@mnemom/mnemom 0.17.9-next.0 → 0.17.10

package/dist/commands/agent-setup.js

@@ -6,32 +6,35 @@
  * governed identity `agent-<handle>`. This module makes that identity REAL in
  * their Mnemom org: it births the agent through the gateway, claims it (so the
  * customer owns it), and publishes a sane default coding posture. The CARDS are
- * observe-only (visibility, no active intervention); the goal contract is what
- * nudges (re-anchor on drift). Specifically:
- *   - alignment card: autonomy_mode + integrity_mode = observe,
+ * OFF by default (operator 2026-10-02: alignment and protection analysis are
+ * billed, so nobody pays for them until they turn them on); the goal contract is
+ * what nudges (re-anchor on drift). Specifically:
+ *   - alignment card: autonomy_mode + integrity_mode = off,
  *     principal.relationship = delegated_authority, coding bounded/forbidden
  *     actions, escalate-on-irreversible;
- *   - protection card: mode = observe, thresholds 0.60/0.80/0.95, all four
- *     screen_surfaces on (screened for observation).
+ *   - protection card: mode = off, thresholds 0.60/0.80/0.95 and all four
+ *     screen_surfaces declared, ready for when it is turned on.
  *   - goal-alignment: nudge — sealed per-conversation via the goal contract
  *     (--goal …), graded and re-anchored by the gateway.
  *
- * All account writes are gated: interactive runs show the plan and confirm;
- * non-interactive runs provision only with an explicit `--setup`, and otherwise
- * launch under the unclaimed (fail-open) identity with a clear warning. A
- * provisioning failure never blocks the launch. Reuses the existing machinery —
- * birthThroughGateway (wrap.ts), deriveHashProof (agents.ts), claimAgent +
- * putAlignmentCard/putProtectionCard (lib/api.ts) — rather than reinventing it.
+ * A launch never runs on an unclaimed agent (operator 2026-10-03): an unclaimed agent lands in
+ * the sandbox org and bills nobody. ensureClaimedServedAgent asks the gateway which agent it
+ * serves for this launch's credential + name, claims it into the org the launch bills when it
+ * is not claimed yet, and refuses otherwise — interactive or not, there is no unclaimed
+ * fallback. Reuses the existing machinery — birthThroughGateway (wrap.ts), deriveHashProof
+ * (agents.ts), claimAgent + putAlignmentCard/putProtectionCard (lib/api.ts) — rather than
+ * reinventing it.
  */
-import { claimAgent, getAgentByName, getMe, getMuBalance, getMyPersonalOrg, MnemomApiError, mintProtectionCapability, putAlignmentCard, putProtectionCard, } from "../lib/api.js";
-import { getAuthInfo, isLoggedIn, loginWithBrowser, loginWithDeviceFlow, resolveAuth, } from "../lib/auth.js";
+import { claimAgent, getAgent, getAgentByName, getMe, getMuBalance, getMyPersonalOrg, MnemomApiError, mintProtectionCapability, putAlignmentCard, putProtectionCard, } from "../lib/api.js";
+import { getAuthInfo, loginWithBrowser, loginWithDeviceFlow, resolveAuth } from "../lib/auth.js";
 import { getActiveOrg } from "../lib/cli-config.js";
 import { getApiUrl, getGatewayUrl, getWebsiteUrl, MNEMOM_DIR } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
 import { askYesNo, isInteractive } from "../lib/prompt.js";
 import { resolveAnthropicDoor, resolveGatewayHost, sanitizeAgentName, singleCellError, } from "../lib/agent.js";
 import { configKeySpec, loadLauncherConfig, writeLauncherConfig } from "../lib/launcher-config.js";
-import { readServedAgent, servedFingerprint, writeServedAgent } from "../lib/served-agent-cache.js";
+import { IdentityRouteMissingError, resolveServedIdentity } from "../lib/agent-identity-route.js";
+import { readConfirmedAgent, readServedAgent, servedFingerprint, writeConfirmedAgent, writeServedAgent, } from "../lib/served-agent-cache.js";
 import { deriveHashProof } from "./agents.js";
 import { birthThroughGateway } from "./wrap.js";
 import { resolveAnthropicKey } from "./agent.js";
@@ -82,152 +85,230 @@ export async function resolveDefaultSlug(opts = {}) {
     return defaultAgentSlug();
 }
 /**
- * Thrown when a name-matched agent in the caller's org is NOT the agent the
- * gateway serves for (credential, name). Both ids are in the message; the
- * launcher treats it as fatal on an explicit `--setup` (MNE-7650).
