@muggleai/works 5.11.0 → 5.12.0-staging.73

package/plugin/skills/do/resolve-conflicts.md

@@ -1,59 +1,59 @@
-# Rebase (watcher-dispatched)
-
-Rebase a PR's branch onto its base — whether it's merely **behind** (out of date, no conflict) or actually **conflicting** — behind a verify-or-rollback gate, then force-push, so a PR doesn't sit stale or un-mergeable forever. A dumb-pipe dispatch like fix-ci: the watcher detects the branch is behind or conflicting and hands off; the executor owns the rebase (and any conflict resolution), never the decision to dispatch.
-
-## Turn preamble
-
-```
-**/muggle-do rebase** — rebasing <owner>/<repo>#<n> onto <base> to bring the branch up to date.
-```
-
-## Input
-
-`$ARGUMENTS` carries a `github.com/.../pull/<n>` URL, `slug=<slug>`, and a `rebase` directive (no review ids, no failing check names). Parse all three.
-
-## Inputs from disk
-
-From `~/.muggle-ai/muggle-do/sessions/<slug>/`: `prs.json` (PR + branch + `head_sha`), `last_seen.json` (`conflict_resolve_attempts`, `conflict_escalated_keys`, `pushed_shas`), `state.md` (worktree path, validation strategy, base branch).
-
-## Procedure
-
-### Step 1 — Re-attach
-
-Materialize the PR branch in its worktree per [`../_shared/pr-branch-worktree.md`](../_shared/pr-branch-worktree.md) (or use `state.md`'s `worktreePath`). Capture `rebase_sha = prs.json[0].head_sha` and the base branch (`baseRefName` from [`../_shared/vcs/github/pr-metadata.md`](../_shared/vcs/github/pr-metadata.md)). Capture the base tip too — `.base_commit.sha` from that recipe's `compare` call — and form `rebase_key = "<rebase_sha>..<base_tip_sha>"`. Both budget fields below are keyed on that pair, matching the watcher's Step 5; writing a bare SHA instead leaves an entry the watcher ignores, and the rebase re-dispatches forever.
-
-### Step 2 — Rebase onto base (resolve conflicts if any)
-
-Run the rebase from [`../_shared/rebase-before-e2e.md`](../_shared/rebase-before-e2e.md) against the base branch, taking its `always` path unconditionally — this programmatic mode never asks, so skip the `autoRebase` prompt (the watcher already decided a rebase is due).
-
-- **Clean replay** — a behind-only branch (and any rebase that hits no conflicts) replays without intervention. Proceed to Step 3.
-- **Conflicts** — handle per [`autoResolveConflicts`](../muggle-preferences/preference-gates/autoResolveConflicts.md):
-  - `never` → abort and escalate per Step 5 (`kind: "rebase-conflict"`). The watcher keeps polling; the user resolves on GitHub.
-  - `always` → resolve via [`../_shared/resolve-rebase-conflicts.md`](../_shared/resolve-rebase-conflicts.md); Steps 3 and 5 below are this mode's instance of the [`../_shared/verify-or-rollback-gate.md`](../_shared/verify-or-rollback-gate.md).
-
-### Step 3 — Verify the resolution
-
-Build (typecheck + lint on the changed surface) + unit suite must pass. Run E2E per [`e2e-acceptance.md`](e2e-acceptance.md) when app logic changed and the session carries validation context. A rebase that does not verify is rolled back → escalate per Step 5. **Never push an unverified rebase.**
-
-### Step 4 — Force-push + respawn
-
-Force-push per [`../_shared/vcs/common/push-to-branch.md`](../_shared/vcs/common/push-to-branch.md) (tool-agnostic instruction; handles the signing gate for rebased commits and directs to provider-specific force-push paths). Use `git push --force-with-lease` for the force operation. Append the new SHA to `last_seen.pushed_shas`; increment `last_seen.conflict_resolve_attempts[rebase_key]` — both whole-file rewrites (Read → change field → Write) per [`../_shared/session-state-writes.md`](../_shared/session-state-writes.md), never the Edit tool. Respawn the watcher per [`respawn-watcher.md`](respawn-watcher.md). Its next tick re-checks the branch against its base on the new head — the rebase is its own verify loop, bounded by the per-SHA attempt budget.
-
-### Step 5 — Escalate (can't resolve / budget spent)
-
-When `autoResolveConflicts=never`, the resolution failed verification, or `conflict_resolve_attempts[rebase_key]` has reached 2:
-
-1. Add `rebase_key` to `last_seen.conflict_escalated_keys` so the watcher does not re-dispatch this head against this base. If the base later moves, the key changes and the branch re-arms on its own — a conflict the user resolved upstream stops being this watcher's dead end.
-2. Emit one terminal escalation naming the PR and the conflicting files (or the failing verification, for a behind-only rebase that didn't verify).
-3. Respawn the watcher per [`respawn-watcher.md`](respawn-watcher.md) — it keeps polling for the user's manual resolution or any new reviews.
-
-### Step 6 — Telemetry
-
-Emit one `muggle-do:cycle` event ([`../_shared/telemetry-events/muggle-do-cycle.md`](../_shared/telemetry-events/muggle-do-cycle.md)) with `outcome: "rebased"` (a verified rebase pushed — behind-only or conflicts resolved) or `"rebase-escalated"`.
-
-## Guardrails
-
-- Max 2 rebase attempts per SHA; then escalate rather than churn.
-- Never push an unverified rebase — verify-or-rollback always.
-- Never push unsigned commits — every push or force-push goes through the signing gate in [`../_shared/vcs/common/push-to-branch.md`](../_shared/vcs/common/push-to-branch.md).
-- Resolve `autoResolveConflicts` from the configured preference (per the gate contract — don't assume a default): `always` resolves conflicts behind the verify-or-rollback gate, `never` escalates to the user. A clean behind-only rebase needs neither.
