@ornncompute/cli 1.0.72 → 1.0.97

package/README.md

@@ -7,8 +7,17 @@ sends browser and CLI traffic only through the API gateway.
 For the customer install and usage guide, see [`docs/cli.md`](../../docs/cli.md).
 The shared capability catalog in `packages/capabilities` is the authority for
 command identity, role visibility, input schemas, help, and resource discovery.
-The CLI imports `@ornn/capabilities/cli`; packaging includes only that entrypoint's
-dependencies, excluding staff commerce and CRM handlers.
+The CLI imports `@ornn/capabilities/cli`; packaging includes its dependencies,
+including `@ornn/api-client`, and excludes MCP-only catalog handlers. These
+packages run without workspace links or React.
+
+Native Commerce requests use the caller’s bearer directly through the gateway:
+`/commerce/*` for public APIs and `/internal/v1/*` for staff APIs.
+The gateway and Commerce enforce the caller’s organization and staff permissions.
+All Commerce operations use `@ornn/api-client/commerce`, including the reservation
+reads inside launch, connect, and evidence flows. Customer reservation pickers
+explicitly scope every page to the selected organization, including for staff.
+The gateway retains its Commerce workflow adapters for already-published CLI versions.
 
 For GCS imports, start with the [source-bucket permissions and version-specific CLI guide](https://docs.ornn.com/cli#gcs-imports-and-storage-transfer-service).
 It documents the current CLI 1.x GCS verification limitation. Scoped
@@ -82,6 +91,9 @@ filesystems      deploy | show | wait | delete
 ```
 
 `ssh-keys list` uses backend cursors; see [pagination](../../docs/cli.md#advanced-customer-resources).
+Organization key deletion saves removal on reservation lists before revoking the
+account key. If preparation fails, retry the deletion; re-registering the key
+does not restore its removed reservation access.
 
 Market commands call one gateway route each and print that route's JSON.
 `capacity-offers list|show|terms` reads native Commerce capacity
@@ -104,9 +116,11 @@ CLI does not send them yet), end a fill with
 on a whole primary listing for one of its terms (`--listing-term-id`, optional
 `--duration-seconds`), list the offers your organization made or received, and
 accept or cancel offers by `--offer-id`.
-Prices are integer micro-USD per GPU-hour (`1000000` is $1.00). Every write
-reviews its terms and needs default-no consent, or `--yes` with
-`--format json`; writes accept `--idempotency-key`. Customer payment methods and
+Prices are integer micro-USD per GPU-hour (`1000000` is $1.00); CPU capacity
+(a null GPU type, traded on the `cpu` book) is priced and counted per vCPU in
+the same fields. Writes execute
+immediately; use `--format json` for machine-readable output and
+`--idempotency-key` for safe retries. Customer payment methods and
 billing stay in the web app. Launch consumes already allocated
 capacity; internal reservation lookups remain necessary for access and
 ownership.
@@ -116,7 +130,7 @@ Only admins can create primary listings or reservations through
 They post to the role-aware `POST /commerce/v2/listings` and Markets
 `POST /v1/markets/bookings` with the admin's own session; the owners enforce
 the admin role. Both commands retain explicit commercial-term validation and
-default-no human confirmation. Reservation creation books a window for a
+execute directly. Reservation creation books a window for a
 customer and takes `--organization-id UUID`, `--listing-id UUID`,
 `--listing-term-id UUID`, `--nodes COUNT`, `--starts-at TIME`, `--ends-at TIME`,
 `--price-per-gpu-hour-micro-usd N`, and `--idempotency-key KEY`. The window is
@@ -125,8 +139,10 @@ Reuse the key and payload on retries. Creation requires an eligible human
 terminal. Native capacity creation takes
 `--gpu-slug`, `--gpus-per-node`, `--facility-id`, `--provisioning-type`,
 `--state`, `--terms` (a JSON array) and `--idempotency-key`, plus optional
-`--organization-id`. Give `--capacity-node-count`, or `--node-ids` (a JSON array)
-to attach nodes at creation; the count then defaults to the number of nodes.