+ * `mnemom agent` refuses to launch: the agent the gateway would serve is not claimed and could
+ * not be claimed here (or could not be identified at all). An unclaimed agent lands in the
+ * sandbox org and bills nobody, so there is no fallback — the message says what to do.
  */
-export class AgentIdentityMismatchError extends Error {
-    slug;
-    namedId;
-    servedId;
-    constructor(slug, 
-    /** The agent the org lookup found by name. */
-    namedId, 
-    /** The agent the gateway answered with on x-mnemom-agent. */
-    servedId) {
-        super(`mnemom agent setup: '${slug}' in your org is ${namedId}, but the gateway serves ${servedId} for this Anthropic key + name. ` +
-            "Refusing to govern the wrong agent. The gateway identity is hash(credential, name): a different key, " +
-            "or a prior setup under another slug, is a different agent. " +
-            `Either claim the served one (mnemom agent claim ${servedId} --key <the same key>) or launch with the --agent and key you set up.`);
-        this.slug = slug;
-        this.namedId = namedId;
-        this.servedId = servedId;
-        this.name = "AgentIdentityMismatchError";
+export class UnclaimedAgentError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnclaimedAgentError";
     }
 }
 /** A bare launch never waits on the served-agent probe longer than this. */
 export const SERVED_PROBE_TIMEOUT_MS = 10_000;
 /**
- * Ensure `slug` is a usable governed agent in the customer's org. Returns
- * {provisioned:false} when it is already usable, when provisioning is not
- * allowed here (non-interactive without --setup, or not logged in), or when the
- * customer declines the confirm — in all those cases the launch continues under
- * the given slug. THROWS only on an actual provisioning failure (birth/claim/
- * card write) so the caller can decide whether that is fatal (`mnemom agent
- * setup`) or a warn-and-continue (a bare launch).
+ * The waits between the tries of a call that failed transiently (network, timeout, 429, 5xx):
+ * three tries, about four seconds of backoff. Exported so tests can zero it.
+ */
+export const CONFIRM_RETRY_DELAYS_MS = [1000, 3000];
+/**
+ * Mnemom couldn't be reached to answer (a transient failure that outlived its retries). Carries
+ * the served id when the gateway did answer before the api failed.
+ */
+class MnemomUnreachableError extends Error {
+    reason;
+    servedId;
+    constructor(reason, servedId) {
+        super(describeApiError(reason));
+        this.reason = reason;
+        this.servedId = servedId;
+        this.name = "MnemomUnreachableError";
+    }
+}
+/**
+ * A failure worth retrying, and that an outage fallback may cover: no answer at all (network,
+ * timeout, an unparseable reply) or a 408/429/5xx. A 4xx, a missing route, or a refusal is a
+ * definite answer.
