@mokoenterprises/mokogit-mcp 1.16.0 → 1.17.1

package/.mokogit/ISSUE_TEMPLATE/config.yml

@@ -2,16 +2,16 @@
 blank_issues_enabled: true
 contact_links:
   - name: 💼 Enterprise Support
-    url: https://mokoconsulting.tech/enterprise
+    url: https://mokoenterprises.us/enterprise
     about: Enterprise-level support and consultation services
   - name: 💬 Ask a Question
-    url: https://mokoconsulting.tech/
+    url: https://mokoenterprises.us/
     about: Get help or ask questions through our website
   - name: 📚 MokoCLI Documentation
-    url: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+    url: https://git.mokoenterprises.us/MokoEnterprises/mokocli
     about: View our coding standards and best practices
   - name: 🔒 Report a Security Vulnerability
-    url: https://git.mokoconsulting.tech/MokoConsulting/.github-private/security/advisories/new
+    url: https://git.mokoenterprises.us/MokoEnterprises/.github-private/security/advisories/new
     about: Report security vulnerabilities privately (for critical issues)
   - name: 💡 Community Discussions
     url: https://github.com/orgs/mokoconsulting-tech/discussions

package/.mokogit/ISSUE_TEMPLATE/feature_request.md

@@ -37,7 +37,7 @@ If you have ideas about how this could be implemented, share them here:
 Add any other context, mockups, or screenshots about the feature request here.
 
 ## Relevant Standards
-Does this relate to any standards in [MokoCLI](https://git.mokoconsulting.tech/MokoConsulting/mokocli)?
+Does this relate to any standards in [MokoCLI](https://git.mokoenterprises.us/MokoEnterprises/mokocli)?
 - [ ] Accessibility (WCAG 2.1 AA)
 - [ ] Localization (en_US/en_GB)
 - [ ] Security best practices

package/.mokogit/ISSUE_TEMPLATE/security.md

@@ -35,7 +35,7 @@ Use this template only for:
 <!-- Describe how this could be addressed -->
 
 ## Standards Reference
-Does this relate to security standards in [MokoCLI](https://git.mokoconsulting.tech/MokoConsulting/mokocli)?
+Does this relate to security standards in [MokoCLI](https://git.mokoenterprises.us/MokoEnterprises/mokocli)?
 - [ ] SPDX license identifiers
 - [ ] Secret management
 - [ ] Dependency security

package/.mokogit/actions/resolve-source-dir/action.yml

@@ -1,4 +1,4 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 name: "Resolve source dir"

package/.mokogit/workflows/apidocs.yml

@@ -1,10 +1,10 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/apidocs.yml
 #
 # apidocs.yml — UNIVERSAL API-docs → wiki (synced to every repo via the universal
@@ -62,9 +62,9 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1 || true
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/docs_php_reference.php ]; then
             echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
             echo "Installed mokocli fresh from the Composer registry."
@@ -128,12 +128,12 @@ jobs:
           if [ -z "$TOKEN" ]; then echo "::warning::no MOKOGIT_TOKEN — skipping wiki publish"; exit 0; fi
           REPO="${{ github.event.repository.name }}"; OWNER="${{ github.repository_owner }}"
           rm -rf /tmp/wiki
-          if ! git clone -q "https://x-access-token:${TOKEN}@git.mokoconsulting.tech/${OWNER}/${REPO}.wiki.git" /tmp/wiki 2>/dev/null; then
+          if ! git clone -q "https://x-access-token:${TOKEN}@git.mokoenterprises.us/${OWNER}/${REPO}.wiki.git" /tmp/wiki 2>/dev/null; then
             echo "::warning::wiki clone failed (wiki may not be initialised) — skipping"; exit 0
           fi
           cp "$FILE" "/tmp/wiki/${PAGE}.md"
           cd /tmp/wiki
-          git config user.name "Moko Consulting"; git config user.email "hello@mokoconsulting.tech"
+          git config user.name "Moko Enterprises"; git config user.email "hello@mokoenterprises.us"
           git add -A
           if git diff --cached --quiet; then echo "wiki already up to date"; exit 0; fi
           git commit -q -m "docs(wiki): update ${PAGE} (moko ${{ steps.gen.outputs.kind }} docs) [skip ci]"

package/.mokogit/workflows/auto-assign.yml

@@ -1,4 +1,4 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION

package/.mokogit/workflows/auto-dev-issue.yml

@@ -1,6 +1,6 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
-# This file is part of a Moko Consulting project.
+# This file is part of a Moko Enterprises project.
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #

