why a launch would fail before
- * it does. Writes nothing and prints no secret VALUE (the Mnemom key is sent to the
- * Mnemom API to check it, exactly as a launch does). Exits non-zero when the machine is
- * not launch-ready (no coding agent CLI, or no Anthropic key), so it can gate a script.
+ * it does. Writes nothing and reads no secret VALUE (only whether a key is
+ * resolvable). Exits non-zero when the machine is not launch-ready (no coding
+ * agent CLI, or no Anthropic key), so it can gate a script.
  *
- * Checks: settings file, coding-agent CLI, Anthropic key source, Mnemom API key source and
- * whether it is still active (every launch sends one; none yet is informational — the launch
- * mints it; a saved key proven dead is a warning — the launch re-mints it), gateway health
+ * Checks: settings file, coding-agent CLI, Anthropic key source, gateway health
  * (200 + the x-mnemom-verdict header that proves the governance pipeline is
  * live), Remote-Control capability (node + openssl + the --remote-control flag),
  * claude.ai login (informational — Remote Control needs it), and CLI auto-update status.
@@ -19,21 +17,6 @@ export interface DoctorOptions {
 }
 /** Run the preflight and print the checklist. Sets process.exitCode on failure. */
 export declare function agentDoctorCommand(options?: DoctorOptions): Promise<void>;
-/**
- * The Mnemom API key row: where the key a launch would send comes from, and whether it passes
- * the launch's own one-time check (commands/agent.ts verifyLocalMnemomKey). A key counts as dead
- * only when proven (lib/subscription-login.ts checkMnemomKey), so only a saved key this CLI
- * minted can be:
- *   valid                 → ok
- *   saved key, invalid    → warn (the next launch mints a new one and revokes the old)
- *   anything else         → info (not verified: a launch sends it as is)
- *   none                  → info (the next launch mints one for the launch's org)
- */
-export declare function mnemomKeyRow(): Promise<{
-    mark: Mark;
-    text: string;
-    hint?: string;
-}>;
 export interface CodeAccessProbe {
     mark: Mark;
     text: string;

package/dist/commands/agent-doctor.js

@@ -2,20 +2,18 @@
  * `mnemom agent doctor` — a read-only preflight for `mnemom agent`. It checks the
  * things a governed launch needs and prints a checklist with clear, actionable
  * remediation, so a customer can see at a glance why a launch would fail before
- * it does. Writes nothing and prints no secret VALUE (the Mnemom key is sent to the
- * Mnemom API to check it, exactly as a launch does). Exits non-zero when the machine is
- * not launch-ready (no coding agent CLI, or no Anthropic key), so it can gate a script.
+ * it does. Writes nothing and reads no secret VALUE (only whether a key is
+ * resolvable). Exits non-zero when the machine is not launch-ready (no coding
+ * agent CLI, or no Anthropic key), so it can gate a script.
  *
- * Checks: settings file, coding-agent CLI, Anthropic key source, Mnemom API key source and
- * whether it is still active (every launch sends one; none yet is informational — the launch
- * mints it; a saved key proven dead is a warning — the launch re-mints it), gateway health
+ * Checks: settings file, coding-agent CLI, Anthropic key source, gateway health
  * (200 + the x-mnemom-verdict header that proves the governance pipeline is
  * live), Remote-Control capability (node + openssl + the --remote-control flag),
  * claude.ai login (informational — Remote Control needs it), and CLI auto-update status.
  */
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { anthropicKeySource, checkRcCapability, defaultConsoleKeyDeps, localLaunchMnemomKey, verifyLocalMnemomKey, resolveCliBin, } from "./agent.js";
+import { anthropicKeySource, checkRcCapability, defaultConsoleKeyDeps, resolveCliBin, } from "./agent.js";
 import { readConsoleKey } from "../lib/console-key.js";
 import { resolveAgentAuth } from "../lib/subscription-login.js";
 import { isProdGateway, resolveAnthropicDoor, resolveGatewayHost, singleCellError, } from "../lib/agent.js";
@@ -75,9 +73,6 @@ export async function agentDoctorCommand(options = {}) {
         else
             add("miss", "Anthropic key: none found", "export MNEMOM_AGENT_ANTHROPIC_KEY=sk-ant-… (or ANTHROPIC_API_KEY), or run `mnemom agent` once and accept the save prompt");
     }
-    // ── Mnemom API key: every launch sends one, whatever the auth mode ──
-    const keyRow = await mnemomKeyRow();
-    add(keyRow.mark, keyRow.text, keyRow.hint);
     // ── one cell: the launch door must be the CLI's own cell ──
     const cellError = singleCellError({
         door: resolveAnthropicDoor(env),
@@ -181,47 +176,6 @@ function claudeLoggedIn(bin) {
         return null;
     }
 }
-const MNEMOM_KEY_MINT_HINT = "minting needs a signed-in session (`mnemom login`) and an org role that may mint a gateway key (owner, admin or member); or ask an org owner/admin for an org API key with the `gateway` scope and set MNEMOM_AGENT_MNEMOM_KEY";
-/**
- * The Mnemom API key row: where the key a launch would send comes from, and whether it passes
- * the launch's own one-time check (commands/agent.ts verifyLocalMnemomKey). A key counts as dead
- * only when proven (lib/subscription-login.ts checkMnemomKey), so only a saved key this CLI
- * minted can be:
- *   valid                 → ok
- *   saved key, invalid    → warn (the next launch mints a new one and revokes the old)
- *   anything else         → info (not verified: a launch sends it as is)
- *   none                  → info (the next launch mints one for the launch's org)
- */
-export async function mnemomKeyRow() {
-    const local = localLaunchMnemomKey();
-    const org = getActiveOrg();
-    const orgLabel = org ? `org ${org.slug}` : "no active org";
-    if (!local) {
-        return {
-            mark: "info",
-            text: `Mnemom API key: none yet for ${orgLabel} — the next launch mints a gateway-only org key and saves it`,
-            hint: MNEMOM_KEY_MINT_HINT,
-        };
-    }
-    const where = local.source === "env"
-        ? "MNEMOM_AGENT_MNEMOM_KEY (environment)"
-        : `~/.mnemom/launcher.json (saved for ${orgLabel})`;
-    const verdict = await verifyLocalMnemomKey(local);
-    if (verdict === "valid")
-        return { mark: "ok", text: `Mnemom API key: ${where} — verified` };
-    if (verdict === "invalid" && local.source === "store") {
-        return {
-            mark: "warn",
-            text: `Mnemom API key: the key saved for ${orgLabel} is no longer active (revoked or rotated) — the next launch mints a new one`,
-            hint: MNEMOM_KEY_MINT_HINT,
-        };
-    }
-    return {
-        mark: "info",
-        text: `Mnemom API key: ${where} — not verified (API unreachable, not signed in, or a gateway-only key the API cannot look up); a launch sends it as is`,
-        hint: "sign in (`mnemom login`) so the doctor and each launch can check a saved key; the gateway refuses a dead key with a clear message",
-    };
-}
 /**
  * The invited-cohort gate, as the doctor reports it. Signed out → info (we can't
  * check without a session); enabled → ok with the reason; a determined