+`--organization-id`. CPU capacity takes `--gpu-slug cpu` and
+`--cores-per-node` (a whole number of at least 1; each core is 2 vCPUs) instead
+of `--gpus-per-node`; its term prices are per vCPU-hour. Give
+`--capacity-node-count`, or `--node-ids` (a JSON array) to attach nodes at creation; the count then defaults to the number of nodes.
 Primary capacity takes `--days-to-rfs` (0 when ready now) or both
 `--available-at` and `--available-until`, not both. Reuse the key and the same
 body on retries. Prices are integer micro-USD inside terms, with explicit
@@ -155,6 +171,8 @@ Every `ornn admin` command, read or mutation, requires an admin session.
 Authorization directory by person name, email, or company name, with bounded `--limit` and
 `--offset` pagination. Users can be restricted by `--organization`; organization
 results can be filtered by `--role`, `--approved`, or `--ids`.
+User, organization, and supplier directory lists return `next_offset`; pass it
+unchanged as the next `--offset`.
 
 `ornn admin organizations invite --organization UUID --email EMAIL` emails an
 invitation immediately using the selected organization UUID from the directory.
@@ -166,8 +184,9 @@ delivery or share the sign-in link before retrying. Use `--format json` for auto
 `ornn admin organizations grant-credit --organization UUID --amount-cents 10000
 --note "Customer goodwill credit" --idempotency-key UUID` grants $100.00 in Ornn
 credits to the organization. Find the organization with the directory commands
-above. Like admin reservation creation, it requires a human terminal and
-reviews the organization, USD amount, note, and UUID before default-no consent.
+above. Like admin reservation creation, it requires an eligible human terminal
+and executes immediately after validating the organization, USD amount, note,
+and UUID.
 The key supplies the existing API's required `adjustmentId`; repeating it with
 the same details returns the same grant. The admin's session supplies audit
 identity. See the [credit-adjustment contract](../../services/commerce/README.md#staff-credit-adjustments).
@@ -184,6 +203,17 @@ include the final newline required by OpenSSH, both in files and with `--print`.
 `ornn admin nodes enroll` takes optional `--filter COMPARTMENT_IDS`
 (omit to run every compartment step); the retired `--mode` flag is gone. The
 gateway, not CLI metadata, authoritatively enforces the admin role.
+`ornn admin nodes sanitize`, `sanitize-status`, and `sanitize-decide` drive one
+node's held sanitize job, sharing the capability with MCP
+`admin_node_sanitize_*` and Slack `node_sanitize_*`. `sanitize` needs
+`--operation`, its exact `--confirmation` phrase, and `--recovery-uuid` for
+`ram_roundtrip` (refused for `data_wipe`); the job then waits for staff approval.
+`sanitize-decide --confirmation "ACCEPT MANUAL CLEANUP"` also needs
+`--reservation`, `--release-operation` (the Orchestrator release operation),
+`--reason`, `--evidence-file` (only its SHA-256 is sent), and each attestation
+flag: `--tenant-access-revoked`, `--data-drives-sanitized`, and
+`--acknowledge-retained-os`. Sanitize writes run only in an eligible human
+terminal. See [manual cleanup with the boot OS retained](../../docs/provisioning/dedicated-machine-runbook.md#manual-cleanup-with-the-boot-os-retained).
 Suppliers are Authorization supplier organizations: `ornn admin suppliers list`
 returns their `id` and `name`, and `--supplier UUID` on `facilities list`,
 `nodes list`, `enrollment-tokens create`, and `nodes enroll` takes that
@@ -212,15 +242,15 @@ never contains admin children. There is no second parser or command registry.
 ## Interaction contract
 
 An eligible human context requires TTY stdin and TTY stdout and no JSON/NDJSON
-format. Human commands may guide selection, render a normalized review, and ask
-default-no `[y/N]` consent. Empty input, EOF, and refusal submit nothing.