package/.mokogit/workflows/auto-release.yml

@@ -1,14 +1,14 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/auto-release.yml
-# VERSION: 07.24.00
-# BRIEF: NEW (07.24.00): npmjs.org publish now FAILS LOUD (::error:: + exit $rc) on an AUTHORIZATION error (404 "not in this registry" / 401 / 403 / ENEEDAUTH / EOTP) instead of swallowing EVERY failure as a non-failing ::warning:: — a missing-scope / unauthorized / revoked / expired NPM_TOKEN previously hid behind a green release fleet-wide (the "secondary registry, not failing the run" catch masked a 404 PUT, which is exactly how npm reports an unauthorized scoped write; CI had in fact NEVER successfully published any MCP package to npmjs while every run reported success). Transient/5xx/network failures still stay a non-failing ::warning:: (npmjs is the SECONDARY mirror; the MokoGIT registry is primary and already hard-fails), and an unset NPM_TOKEN still skips cleanly — so repos that do not publish to npmjs are 100% unaffected. PREVIOUS (07.23.00): "Vendor PHP dependencies (build-time)" added to BOTH publish legs (promote-rc + stable) — this workflow had NO build-time composer vendoring at all, so any component declaring runtime PHP deps via a sub-package composer.json (vendor-dir admin/vendor, e.g. mPDF in MokonyxCRM/MokonyxCRMDCM) shipped its rc/stable zip WITHOUT admin/vendor while the component manifest lists <folder>vendor</folder> — JInstaller then aborts the ENTIRE package install on-site ("File does not exist [ROOT][TMP]/.../admin/vendor" → "Failed to copy administrator files"). The step mirrors pre-release.yml 07.15.00: no-op without a sub-package composer.json; provisions ext-gd when missing (the release runners' php-cli lacks it, which failed mpdf dependency RESOLUTION outright); verifies the CONFIGURED vendor-dir (composer config vendor-dir) materialized autoload.php; FAILS the build loud when vendoring fails for a package whose manifest ships <folder>vendor</folder> (a green build with an install-bricking artifact is strictly worse than a red build); fail-soft warning for packages whose manifests do not reference vendor/. Runs before `moko publish` (release_publish.php → release_package.php zips the plain working tree; vendor/ was never excluded — the tree simply never had it in CI). PREVIOUS (07.22.00): #498 — the #469 SRC_DIR gate no longer self-traps, and the fast-merge guard is MINOR-identity aware (fixes stable version never advancing; MokoCLI stuck re-publishing v10.20.00). (1) The gate read SRC_DIR with grep|sed, capturing the LITERAL unexpanded `$(shell …)` from the fleet-standard `SRC_DIR := $(shell [ -d src ] && echo src || echo source)` — an unmatchable directory that forced should_bump=false on EVERY push even when source changed. It now resolves SRC_DIR via `make --eval` expansion, falls back to the grep|sed read only if make is unavailable, nulls out a still-unexpanded `$(...)`/backtick value, and treats a declared-but-NONEXISTENT SRC_DIR (repos with code in cli/lib/bin, not src/source) as the non-source denylist fallback instead of an unmatchable INCLUSION prefix. (2) The "Guarantee monotonic release version (fast-merge bump guard)" compared the FULL version, so dev's per-merge PATCH bumps (10.20.00→10.20.04) fooled it into "normal path, no heal" and it re-published the already-released vMAJOR.MINOR.00. It now compares the MINOR identity (MAJOR.MINOR), so a fast dev→stable merge with no promote-rc cuts a new MINOR. Fleet-wide release-semantics change — validate on one repo before syncing. PREVIOUS (07.21.00): #469 — gate the version BUMP on whether the push touched the Makefile SRC_DIR. The former non-code paths-ignore denylist on the push trigger is REMOVED: a docs/workflow/sample push no longer skips the pipeline, it now RUNS in no-bump "update the existing stable release in place" mode (re-stamps the UNCHANGED current version via the existing `moko publish --bump none --no-commit`, refreshes notes/assets, no version advance, no new vNN tag). A new early step "Resolve SRC_DIR bump gate (#469)" (id: srcgate) decides should_bump: (1) ELECTRON (file-detected) or opt-out vars.RELEASE_SRCDIR_GATE=off -> BYPASS, always bump as today (electron has NO source dir, so a naive SRC_DIR test would never bump — a release-breaking trap); (2) else SRC_DIR is REQUIRED — a non-electron repo with no resolvable SRC_DIR FAILS LOUD (::error:: + exit 1), never silently never-bump; (3) else diff the push range (github.event.before..GITHUB_SHA, with a HEAD^1 / merge-base fallback) intersected with ${SRC_DIR}/ — source hit -> should_bump=true, none -> should_bump=false. workflow_dispatch always bumps. The self-heal monotonic bump + the new vNN semver tag are now gated on should_bump!='false' so no-bump mode keeps the version PUT; the publish + "Update release notes and reconcile changelog" (channel-pointer resolution) run on BOTH paths to refresh the current release. Loop-safety is unchanged: the job if: still re-checks [skip ci]/[skip sync], so the workflow's own commits never re-trigger. Fleet-wide release-semantics change — validate on one repo before syncing. PREVIOUS (07.20.00): the dev/promote bump + release steps now name the per-run token env var GITHUB_TOKEN (was the misleadingly-named MOKOGIT_TOKEN; the VALUE was always ${{ github.token }}). All token use in this workflow is SAME-REPO (release API, the release_bump_dev dev base bump, pushes to its own repo) — the org MOKOGIT_TOKEN secret is not referenced here. Naming-only; no behavior change. Mirrors the pre-release.yml fix (MokoGIT#1721). PREVIOUS: NEW (07.19.00): #1621 Phase 6 / .mokogit-private#76 — resolve the CURRENT stable release by its CHANNEL POINTER, not by a fixed tag_name=stable. Under version-primary releases (a release is born with the immutable tag_name=vNN and `stable`/`rc` attached as movable is_channel tags), GET /releases/tags/stable no longer resolves the current stable release, which would break two steps that read "the last released version". Both now call GET /repos/{owner}/{repo}/releases/channel/stable (#1702 — resolves whichever release the `stable` channel points at via ReleaseStreamMap) with a GRACEFUL FALLBACK to the legacy GET /releases/tags/stable for forges predating #1702 (the channel route 404s pre-rollout and the rolling `stable` tag still exists). (1) The monotonic-version guard ("Guarantee monotonic release version") resolves ROLLING_LAST by parsing the same `VERSION: NN.NN.NN` out of the channel-resolved release NAME. (2) "Update release notes and reconcile changelog" resolves the stable RELEASE_ID + VERSION the same channel-first way. The #386 integrity gate is UNCHANGED (it already keys off the immutable vNN version tag). SEQUENCING unchanged: do NOT enable in prod until #1702 server support is on stable/prod; works pre-#1702 via the fallback. PREVIOUS (07.18.00): #1621 Phase 6 — version/* BRANCHES retired in favor of dual-tagged version RELEASES. REMOVED three now-redundant steps: "Step 12: Create version branch from main", "Step 13: Prune superseded-major version branches", and "Advance rolling channel tag via git". A release's permanent version identity is now the git tag v<version>, attached by the publish as a MOVABLE channel tag on the dual-tagged release (MokoCLI release_publish -> release_create channel_tags[]/update_stream; the forge attaches/moves the tag at the release commit via AttachChannelTag server-side) — so a new cut is born dual-tagged (rolling `stable`/`release-candidate` primary tag + permanent v<version> channel tag) and the channel tag MOVES onto the new release instead of a new version/* branch being created. The rolling `stable` tag is still pinned by release_create forceTagRef() (#808), so the "Advance rolling channel tag" force-push was redundant. KEPT UNCHANGED: "Create semver tag" (v<version>), the #386 integrity gate (still resolves tags/stable to the built commit), and the monotonic guard (still reads the stable release name VERSION: NN.NN.NN). Pruning EXISTING version/* branches is a SEPARATE one-time manual reconcile — not done here. SEQUENCING: do NOT enable in prod until the #1621 SERVER channel_tags support is on stable/prod. PREVIOUS (07.17.00): Setup MokoCLI tools no longer installs a STALE mokocli during the registry publish-lag window (#1671). After the fresh registry install, the step now compares the installed /tmp/mokocli PROJECT_VERSION against the /opt/mokocli failsafe and PREFERS whichever is NEWER (sort -V), and the opportunistic /opt refresh is gated to only move FORWARD (never downgrade /opt when it is the newer, just-deployed copy). Backward-compatible: runners with no /opt/mokocli use the registry copy exactly as before. PREVIOUS (07.16.00): release-integrity + dev-channel fixes. (1) A new pre-publish "no stale (pre-merge) tree" guard (#428/MokoCLI#901) hard-FAILS the release if the triggering GITHUB_SHA is an ANCESTOR of the current branch tip (a concurrent merge landed mid-run) -- otherwise a green, version-bumped release silently ships old code missing that merge (reproduced: built ef8c1a5d while tip was 2740342). Fail-open on any unresolved/replica-lagged tip so a good release is never falsely blocked. Complements the mokocli engine assertion (packaged-tree == GITHUB_SHA), which cannot see that GITHUB_SHA itself trails the tip. (2) The "Post-release: Reset dev version" safety-net (#309/MokoCLI#900) no longer swallows failure: a failed dev-advance now emits ::error:: + a job-summary block (dev-channel would trail stable), and a SUCCESSFUL advance dispatches pre-release.yml (development) to actually publish the leading dev build -- the advance commit is [skip ci]+paths-ignored and never auto-fires. Stays green (continue-on-error) since stable already published. NEW (07.15.00): the rolling stable channel tag is now advanced via a git force-push BEFORE the #386 integrity gate. MokoGIT's tags API 405s on the release-attached `stable` tag, so release_publish.php could not move it ("Could not pin tag stable ... HTTP 405") and every Joomla/electron stable cut left the tag lagging the freshly-built commit -- red-failing a correct release on the integrity gate. A new step git-force-pushes refs/tags/stable to the built HEAD (force-push allowlist -- the same escape hatch the rc BRANCH pin already uses), so the gate passes and no manual tag repoint is needed. PREVIOUS (07.14.00): integrity gate #386 no longer false-fails. It compared the published tag against GITHUB_SHA (the triggering commit), but the publish step commits the CHANGELOG entry ("build NN.NN.NN [skip ci]") and mokocli pins the channel tag + semver tag to that POST-PUBLISH HEAD -- so every cut whose CHANGELOG wasn't pre-seeded on dev (e.g. a version set straight on the release branch) diverged by one commit and red-failed a correct release. The gate now compares against the actual built/published HEAD (git rev-parse HEAD, falling back to GITHUB_SHA), which equals what the tag is pinned to in both the commit and no-commit cases while still catching a tag pinned to a commit we did NOT build; the semver tag is pinned to the same built HEAD for consistency. PREVIOUS (07.13.00): RC is ON-DEMAND ONLY. The `pull_request` trigger (RC-preview on a PR to main/stable) is REMOVED and the promote-rc job now runs solely on workflow_dispatch action=promote-rc. Only dev + stable release automatically (dev via pre-release.yml push->dev; stable via the push->main release job here); alpha/beta/rc never auto-cut. PREVIOUS (07.12.00): electron repos create NO release on ANY channel (RC enabled=false + stable publish/tag/notes/integrity guarded on is_electron; opt back in with vars.ELECTRON_CI_BUILD=true) and build NO installer in CI — always built locally + uploaded manually; the dev/promote version BUMP still runs. Template-Generic #390. NEW (07.11.00): the electron installer build/attach steps (electron-builder via Wine/Xvfb) are gated to MANUAL workflow_dispatch only (`&& github.event_name == 'workflow_dispatch'`). An automatic push no longer auto-builds electron installers (heavy ~90m, runner-fragile — OOM/Wine-zombie; migrating to mokocli ElectronPackager, MokoCLI #756/#758). The version bump, CHANGELOG, tag and npm publish STILL run on push — only the electron installer is skipped and pushed MANUALLY via dispatch. Non-electron platforms (joomla/go/npm) unaffected. Template-Generic #390. Universal build & release - BUMP-ON-DEV: base version + CHANGELOG promoted on dev pre-promotion (promote-rc), main publishes --bump none --no-commit so it never diverges from dev. MokoCLI build agent (moko publish). NEW (07.06.00): npm stable publishing ABSORBED here from Template-NPM's retired npm-publish.yml as npm-gated dual-registry steps (MokoGIT registry via per-run token + npmjs.org best-effort), replacing the former npm-publish.yml dispatch. No-Makefile repos SKIP the release job gracefully (green) instead of failing. Conflict-marker scan reads git-tracked files only (git ls-files | xargs grep) so vendored/generated trees can't false-match. NEW (07.07.00): npm stamp normalizes the zero-padded Makefile PROJECT_VERSION (NN.NN.NN) to strict semver via awk before `npm version`, and an unstampable version now HARD-FAILS instead of silently keeping the old package.json version (#382). NEW (07.00.00): `moko assets:optimize` artifact-time step added before publish (graceful-skip on non-asset repos); Setup MokoCLI tools makes the fresh `moko` executable + first on PATH to fix exit-126 (mokocli #650).
+# VERSION: 07.25.01