  */
-export async function ensureGovernedAgent(opts) {
+export function isTransient(err) {
+    if (err instanceof UnclaimedAgentError || err instanceof IdentityRouteMissingError)
+        return false;
+    if (err instanceof MnemomApiError) {
+        const status = err.effectiveStatus;
+        return status === 408 || status === 429 || status >= 500;
+    }
+    return true;
+}
+/** `call`, retried with backoff while it fails transiently; the last failure is rethrown. */
+async function withRetry(call) {
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await call();
+        }
+        catch (err) {
+            if (!isTransient(err) || attempt >= CONFIRM_RETRY_DELAYS_MS.length)
+                throw err;
+            await sleep(CONFIRM_RETRY_DELAYS_MS[attempt]);
+        }
+    }
+}
+/**
+ * The one invariant behind every `mnemom agent` launch: the coding CLI never starts unless the
+ * agent the gateway serves for THIS launch's credential + name is claimed.
+ *
+ * 1. Ask which agent the gateway serves (an Anthropic-key launch: the birth probe, cached per
+ *    key + name + gateway; a subscription launch: the gateway's identity route).
+ * 2. Read its claim state. Claimed ⇒ launch, and never claim it again: a re-claim by its owner
+ *    MOVES it to the requested org.
+ * 3. Unclaimed ⇒ claim it into `orgId` with the hash proof of the key that anchors it. Another
+ *    account owns it ⇒ refuse; any other claim failure ⇒ refuse.
+ *
+ * A definite answer (unclaimed and can't be claimed, owned by another account, the identity
+ * route missing, a rejected key) always refuses. A transient failure is retried; if Mnemom still
+ * can't be reached, the launch uses the agent this machine last confirmed claimed for the same
+ * credential + name — and only when the gateway hasn't since named a different one — or
+ * refuses. There is deliberately no switch that launches unclaimed (operator ruling 2026-10-03).
+ *
+ * Interactive and non-interactive runs behave the same: there is no prompt to decline.
+ * MNE-7650: the name is client-controlled, so a same-named org agent proves nothing — only the
+ * served id counts.
+ */
+export async function ensureClaimedServedAgent(opts) {
     const slug = opts.slug;
+    const anchorKey = opts.anthropicKey || opts.mnemomKey;
+    if (!anchorKey) {
+        throw new UnclaimedAgentError(`mnemom agent: no credential anchors '${slug}' — an Anthropic key or a Mnemom API key is required.`);
+    }
     const cacheDir = opts.cacheDir ?? MNEMOM_DIR;
-    const interactive = opts.interactive ?? isInteractive();
-    // 1. Already usable? A named agent in the caller's fleet is claimed by them.
-    const loggedIn = await isLoggedIn();
-    if (loggedIn) {
-        const existing = await getAgentByName(slug).catch(() => null);
-        if (existing) {
-            // MNE-7650: the name is client-controlled and the API exposes no
-            // agent_hash, so a name match proves nothing about which agent the
-            // gateway will serve for (key, slug) — it looks agents up by
-            // hash(credential, name) only. Ask the gateway on EVERY launch, not just
-            // under --setup: the same 16-token "hello" the birth path uses answers
-            // with the served mnm- id on x-mnemom-agent. A bare launch that trusted
-            // the name recorded and reported an org agent while the gateway governed
-            // a different, unclaimed one (a second Anthropic key on a shared name).
-            //
-            // The answer is stable per (key, name, gateway), so a bare launch reuses a cached one and
-            // only probes (time-boxed) the first time; --setup always re-asks.
-            const gatewayUrl = opts.gatewayHost.replace(/\/+$/, "");
-            const fp = servedFingerprint(opts.anthropicKey, slug, gatewayUrl);
-            const cached = opts.setup === true ? null : readServedAgent(cacheDir, fp);
-            let served;
-            try {
-                served =
-                    cached ??
-                        (await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey, {
-                            timeoutMs: opts.setup === true ? undefined : SERVED_PROBE_TIMEOUT_MS,
-                        }));
-            }
-            catch (err) {
-                // --setup must know which agent it governs; a bare launch carries on
-                // with the id unresolved rather than guessing it from the name.