package/dist/commands/agent-goal.d.ts

@@ -31,7 +31,7 @@ export interface GoalCommandDeps {
 }
 /**
  * The Anthropic key the launch would resolve (env, then ~/.mnemom/launcher.json), never prompted
- * for, plus the Mnemom key the launch sent (null when this machine has none). Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
+ * for. Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
  */
 export declare function resolveLaunchCreds(): Promise<GoalControlCreds>;
 export declare const liveGoalDeps: GoalCommandDeps;

package/dist/commands/agent-goal.js

@@ -24,20 +24,17 @@ import { askYesNo, isInteractive } from "../lib/prompt.js";
 import { localGoalFlag, resolveSessionRef } from "./agent-sessions.js";
 /**
  * The Anthropic key the launch would resolve (env, then ~/.mnemom/launcher.json), never prompted
- * for, plus the Mnemom key the launch sent (null when this machine has none). Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
+ * for. Lazy import: commands/agent.ts is the launcher and carries a heavy import graph.
  */
 export async function resolveLaunchCreds() {
-    const agentMod = await import("./agent.js");
-    let anthropicKey;
+    const { resolveAnthropicKey } = await import("./agent.js");
     try {
-        anthropicKey = await agentMod.resolveAnthropicKey(process.env, { allowPrompt: false });
+        return { anthropicKey: await resolveAnthropicKey(process.env, { allowPrompt: false }) };
     }
     catch {
         throw new Error("no Anthropic key in env (MNEMOM_AGENT_ANTHROPIC_KEY / ANTHROPIC_API_KEY) or ~/.mnemom/launcher.json — " +
             "the goal commands authenticate with the same key the session launched with");
     }
-    // The Mnemom key the launch sent too (env, then the store — never minted here).
-    return { anthropicKey, mnemomKey: agentMod.localLaunchMnemomKey()?.key ?? null };
 }
 export const liveGoalDeps = {
     readRecords: () => readSessionRecords({ dir: MNEMOM_DIR }).reverse(),