+# BRIEF: NEW (07.25.01): consistency follow-up to 07.25.00 — the monotonic self-heal's DEV CARRY-FORWARD now also bumps PATCH, not MINOR. After the self-heal patch-bumps the stable base, it carries that bump forward to dev via `release_bump_dev.php --path . --branch dev --bump patch` (was `--bump minor`), so a direct-push / fast-merge hotfix does NOT inflate the dev base by a full minor — dev and stable stay aligned on the PATCH heal. UNCHANGED: the promote-rc job's planned-release dev PRE-bump (`release_bump_dev.php --path . --branch dev --bump minor`) still stays MINOR; only the self-heal carry-forward inside the fast-merge bump guard changes minor->patch. PREVIOUS (07.25.00): the "Guarantee monotonic release version (fast-merge bump guard)" self-heal now bumps PATCH, not MINOR. On a push to stable whose version was NOT pre-bumped on dev — a direct admin push, or a fast dev->stable merge that landed before promote-rc ran its dev pre-bump — the monotonic guard previously self-healed with a MINOR bump (`version_bump.php --minor --min-version "$LAST"`), minting a new MINOR for an unplanned change. It now self-heals with a PATCH bump (`version_bump.php --patch --min-version "$LAST"`), matching hotfix / direct-admin-push semantics: `--min-version "$LAST"` still guarantees the healed version is strictly above the last release, so monotonicity is preserved. PLANNED ladder releases are UNCHANGED — the promote-rc dev pre-bump (`release_bump_dev.php --bump minor`) and the stable `moko publish --bump none --no-commit` are untouched; only the non-pre-bumped self-heal path changes minor->patch. The dev side already patch-bumps per push (pre-release.yml `release_bump_dev.php --branch dev --bump patch`), so the healed PATCH carries forward consistently. PREVIOUS (07.24.00): npmjs.org publish now FAILS LOUD (::error:: + exit $rc) on an AUTHORIZATION error (404 "not in this registry" / 401 / 403 / ENEEDAUTH / EOTP) instead of swallowing EVERY failure as a non-failing ::warning:: — a missing-scope / unauthorized / revoked / expired NPM_TOKEN previously hid behind a green release fleet-wide (the "secondary registry, not failing the run" catch masked a 404 PUT, which is exactly how npm reports an unauthorized scoped write; CI had in fact NEVER successfully published any MCP package to npmjs while every run reported success). Transient/5xx/network failures still stay a non-failing ::warning:: (npmjs is the SECONDARY mirror; the MokoGIT registry is primary and already hard-fails), and an unset NPM_TOKEN still skips cleanly — so repos that do not publish to npmjs are 100% unaffected. PREVIOUS (07.23.00): "Vendor PHP dependencies (build-time)" added to BOTH publish legs (promote-rc + stable) — this workflow had NO build-time composer vendoring at all, so any component declaring runtime PHP deps via a sub-package composer.json (vendor-dir admin/vendor, e.g. mPDF in MokonyxCRM/MokonyxCRMDCM) shipped its rc/stable zip WITHOUT admin/vendor while the component manifest lists <folder>vendor</folder> — JInstaller then aborts the ENTIRE package install on-site ("File does not exist [ROOT][TMP]/.../admin/vendor" → "Failed to copy administrator files"). The step mirrors pre-release.yml 07.15.00: no-op without a sub-package composer.json; provisions ext-gd when missing (the release runners' php-cli lacks it, which failed mpdf dependency RESOLUTION outright); verifies the CONFIGURED vendor-dir (composer config vendor-dir) materialized autoload.php; FAILS the build loud when vendoring fails for a package whose manifest ships <folder>vendor</folder> (a green build with an install-bricking artifact is strictly worse than a red build); fail-soft warning for packages whose manifests do not reference vendor/. Runs before `moko publish` (release_publish.php → release_package.php zips the plain working tree; vendor/ was never excluded — the tree simply never had it in CI). PREVIOUS (07.22.00): #498 — the #469 SRC_DIR gate no longer self-traps, and the fast-merge guard is MINOR-identity aware (fixes stable version never advancing; MokoCLI stuck re-publishing v10.20.00). (1) The gate read SRC_DIR with grep|sed, capturing the LITERAL unexpanded `$(shell …)` from the fleet-standard `SRC_DIR := $(shell [ -d src ] && echo src || echo source)` — an unmatchable directory that forced should_bump=false on EVERY push even when source changed. It now resolves SRC_DIR via `make --eval` expansion, falls back to the grep|sed read only if make is unavailable, nulls out a still-unexpanded `$(...)`/backtick value, and treats a declared-but-NONEXISTENT SRC_DIR (repos with code in cli/lib/bin, not src/source) as the non-source denylist fallback instead of an unmatchable INCLUSION prefix. (2) The "Guarantee monotonic release version (fast-merge bump guard)" compared the FULL version, so dev's per-merge PATCH bumps (10.20.00→10.20.04) fooled it into "normal path, no heal" and it re-published the already-released vMAJOR.MINOR.00. It now compares the MINOR identity (MAJOR.MINOR), so a fast dev→stable merge with no promote-rc cuts a new MINOR. Fleet-wide release-semantics change — validate on one repo before syncing. PREVIOUS (07.21.00): #469 — gate the version BUMP on whether the push touched the Makefile SRC_DIR. The former non-code paths-ignore denylist on the push trigger is REMOVED: a docs/workflow/sample push no longer skips the pipeline, it now RUNS in no-bump "update the existing stable release in place" mode (re-stamps the UNCHANGED current version via the existing `moko publish --bump none --no-commit`, refreshes notes/assets, no version advance, no new vNN tag). A new early step "Resolve SRC_DIR bump gate (#469)" (id: srcgate) decides should_bump: (1) ELECTRON (file-detected) or opt-out vars.RELEASE_SRCDIR_GATE=off -> BYPASS, always bump as today (electron has NO source dir, so a naive SRC_DIR test would never bump — a release-breaking trap); (2) else SRC_DIR is REQUIRED — a non-electron repo with no resolvable SRC_DIR FAILS LOUD (::error:: + exit 1), never silently never-bump; (3) else diff the push range (github.event.before..GITHUB_SHA, with a HEAD^1 / merge-base fallback) intersected with ${SRC_DIR}/ — source hit -> should_bump=true, none -> should_bump=false. workflow_dispatch always bumps. The self-heal monotonic bump + the new vNN semver tag are now gated on should_bump!='false' so no-bump mode keeps the version PUT; the publish + "Update release notes and reconcile changelog" (channel-pointer resolution) run on BOTH paths to refresh the current release. Loop-safety is unchanged: the job if: still re-checks [skip ci]/[skip sync], so the workflow's own commits never re-trigger. Fleet-wide release-semantics change — validate on one repo before syncing. PREVIOUS (07.20.00): the dev/promote bump + release steps now name the per-run token env var GITHUB_TOKEN (was the misleadingly-named MOKOGIT_TOKEN; the VALUE was always ${{ github.token }}). All token use in this workflow is SAME-REPO (release API, the release_bump_dev dev base bump, pushes to its own repo) — the org MOKOGIT_TOKEN secret is not referenced here. Naming-only; no behavior change. Mirrors the pre-release.yml fix (MokoGIT#1721). PREVIOUS: NEW (07.19.00): #1621 Phase 6 / .mokogit-private#76 — resolve the CURRENT stable release by its CHANNEL POINTER, not by a fixed tag_name=stable. Under version-primary releases (a release is born with the immutable tag_name=vNN and `stable`/`rc` attached as movable is_channel tags), GET /releases/tags/stable no longer resolves the current stable release, which would break two steps that read "the last released version". Both now call GET /repos/{owner}/{repo}/releases/channel/stable (#1702 — resolves whichever release the `stable` channel points at via ReleaseStreamMap) with a GRACEFUL FALLBACK to the legacy GET /releases/tags/stable for forges predating #1702 (the channel route 404s pre-rollout and the rolling `stable` tag still exists). (1) The monotonic-version guard ("Guarantee monotonic release version") resolves ROLLING_LAST by parsing the same `VERSION: NN.NN.NN` out of the channel-resolved release NAME. (2) "Update release notes and reconcile changelog" resolves the stable RELEASE_ID + VERSION the same channel-first way. The #386 integrity gate is UNCHANGED (it already keys off the immutable vNN version tag). SEQUENCING unchanged: do NOT enable in prod until #1702 server support is on stable/prod; works pre-#1702 via the fallback. PREVIOUS (07.18.00): #1621 Phase 6 — version/* BRANCHES retired in favor of dual-tagged version RELEASES. REMOVED three now-redundant steps: "Step 12: Create version branch from main", "Step 13: Prune superseded-major version branches", and "Advance rolling channel tag via git". A release's permanent version identity is now the git tag v<version>, attached by the publish as a MOVABLE channel tag on the dual-tagged release (MokoCLI release_publish -> release_create channel_tags[]/update_stream; the forge attaches/moves the tag at the release commit via AttachChannelTag server-side) — so a new cut is born dual-tagged (rolling `stable`/`release-candidate` primary tag + permanent v<version> channel tag) and the channel tag MOVES onto the new release instead of a new version/* branch being created. The rolling `stable` tag is still pinned by release_create forceTagRef() (#808), so the "Advance rolling channel tag" force-push was redundant. KEPT UNCHANGED: "Create semver tag" (v<version>), the #386 integrity gate (still resolves tags/stable to the built commit), and the monotonic guard (still reads the stable release name VERSION: NN.NN.NN). Pruning EXISTING version/* branches is a SEPARATE one-time manual reconcile — not done here. SEQUENCING: do NOT enable in prod until the #1621 SERVER channel_tags support is on stable/prod. PREVIOUS (07.17.00): Setup MokoCLI tools no longer installs a STALE mokocli during the registry publish-lag window (#1671). After the fresh registry install, the step now compares the installed /tmp/mokocli PROJECT_VERSION against the /opt/mokocli failsafe and PREFERS whichever is NEWER (sort -V), and the opportunistic /opt refresh is gated to only move FORWARD (never downgrade /opt when it is the newer, just-deployed copy). Backward-compatible: runners with no /opt/mokocli use the registry copy exactly as before. PREVIOUS (07.16.00): release-integrity + dev-channel fixes. (1) A new pre-publish "no stale (pre-merge) tree" guard (#428/MokoCLI#901) hard-FAILS the release if the triggering GITHUB_SHA is an ANCESTOR of the current branch tip (a concurrent merge landed mid-run) -- otherwise a green, version-bumped release silently ships old code missing that merge (reproduced: built ef8c1a5d while tip was 2740342). Fail-open on any unresolved/replica-lagged tip so a good release is never falsely blocked. Complements the mokocli engine assertion (packaged-tree == GITHUB_SHA), which cannot see that GITHUB_SHA itself trails the tip. (2) The "Post-release: Reset dev version" safety-net (#309/MokoCLI#900) no longer swallows failure: a failed dev-advance now emits ::error:: + a job-summary block (dev-channel would trail stable), and a SUCCESSFUL advance dispatches pre-release.yml (development) to actually publish the leading dev build -- the advance commit is [skip ci]+paths-ignored and never auto-fires. Stays green (continue-on-error) since stable already published. NEW (07.15.00): the rolling stable channel tag is now advanced via a git force-push BEFORE the #386 integrity gate. MokoGIT's tags API 405s on the release-attached `stable` tag, so release_publish.php could not move it ("Could not pin tag stable ... HTTP 405") and every Joomla/electron stable cut left the tag lagging the freshly-built commit -- red-failing a correct release on the integrity gate. A new step git-force-pushes refs/tags/stable to the built HEAD (force-push allowlist -- the same escape hatch the rc BRANCH pin already uses), so the gate passes and no manual tag repoint is needed. PREVIOUS (07.14.00): integrity gate #386 no longer false-fails. It compared the published tag against GITHUB_SHA (the triggering commit), but the publish step commits the CHANGELOG entry ("build NN.NN.NN [skip ci]") and mokocli pins the channel tag + semver tag to that POST-PUBLISH HEAD -- so every cut whose CHANGELOG wasn't pre-seeded on dev (e.g. a version set straight on the release branch) diverged by one commit and red-failed a correct release. The gate now compares against the actual built/published HEAD (git rev-parse HEAD, falling back to GITHUB_SHA), which equals what the tag is pinned to in both the commit and no-commit cases while still catching a tag pinned to a commit we did NOT build; the semver tag is pinned to the same built HEAD for consistency. PREVIOUS (07.13.00): RC is ON-DEMAND ONLY. The `pull_request` trigger (RC-preview on a PR to main/stable) is REMOVED and the promote-rc job now runs solely on workflow_dispatch action=promote-rc. Only dev + stable release automatically (dev via pre-release.yml push->dev; stable via the push->main release job here); alpha/beta/rc never auto-cut. PREVIOUS (07.12.00): electron repos create NO release on ANY channel (RC enabled=false + stable publish/tag/notes/integrity guarded on is_electron; opt back in with vars.ELECTRON_CI_BUILD=true) and build NO installer in CI — always built locally + uploaded manually; the dev/promote version BUMP still runs. Template-Generic #390. NEW (07.11.00): the electron installer build/attach steps (electron-builder via Wine/Xvfb) are gated to MANUAL workflow_dispatch only (`&& github.event_name == 'workflow_dispatch'`). An automatic push no longer auto-builds electron installers (heavy ~90m, runner-fragile — OOM/Wine-zombie; migrating to mokocli ElectronPackager, MokoCLI #756/#758). The version bump, CHANGELOG, tag and npm publish STILL run on push — only the electron installer is skipped and pushed MANUALLY via dispatch. Non-electron platforms (joomla/go/npm) unaffected. Template-Generic #390. Universal build & release - BUMP-ON-DEV: base version + CHANGELOG promoted on dev pre-promotion (promote-rc), main publishes --bump none --no-commit so it never diverges from dev. MokoCLI build agent (moko publish). NEW (07.06.00): npm stable publishing ABSORBED here from Template-NPM's retired npm-publish.yml as npm-gated dual-registry steps (MokoGIT registry via per-run token + npmjs.org best-effort), replacing the former npm-publish.yml dispatch. No-Makefile repos SKIP the release job gracefully (green) instead of failing. Conflict-marker scan reads git-tracked files only (git ls-files | xargs grep) so vendored/generated trees can't false-match. NEW (07.07.00): npm stamp normalizes the zero-padded Makefile PROJECT_VERSION (NN.NN.NN) to strict semver via awk before `npm version`, and an unstampable version now HARD-FAILS instead of silently keeping the old package.json version (#382). NEW (07.00.00): `moko assets:optimize` artifact-time step added before publish (graceful-skip on non-asset repos); Setup MokoCLI tools makes the fresh `moko` executable + first on PATH to fix exit-126 (mokocli #650).
 #
 # +=======================================================================+
 # |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
@@ -57,7 +57,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
   GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
   GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
 