-                if (opts.setup === true)
-                    throw err;
-                say(fmt.dim(`mnemom agent: couldn't confirm which agent the gateway serves for '${slug}' (${err instanceof Error ? err.message : String(err)}) — launching anyway.`));
-                return { slug, provisioned: false };
-            }
-            if (!cached)
-                writeServedAgent(cacheDir, fp, served);
-            if (served !== existing.id) {
-                if (opts.setup === true)
-                    throw new AgentIdentityMismatchError(slug, existing.id, served);
-                warnServedMismatch(slug, existing.id, served);
-                return { slug, provisioned: false, agentId: served };
-            }
-            // On an EXPLICIT `mnemom agent setup`, repair/complete the cards on the
-            // already-claimed agent (e.g. a protection card that failed on a prior run
-            // before we minted its one-time grant). A bare launch leaves it alone.
-            if (opts.setup === true) {
-                say(fmt.dim(`mnemom agent: '${slug}' is already claimed (${existing.id}, the agent the gateway serves) — refreshing its cards.`));
-                await publishDefaultCards(existing.id);
-                persistAgentSlug(slug);
-                return { slug, provisioned: true, agentId: existing.id };
-            }
-            return { slug, provisioned: false, agentId: existing.id };
+    const fp = servedFingerprint(anchorKey, slug, opts.gatewayHost.replace(/\/+$/, ""));
+    let result;
+    try {
+        result = await confirmClaimed(opts, anchorKey, fp);
+    }
+    catch (err) {
+        if (!(err instanceof MnemomUnreachableError))
+            throw err;
+        const confirmed = readConfirmedAgent(cacheDir, fp);
+        if (confirmed && (err.servedId === undefined || err.servedId === confirmed)) {
+            say(fmt.warn(`mnemom agent: couldn't reach Mnemom to confirm '${slug}' (${err.message}) — launching on ${confirmed}, the agent this machine last confirmed claimed.`));
+            return { slug, agentId: confirmed, claimedNow: false };
         }
+        throw new UnclaimedAgentError(`mnemom agent: couldn't reach Mnemom to confirm your agent '${slug}' (${err.message}); try again.`);
     }
-    // 2. Are we allowed to provision here?
-    const canProvision = opts.setup === true || (opts.setup !== false && interactive);
-    if (!canProvision) {
-        warnUnclaimed(slug);
-        return { slug, provisioned: false };
+    writeConfirmedAgent(cacheDir, fp, result.agentId);
+    return result;
+}
+async function confirmClaimed(opts, anchorKey, fp) {
+    const slug = opts.slug;
+    const agentId = await resolveServedAgent(opts, fp);
+    if (await isClaimed(slug, agentId)) {
+        if (opts.setup === true) {
+            // An explicit `mnemom agent setup` / --setup repairs or completes the cards (e.g. a
+            // protection card that failed on a prior run before its one-time grant was minted).
+            say(fmt.dim(`mnemom agent: '${slug}' is ${agentId}, already claimed — refreshing its cards.`));
+            await publishDefaultCards(agentId);
+            persistAgentSlug(slug);
+        }
+        else {
+            say(fmt.dim(`mnemom agent: '${slug}' is ${agentId}, claimed.`));
+        }
+        return { slug, agentId, claimedNow: false };
+    }
+    // From here the agent is known to be unclaimed: every failure refuses, none falls back.
+    if (!opts.orgId) {
+        throw new UnclaimedAgentError(`mnemom agent: '${slug}' (${agentId}) is not claimed, and this launch has no org to claim it into. ` +
+            "Choose one with `mnemom org use <org>`, then run `mnemom agent` again.");
+    }
+    try {
+        const hashProof = deriveHashProof(anchorKey, slug);
+        await withRetry(() => claimAgent(agentId, { hashProof, orgId: opts.orgId }));
     }
-    // 3. Writing to the org needs a mnemom session.