package/dist/commands/agent-setup.d.ts

@@ -68,15 +68,6 @@ export interface EnsureAgentOptions {
     slug: string;
     /** The customer's Anthropic key (for the birth call + hash-proof). Never logged. */
     anthropicKey: string;
-    /**
-     * The launch's Mnemom API key, sent on the gateway probe/birth call (x-mnemom-api-key, with a
-     * no-op x-mnemom-session-config — see birthThroughGateway). That makes the call Mnemom agent
-     * traffic: the gateway verifies the key and births a new agent in the key's org — the active
-     * org, else the personal org, i.e. the launch org the key was minted for. The claim below
-     * records the claim in that same org, which the gateway's agent-traffic org check requires of
-     * every governed turn. Never logged.
-     */
-    mnemomKey?: string;
     /** undefined = auto, true = force (--setup), false handled by the caller (skip). */
     setup?: boolean;
     /** Gateway host the launch targets (birth goes to the same cell). */
@@ -166,13 +157,11 @@ export declare function ensureSessionAndBalance(opts: {
 }>;
 /**
  * The account for a launch an orchestrator already preflighted
- * (`MNEMOM_AGENT_PREFLIGHTED=1`, see launchPreflighted): no session prompt and no
- * µ-balance read. The launch org resolves exactly as on a normal launch — the
- * active org, else the caller's personal org — because the launch's Mnemom key is
- * minted for it and the agent is claimed into it (the gateway requires the agent's
- * org to be the key's org). The entitlement is still fetched for that org — it is
- * the access gate and decides Remote Control fail-closed, which a caller's
- * preflight can't vouch for.
+ * (`MNEMOM_AGENT_PREFLIGHTED=1`, see launchPreflighted): no session prompt, no
+ * personal-org lookup, no µ-balance read. The entitlement is still fetched — it
+ * is the access gate and decides Remote Control fail-closed, which a caller's
+ * preflight can't vouch for. With no active org the api resolves the caller's
+ * primary org, and the ledger records the org id the entitlement names.
  */
 export declare function resolvePreflightedAccount(): Promise<{
     orgId: string;

package/dist/commands/agent-setup.js

@@ -34,8 +34,7 @@ import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/l
 import { readServedAgent, servedFingerprint, writeServedAgent } from "../lib/served-agent-cache.js";
 import { deriveHashProof } from "./agents.js";
 import { birthThroughGateway } from "./wrap.js";
-import { defaultMnemomKeyDeps, resolveAnthropicKey } from "./agent.js";
-import { resolveLaunchMnemomKey } from "../lib/subscription-login.js";
+import { resolveAnthropicKey } from "./agent.js";
 import { assertCodeEnabled, CodeNotEnabledError } from "./agent-invite.js";
 const say = (line = "") => console.error(line);
 /**
@@ -146,7 +145,6 @@ export async function ensureGovernedAgent(opts) {
                     cached ??
                         (await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey, {
                             timeoutMs: opts.setup === true ? undefined : SERVED_PROBE_TIMEOUT_MS,
-                            mnemomKey: opts.mnemomKey,
                         }));
             }
             catch (err) {
@@ -208,9 +206,7 @@ export async function ensureGovernedAgent(opts) {
     }
     // 5. Birth → claim → publish observe-only cards. (Key never logged.)
     const gatewayUrl = opts.gatewayHost.replace(/\/+$/, "");
-    const agentId = await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey, {
-        mnemomKey: opts.mnemomKey,
-    });
+    const agentId = await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey);
     const hashProof = deriveHashProof(opts.anthropicKey, slug);
     await claimAgent(agentId, { hashProof, orgId: org?.org_id });
     say(fmt.success(`mnemom agent: claimed '${slug}' (${agentId}) in ${orgLabel}.`));
@@ -326,9 +322,8 @@ export async function agentSetupCommand(opts = {}) {
     if (cellError)
         throw new Error(cellError.replace("mnemom agent:", "mnemom agent setup:"));
     // Sign in (offer sign-up) and enforce the MU balance before any account write.
-    let launchOrgId;
     try {
-        launchOrgId = (await ensureSessionAndBalance({})).orgId;
+        await ensureSessionAndBalance({});
     }
     catch (err) {
         if (isQuietPreambleExit(err))
@@ -343,16 +338,7 @@ export async function agentSetupCommand(opts = {}) {
         : await resolveDefaultSlug({ strict: true });
     if (!slug)
         throw new Error("mnemom agent setup: agent slug sanitised to empty — pass --agent <slug>.");
-    // The birth call carries the same Mnemom key every launch sends, minted for the org the agent
-    // is claimed into (see EnsureAgentOptions.mnemomKey).
-    const mnemomKey = await resolveLaunchMnemomKey(defaultMnemomKeyDeps(undefined, launchOrgId));
-    const result = await ensureGovernedAgent({
-        slug,
-        anthropicKey,
-        mnemomKey,
-        setup: true,
-        gatewayHost,
-    });
+    const result = await ensureGovernedAgent({ slug, anthropicKey, setup: true, gatewayHost });
     if (!result.provisioned) {
         say(fmt.dim(`  '${slug}' is ready (already claimed) or setup was skipped.`));
     }
@@ -522,20 +508,17 @@ export async function ensureSessionAndBalance(opts) {
 }
 /**
  * The account for a launch an orchestrator already preflighted
- * (`MNEMOM_AGENT_PREFLIGHTED=1`, see launchPreflighted): no session prompt and no
- * µ-balance read. The launch org resolves exactly as on a normal launch — the
- * active org, else the caller's personal org — because the launch's Mnemom key is
- * minted for it and the agent is claimed into it (the gateway requires the agent's
- * org to be the key's org). The entitlement is still fetched for that org — it is
- * the access gate and decides Remote Control fail-closed, which a caller's
- * preflight can't vouch for.
+ * (`MNEMOM_AGENT_PREFLIGHTED=1`, see launchPreflighted): no session prompt, no
+ * personal-org lookup, no µ-balance read. The entitlement is still fetched — it
+ * is the access gate and decides Remote Control fail-closed, which a caller's
+ * preflight can't vouch for. With no active org the api resolves the caller's
+ * primary org, and the ledger records the org id the entitlement names.
  */
 export async function resolvePreflightedAccount() {
     const active = getActiveOrg();
-    const orgId = active?.org_id ?? (await getMyPersonalOrg()).org_id;
-    const orgLabel = active ? `${active.name} (${active.slug})` : "your personal org";
-    const entitlement = await assertCodeEnabled(orgId, orgLabel);
-    return { orgId, orgLabel, entitlement };
+    const orgLabel = active ? `${active.name} (${active.slug})` : "your primary org";
+    const entitlement = await assertCodeEnabled(active?.org_id ?? "", orgLabel);
+    return { orgId: active?.org_id ?? entitlement?.org_id ?? "", orgLabel, entitlement };
 }
 // ── The default coding posture (cards observe-only; goal contracts nudge) ────
 function buildCodeAlignmentCard(agentId) {