@@ -132,7 +132,7 @@ jobs:
         run: |
           set -u
           TOK="$(printf '%s' "$GITHUB_TOKEN" | tr -d '[:space:]')"; echo "::add-mask::$TOK"
-          SERVER="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}"
+          SERVER="${GITHUB_SERVER_URL:-https://git.mokoenterprises.us}"
           CLONE_URL="https://x-access-token:${TOK}@${SERVER#https://}/${GITHUB_REPOSITORY}.git"
           REF="${GITHUB_SHA:-${GITHUB_REF_NAME:-}}"
           echo "Retrying checkout of ${GITHUB_REPOSITORY}@${REF:-<HEAD>} into ${GITHUB_WORKSPACE}"
@@ -177,9 +177,9 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/version_bump.php ]; then
             echo "Installed mokocli fresh from the Composer registry (primary)"
             # #1671: registry-publish LAG race. The registry install "succeeds" but can
@@ -320,7 +320,7 @@ jobs:
           # the push + force-push allowlists and creates rc if it is absent.
           PUSH_URL="https://x-access-token:${PUSH_TOK}@${MOKOGIT_URL#https://}/${GIT_ORG}/${GIT_REPO}.git"
           git config --global user.name "mokogit-actions[bot]"
-          git config --global user.email "actions@mokoconsulting.tech"
+          git config --global user.email "actions@mokoenterprises.us"
           git fetch --no-tags "$PUSH_URL" "${FROM}"
           git push --force "$PUSH_URL" "FETCH_HEAD:refs/heads/rc" \
             || { echo "::error::Failed to point rc at ${FROM} (${SRC_SHA}) via git push"; exit 1; }
@@ -355,9 +355,9 @@ jobs:
           # `git fetch origin rc` / `git checkout rc` is ambiguous and could grab the tag.
           git fetch origin "+refs/heads/rc:refs/remotes/origin/rc"
           git checkout -B rc origin/rc
-          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "mokogit-actions[bot]@mokoenterprises.us"
           git config --local user.name "mokogit-actions[bot]"
-          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoenterprises.us/${{ github.repository }}.git"
 