-    if (!loggedIn) {
-        if (opts.setup === true && !interactive) {
-            throw new Error("not authenticated — run `mnemom login` (or set MNEMOM_API_KEY) first.");
+    catch (err) {
+        if (err instanceof MnemomApiError && err.code === "agent_cross_tenant") {
+            throw new UnclaimedAgentError(`mnemom agent: the agent for this key + name ('${slug}', ${agentId}) belongs to another Mnemom account. ` +
+                "Use a name of your own: `mnemom agent <scenario> --agent <a-name-of-your-own>`.");
         }
-        say(fmt.warn(`mnemom agent: not logged in — can't provision '${slug}'.`));
-        say(fmt.dim("  Run `mnemom login`, then `mnemom agent setup`. Launching with the unclaimed identity for now."));
-        return { slug, provisioned: false };
-    }
-    // 4. Confirm the plan (interactive runs; --setup non-interactive proceeds).
-    const org = getActiveOrg();
-    const orgLabel = org ? `${org.name} (${org.slug})` : "your personal org";
-    if (interactive) {
-        say(fmt.section("Set up a governed coding agent"));
-        say(fmt.label("  Agent:", slug));
-        say(fmt.label("  Org:", orgLabel));
-        say(fmt.label("  Posture:", "observe (alignment + protection observe-only, all surfaces screened); goal contracts nudge"));
-        say(fmt.dim("  Births the agent through the gateway, claims it to your org, and publishes its cards."));
-        if (!(await askYesNo("Provision and claim this agent now?", true))) {
-            say(fmt.dim("  Skipped — launching under the unclaimed identity. Run `mnemom agent setup` anytime."));
-            return { slug, provisioned: false };
+        // A concurrent launch of the same user (another fleet lane) may have claimed it first.
+        if (await isClaimed(slug, agentId).catch(() => false)) {
+            say(fmt.dim(`mnemom agent: '${slug}' is ${agentId}, claimed by another launch just now.`));
+            return { slug, agentId, claimedNow: false };
         }
+        throw new UnclaimedAgentError(`mnemom agent: couldn't claim '${slug}' (${agentId}) into ${opts.orgLabel} — ${describeApiError(err)}. ` +
+            "mnemom agent never runs on an unclaimed agent; fix that and run it again.");
     }
-    // 5. Birth → claim → publish observe-only cards. (Key never logged.)
-    const gatewayUrl = opts.gatewayHost.replace(/\/+$/, "");
-    const agentId = await birthThroughGateway(gatewayUrl, "anthropic", slug, opts.anthropicKey);
-    const hashProof = deriveHashProof(opts.anthropicKey, slug);
-    await claimAgent(agentId, { hashProof, orgId: org?.org_id });
-    say(fmt.success(`mnemom agent: claimed '${slug}' (${agentId}) in ${orgLabel}.`));
-    // Publish the observe-only cards. A card write that can't complete (propagation
-    // right after the claim, or a missing cards:write scope) does NOT abort the
-    // provision — the agent is claimed and governed on whatever landed; we warn how
-    // to finish it. So `provisioned` reflects the claim, not a perfect card set.
-    await publishDefaultCards(agentId);
-    // 6. Remember the slug so future launches skip straight to usable.
+    say(fmt.success(`mnemom agent: claimed '${slug}' (${agentId}) in ${opts.orgLabel}.`));
+    await noteSameNamedAgent(slug, agentId);
+    // Publish the default (off) cards. A card write that can't complete does NOT undo the claim —
+    // the agent is claimed and governed on whatever landed; we warn how to finish it.
+    if (opts.setup !== false)
+        await publishDefaultCards(agentId);
     persistAgentSlug(slug);
-    return { slug, provisioned: true, agentId };
+    return { slug, agentId, claimedNow: true };
+}
+/**
+ * Which mnm- agent the gateway serves for this launch's credential + slug. A definite failure
+ * throws UnclaimedAgentError; a transient one that outlives its retries throws
+ * MnemomUnreachableError. A launch never guesses its agent from the name.