package/dist/commands/agent.d.ts

@@ -25,7 +25,7 @@
  * line, or the proxy's stdin under RC). It is never logged, printed, or passed as
  * an argv value.
  */
-import { type LocalMnemomKey, type MnemomKeyCheck, type MnemomKeyDeps, type StoredMnemomKey } from "../lib/subscription-login.js";
+import { type MnemomKeyDeps } from "../lib/subscription-login.js";
 import { type SessionRecord } from "../lib/agent-ledger.js";
 import { type ExperimentalId } from "../lib/experimental.js";
 import { type ConsoleKeyDeps } from "../lib/console-key.js";
@@ -201,30 +201,8 @@ export declare function recordSessionLaunch(ctx: {
     /** The resolved compaction target this launch runs under (`resolveCompactAt`). */
     compactAt: number | null;
 }): Promise<void>;
-/** Per-call timeout of the launch's Mnemom-key check: a slow API must not hold up a launch. */
-export declare const MNEMOM_KEY_CHECK_TIMEOUT_MS = 2500;
-/**
- * Mint the launch's key: an ORG-owned key for `orgId` (the launch's org) with scopes exactly
- * ["gateway"], which any owner/admin/member may mint — so the gateway's agent-traffic org check
- * (agent org = key org) passes for the agent the launcher claims into that org. Never a personal
- * key: it has no org, and the gateway would refuse every governed turn with it. A refusal (403:
- * an API that predates member org keys, or a viewer/auditor role) is thrown as is; the launch
- * stops with guidance (lib/subscription-login.ts mintAndStore).
- */
-export declare function mintLaunchMnemomKey(orgId: string): Promise<StoredMnemomKey>;
-/**
- * The real I/O behind every launch's Mnemom key (lib/subscription-login.ts). `launchOrgId` is
- * the org the launch runs in (ensureSessionAndBalance's `orgId`: the active org, else the
- * caller's personal org); omitted or empty, it is the active org.
- */
-export declare function defaultMnemomKeyDeps(storePath?: string, launchOrgId?: string | null): MnemomKeyDeps;
-/**
- * The Mnemom key already on this machine (MNEMOM_AGENT_MNEMOM_KEY, then ~/.mnemom/launcher.json),
- * never minted: `mnemom agent doctor` reports its source, the goal commands send it.
- */
-export declare function localLaunchMnemomKey(storePath?: string): LocalMnemomKey | null;
-/** The launch's one-time check of that key (`mnemom agent doctor` reports it). Never throws. */
-export declare function verifyLocalMnemomKey(local: LocalMnemomKey): Promise<MnemomKeyCheck>;
+/** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
+export declare function defaultMnemomKeyDeps(storePath?: string): MnemomKeyDeps;
 /** The real machine behind lib/console-key.ts: the macOS keychain via `security`, no shell. */
 export declare function defaultConsoleKeyDeps(env: NodeJS.ProcessEnv): ConsoleKeyDeps;
 /**