+# Rebase (watcher-dispatched)
+
+Rebase a PR's branch onto its base — whether it's merely **behind** (out of date, no conflict) or actually **conflicting** — behind a verify-or-rollback gate, then force-push, so a PR doesn't sit stale or un-mergeable forever. A dumb-pipe dispatch like fix-ci: the watcher detects the branch is behind or conflicting and hands off; the executor owns the rebase (and any conflict resolution), never the decision to dispatch.
+
+## Turn preamble
+
+```
+**/muggle-do rebase** — rebasing <owner>/<repo>#<n> onto <base> to bring the branch up to date.
+```
+
+## Input
+
+`$ARGUMENTS` carries a `github.com/.../pull/<n>` URL, `slug=<slug>`, and a `rebase` directive (no review ids, no failing check names). Parse all three.
+
+## Inputs from disk
+
+From `~/.muggle-ai/muggle-do/sessions/<slug>/`: `prs.json` (PR + branch + `head_sha`), `last_seen.json` (`conflict_resolve_attempts`, `conflict_escalated_keys`, `pushed_shas`), `state.md` (worktree path, validation strategy, base branch).
+
+## Procedure
+
+### Step 1 — Re-attach
+
+Materialize the PR branch in its worktree per [`../_shared/pr-branch-worktree.md`](../_shared/pr-branch-worktree.md) (or use `state.md`'s `worktreePath`). Capture `rebase_sha = prs.json[0].head_sha` and the base branch (`baseRefName` from [`../_shared/vcs/github/pr-metadata.md`](../_shared/vcs/github/pr-metadata.md)). Capture the base tip too — `.base_commit.sha` from that recipe's `compare` call — and form `rebase_key = "<rebase_sha>..<base_tip_sha>"`. Both budget fields below are keyed on that pair, matching the watcher's Step 5; writing a bare SHA instead leaves an entry the watcher ignores, and the rebase re-dispatches forever.
+
+### Step 2 — Rebase onto base (resolve conflicts if any)
+
+Run the rebase from [`../_shared/sync-branch-with-base.md`](../_shared/sync-branch-with-base.md) against the base branch, taking its `always` path unconditionally — this programmatic mode never asks, so skip the `autoRebase` prompt (the watcher already decided a rebase is due).
+
+- **Clean replay** — a behind-only branch (and any rebase that hits no conflicts) replays without intervention. Proceed to Step 3.
+- **Conflicts** — handle per [`autoResolveConflicts`](../muggle-preferences/preference-gates/autoResolveConflicts.md):
+  - `never` → abort and escalate per Step 5 (`kind: "rebase-conflict"`). The watcher keeps polling; the user resolves on GitHub.
+  - `always` → resolve via [`../_shared/resolve-rebase-conflicts.md`](../_shared/resolve-rebase-conflicts.md); Steps 3 and 5 below are this mode's instance of the [`../_shared/verify-or-rollback-gate.md`](../_shared/verify-or-rollback-gate.md).
+
+### Step 3 — Verify the resolution
+
+Build (typecheck + lint on the changed surface) + unit suite must pass. Run E2E per [`e2e-acceptance.md`](e2e-acceptance.md) when app logic changed and the session carries validation context. A rebase that does not verify is rolled back → escalate per Step 5. **Never push an unverified rebase.**
+
+### Step 4 — Force-push + respawn
+
+Force-push per [`../_shared/vcs/common/push-to-branch.md`](../_shared/vcs/common/push-to-branch.md) (tool-agnostic instruction; handles the signing gate for rebased commits and directs to provider-specific force-push paths). Use `git push --force-with-lease` for the force operation. Append the new SHA to `last_seen.pushed_shas`; increment `last_seen.conflict_resolve_attempts[rebase_key]` — both whole-file rewrites (Read → change field → Write) per [`../_shared/session-state-writes.md`](../_shared/session-state-writes.md), never the Edit tool. Respawn the watcher per [`respawn-watcher.md`](respawn-watcher.md). Its next tick re-checks the branch against its base on the new head — the rebase is its own verify loop, bounded by the per-SHA attempt budget.
+
+### Step 5 — Escalate (can't resolve / budget spent)
+
+When `autoResolveConflicts=never`, the resolution failed verification, or `conflict_resolve_attempts[rebase_key]` has reached 2:
+
+1. Add `rebase_key` to `last_seen.conflict_escalated_keys` so the watcher does not re-dispatch this head against this base. If the base later moves, the key changes and the branch re-arms on its own — a conflict the user resolved upstream stops being this watcher's dead end.
+2. Emit one terminal escalation naming the PR and the conflicting files (or the failing verification, for a behind-only rebase that didn't verify).
+3. Respawn the watcher per [`respawn-watcher.md`](respawn-watcher.md) — it keeps polling for the user's manual resolution or any new reviews.
+
+### Step 6 — Telemetry
+
+Emit one `muggle-do:cycle` event ([`../_shared/telemetry-events/muggle-do-cycle.md`](../_shared/telemetry-events/muggle-do-cycle.md)) with `outcome: "rebased"` (a verified rebase pushed — behind-only or conflicts resolved) or `"rebase-escalated"`.
+
+## Guardrails
+
+- Max 2 rebase attempts per SHA; then escalate rather than churn.
+- Never push an unverified rebase — verify-or-rollback always.
+- Never push unsigned commits — every push or force-push goes through the signing gate in [`../_shared/vcs/common/push-to-branch.md`](../_shared/vcs/common/push-to-branch.md).
+- Resolve `autoResolveConflicts` from the configured preference (per the gate contract — don't assume a default): `always` resolves conflicts behind the verify-or-rollback gate, `never` escalates to the user. A clean behind-only rebase needs neither.