       # Build-time PHP dependency vendoring (universal, guarded — mirrors
       # pre-release.yml 07.15.00). If a sub-package ships a composer.json, fetch its
@@ -589,7 +589,7 @@ jobs:
         run: |
           set -u
           TOK="$(printf '%s' "$GITHUB_TOKEN" | tr -d '[:space:]')"; echo "::add-mask::$TOK"
-          SERVER="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}"
+          SERVER="${GITHUB_SERVER_URL:-https://git.mokoenterprises.us}"
           CLONE_URL="https://x-access-token:${TOK}@${SERVER#https://}/${GITHUB_REPOSITORY}.git"
           REF="${GITHUB_SHA:-${GITHUB_REF_NAME:-}}"
           echo "Retrying full-history checkout of ${GITHUB_REPOSITORY}@${REF:-<HEAD>} into ${GITHUB_WORKSPACE}"
@@ -653,9 +653,9 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
           PUSH_TOK="$(printf '%s' "$GITHUB_TOKEN" | tr -d '[:space:]')"; [ -z "$PUSH_TOK" ] && PUSH_TOK="${{ github.token }}"; echo "::add-mask::$PUSH_TOK"
-          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "mokogit-actions[bot]@mokoenterprises.us"
           git config --local user.name "mokogit-actions[bot]"
-          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git remote set-url origin "https://x-access-token:${PUSH_TOK}@git.mokoenterprises.us/${{ github.repository }}.git"
 
