How MUON governs the crew

When an agent's work crosses a boundary that matters — an edit outside the expected surface, a network call, a merge, a dangerous command — MUON files a gate and the agent waits. A few rules hold everywhere a gate appears (desktop, TUI, CLI):

• Every field of the request has to be readable before you decide: the exact action, its scope, the consequence and the bound evidence. Truncated text can never be approved.
• A native notification can deep-link to the full review — it can never let you approve directly from the notification itself.
• A decision is bound to the exact content it was made on. If the content changes after you've seen it, the old approval cannot be reused.
• A merge gate can be graph-certified: MUON reviews the diff against the code graph and either certifies it or names specific files REVIEW BLIND (new, unindexed, or a stale index) that a human has to read directly.

muon approve is the terminal client of the same queue. Resolving an approval requires operator authority.

muon approve list                       # every pending approval
muon approve review --approval-id <id>  # the full merge dossier: reviewer, artifact, checks, blockers
muon approve resolve --approval-id <id> --status approved   # or rejected

• muon approve review prints the whole review dossier: the reviewer of record, the exact artifact coordinates, the pull request checks, the landing state, and every blocker with the recovery that clears it. Add --routine to review the exact routine policy, or --certification-only for just the graph certification. For a blocked merge it also lists each REVIEW BLIND file and the artifact digest you attest against.
• --remember <ttlMs> on muon approve resolve mints a content-bound receipt so one exact action is auto-allowed until it expires (60000–3600000 ms, i.e. 1 minute to 1 hour) — never a blanket allow. It cannot be combined with a rejection.
• --remember-scope <once | session | always> is the graded replacement for --remember: once remembers nothing, session covers this run for one hour, always covers this exact action in this chat for seven days and is revocable. The expiry is computed by the brain, and the two flags cannot be combined.
• --attest-review-blind <artifactDigest> is how you approve a merge over REVIEW BLIND files: after muon approve review, pass the 64-character artifact digest it printed to attest that every listed blind file was read. A merge or ship is never remembered, so this cannot be combined with --remember or --remember-scope.
• --acknowledge-routine <recipeDigest> explicitly acknowledges a routine policy's exact recipe digest after muon approve review --routine.

Every memory note carries exactly one of four tiers, computed by one shared rule so the desktop, TUI and CLI can never describe the same note differently.

The pre-edit gate only ever shows trusted decision text; a contested or pending proposal shows as existence-only until you explicitly ask to read it and confirm or reject it. Untrusted note text can never reach an agent through that gate as if it were a decision.

Full-auto lets you pre-authorize approvals instead of clicking through each one — but it is consent you grant, not a mode that removes the gate.

• Scoped, not global by construction. Arm it for every lane, or for specific vendor lanes only; a request MUON cannot attribute to a resolvable lane is not covered by a partial selection.
• It cannot cover everything. Egress actions and blocked merge reviews still ask, always. A merge needing an operator attestation over REVIEW BLIND files is exactly what full-auto cannot manufacture.
• Every grant is an audited decision. Each auto-approval goes through the identical operator-tier resolve path a manual click uses, leaving a receipt naming the action and scope it covered.
• It fails back to you, visibly. If a standing grant is refused or hasn't landed within its grace window, the request drops back to an ordinary blocking prompt.

Standing consent is stored by the brain and shared by the desktop's Auto-approve lanes and the muon consent CLI:

muon consent status                 # every live record and per-lane coverage
muon consent set --vendors all      # machine-wide, never expires
muon consent set --vendors codex,claude --session   # one hour, kept alive until Ctrl-C
muon consent clear                  # revoke every record

A record is honoured only while a standing approver is watching. A plain muon consent set --vendors all writes a record that never expires and leaves the watch to whichever surface holds the lease; --session writes a one-hour record and keeps the lease alive for as long as that terminal lives, then clears itself on Ctrl-C. muon consent status says whether anyone is watching.

Everything above rests on one separation: the operator token can govern (approve, confirm memory, resize the fleet); the agent token can only do (dispatch work, propose memory, read the graph). A UI surface never holds the raw operator token itself, and an MCP server — including one attached to a session you launched — can only ever present the agent tier. There is no code path where an agent-held credential decides a gate.