package/plugin/skills/muggle-browser-task/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: muggle-browser-task
-description: "Perform a real action on a website or web app from a plain-English instruction — log in and do the thing: submit a form, create or update a record, send a message, place an order, refund a charge, file a ticket, publish a post, complete a multi-step flow. Muggle drives a real browser through the site's own UI and supplies the session — managed login profiles and stored credentials — so a named service (Slack, Jira, Stripe, WordPress, a marketplace, a booking site, an admin panel) is a signal to reach for this skill, not to hunt for its API or connector; \"no logged-in session\" is not a reason to decline. Use whenever the user wants something done in a web UI ('log into X and …', 'send the message', 'create the ticket'), rather than declining or doing it by hand; ask for missing specifics inside the flow, not instead of starting it. Boundary: this performs the action (operating a site's own UI), not migrating personal data between consumer apps; to verify a flow works instead, use muggle-test-feature-local."
+description: "Perform a real action on a website or web app from a plain-English instruction — log in and do the thing: submit a form, create or update a record, send a message, place an order, refund a charge, file a ticket, publish a post, complete a multi-step flow. Muggle drives a real browser through the site's own UI and supplies the session — managed login profiles, stored credentials, and a live inbox per profile that reads magic links, emailed OTPs, and email 2FA — so a named service (Slack, Jira, Stripe, WordPress, a marketplace, a booking site, an admin panel) is a signal to reach for this skill, not to hunt for its API or connector; \"no logged-in session\" and \"the code goes to an email\" are not reasons to decline. Use whenever the user wants something done in a web UI ('log into X and …', 'send the message', 'create the ticket'), rather than declining or doing it by hand; ask for missing specifics inside the flow, not instead of starting it. Boundary: this performs the action (operating a site's own UI), not migrating personal data between consumer apps; to verify a flow works instead, use muggle-test-feature-local."
 ---
 