+format. Human commands may guide selection and render a normalized summary;
+mutations execute immediately without a confirmation prompt.
 
 Automation supplies complete semantic inputs and an explicit format:
 
 ```bash
 ornn status --format json
 ornn machines list --limit 100 --format ndjson
-ornn launch RESERVATION_ID --mode vm --yes \
+ornn launch RESERVATION_ID --mode vm  \
   --idempotency-key caller-stable-key --format json
 ```
 
@@ -229,19 +259,20 @@ Redirected commands require `--format human`, `--format json`, or
 prompts or launches a browser. Inputs missing for a safe decision fail before
 network, browser, or process I/O.
 
-Global interaction modifiers are `--format`, `--guided`, `--yes`, `--wait`,
+Global interaction modifiers are `--format`, `--guided`, `--wait`,
 `--no-wait`, `--timeout`, `--no-browser`, `--overwrite`, and
-`--idempotency-key`. Mutations that create or increase spend, erase data, tear
-down resources, or reduce access require consent. Machine retries require a
+`--idempotency-key`. Destructive operations require explicit intent flags such
+as `--erase-local-data` or `--delete-node-record`. Machine retries require a
 caller-stable idempotency key and reconcile against durable owner state.
 
-Permanent deletion and teardown requests never fire without consent. Private
-networks, detached volumes, filesystem deployments, and Kubernetes or Slurm
-clusters accept `--yes` for automation or ask an eligible human for default-no
-confirmation. Clearing a volume or deleting nested content is live-terminal
-only and always asks, even when `--yes` is present.
+Permanent deletion and teardown requests execute directly when explicitly
+requested. Private networks, detached volumes, filesystem deployments, and
+Kubernetes or Slurm clusters use their command arguments to express the exact
+operation. Clearing a volume or deleting nested content is live-terminal only
+and does not prompt for consent.
 
-List commands use bounded `--limit` values and opaque `--cursor` values. Waits
+Other paged list commands use bounded `--limit` values and opaque `--cursor`
+values. Pass the returned cursor unchanged as the next `--cursor`. Waits
 poll only retryable transitional states, honor the caller deadline and
 cancellation, and return the last observed state on timeout. Durable Bare Metal
 workspace flows persist local recovery pointers for `launch --resume`.
@@ -334,8 +365,8 @@ with one replacement and <https://docs.ornn.com/cli#migrating-to-vnext>.
 | `--json`                                                                                  | `--format json`                                               |
 | `--interactive`                                                                           | `--guided`                                                    |
 
-Changed behavior is intentional: waits are deadline-bound, consent is semantic
-and default-no, pagination is bounded and cursor-based, machine output is always
+Changed behavior is intentional: waits are deadline-bound, mutations execute
+directly, pagination is bounded and cursor-based, machine output is always
 enveloped, and exit statuses are semantic. Old help, completion entries,
 fixtures, staff roots, and owner-route spellings are not shipped.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.72",
+  "version": "1.0.97",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {
@@ -35,7 +35,9 @@
     "test": "node --test 'test/*.test.mjs'"
   },
   "devDependencies": {
-    "@ornn/capabilities": "0.1.0"
+    "@ornn/api-client": "0.1.0",
+    "@ornn/capabilities": "0.1.0",
+    "esbuild": "^0.28.2"
   },
   "engines": {
     "node": ">=20"

package/src/admin-capacity-reservations.mjs

@@ -5,7 +5,7 @@ const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-
 
 const USAGE = {
   "reservations.create":