package/dist/commands/agent.js

@@ -33,10 +33,10 @@ import { basename, join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { statuslineLaunch } from "../lib/statusline.js";
 import { getApiUrl, getGatewayUrl, MNEMOM_DIR } from "../lib/config.js";
-import { apiAcceptsMnemomKey, createOrgApiKey, getAgentByName, listOwnApiKeysForCheck, revokeApiKey, } from "../lib/api.js";
-import { checkMnemomKey, MNEMOM_KEY_ENV, readLocalMnemomKey, readStoredMnemomKey, resolveAgentAuth, resolveLaunchMnemomKey, storePatchForMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
+import { createApiKey, getAgentByName } from "../lib/api.js";
+import { MNEMOM_KEY_STORE_FIELD, resolveAgentAuth, resolveSubscriptionMnemomKey, subscriptionChildEnv, subscriptionShape, } from "../lib/subscription-login.js";
 import { LEDGER_FILE, appendSessionRecord, findResumeCandidate, readSessionRecords, resolveRetentionDays, resumedContextProfile, toLedgerContract, } from "../lib/agent-ledger.js";
-import { getActiveOrg, loadCliConfig } from "../lib/cli-config.js";
+import { loadCliConfig } from "../lib/cli-config.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
 import { experimentalNotice } from "../lib/experimental.js";
 import { fmt } from "../lib/format.js";
@@ -45,8 +45,8 @@ import { authConfigured, chooseAuth, detectClaudeLogin, readClaudeLoginState, }
 import { requireConsoleKey, readConsoleKey } from "../lib/console-key.js";
 import { goalAlignmentLine, resolveSessionSetup } from "./agent-session.js";
 import { AgentIdentityMismatchError, defaultAgentSlug, ensureGovernedAgent, ensureSessionAndBalance, isQuietPreambleExit, resolveDefaultSlug, resolvePreflightedAccount, } from "./agent-setup.js";
-import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfig, buildSessionConfigB64, assertCompactAtCompatible, assertOffProfileCompatible, compactAtWindowWarning, describeCompactAt, launchWindow, resolveCompactAt, applyGatewayHintHeaders, resolveCompactionIntercept, resolveContextHandoff, resolveContextProfile, resolveHandoffGatewayHost, HANDOFF_RC_KEY_ENV_NAME, HANDOFF_RC_MNEMOM_KEY_ENV_NAME, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, applyToolSearchDefault, DISABLE_1M_ENV, readCcSettings, resolveWindowModel, resolveAnthropicDoor, resolveLaunchModel, resolveConversationId, resolveGatewayHost, singleCellError, resolveLaunchShape, resolveRemoteControlShape, passthroughName, sanitizeAgentName, sessionDisplayName, SESSION_NAME_ENV, SESSION_CONFIG_HEADER, } from "../lib/agent.js";
-import { LAUNCHER_STORE_PATH, mergeStore, readStore } from "../lib/launcher-store.js";
+import { assembleContract, buildGoalModeHeader, buildCustomHeaders, buildHandoffMcpConfigJson, buildSessionConfig, buildSessionConfigB64, assertCompactAtCompatible, assertOffProfileCompatible, compactAtWindowWarning, describeCompactAt, launchWindow, resolveCompactAt, applyGatewayHintHeaders, resolveCompactionIntercept, resolveContextHandoff, resolveContextProfile, resolveHandoffGatewayHost, HANDOFF_RC_KEY_ENV_NAME, isProdGateway, launchPreferenceExplicit, launchPreflighted, remoteControlAllowed, applyToolSearchDefault, DISABLE_1M_ENV, readCcSettings, resolveWindowModel, resolveAnthropicDoor, resolveLaunchModel, resolveConversationId, resolveGatewayHost, singleCellError, resolveLaunchShape, resolveRemoteControlShape, passthroughName, sanitizeAgentName, sessionDisplayName, SESSION_NAME_ENV, SESSION_CONFIG_HEADER, } from "../lib/agent.js";
+import { LAUNCHER_STORE_PATH, mergeStore } from "../lib/launcher-store.js";
 import { slackChannelArgs } from "../lib/slack-launch.js";
 /** The CLI's own provider-key store (zero 1Password): ~/.mnemom/launcher.json, 0600. */
 const CODE_STORE = LAUNCHER_STORE_PATH;
@@ -328,9 +328,8 @@ export async function agentCommand(scenarioArg, options = {}) {
     // lives in (default: the user's personal org). No µ ⇒ blocked with a
     // portal-style top-up message. Skipped only on --dry-run (handled above).
     // MNEMOM_AGENT_PREFLIGHTED=1 (orchestrators such as the ADW fleet that already
-    // ran their own session + balance preflight) skips those round trips; the launch
-    // org resolves the same way and its entitlement is still fetched — see
-    // resolvePreflightedAccount.
+    // ran their own session + balance preflight) skips those round trips; the
+    // entitlement is still fetched — see resolvePreflightedAccount.
     let account;
     try {
         account = launchPreflighted(env)
@@ -370,19 +369,14 @@ export async function agentCommand(scenarioArg, options = {}) {
         rcCapable: rc.ok,
         say,
     });
-    // Subscription login: Remote Control only for RC-entitled (internal) accounts.
+    // Subscription login: Remote Control only for RC-entitled (internal) accounts, and the governed identity anchors on a
+    // Mnemom API key (minted once and stored if there is none). Resolved after sign-in so
+    // minting can use the session.
+    let mnemomKey;