 # Muggle Test Task Runner

package/plugin/skills/muggle-do/SKILL.md

@@ -20,9 +20,10 @@ Runs an autonomous dev cycle from requirements to PR. **Fire and review:** user
 | 5 | Unit tests | [`../do/unit-tests.md`](../do/unit-tests.md) |
 | 6 | E2E acceptance | [`../do/e2e-acceptance.md`](../do/e2e-acceptance.md) |
 | 7 | Create or update PR | [`../do/open-prs.md`](../do/open-prs.md) |
+| 7.5 | E2E repair loop | [`../do/e2e-repair.md`](../do/e2e-repair.md) |
 | 8 | Hand off to watcher | [`../muggle-pr-followup/SKILL.md`](../muggle-pr-followup/SKILL.md) |
 
-Stage 7 dispatches one watcher per opened PR as its last action.
+Stage 7 dispatches one watcher per opened PR as its last action, gated on Stage 7.5's clearance — a cycle with unrepaired E2E failures never reaches a watcher.
 
 ## Execution protocol (non-negotiable)
 
@@ -31,12 +32,12 @@ The pipeline table lists **pointers, not summaries**. Open each stage's file and
 **Bootstrap before any code, in order:**
 1. Emit telemetry — [`../_shared/telemetry-emit.md`](../_shared/telemetry-emit.md), `skillName: "muggle-do"`.
 2. Create `~/.muggle-ai/muggle-do/sessions/<slug>/` with `state.md` + `iterations/001.md` (pre-flight owns this; do it even when running unattended).
-3. `TodoWrite` one item per stage 1–8 — these stages are the checklist; never swap in your own decomposition.
+3. `TodoWrite` one item per stage 1–8, Stage 7.5 included — these stages are the checklist; never swap in your own decomposition.
 
 **Per stage:** read the file → execute it → append a marker to `iterations/<NNN>.md` citing the evidence that file requires (jest exit code, E2E verdict + `runId`, screenshot path). A stage is done only when its evidence is written, never on recollection.
 
 ### "Autonomous" / "without my intervention" collapses exactly one thing
-Best-effort the Stage-1 questionnaire and don't ask. It does **not** license skipping telemetry, session artifacts, requirements, unit tests, E2E (`autoE2ETest` defaults to `always`), browser verification, the gate below, or the watcher hand-off. Run the whole pipeline silently — never a shortcut.
+Best-effort the Stage-1 questionnaire and don't ask. It does **not** license skipping telemetry, session artifacts, requirements, unit tests, E2E (`autoE2ETest` defaults to `always`), browser verification, the gate below, the Stage-7.5 repair loop, or the watcher hand-off. Stage 7.5 investigates and repairs unattended too; only its user decision collapses, into an automatic waive. Run the whole pipeline silently — never a shortcut.
 