-    "Usage: ornn admin reservations create --organization-id ID --listing-id ID --listing-term-id ID --nodes COUNT --starts-at TIME --ends-at TIME --price-per-gpu-hour-micro-usd N --idempotency-key KEY [--yes]",
+    "Usage: ornn admin reservations create --organization-id ID --listing-id ID --listing-term-id ID --nodes COUNT --starts-at TIME --ends-at TIME --price-per-gpu-hour-micro-usd N --idempotency-key KEY",
 };
 
 function parseOptions(argv, { values, positionals }, usage) {
@@ -17,14 +17,6 @@ function parseOptions(argv, { values, positionals }, usage) {
       positionalValues.push(argument);
       continue;
     }
-    if (argument === "--yes") {
-      if (options.yes !== undefined)
-        throw new AdminMutationError(`${usage}\n--yes may be supplied only once.`, {
-          field: "yes",
-        });
-      options.yes = true;
-      continue;
-    }
     const separator = argument.indexOf("=");
     const name = argument.slice(2, separator === -1 ? undefined : separator);
     if (!values.includes(name)) throw new AdminMutationError(`${usage}\nUnknown option: --${name}`);
@@ -84,14 +76,13 @@ function timestamp(options, name, usage) {
 }
 
 function parseCapacityOffer(argv) {
-  const { $positionals, yes, ...input } = parseSemanticArguments(argv);
+  const { $positionals, ...input } = parseSemanticArguments(argv);
   if ($positionals.length) throw new AdminMutationError("Use named options for listing writes.");
   return {
     input,
     mutation: {
       idempotencyKey: input.idempotencyKey,
       safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
-      yes: yes === true,
     },
   };
 }
@@ -135,7 +126,6 @@ function parseReservationCreate(argv) {
     mutation: {
       idempotencyKey,
       safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
-      yes: options.yes === true,
     },
   };
 }
@@ -163,7 +153,10 @@ function reservationCreateReview(input) {
       { label: "Nodes", value: input.nodes },
       { label: "Starts at", value: input.startsAt },
       { label: "Ends at", value: input.endsAt },
-      { label: "Price per GPU-hour (micro-USD)", value: input.pricePerGpuHourMicroUsd },
+      {
+        label: "Price per unit-hour (micro-USD; per vCPU on CPU capacity)",
+        value: input.pricePerGpuHourMicroUsd,
+      },
       { label: "Idempotency key", value: input.idempotencyKey },
     ],
     consequence:

package/src/admin-command-handlers.mjs

@@ -3,6 +3,7 @@ import { adminCreditHandlers } from "./admin-credits.mjs";
 import { adminEnrollmentHandlers } from "./admin-enrollment.mjs";
 import { adminNodeDiagnosticsHandlers } from "./admin-node-diagnostics.mjs";
 import { adminNodeLifecycleHandlers } from "./admin-node-lifecycle.mjs";
+import { adminNodeSanitizeHandlers } from "./admin-node-sanitize.mjs";
 import { ADMIN_MUTATION_SAFETY, assertAdminMutationContext } from "./admin-mutations.mjs";
 
 const handlers = [
@@ -11,6 +12,7 @@ const handlers = [
   ...adminEnrollmentHandlers,
   ...adminNodeDiagnosticsHandlers,
   ...adminNodeLifecycleHandlers,
+  ...adminNodeSanitizeHandlers,
 ];
 
 export function adminCommandHandler(capability) {
@@ -50,7 +52,6 @@ export function preflightAdminCommand(catalog, argv, runtime) {
       ...runtime,
       idempotencyKey: parsed.mutation?.idempotencyKey,
       safety: handler.safety,
-      yes: parsed.mutation?.yes,
     });
   }
   return { capabilityId: capability.id, command: command.join(" "), parsed };

package/src/admin-credits.mjs

@@ -2,7 +2,7 @@ import { ADMIN_MUTATION_SAFETY, AdminMutationError, runAdminMutation } from "./a
 import { parseSemanticArguments } from "./interaction-runtime.mjs";
 
 function parseGrant(argv, capability) {
-  const { $positionals, yes, organization, amountCents, note, idempotencyKey, ...extra } =
+  const { $positionals, organization, amountCents, note, idempotencyKey, ...extra } =