+ */
+async function resolveServedAgent(opts, fp) {
+    const { slug } = opts;
+    const gatewayUrl = opts.gatewayHost.replace(/\/+$/, "");
+    const cacheDir = opts.cacheDir ?? MNEMOM_DIR;
+    try {
+        if (opts.anthropicKey) {
+            const anthropicKey = opts.anthropicKey;
+            // The answer is stable per (key, name, gateway) and the probe costs a completion, so a
+            // bare launch reuses a cached one and only probes (time-boxed) the first time; --setup
+            // re-asks.
+            const cached = opts.setup === true ? null : readServedAgent(cacheDir, fp);
+            if (cached)
+                return cached;
+            const served = await withRetry(() => birthThroughGateway(gatewayUrl, "anthropic", slug, anthropicKey, {
+                timeoutMs: opts.setup === true ? undefined : SERVED_PROBE_TIMEOUT_MS,
+            }));
+            writeServedAgent(cacheDir, fp, served);
+            return served;
+        }
+        // Subscription: the identity route makes no upstream call, so it is asked on every launch
+        // (a later claim can change which agent the key's owner is served).
+        const mnemomKey = opts.mnemomKey ?? "";
+        return await withRetry(() => resolveServedIdentity(gatewayUrl, slug, mnemomKey, { timeoutMs: SERVED_PROBE_TIMEOUT_MS }));
+    }
+    catch (err) {
+        if (err instanceof IdentityRouteMissingError) {
+            throw new UnclaimedAgentError(`mnemom agent: ${err.message}, so it can't confirm '${slug}' is claimed. ` +
+                "Launch with an Anthropic API key instead (`--auth api-key`), or try again once the gateway is updated.");
+        }
+        if (isTransient(err))
+            throw new MnemomUnreachableError(err);
+        throw new UnclaimedAgentError(`mnemom agent: the gateway wouldn't say which agent it serves for '${slug}' (${describeApiError(err)}). ` +
+            "mnemom agent never runs on an agent it can't confirm is claimed.");
+    }
 }
 /**
- * A bare launch whose name matches an org agent the gateway does NOT serve for this key. Not
- * fatal (no --setup asked to govern it), but the user must know their governance lands on the
- * served agent, and how to get a governed one of their own.
+ * Whether `agentId` is claimed. A 404/403 reads as unclaimed (an unclaimed sandbox agent can be
+ * invisible to a normal user), so the caller claims it. A transient failure is retried and then
+ * throws MnemomUnreachableError; any other failure refuses.
  */
-function warnServedMismatch(slug, namedId, servedId) {
-    say(fmt.warn(`mnemom agent: '${slug}' in your org is ${namedId}, but the gateway serves ${servedId} for this Anthropic key + name — this session is governed as ${servedId}, which is not claimed to your org.`));
-    say(fmt.dim("  The gateway identity is hash(Anthropic key, name), so another key on the same name is a different agent. " +
-        `Use a name of your own: \`mnemom agent <scenario> --agent <unique-name> --setup\` (or claim the served one: \`mnemom agent claim ${servedId} --key <this key>\`).`));
+async function isClaimed(slug, agentId) {
+    let agent;
+    try {
+        agent = await withRetry(() => getAgent(agentId));
+    }
+    catch (err) {
+        const status = err instanceof MnemomApiError ? err.effectiveStatus : undefined;
+        if (status === 404 || status === 403)
+            return false;
+        if (isTransient(err))
+            throw new MnemomUnreachableError(err, agentId);
+        throw new UnclaimedAgentError(`mnemom agent: couldn't read whether '${slug}' (${agentId}) is claimed — ${describeApiError(err)}. ` +
+            "mnemom agent never runs on an agent it can't confirm is claimed.");
+    }
+    // The org-member view carries the claimed_by column; the public projection a `claimed` flag.