       - name: Check for merge conflict markers
         if: steps.gate.outputs.has_makefile == 'true'
@@ -689,9 +689,9 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/version_bump.php ]; then
             echo "Installed mokocli fresh from the Composer registry (primary)"
             # #1671: registry-publish LAG race. The registry install "succeeds" but can
@@ -1026,7 +1026,7 @@ jobs:
       - name: "Guarantee monotonic release version (fast-merge bump guard)"
         id: monotonic
         # #469: in no-bump mode (a non-source push updating the existing release in
-        # place) the version must stay PUT, so the self-healing minor bump must not
+        # place) the version must stay PUT, so the self-healing patch bump must not
         # run — skip this guard when steps.srcgate decided should_bump=false. On the
         # bump path (should_bump=true, or electron/opt-out/dispatch where srcgate is
         # bypassed/true) it runs exactly as before.
@@ -1078,20 +1078,26 @@ jobs:
           # already-released vMAJOR.MINOR.00 forever (observed: MokoCLI stuck at
           # v10.20.00 while dev reached 10.20.04), violating this guard's own "never
           # re-publish an already-released base" intent. Compare the MINOR identity
-          # (MAJOR.MINOR): heal (minor-bump) whenever CUR's minor has NOT advanced past
-          # the last release's minor. The normal promote-rc path (dev already
-          # minor-bumped) still no-ops.
+          # (MAJOR.MINOR): heal (PATCH-bump above --min-version LAST) whenever CUR's
+          # minor has NOT advanced past the last release's minor. An unplanned /
+          # non-pre-bumped stable change (a direct admin push, or a fast dev->stable
+          # merge that skipped the promote-rc dev pre-bump) is a hotfix-shaped event,
+          # so it bumps PATCH, not MINOR — --min-version "$LAST" still guarantees the
+          # healed version is strictly above the last release, and the dev carry-forward
+          # below is ALSO --bump patch (consistent with the stable patch heal, so a
+          # direct-push hotfix does not inflate dev by a full minor). The normal
+          # promote-rc path (dev already minor-bumped) still no-ops.
           CUR_MI=$(printf '%s' "$CUR"  | awk -F. '{printf "%s.%s", $1, $2}')
           LAST_MI=$(printf '%s' "$LAST" | awk -F. '{printf "%s.%s", $1, $2}')
           GREATEST_MI=$( { echo "$CUR_MI"; echo "$LAST_MI"; } | sort -V | tail -n1 || true)
           if [ "$CUR_MI" = "$LAST_MI" ] || [ "$GREATEST_MI" = "$LAST_MI" ]; then
-            echo "::warning::inherited minor ${CUR_MI} <= last release minor ${LAST_MI} (CUR=${CUR} LAST=${LAST}); minor-bump skipped -> self-healing"
-            if ! php ${MOKO_CLI}/version_bump.php --minor --min-version "$LAST" --path .; then
+            echo "::warning::inherited minor ${CUR_MI} <= last release minor ${LAST_MI} (CUR=${CUR} LAST=${LAST}); pre-bump skipped -> self-healing PATCH bump"
+            if ! php ${MOKO_CLI}/version_bump.php --patch --min-version "$LAST" --path .; then
               echo "::error::monotonic bump guard failed to advance the base"; exit 1
             fi
             NEW=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
-            echo "healed ${CUR} -> ${NEW} (publishing fresh; carrying forward to dev)"
-            php ${MOKO_CLI}/release_bump_dev.php --path . --branch dev --bump minor \n              --repo "${{ github.repository }}" --token "${GITHUB_TOKEN:-${{ github.token }}}" \n              || echo "::warning::dev carry-forward failed (non-fatal; release still publishes the healed version)"
+            echo "healed ${CUR} -> ${NEW} (publishing fresh; carrying the PATCH forward to dev)"
+            php ${MOKO_CLI}/release_bump_dev.php --path . --branch dev --bump patch \n              --repo "${{ github.repository }}" --token "${GITHUB_TOKEN:-${{ github.token }}}" \n              || echo "::warning::dev carry-forward failed (non-fatal; release still publishes the healed version)"
           else
             echo "base ${CUR} > last release ${LAST}: normal path, no heal"
           fi
@@ -1721,7 +1727,7 @@ jobs:
           # Write the safely-extracted blob (NOT a copy of the possibly-symlinked file).
           install -m 0644 "${NOTES_CONTENT}" "${WIKI_DIR}/Release-Notes.md"
           cd "${WIKI_DIR}"
-          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "mokogit-actions[bot]@mokoenterprises.us"
           git config --local user.name  "mokogit-actions[bot]"
           git config --local commit.gpgsign false
           git add -- Release-Notes.md

package/.mokogit/workflows/branch-cleanup.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/branch-cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Delete feature branches after PR merge
@@ -39,7 +39,7 @@ jobs:
         env:
           MOKOGIT_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
-          API_BASE: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          API_BASE: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           BRANCH: ${{ github.event.pull_request.head.ref }}
         run: |
           set -euo pipefail