     parseSemanticArguments(argv);
   if ($positionals.length || Object.keys(extra).length) {
     throw new AdminMutationError(`Usage: ${capability.cli.vnext.human}`);
@@ -21,7 +21,6 @@ function parseGrant(argv, capability) {
     mutation: {
       idempotencyKey: parsed.data.adjustmentId,
       safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
-      yes: yes === true,
     },
   };
 }

package/src/admin-enrollment.mjs

@@ -11,15 +11,15 @@ const ENROLLMENT_LOG_READ_TIMEOUT_MS = 5_000;
 
 const USAGE = {
   "tokens.create":
-    "Usage: ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite] [--yes]",
-  "tokens.revoke":
-    "Usage: ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] [--yes] [--idempotency-key KEY]",
+    "Usage: ornn admin enrollment-tokens create --supplier UUID --expires-in SECONDS (--print | --output PATH) [--overwrite]",
+  "enrollment.token.revoke":
+    "Usage: ornn admin enrollment-tokens revoke <token-id> [--expected-created-at TIME] [--idempotency-key KEY]",
   "nodes.enroll":
-    "Usage: ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose] [--yes]",
+    "Usage: ornn admin nodes enroll <node-id> --host HOST --supplier UUID --facility UUID [--filter COMPARTMENT_IDS] --identity-file PATH --token-ttl SECONDS --replace-existing-management [--verbose]",
   "nodes.export-key":
     "Usage: ornn admin nodes export-key <node-id> (--print | --output PATH) [--overwrite]",
   "nodes.rotate-key":
-    "Usage: ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite] [--yes]",
+    "Usage: ornn admin nodes rotate-key <node-id> (--print | --output PATH) [--overwrite]",
 };
 
 function parseOptions(argv, { booleans = [], positionals, values }, usage) {
@@ -108,7 +108,7 @@ function parseTokenCreate(argv) {
   const { options } = parseOptions(
     argv,
     {
-      booleans: ["overwrite", "print", "yes"],
+      booleans: ["overwrite", "print"],
       positionals: 0,
       values: ["supplier", "expires-in", "output"],
     },
@@ -127,21 +127,22 @@ function parseTokenCreate(argv) {
     },
     mutation: {
       safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
-      yes: options.yes === true,
     },
   };
 }
 
 function parseTokenRevoke(argv) {
-  const usage = USAGE["tokens.revoke"];
+  const usage = USAGE["enrollment.token.revoke"];
   const { options, positionals } = parseOptions(
     argv,
-    { booleans: ["yes"], positionals: 1, values: ["expected-created-at", "idempotency-key"] },
+    { booleans: [], positionals: 1, values: ["expected-created-at", "idempotency-key"] },
     usage
   );
+  const tokenId = uuid(positionals[0], "token-id");
   return {
     input: {
-      token_id: uuid(positionals[0], "token-id"),
+      tokenId,
+      token_id: tokenId,
       ...(options["expected-created-at"]?.trim()
         ? { expected_created_at: options["expected-created-at"].trim() }
         : {}),
@@ -152,7 +153,6 @@ function parseTokenRevoke(argv) {
     mutation: {
       idempotencyKey: options["idempotency-key"]?.trim(),
       safety: ADMIN_MUTATION_SAFETY.reconcile,
-      yes: options.yes === true,
     },
   };
 }
@@ -162,7 +162,7 @@ function parseNodeEnroll(argv) {
   const { options, positionals } = parseOptions(
     argv,
     {
-      booleans: ["replace-existing-management", "verbose", "yes"],
+      booleans: ["replace-existing-management", "verbose"],
       positionals: 1,
       values: [
         "facility",
@@ -179,12 +179,9 @@ function parseNodeEnroll(argv) {
   );
   const filter = options.filter?.trim();
   if (!options["replace-existing-management"]) {
-    throw new AdminMutationError(
-      `${usage}\n--replace-existing-management is required and cannot be inferred by --yes.`,
-      {
-        field: "replace-existing-management",
-      }
-    );
+    throw new AdminMutationError(`${usage}\n--replace-existing-management is required.`, {