+    return agent.claimed_by !== undefined ? !!agent.claimed_by : agent.claimed === true;
+}
+/**
+ * After a claim: if the caller's org already had an agent of this name that is NOT the served
+ * one (another key on the same name, MNE-7650), say so — this launch governs the served one.
+ * Best effort.
+ */
+async function noteSameNamedAgent(slug, servedId) {
+    const named = await getAgentByName(slug).catch(() => null);
+    if (!named || named.id === servedId)
+        return;
+    say(fmt.dim(`  Note: '${slug}' in your org is ${named.id}, a different agent — the gateway identity is hash(key, name), ` +
+        `so this key runs as ${servedId}.`));
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 /**
@@ -273,14 +354,14 @@ async function tryPublishCard(name, write) {
     }
     return { name, ok: false, error: "unknown error" };
 }
-/** Publish both default observe-only cards; never throws — warns on a card that can't be written. */
+/** Publish both default (off) cards; never throws — warns on a card that can't be written. */
 async function publishDefaultCards(agentId) {
     const align = await tryPublishCard("alignment", () => putAlignmentCard(agentId, JSON.stringify(buildCodeAlignmentCard(agentId)), "application/json"));
     // Protection is the "locked door": it needs a one-time cards:write:protection
     // grant that the claim does NOT include (alignment rides a standing cap). Mint
-    // it with our human login JWT — the "Provision and claim?" confirm is the
-    // explicit human approval, and the mint endpoint accepts a human operator (only
-    // agent OAuth principals are rejected). The next write consumes the grant. A
+    // it with our human login JWT — the human running `mnemom agent` (which claims
+    // the agent for them) is the approval, and the mint endpoint accepts a human
+    // operator (only agent OAuth principals are rejected). The next write consumes the grant. A
     // mint failure falls through to the write's retry + graceful degrade, but it
     // is NAMED: the mint's error code (e.g. an ownership `agent_org_forbidden`)
     // and `details.required_scope` are the actionable diagnosis — the downstream
@@ -296,11 +377,11 @@ async function publishDefaultCards(agentId) {
     }
     const prot = await tryPublishCard("protection", () => putProtectionCard(agentId, JSON.stringify(buildCodeProtectionCard(agentId)), "application/json"));
     if (align.ok && prot.ok) {
-        say(fmt.success("mnemom agent: observe posture published (alignment + protection observe; goal contracts nudge)."));
+        say(fmt.success("mnemom agent: default posture published (alignment + protection off until you turn them on; goal contracts nudge)."));
         return;
     }
     if (align.ok)
-        say(fmt.success("mnemom agent: alignment card published (observe)."));
+        say(fmt.success("mnemom agent: alignment card published (off)."));
     for (const c of [align, prot]) {
         if (c.ok)
             continue;
@@ -322,8 +403,9 @@ export async function agentSetupCommand(opts = {}) {
     if (cellError)
         throw new Error(cellError.replace("mnemom agent:", "mnemom agent setup:"));
     // Sign in (offer sign-up) and enforce the MU balance before any account write.