     if (auth === "subscription") {
         shape = subscriptionShape(shape, shapeExplicit, rcAllowed, say);
+        mnemomKey = await resolveSubscriptionMnemomKey(defaultMnemomKeyDeps());
     }
-    // Every launch — api-key, console and subscription, every shape — sends a Mnemom API key
-    // (x-mnemom-api-key): the gateway refuses `mnemom agent` traffic without a verified one.
-    // Resolved after sign-in so minting and the one-time liveness check can use the session: the
-    // key stored for the active org, checked once (a revoked/rotated one is re-minted), else a
-    // fresh key minted for the launch's org (account.orgId: the active org, else the personal
-    // org — the org the agent is claimed into, which the gateway's org check requires of the key)
-    // and stored. No key ⇒ this throws and the launch does not start (a session the gateway
-    // would refuse is worse than an actionable error).
-    const mnemomKey = await resolveLaunchMnemomKey(defaultMnemomKeyDeps(CODE_STORE, account.orgId));
     // Now that a session exists, a defaulted slug uses the real login handle from
     // /v1/auth/me (the stored token has no email, so the pre-sign-in value was the
     // "agent-user" fallback). Only when the caller didn't name an agent. Under an
@@ -413,7 +407,6 @@ export async function agentCommand(scenarioArg, options = {}) {
             const ensured = await ensureGovernedAgent({
                 slug: agent,
                 anthropicKey,
-                mnemomKey,
                 setup: options.setup,
                 gatewayHost,
             });
@@ -543,22 +536,15 @@ export async function agentCommand(scenarioArg, options = {}) {
             // back out at request time. Remote Control (both shapes) strips every ANTHROPIC_* auth
             // var from the child's env, so `spawnRcCli` below instead sets a dedicated, non-ANTHROPIC
             // var (HANDOFF_RC_KEY_ENV_NAME) on that same child env — still nothing in this file.
-            // The Mnemom key the gateway requires rides the same way: its `x-mnemom-api-key:` line
-            // in ANTHROPIC_CUSTOM_HEADERS (terminal), or HANDOFF_RC_MNEMOM_KEY_ENV_NAME (RC).
-            const terminal = shape === "terminal";
-            const anthropicKeySource = terminal
+            const anthropicKeySource = shape === "terminal"
                 ? { envName: "ANTHROPIC_CUSTOM_HEADERS" }
                 : { envName: HANDOFF_RC_KEY_ENV_NAME };
-            const mnemomKeySource = terminal
-                ? { envName: "ANTHROPIC_CUSTOM_HEADERS" }
-                : { envName: HANDOFF_RC_MNEMOM_KEY_ENV_NAME };
             handoffMcpConfigPath = writeHandoffMcpConfigFile(buildHandoffMcpConfigJson({
                 // The SAME origin the session's own model traffic goes to — not resolveGatewayHost,
                 // which would ignore a MNEMOM_AGENT_ANTHROPIC_GATEWAY override (a test-cell launch
                 // must never send its handoff calls to prod, or vice versa).
                 gatewayHost: resolveHandoffGatewayHost(door),
                 anthropicKeySource,
-                mnemomKeySource,
                 agent,
                 conversationId,
                 sessionConfigB64,
@@ -778,55 +764,25 @@ export async function recordSessionLaunch(ctx) {
 // ───────────────────────────────────────────────────────────────────────────
 // Credential resolution (zero 1Password)
 // ───────────────────────────────────────────────────────────────────────────
-/** Per-call timeout of the launch's Mnemom-key check: a slow API must not hold up a launch. */
-export const MNEMOM_KEY_CHECK_TIMEOUT_MS = 2500;
-/**
- * Mint the launch's key: an ORG-owned key for `orgId` (the launch's org) with scopes exactly
- * ["gateway"], which any owner/admin/member may mint — so the gateway's agent-traffic org check
- * (agent org = key org) passes for the agent the launcher claims into that org. Never a personal
- * key: it has no org, and the gateway would refuse every governed turn with it. A refusal (403:
- * an API that predates member org keys, or a viewer/auditor role) is thrown as is; the launch
- * stops with guidance (lib/subscription-login.ts mintAndStore).
- */
-export async function mintLaunchMnemomKey(orgId) {
-    const k = await createOrgApiKey(orgId, `mnemom-agent ${hostname()}`, ["gateway"]);
-    return { key: k.key, keyId: k.key_id };
-}
-/**
- * The real I/O behind every launch's Mnemom key (lib/subscription-login.ts). `launchOrgId` is
- * the org the launch runs in (ensureSessionAndBalance's `orgId`: the active org, else the
- * caller's personal org); omitted or empty, it is the active org.
- */
-export function defaultMnemomKeyDeps(storePath = CODE_STORE, launchOrgId) {
-    const activeOrgId = getActiveOrg()?.org_id || null;
+/** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
+export function defaultMnemomKeyDeps(storePath = CODE_STORE) {
     return {
         env: process.env,