+      field: "replace-existing-management",
+    });
   }
   return {
     input: {
@@ -207,7 +204,6 @@ function parseNodeEnroll(argv) {
     },
     mutation: {
       safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
-      yes: options.yes === true,
     },
   };
 }
@@ -218,7 +214,7 @@ function parseNodeKey(argv, rotate) {
   const { options, positionals } = parseOptions(
     argv,
     {
-      booleans: rotate ? ["overwrite", "print", "yes"] : ["overwrite", "print"],
+      booleans: ["overwrite", "print"],
       positionals: 1,
       values: ["output"],
     },
@@ -233,7 +229,6 @@ function parseNodeKey(argv, rotate) {
       ? {
           mutation: {
             safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
-            yes: options.yes === true,
           },
         }
       : {}),
@@ -353,7 +348,7 @@ function reviewFor(capabilityId, input, prepared) {
       consequence: "Creates a bearer credential that can enroll a node until it expires.",
     };
   }
-  if (capabilityId === "tokens.revoke") {
+  if (capabilityId === "enrollment.token.revoke") {
     const target = prepared?.target;
     return {
       title: "Revoke enrollment token",
@@ -374,9 +369,7 @@ function reviewFor(capabilityId, input, prepared) {
         { label: "SSH target", value: `${input.username}@${input.host}:${input.port}` },
         { label: "Supplier", value: input.organization_id },
         { label: "Facility", value: input.facility_id },
-        ...(input.filter
-          ? [{ label: "Compartment filter", value: input.filter }]
-          : []),
+        ...(input.filter ? [{ label: "Compartment filter", value: input.filter }] : []),
         { label: "Token lifetime", value: `${input.expires_in_seconds} seconds` },
       ],
       consequence:
@@ -573,7 +566,7 @@ async function runEnrollmentMutation({ capability, execute, fetch, input, mutati
     assertSecretOutputContext(input, runtime);
     await refuseExistingOutput(input.export);
   }
-  if (capabilityId === "tokens.revoke" && runtime.machine && !input.expected_created_at) {
+  if (capabilityId === "enrollment.token.revoke" && runtime.machine && !input.expected_created_at) {
     throw new AdminMutationError(
       "Machine revocation requires --expected-created-at from the listed token generation.",
       { code: "exact_token_identity_required", field: "expected-created-at" }
@@ -585,7 +578,7 @@ async function runEnrollmentMutation({ capability, execute, fetch, input, mutati
     ...mutation,
     stdout: runtime.stderr ?? runtime.stdout,
     prepare: async () => {
-      if (capabilityId === "tokens.revoke") {
+      if (capabilityId === "enrollment.token.revoke") {
         const prepared = await execute(input);
         return {
           review: reviewFor(capabilityId, input, prepared),
@@ -599,7 +592,7 @@ async function runEnrollmentMutation({ capability, execute, fetch, input, mutati
       return { review: reviewFor(capabilityId, input), value: input };
     },
     reconcile:
-      capabilityId === "tokens.revoke"
+      capabilityId === "enrollment.token.revoke"
         ? async (value) => {
             if (value.prepared.disposition === "satisfied") {
               return {
@@ -635,7 +628,6 @@ async function runEnrollmentMutation({ capability, execute, fetch, input, mutati
     },
   });
 
-  if (execution.status === "declined") return { ...execution, suppressResult: true };
   if (!SECRET_OUTPUT.has(capabilityId)) return execution;
   const exported = await exportSecret({
     capabilityId,
@@ -655,7 +647,7 @@ export const adminEnrollmentHandlers = [
     safety: ADMIN_MUTATION_SAFETY.eligibleHumanOnly,
   },
   {
-    capabilityId: "tokens.revoke",
+    capabilityId: "enrollment.token.revoke",
     parse: parseTokenRevoke,
     run: runEnrollmentMutation,
     safety: ADMIN_MUTATION_SAFETY.reconcile,