+    let account;
     try {
-        await ensureSessionAndBalance({});
+        account = await ensureSessionAndBalance({});
     }
     catch (err) {
         if (isQuietPreambleExit(err))
@@ -338,14 +420,14 @@ export async function agentSetupCommand(opts = {}) {
         : await resolveDefaultSlug({ strict: true });
     if (!slug)
         throw new Error("mnemom agent setup: agent slug sanitised to empty — pass --agent <slug>.");
-    const result = await ensureGovernedAgent({ slug, anthropicKey, setup: true, gatewayHost });
-    if (!result.provisioned) {
-        say(fmt.dim(`  '${slug}' is ready (already claimed) or setup was skipped.`));
-    }
-}
-function warnUnclaimed(slug) {
-    say(fmt.warn(`mnemom agent: agent '${slug}' is not set up in your org — launching with an UNCLAIMED identity (governance is advisory/fail-open).`));
-    say(fmt.dim("  Provision it (creates + claims the agent, publishes observe cards): mnemom agent setup"));
+    await ensureClaimedServedAgent({
+        slug,
+        anthropicKey,
+        gatewayHost,
+        orgId: account.orgId,
+        orgLabel: account.orgLabel,
+        setup: true,
+    });
 }
 function persistAgentSlug(slug) {
     try {
@@ -520,13 +602,13 @@ export async function resolvePreflightedAccount() {
     const entitlement = await assertCodeEnabled(active?.org_id ?? "", orgLabel);
     return { orgId: active?.org_id ?? entitlement?.org_id ?? "", orgLabel, entitlement };
 }
-// ── The default coding posture (cards observe-only; goal contracts nudge) ────
+// ── The default coding posture (cards off; goal contracts nudge) ─────────────
 function buildCodeAlignmentCard(agentId) {
     return {
         card_version: "unified/2026-04-26",
         agent_id: agentId,
-        autonomy_mode: "observe",
-        integrity_mode: "observe",
+        autonomy_mode: "off",
+        integrity_mode: "off",
         principal: { type: "agent", identifier: agentId, relationship: "delegated_authority" },
         values: {
             declared: ["transparency", "safety", "honesty", "user_control", "harm_prevention"],
@@ -563,7 +645,7 @@ function buildCodeProtectionCard(agentId) {
     return {
         card_version: "protection/2026-04-26",
         agent_id: agentId,
-        mode: "observe",
+        mode: "off",
         thresholds: { warn: 0.6, quarantine: 0.8, block: 0.95 },
         screen_surfaces: {
             incoming: true,

package/dist/commands/agent.d.ts

@@ -97,9 +97,9 @@ export interface AgentOptions {
      */
     compactionIntercept?: boolean;
     /**
-     * Governed-agent provisioning: undefined = AUTO (provision-with-confirm when
-     * interactive, warn-and-continue otherwise), true = force (`--setup`), false =
-     * skip entirely (`--no-setup`).
+     * Governed-agent cards. Every launch confirms (and if needed claims) the served
+     * agent regardless; true (`--setup`) re-asks the gateway and refreshes the
+     * default cards, false (`--no-setup`) skips the card writes.
      */
     setup?: boolean;
     /**
@@ -171,19 +171,16 @@ interface LaunchContinuationInput {
     ccSessionExists: (ccSessionId: string) => boolean;
 }
 /**
- * Record this launch in ~/.mnemom/sessions.jsonl. The agent record id is
- * resolved best-effort (a lookup failure or an unknown slug records null); a
- * ledger write failure warns to stderr and the launch proceeds regardless.
+ * Record this launch in ~/.mnemom/sessions.jsonl, with the claimed agent id the
+ * gateway serves; a ledger write failure warns to stderr and the launch proceeds
+ * regardless.
  */
 export declare function recordSessionLaunch(ctx: {
     session: string;
     conversationId: string;
     agent: string;
-    /**
-     * The id the gateway serves, as setup learned it (null = asked, unknown). Undefined = setup
-     * never asked, so fall back to the org's name lookup.
-     */
-    agentId?: string | null;
+    /** The claimed mnm- id the gateway serves for this launch (ensureClaimedServedAgent). */
+    agentId: string;
     account: {
         orgId: string;
         orgLabel: string;
@@ -200,7 +197,7 @@ export declare function recordSessionLaunch(ctx: {
     contextProfile: ContextProfile | null;
     /** The resolved compaction target this launch runs under (`resolveCompactAt`). */
     compactAt: number | null;
-}): Promise<void>;
+}): void;
 /** The real I/O behind a subscription launch's Mnemom key (lib/subscription-login.ts). */
 export declare function defaultMnemomKeyDeps(storePath?: string): MnemomKeyDeps;
 /** The real machine behind lib/console-key.ts: the macOS keychain via `security`, no shell. */