package/.mokogit/workflows/cascade.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Cascade
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/cascade.yml
 # VERSION: 03.07.00
 # BRIEF: (03.07.00) TOPOLOGY + SERVER-CASCADE NOTE (MokoCLI #965/#967): (1) R4 dev -> child-branch pass. The workflow previously cascaded ONLY the production branch (SRC) into CASCADE_TARGETS; it now does an optional SECOND pass that cascades `dev` into a new DEV_CHILD_TARGETS variable (reusing cascade_to with SRC repointed to dev). DEV_CHILD_TARGETS DEFAULTS TO EMPTY, so this is a strict no-op for every existing repo and must be opted into per repo/org -- no fleet behaviour changes until a repo sets it. The pass is guarded by branch_exists dev and self-skips when dev is absent. dev -> child REPOS remains the SYNC engine's responsibility and is intentionally NOT done here. (2) R3 is satisfied PRIMARILY by the MokoGIT server-side cascade (the Gitea-fork notifier fires per-merge -- including on [skip ci] commits the platform skips for workflows -- and auto-merges/fan-outs/chains via the cascade rule `mode`); this workflow is the SECONDARY/fallback layer (cron reconcile + workflow_dispatch after sync). The header/`on:` comments now state that explicitly. The daily cron is UNCHANGED (left intact as the documented safety-net). --- (03.06.00) RC4 WEDGE RECOVERY: when a cascade PR's mergeability check wedges in Gitea's internal "checking" state so every /merge returns HTTP 405 "Please try again later" indefinitely (MokoGIT #1729; neither the 12x retry loop + prime_merge_status nor a close+reopen of the SAME PR recovers it), the conflict-free path now ABANDONS the stuck PR and recreates a fresh ${SRC}->${TGT} PR (the only recovery -- a brand-new PR gets a clean check task), then retries the immediate merge once; non-405 failures still short-circuit straight to notify. --- RECONCILED (03.05.01): carries BOTH divergent 03.05.00 improvements. (1) SRC=stable fix: SRC resolves to the PRODUCTION branch via branch_exists() -- `stable` if it exists, else `main` if it exists, else default_branch -- so a channel-named repo whose DEFAULT is `dev` still back-merges stable -> dev instead of cascading dev -> rc/alpha/beta the wrong direction; every PR title/body/commit/log is labelled by the RESOLVED source (chore(sync): cascade ${SRC} -> <TGT>), no more misleading literal "main". (2) composer.json conflict resolution: composer.json version conflicts are inline-resolved to version=max (via resolve_json_version), same as Makefile PROJECT_VERSION, package.json and XML manifests, so a fix/chore->stable patch bump can no longer cascade a LOWER composer.json version onto a dev already bumped ahead (the DEV VERSION NEVER REGRESSES ON CASCADE); previously composer.json fell through to the '*' deeper-resolver/human path, blocking the cascade (Mokonyx #320/#408 manual reconcile) and racing the version between channels. Cascade the production branch -> the full release ladder (dev + on-demand rc/alpha/beta). Rolls up the retired cascade-dev.yml: one job loops the ladder, cascading the source into each target that EXISTS. dev is permanent and self-heals (recreated from main if missing after an RC-rename); rc/alpha/beta are on-demand and are SKIPPED when absent (never conjured). Branch-motivated (real push to main cascades down immediately) PLUS a daily scheduled safety-net: workflow_sync.php commits to stable/main carry [skip ci] and fire NO push trigger, so if its post-sync workflow_dispatch is missed the sync commits never back-merge and stable silently forks from dev (the MokonyxLicensing 79-commit drift incident). The cron reconciles stable/main -> dev periodically regardless of [skip ci]; it is idempotent/no-op when already in sync. Auto-merge clean, auto-resolve routine conflicts INLINE (manifest version=max / .mokogit-.gitea-.github -> main / docs-stamps -> dev) with no mokocli dependency, fall back to cascade_resolve.php then notify. Resolved merges are LANDED VIA PR (temp branch + PR-merge API), never direct-pushed to a protected target (the runner token is refused by the pre-receive hook). Conflict-free path does an IMMEDIATE PR merge so a clean cascade self-completes on repos with no required status checks.
@@ -45,9 +45,9 @@ permissions:
   pull-requests: write
 
 env:
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
   # ntfy destination is configured via repo or org variables (org vars are inherited).
-  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoenterprises.us' }}
   NTFY_TOPIC: ${{ vars.CASCADE_NTFY_TOPIC || vars.NTFY_TOPIC || 'git-releases' }}
   # The release ladder, high -> low. main cascades into each of these that exists.
   # `dev` is permanent (self-heals); the rest are on-demand (skipped when absent).
@@ -382,7 +382,7 @@ jobs:
             # 4b. conflicts -> try to auto-resolve if they are ONLY routine classes.
             echo "PR not cleanly mergeable; checking whether conflicts are auto-resolvable..."
             git config user.name  "MokoGIT Cascade"
-            git config user.email "actions@mokoconsulting.tech"
+            git config user.email "actions@mokoenterprises.us"
             # Fetch the BRANCH refs explicitly (refs/heads/...): the channel-named
             # branch model (#1294) allows a tag and a branch to share a name (e.g. a
             # `stable`/`rc` release tag alongside the branch), so a bare `git fetch
@@ -571,14 +571,14 @@ jobs:
             # (PRIMARY); /opt/mokocli is a FAILSAFE only (may be stale). Registry path
             # /api/packages/** is anon-allowlisted. git clone is the last resort.
             local RESOLVER=""
-            local REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+            local REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
             if ! command -v composer >/dev/null 2>&1; then
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1 || true
             fi
             rm -rf /tmp/mokocli
             if command -v composer >/dev/null 2>&1 \
                && composer create-project --no-install --no-interaction --no-progress --quiet \
-                    --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+                    --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 \
                && [ -f /tmp/mokocli/cli/cascade_resolve.php ]; then
               RESOLVER=/tmp/mokocli/cli/cascade_resolve.php
               if command -v sudo >/dev/null 2>&1 && [ -d /opt/mokocli ] \
@@ -589,9 +589,9 @@ jobs:
               echo "::warning::registry install failed — using /opt/mokocli FAILSAFE cascade_resolve.php (may be stale)"
               RESOLVER=/opt/mokocli/cli/cascade_resolve.php
             elif git clone --depth 1 --quiet \
-                   "https://x-access-token:${MOKOGIT_TOKEN}@${MOKOGIT_URL#https://}/MokoConsulting/mokocli.git" \
+                   "https://x-access-token:${MOKOGIT_TOKEN}@${MOKOGIT_URL#https://}/MokoEnterprises/mokocli.git" \
                    /tmp/mokocli 2>/dev/null \
-                 || git clone --depth 1 --quiet "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli 2>/dev/null; then
+                 || git clone --depth 1 --quiet "${MOKOGIT_URL}/MokoEnterprises/mokocli.git" /tmp/mokocli 2>/dev/null; then
               RESOLVER=/tmp/mokocli/cli/cascade_resolve.php
             else
               echo "::warning::On-demand mokocli install failed; cascade_resolve.php is UNAVAILABLE. Inline resolver handled the routine classes; any remaining conflicts need a human."

package/.mokogit/workflows/ci-issue-reporter.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
 # BRIEF: Reusable workflow � creates/updates a MokoGIT issue when a CI gate fails.
@@ -62,9 +62,9 @@ jobs:
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1 || true
           fi
           rm -rf /tmp/mokocli
-          REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
+          REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
           if composer create-project --no-install --no-interaction --no-progress --quiet \
-               --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 \
+               --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 \
              && [ -f /tmp/mokocli/cli/version_bump.php ]; then
             echo "Installed mokocli fresh from the Composer registry (primary)"
             echo "MOKO_CLI=/tmp/mokocli/cli" >> $GITHUB_ENV
@@ -83,7 +83,7 @@ jobs:
       - name: Report CI failure
         env:
           MOKOGIT_TOKEN: ${{ github.token }}
-          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           # Route all workflow_call inputs through env vars — referencing ${{ inputs.* }}
           # directly in a run: block interpolates at YAML-parse time and is a shell-injection
           # vector. Shell variables are not re-parsed, so a crafted input can't break out.