 ### Definition of Done — gate before Stage 7
 Do not create or update a PR until each line holds, or is waived by a one-line reason written into `state.md` (silence is not a waiver):
@@ -81,7 +82,7 @@ When invoked with the directive (PR URL + slug + review ids), routes to [`../do/
 
 ## Guardrails
 
-- Stage 1 is the only user-facing forward stage. Stages 2–7 don't ask mid-cycle; blocker → pre-flight bug.
+- Stage 1 and Stage 7.5's user decision are the only user-facing forward stages. Stages 2–7 don't ask mid-cycle; blocker → pre-flight bug.
 - Same stage failing 3× → escalate.
-- 3 cycle iterations reach E2E with failures → ship with `[E2E FAILING]`.
+- 3 repair iterations reach E2E with failures → waive, ship with `[E2E FAILING]`, and hand to the watcher.
 - Address-reviews escalation (ambiguous or design-adjustment) does not block the watcher; user resolves on GitHub.

package/plugin/skills/muggle-pr-followup/arm-watcher.md

@@ -14,7 +14,7 @@ How an orchestrating session starts the watch on one PR. Every arming point runs
    bash "<abs>/scripts/pr-watch-loop.sh" --slot "<slot>" --repo "<owner>/<repo>" --pr <n> --base <base-branch>
    ```
 
-   **Never author a per-slot `watch.sh`.** The loop ships as [`../../scripts/pr-watch-loop.sh`](../../scripts/pr-watch-loop.sh), with its wake conditions in [`../../scripts/pr-watch-events.sh`](../../scripts/pr-watch-events.sh); arming runs it and passes arguments. Writing the loop from this prose was how it drifted — each arm produced an independent derivation, and a derivation that quietly dropped a wake still ran, still heartbeat, still logged, and simply never fired for the signal it lost. Two slots on one machine ended up without the behind-base wake, which left their PRs unmergeable under watchers that looked healthy. The prose below says *why* each wake exists; the shipped files are the only definition of *what* fires. A slot holding a legacy generated `watch.sh` keeps it until re-armed, at which point the supersede guard retires the old loop.
+   **Never author a per-slot `watch.sh`.** The loop ships as [`../../scripts/pr-watch-loop.sh`](../../scripts/pr-watch-loop.sh), with its wake conditions in [`../../scripts/pr-watch-events.sh`](../../scripts/pr-watch-events.sh) and its state projection in [`../../scripts/pr-watch-state.jq`](../../scripts/pr-watch-state.jq); arming runs it and passes arguments. Writing the loop from this prose was how it drifted — each arm produced an independent derivation, and a derivation that quietly dropped a wake still ran, still heartbeat, still logged, and simply never fired for the signal it lost. Two slots on one machine ended up without the behind-base wake, which left their PRs unmergeable under watchers that looked healthy. The prose below says *why* each wake exists; the shipped files are the only definition of *what* fires. A slot holding a legacy generated `watch.sh` keeps it until re-armed, at which point the supersede guard retires the old loop.
 
