Governance
How MUON governs the crew
MUON separates two roles everywhere: an operator (you, holding an operator-tier credential) decides; an agent (any dispatched worker, or a session with MUON's MCP server attached) does. Nothing an agent holds can approve, confirm memory, or answer a gate — enforced by which token a caller presents, not by convention.
Approval gates
When an agent's work crosses a boundary that matters — an edit outside the expected surface, a network call, a merge, a dangerous command — MUON files a gate and the agent waits. A few rules hold everywhere a gate appears (desktop, TUI, CLI):
- Every field of the request has to be readable before you decide: the exact action, its scope, the consequence and the bound evidence. Truncated text can never be approved.
- A native notification can deep-link to the full review — it can never let you approve directly from the notification itself.
- A decision is bound to the exact content it was made on. If the content changes after you've seen it, the old approval cannot be reused.
- A merge gate can be graph-certified: MUON reviews the diff against the code graph and either certifies it or names specific files REVIEW BLIND (new, unindexed, or a stale index) that a human has to read directly.
--remember <ttlMs>on the CLI mints a content-bound receipt so one exact action is auto-allowed until it expires (1 minute to 1 hour) — never a blanket allow, and never available for a merge or ship decision.
Memory tiers
Every memory note carries exactly one of four tiers, computed by one shared rule so the desktop, TUI and CLI can never describe the same note differently.
human-confirmed
A person confirmed it. The only tier that unlocks global-scope promotion, pack export and destructive-write protection.
MUON-vouched
The crew's coordinator vouched for it on the record. Settled and durable, but not human-confirmed.
crew-auto
Crew-visible only under an operator's explicit auto-confirm posture — nobody has actually vouched for it.
pending / open
Nobody vouched and nothing is carrying it — the one tier that is a debt. A note that lapses returns here regardless of what once vouched for it.
The pre-edit gate only ever shows trusted decision text; a contested or pending proposal shows as existence-only until you explicitly ask to read it and confirm or reject it. Untrusted note text can never reach an agent through that gate as if it were a decision.
Full-auto: standing operator consent
Full-auto lets you pre-authorize approvals instead of clicking through each one — but it is consent you grant, not a mode that removes the gate.
- Scoped, not global by construction. Arm it for every lane, or for specific vendor lanes only; a request MUON cannot attribute to a resolvable lane is not covered by a partial selection.
- It cannot cover everything. Egress actions and blocked merge reviews still ask, always. A merge needing an operator attestation over REVIEW BLIND files is exactly what full-auto cannot manufacture.
- Every grant is an audited decision. Each auto-approval goes through the identical operator-tier resolve path a manual click uses, leaving a receipt naming the action and scope it covered.
- It fails back to you, visibly. If a standing grant is refused or hasn't landed within its grace window, the request drops back to an ordinary blocking prompt.
What never happens
No vendor token custody
You log in to each coding agent with its own CLI, or use your own BYOK credential. MUON only observes readiness and, for supported BYOK setups, forwards the one selected credential variable to the one selected child process. It never stores, proxies, or logs you into a vendor account.
No data egress by default
MUON is loopback-only and local-first. The sole MUON-owned outbound call is the opt-in update check described in Install — off by default. Vendor model traffic remains vendor-owned; MUON does not add a hop to it or read its contents.
No telemetry upload
MUON's telemetry module ships with a fixed provider of “none” — there is no uploader in the code at all. Events are spooled locally as a bounded, enum-only vocabulary with no free-text field, for local crash diagnostics and as an inspectable audit artifact.
Two tokens, one gate
Everything above rests on one separation: the operator token can govern (approve, confirm memory, resize the fleet); the agent token can only do (dispatch work, propose memory, read the graph). A UI surface never holds the raw operator token itself, and an MCP server — including one attached to a session you launched — can only ever present the agent tier. There is no code path where an agent-held credential decides a gate.