package/.mokogit/workflows/cleanup.yml

@@ -1,11 +1,11 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/cleanup.yml
 # VERSION: 01.01.00
 # CHANGE (01.01.00): fail-open branch/run cleanup (#430) — the run token may lack REST read on some repos, returning an error OBJECT; `jq '.[]'` on it exit-5'd the job under pipefail (fleet-wide red). Guard type=="array" / `(.workflow_runs // [])` and skip gracefully; cleanup is best-effort housekeeping and must never red the run.
@@ -23,7 +23,7 @@ permissions:
   actions: write
 
 env:
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
 
 jobs:
   cleanup:

package/.mokogit/workflows/makefile-lint.yml

@@ -1,14 +1,14 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: MokoGIT.Workflow
 # INGROUP: MokoCLI.Validation
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoenterprises.us/MokoEnterprises/Template-Generic
 # PATH: /.mokogit/workflows/makefile-lint.yml
-# VERSION: 01.03.00
-# BRIEF: Makefile sanity lint -- identity fields + release contract (SRC_DIR, PROJECT_VERSION format, BUILD_DIR, required targets, parse). Release-contract checks are WARN by default; set vars.MAKEFILE_LINT_ENFORCE=enforce to hard-fail (JOOMLA_I18N_ENFORCE-style, per-repo opt-in). Also runs a Scaffold Placeholder Guard job that HARD-FAILS when leftover de-template placeholders ({{UPPER_SNAKE}} moustaches, Template-<Word> repo refs, and fixed literals like example_resources/CHANGEME/myproject) survive in the tracked tree; skipped on Template-* source repos and excludes .mokogit/** + CHANGELOG*.
+# VERSION: 01.04.00
+# BRIEF: Makefile sanity lint -- identity fields + release contract (SRC_DIR, PROJECT_VERSION format, BUILD_DIR, required targets, parse). Release-contract checks are WARN by default; set vars.MAKEFILE_LINT_ENFORCE=enforce to hard-fail (JOOMLA_I18N_ENFORCE-style, per-repo opt-in). Also runs a Scaffold Placeholder Guard job that HARD-FAILS when leftover de-template placeholders ({{UPPER_SNAKE}} moustaches and fixed literals like example_resources/CHANGEME/myproject/MokonyxExample) survive in the tracked tree; skipped on Template-* source repos and excludes .mokogit/** + CHANGELOG*. The bare Template-<Word> content scan and the com_example literal were removed (#524) as they false-positived on legitimate standards-repo citations and documented example hints.
 #
 # +========================================================================+
 # |                     MAKEFILE IDENTITY LINT                             |
@@ -300,10 +300,14 @@ jobs:
 
           # Literal scaffold strings that must never survive de-templating,
           # as a single pre-built alternation (so this definition line is not
-          # itself a multi-token target the scanner would trip over). The
-          # Template-* names here are also covered by TEMPLATE_REPO_RE below;
-          # they are listed explicitly so the failure message is unambiguous.
-          LITERAL_ALT='example_resources|CHANGEME|myproject|myorg|your-project|com_example|MokonyxExample'
+          # itself a multi-token target the scanner would trip over).
+          #
+          # Deliberately NOT included (issue #524):
+          #  - com_example : a legitimate documentation/example token used in
+          #    real field hints (e.g. hint="/media/com_example/*.php"), the
+          #    matching _DESC language strings, and source/build/i18n-allow.txt.
+          #    It is an illustrative glob, not an un-de-templated scaffold token.
+          LITERAL_ALT='example_resources|CHANGEME|myproject|myorg|your-project|MokonyxExample'
 
           # Regexes applied per tracked file. Kept as distinct patterns so the
           # failure message can name which class of placeholder was hit.
@@ -311,9 +315,15 @@ jobs:
           #     {{DISPLAY_NAME}}, {{ENV_PREFIX}}, and the general
           #     {{UPPER_SNAKE}} shape. Requires [A-Z0-9_] (at least one [A-Z]),
           #     so lowercase app tokens like {{tempFile}} do NOT match.
-          #  2) Template-<Word> repo-name references in docs/content.
+          #
+          # The moustache shape plus the explicit literal set are the reliable
+          # de-template signals. A bare Template-<Word> word-match was REMOVED
+          # (issue #524): it false-positived on every legitimate citation of the
+          # standards repos (Template-Joomla #377 in installer comments, README
+          # extension tables, @see wiki links, uninstall SQL banners), which are
+          # correct references, not leftover scaffolding. A genuinely
+          # un-de-templated repo still trips the moustache/literal rules.
           MOUSTACHE_RE='\{\{[A-Z0-9_]*[A-Z][A-Z0-9_]*\}\}'
-          TEMPLATE_REPO_RE='Template-[A-Z][A-Za-z0-9]+'
 
           # Files to exclude from the scan:
           #  - .mokogit/**        : carries this workflow (its own token list)
@@ -344,7 +354,6 @@ jobs:
           }
 
           scan "$MOUSTACHE_RE" "UPPER_SNAKE moustache placeholder"
-          scan "$TEMPLATE_REPO_RE" "Template-<Word> repo reference"
           scan "$LITERAL_ALT" "literal scaffold token"
 
           if [ "$HITS" -ne 0 ]; then

package/.mokogit/workflows/npm-build-test.yml

@@ -1,5 +1,5 @@
 # MCP Server Build & Validation
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Enterprises <hello@mokoenterprises.us>
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # Builds the MCP server via the centralized MokoCLI build agent
@@ -32,7 +32,7 @@ permissions:
   issues: write            # folded-in Wiki Reminder posts a sticky PR comment
 
 env:
-  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
   GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
   GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
 
@@ -97,7 +97,7 @@ jobs:
       - name: Setup MokoCLI build agent (moko on PATH)
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+          MOKO_CLONE_HOST: git.mokoenterprises.us/MokoEnterprises
         run: |
           # Reach mokocli deterministically and expose `moko` on PATH (mokocli's cli/ dir)
           # so `moko build|test|lint` resolve. Prefer a pre-installed /opt/mokocli ONLY
@@ -120,8 +120,8 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            REG='{"type":"composer","url":"https://git.mokoconsulting.tech/api/packages/MokoConsulting/composer"}'
-            if composer create-project --no-dev --no-interaction --no-progress --quiet --repository="${REG}" mokoconsulting/mokocli /tmp/mokocli >/dev/null 2>&1 && { [ -x /tmp/mokocli/cli/moko ] || [ -f /tmp/mokocli/cli/moko ]; }; then
+            REG='{"type":"composer","url":"https://git.mokoenterprises.us/api/packages/MokoEnterprises/composer"}'
+            if composer create-project --no-dev --no-interaction --no-progress --quiet --repository="${REG}" mokoenterprises/mokocli /tmp/mokocli >/dev/null 2>&1 && { [ -x /tmp/mokocli/cli/moko ] || [ -f /tmp/mokocli/cli/moko ]; }; then
               echo "Bootstrapped mokocli from the Composer registry (tokenless)."
             else
               echo "Registry bootstrap unavailable; falling back to authenticated git clone."
@@ -355,7 +355,7 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           PR_CREATED_AT: ${{ github.event.pull_request.created_at }}
-          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           REPO: ${{ github.repository }}
           TOKEN: ${{ github.token }}
           DOCS_WIKI_WINDOW: ${{ vars.DOCS_WIKI_WINDOW || 'pr' }}
@@ -467,7 +467,7 @@ jobs:
       - name: Remind to update the wiki
         env:
           TOKEN: ${{ github.token }}
-          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          SERVER: ${{ vars.MOKOGIT_URL || 'https://git.mokoenterprises.us' }}
           REPO: ${{ github.repository }}
           PR: ${{ github.event.pull_request.number }}
         run: |
@@ -475,7 +475,7 @@ jobs:
           {
             echo "## Wiki Update Reminder"
             echo ""
-            echo "Docs are **wiki-first** at MokoConsulting. If this change affects behavior, usage, configuration, or standards, update the repo wiki:"
+            echo "Docs are **wiki-first** at MokoEnterprises. If this change affects behavior, usage, configuration, or standards, update the repo wiki:"
             echo ""
             echo "- ${SERVER}/${REPO}/wiki"
             echo ""