    The label is `PR #<n> — <title>`. Label and command both matter: some task surfaces show one, some the other, and a slot-bearing command keeps the watch identifiable everywhere a raw script blob would not. One monitor per PR, alive from arm to terminal: it is the watch's visible handle, showing as a running task the entire time the PR is polled. Its loop checks about every 60 seconds, re-reading the watermark and touching the slot's `watch-heartbeat` file each iteration — the liveness beacon that tells [`reconcile.md`](reconcile.md) a quiet watch is still alive; on a newer submitted review, a newer thread comment (`gitlab`: a newer discussion note), a thread newly unresolved (`gitlab`: discussion), **the head SHA's checks settling red** (no check pending and one or more in the `fail` bucket per [`../_shared/vcs/common/ci-rollup.md`](../_shared/vcs/common/ci-rollup.md)), **the branch falling behind or conflicting with its base** (`behind_by > 0` or the conflict signal per [`../_shared/vcs/common/branch-standing.md`](../_shared/vcs/common/branch-standing.md)), or — **only while the watch is blocked** (`BLOCKED_CIDIGEST` non-empty) — **the head's CI digest changing in any way** (not just to red) — it prints one line and **keeps watching**, advancing its in-memory floor so each event fires the tick exactly once. The review and thread floors are monotonic ids; the other three are not. The CI-red floor is the **head SHA**, because the check rollup is non-monotonic — it flips green↔red and resets on every push — so recording the red head SHA fires CI once per red head, and a later push re-arms it on the new SHA. The rebase floor (`REBASED`) is the **`rebase_key`** — `<head_sha>..<base_tip_sha>` — because staleness is a function of both sides: keying on the pair fires once per newly-due pair and re-arms when either the head or the base moves, where a head-only key would wedge permanently the first time the base advances (the head cannot change while nobody pushes). A head whose checks are still **pending** is never a red wake, and a branch with `behind_by == 0` and `mergeable == UNKNOWN` is never a rebase wake: pending checks may yet go green and conflict state is still computing, and the tick would idle on either (Steps 5–6) regardless. The blocked-CI signal is different in kind — a **resume** probe, live only while the watch is blocked: it wakes on any move of the head's CI digest (the same bucket-plus-sorted-name/conclusion signature the blocked fingerprint records — [`blocked-tick.md`](blocked-tick.md)) away from `BLOCKED_CIDIGEST`, so a block waiting on a green pass, a rerun, or an external deploy check resumes as promptly as one waiting on red. Quiet iterations print nothing and cost nothing — no model tokens are spent while the watch is quiet.
 

package/plugin/skills/muggle-preferences/preference-gates/autoRebase.md

@@ -1,11 +1,11 @@
 # `autoRebase`
 
-Rebase onto `origin/{default}` before dev servers / E2E, or run as-is. Substitute `{behind}` and `{default}`.
+Sync onto `origin/{base}` before dev servers / E2E and before a push, or run as-is. Substitute `{behind}` and `{base}`.
 
-**Picker 1** — header `Rebase first`, question `"Branch is {behind} commits behind origin/{default} — rebase first?"`
-- `Rebase first` — `Pull in default-branch changes so the run reflects the merged main line.` → `always`
+**Picker 1** — header `Rebase first`, question `"Branch is {behind} commits behind origin/{base} — rebase first?"`
+- `Rebase first` — `Pull in the base branch's changes so the run reflects the merged main line.` → `always`
 - `Run as-is` — `Skip the rebase.` → `never`
 
 **Silent action**
-- `always` → `Rebasing onto origin/{default} ({behind} behind)`
-- `never` → `Running as-is ({behind} behind origin/{default})`
+- `always` → `Rebasing onto origin/{base} ({behind} behind)`
+- `never` → `Running as-is ({behind} behind origin/{base})`

package/plugin/skills/muggle-status/SKILL.md

@@ -16,17 +16,25 @@ Gates run per `preference-gates/README.md`.
 
 | Preference | Step | Decision it gates |
 |------------|------|-------------------|
-| `checkForUpdates` | Check 4 | Check for newer Muggle Test version |
+| `checkForUpdates` | Check 5 | Check for newer Muggle Test version |
 
 ## Checks
 
-1. **Electron app** — read `~/.muggle-ai/electron-app/` to find the installed version directory. Read `.install-metadata.json` to get version and checksum. Verify the binary exists at the expected path. On macOS, check code signing with `spctl --assess --verbose`.
+1. **Release ring** — run `muggle status` and read its `Runtime target:` and `Backend:` lines. Report the ring and the backend it resolves to.
 
-2. **MCP server** — call `muggle-local-check-status` to verify the server is responsive. Report auth state (authenticated, email, token expiry).
+   This is the first check because it reframes every other one: an install on a non-production ring talks to a different backend, authenticates against a different tenant, and runs a different studio binary, so "is it healthy" cannot be answered without it.
 