package/src/admin-mutations.mjs

@@ -1,6 +1,5 @@
-import { createInterface } from "node:readline/promises";
-
 export const ADMIN_MUTATION_SAFETY = Object.freeze({
+  direct: "direct",
   eligibleHumanOnly: "eligible-human-only",
   reconcile: "reconcile",
 });
@@ -46,32 +45,8 @@ export function writeAdminMutationReview(stdout, review) {
   }
 }
 
-async function defaultNoConsent(stdin, stdout) {
-  const readline = createInterface({ input: stdin, output: stdout, terminal: false });
-  try {
-    const answer = await readline.question("Proceed? [y/N] ");
-    return /^(y|yes)$/i.test(answer.trim());
-  } catch (error) {
-    if (
-      error?.code === "ERR_USE_AFTER_CLOSE" ||
-      error?.code === "ABORT_ERR" ||
-      error?.name === "AbortError"
-    ) {
-      return false;
-    }
-    throw error;
-  } finally {
-    readline.close();
-  }
-}
-
-export function assertAdminMutationContext({
-  eligibleHuman,
-  idempotencyKey,
-  machine,
-  safety,
-  yes,
-}) {
+export function assertAdminMutationContext({ eligibleHuman, idempotencyKey, machine, safety }) {
+  if (safety === ADMIN_MUTATION_SAFETY.direct) return;
   if (safety === ADMIN_MUTATION_SAFETY.eligibleHumanOnly) {
     if (!eligibleHuman || machine) {
       throw new AdminMutationError(
@@ -86,12 +61,6 @@ export function assertAdminMutationContext({
       code: "admin_mutation_policy_missing",
     });
   }
-  if (!eligibleHuman && yes !== true) {
-    throw new AdminMutationError("Noninteractive admin mutations require --yes.", {
-      code: "consent_required",
-      field: "yes",
-    });
-  }
   if (!eligibleHuman && !idempotencyKey?.trim()) {
     throw new AdminMutationError(
       "Noninteractive admin mutations require --idempotency-key with a caller-stable value.",
@@ -100,12 +69,6 @@ export function assertAdminMutationContext({
   }
 }
 
-/**
- * Shared privileged-mutation gate. All noninteractive prerequisites are checked
- * before prepare/reconcile/execute can perform I/O. Domain handlers own semantic
- * validation and exact goal comparison; this function owns context safety,
- * normalized review, default-no consent, and the apply/satisfied/conflict flow.
- */
 export async function runAdminMutation({
   eligibleHuman,
   execute,
@@ -114,11 +77,9 @@ export async function runAdminMutation({
   prepare,
   reconcile,
   safety,
-  stdin,
   stdout,
-  yes = false,
 }) {
-  assertAdminMutationContext({ eligibleHuman, idempotencyKey, machine, safety, yes });
+  assertAdminMutationContext({ eligibleHuman, idempotencyKey, machine, safety });
   if (typeof prepare !== "function" || typeof execute !== "function") {
     throw new AdminMutationError("Admin mutation handler is incomplete.", {
       code: "admin_mutation_handler_incomplete",
@@ -132,8 +93,8 @@ export async function runAdminMutation({
 
   let prepared = await prepare();
   if (!prepared || typeof prepared !== "object") {
-    throw new AdminMutationError("Admin mutation preparation returned no review.", {
-      code: "admin_review_incomplete",
+    throw new AdminMutationError("Admin mutation preparation returned no operation.", {
+      code: "admin_preparation_invalid",
     });
   }
 
@@ -161,22 +122,11 @@ export async function runAdminMutation({
     }
     prepared = {
       ...prepared,
-      ...(reconciliation.review ? { review: reconciliation.review } : {}),
       ...(reconciliation.value !== undefined ? { value: reconciliation.value } : {}),
     };
   }
 
   if (!machine) writeAdminMutationReview(stdout, prepared.review);
-  if (eligibleHuman && yes !== true && !(await defaultNoConsent(stdin, stdout))) {
-    return {
-      data: { submitted: false },
-      exitCode: 1,
-      outcome: { class: "ended", phase: "declined" },
-      reconciled: false,
-      status: "declined",
-    };
-  }
-
   return {
     data: await execute(prepared.value),
     exitCode: 0,