-        activeOrgId,
-        launchOrgId: launchOrgId || activeOrgId,
-        readStored: (orgId) => readStoredMnemomKey(readStore(storePath), orgId),
-        mint: mintLaunchMnemomKey,
-        store: (orgId, key) => mergeStore(storePatchForMnemomKey(readStore(storePath), orgId, key), storePath),
-        check: (key, keyId) => checkMnemomKey(key, keyId, {
-            apiAccepts: (k) => apiAcceptsMnemomKey(k, MNEMOM_KEY_CHECK_TIMEOUT_MS),
-            listOwnKeys: () => listOwnApiKeysForCheck(MNEMOM_KEY_CHECK_TIMEOUT_MS),
-        }),
-        // DELETE /v1/api-keys/:key_id revokes only keys the signed-in user created (org keys
-        // included), so a replaced key minted by someone else is never touched.
-        revoke: (keyId) => revokeApiKey(keyId, { timeoutMs: MNEMOM_KEY_CHECK_TIMEOUT_MS }),
+        readStored: () => {
+            try {
+                const data = JSON.parse(readFileSync(storePath, "utf8"));
+                const v = data[MNEMOM_KEY_STORE_FIELD];
+                return typeof v === "string" ? stripCrlf(v) : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        mint: async () => (await createApiKey(`mnemom-agent ${hostname()}`, ["gateway"])).key,
+        store: (key) => mergeStore({ [MNEMOM_KEY_STORE_FIELD]: key }, storePath),
         say,
     };
 }
-/**
- * The Mnemom key already on this machine (MNEMOM_AGENT_MNEMOM_KEY, then ~/.mnemom/launcher.json),
- * never minted: `mnemom agent doctor` reports its source, the goal commands send it.
- */
-export function localLaunchMnemomKey(storePath = CODE_STORE) {
-    return readLocalMnemomKey(defaultMnemomKeyDeps(storePath));
-}
-/** The launch's one-time check of that key (`mnemom agent doctor` reports it). Never throws. */
-export function verifyLocalMnemomKey(local) {
-    return defaultMnemomKeyDeps().check(local.key, local.keyId);
-}
 /** The real machine behind lib/console-key.ts: the macOS keychain via `security`, no shell. */
 export function defaultConsoleKeyDeps(env) {
     return {
@@ -1102,8 +1058,6 @@ function launchTerminal(ctx) {
     if (ctx.anthropicKey) {
         childEnv = { ...process.env };
         delete childEnv.ANTHROPIC_API_KEY;
-        // The Mnemom key already rides in the headers; the child has no other use for it.
-        Reflect.deleteProperty(childEnv, MNEMOM_KEY_ENV);
         childEnv.ANTHROPIC_BASE_URL = ctx.door;
         childEnv.ANTHROPIC_AUTH_TOKEN = "mnemom-gateway";
         childEnv.ANTHROPIC_CUSTOM_HEADERS = headers;
@@ -1288,10 +1242,9 @@ function launchRemoteControl(ctx) {
         }
     };
     process.on("exit", onExit);
-    // Secrets on stdin — three lines (anthropic, mnemom, openai). Every launch sends the Mnemom
-    // key (the proxy adds it as x-mnemom-api-key on every gateway request); an api-key launch
-    // also sends the Anthropic key, a subscription launch leaves that line empty (the user's
-    // OAuth bearer is what pays). openai is always empty on this Anthropic-only door.
+    // Secrets on stdin — three lines (anthropic, mnemom, openai). An api-key launch sends the
+    // Anthropic key only; a subscription launch sends the Mnemom key only (the identity anchor —
+    // the user's OAuth bearer is what pays). openai is always empty on this Anthropic-only door.
     // A proxy that exits before reading them turns this write into an EPIPE; that is
     // not a failure of its own — the exited-before-READY check below refuses the
     // launch. Any other stdin error fails closed like a spawn error.
@@ -1302,7 +1255,7 @@ function launchRemoteControl(ctx) {
         onExit();
         process.exit(1);
     });
-    proxy.stdin?.end(`${ctx.anthropicKey ?? ""}\n${ctx.mnemomKey}\n\n`);
+    proxy.stdin?.end(`${ctx.anthropicKey ?? ""}\n${ctx.anthropicKey ? "" : (ctx.mnemomKey ?? "")}\n\n`);
     let stdoutBuf = "";
     const start = Date.now();
     const tryStart = () => {
@@ -1370,9 +1323,6 @@ function spawnRcCli(ctx) {
         "no_proxy",
         "HTTP_PROXY",
         "http_proxy",
-        // The Mnemom key rides to the gateway via the proxy (stdin) and, with handoff on, in
-        // HANDOFF_RC_MNEMOM_KEY_ENV_NAME below; the CLI itself has no use for the launch's env var.
-        MNEMOM_KEY_ENV,
     ]);
     const childEnv = {};
     for (const [k, v] of Object.entries(process.env)) {
@@ -1400,10 +1350,8 @@ function spawnRcCli(ctx) {
     // ride through here ungated), so this rides through untouched. Only set when the tool is
     // actually registered — never on a plain RC launch.
     // (Never on a subscription launch — handoff is turned off there, so there is no key to set.)
-    // The Mnemom key the gateway requires rides beside it in its own non-ANTHROPIC var.
     if (ctx.handoffMcpConfigPath && ctx.anthropicKey) {
         childEnv[HANDOFF_RC_KEY_ENV_NAME] = ctx.anthropicKey;
-        childEnv[HANDOFF_RC_MNEMOM_KEY_ENV_NAME] = ctx.mnemomKey;
     }
     let args;
     if (ctx.shape === "server") {

package/dist/commands/wrap.d.ts

@@ -26,13 +26,5 @@ export interface WrapOptions {
 export declare function wrapCommand(options?: WrapOptions): Promise<void>;
 export declare function birthThroughGateway(gatewayUrl: string, provider: Provider, agentName: string, providerKey: string, opts?: {
     timeoutMs?: number;
-    /**
-     * The caller's Mnemom API key, sent as `x-mnemom-api-key` together with a no-op
-     * `x-mnemom-session-config` (NOOP_SESSION_CONFIG_B64). The session config makes the call
-     * Mnemom agent traffic, so the gateway verifies the key and births a NEW agent in the key's
-     * org; the caller's claim step then records the claim in that same org. `mnemom agent`
-     * always sends its launch key; `mnemom wrap` sends neither header (plain traffic, as before).
-     */
-    mnemomKey?: string;
 }): Promise<string>;
 export {};

package/dist/commands/wrap.js

@@ -20,9 +20,7 @@ import { mergeAgentConfig } from "../lib/agent-config.js";
 import { askSelect, askInput, isInteractive } from "../lib/prompt.js";
 import { getGatewayUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
-import { NOOP_SESSION_CONFIG_B64, SESSION_CONFIG_HEADER } from "../lib/agent.js";
 const AGENT_HEADER = "x-mnemom-agent";
-const MNEMOM_KEY_HEADER = "x-mnemom-api-key";
 const PROVIDERS = {
     anthropic: {
         label: "Anthropic",
@@ -210,10 +208,6 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
         [prov.keyHeader]: authValue,
         [AGENT_HEADER]: agentName,
     };
-    if (opts.mnemomKey) {
-        headers[MNEMOM_KEY_HEADER] = opts.mnemomKey;
-        headers[SESSION_CONFIG_HEADER] = NOOP_SESSION_CONFIG_B64;
-    }
     if (provider === "anthropic") {
         headers["anthropic-version"] = "2023-06-01";
     }
@@ -241,24 +235,13 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
                 messages: [{ role: "user", content: "hello" }],
             });
     }
-    const post = (h) => fetch(url, {
+    const response = await fetch(url, {
         method: "POST",
-        headers: h,
+        headers,
         body,
         signal: opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined,
     });
-    let response = await post(headers);
-    let agentId = response.headers.get(AGENT_HEADER);
-    // An agent an earlier plain call already birthed sits unclaimed in the sandbox org, and the
-    // gateway refuses agent traffic for it with 402 `agent_unclaimed` (and no agent id) — yet that
-    // is exactly the agent `mnemom agent setup` must claim. Ask once more as plain traffic (no
-    // session config): that serves it exactly as before and returns the id for the claim step.
-    if (!agentId && SESSION_CONFIG_HEADER in headers && (await isAgentUnclaimedRefusal(response))) {
-        const plain = { ...headers };
-        Reflect.deleteProperty(plain, SESSION_CONFIG_HEADER);
-        response = await post(plain);
-        agentId = response.headers.get(AGENT_HEADER);
-    }
+    const agentId = response.headers.get(AGENT_HEADER);
     if (!response.ok && !agentId) {
         const text = await response.text().catch(() => "");
         throw new MnemomApiError(response.status, `Gateway returned ${response.status}: ${text.slice(0, 300)}`);
@@ -268,22 +251,6 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
     }
     return agentId;
 }
-/**
- * Is `response` the gateway's agent-traffic refusal for an agent still unclaimed in the sandbox
- * org — 402 with `error.details.reason === "agent_unclaimed"`? Reads a clone, so the caller can
- * still read the body. Anything unparseable is `false`.
- */
-async function isAgentUnclaimedRefusal(response) {
-    if (response.status !== 402)
-        return false;
-    try {
-        const body = (await response.clone().json());
-        return body?.error?.details?.reason === "agent_unclaimed";
-    }
-    catch {
-        return false;
-    }
-}
 // ── Starter cards ─────────────────────────────────────────────────────────────
 function buildStarterAlignmentCard(agentId) {
     return {