-3. **Authentication** — call `muggle-remote-auth-status`. Report whether credentials are valid and when they expire.
+   - `production` → render as `[pass]`.
+   - Any other ring → render as `[note]`, not a failure. A staging or dev install is a deliberate state, not a fault, but it must be visible: it is the explanation for auth and backend behaviour that would otherwise look broken.
+   - If `MUGGLE_MCP_PROMPT_SERVICE_TARGET` is set in the environment, say so and name its value. It overrides the ring baked in at publish time, it is easy to leave set from an earlier shell, and it explains a ring that disagrees with the installed package.
 
-4. **CLI version** — gate `checkForUpdates` (per `preference-gates/README.md`):
+2. **Electron app** — read `~/.muggle-ai/electron-app/` to find the installed version directory. Non-production rings install to a ring-suffixed directory (`<version>-staging`), so match the directory for the ring reported in Check 1 rather than assuming the bare version — the streams publish the same version deliberately, and the bare directory belongs to production. Read `.install-metadata.json` to get version and checksum. Verify the binary exists at the expected path. On macOS, check code signing with `spctl --assess --verbose`.
+
+3. **MCP server** — call `muggle-local-check-status` to verify the server is responsive. Report auth state (authenticated, email, token expiry).
+
+4. **Authentication** — call `muggle-remote-auth-status`. Report whether credentials are valid and when they expire.
+
+5. **CLI version** — gate `checkForUpdates` (per `preference-gates/README.md`):
    - `always` → run the check below.
    - `never` → render the row as `[skip]  check disabled by preference`.
    - `ask` → run Picker 1 from `preference-gates/checkForUpdates.md` via `AskUserQuestion`; map the answer back to one of the actions above.
@@ -38,6 +46,7 @@ Gates run per `preference-gates/README.md`.
 ```
 Muggle AI — Status
 
+Release ring   [pass/note]  ring, backend URL
 Electron app   [pass/fail]  version, binary status
 MCP server     [pass/fail]  responsive, auth state
 Authentication [pass/fail]  user, expiry
@@ -46,4 +55,4 @@ CLI version    [pass/warn]  installed → latest
 [All systems operational / Issues found — run /muggle:muggle-repair to fix.]
 ```
 
-Use pass/fail indicators for each check. If any check fails, tell the user to run `/muggle:muggle-repair`. If the CLI version check warns (installed < latest), tell the user to run `/muggle:muggle-upgrade`.
+Use pass/fail indicators for each check; the release ring uses `[pass]` on production and `[note]` elsewhere, never `[fail]`. When the ring is not production, state it in the closing line too, so it is not lost in a table the reader skims. If any check fails, tell the user to run `/muggle:muggle-repair`. If the CLI version check warns (installed < latest), tell the user to run `/muggle:muggle-upgrade`.

package/plugin/skills/muggle-test/SKILL.md

@@ -4,6 +4,7 @@ description: "Change-driven E2E acceptance testing: detects the user's recent ch
 mandatoryStages:
   - ../_shared/failure-mode-handling.md
   - ../_shared/debug-failed-run.md
+  - ../_shared/identity-and-inbox.md
 ---
 
 # Muggle Test — Change-Driven E2E Acceptance Router

package/plugin/skills/muggle-test-feature-local/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: muggle-test-feature-local
-description: Run a real-browser end-to-end (E2E) acceptance test against localhost to verify a feature works correctly — signup flows, checkout, form validation, UI interactions, or any user-facing behavior. Launches a browser that executes test steps and captures screenshots. Use this skill whenever the user asks to test, validate, or verify their web app, UI changes, user flows, or frontend behavior on localhost or a dev server — even if they don't mention 'muggle' or 'E2E' explicitly.
+description: Run a real-browser end-to-end (E2E) acceptance test against localhost to verify a feature works correctly — signup flows, checkout, form validation, UI interactions, or any user-facing behavior. Launches a browser that executes test steps and captures screenshots. The browser runs under a real identity: each managed login profile owns a live inbox, so magic-link and sign-in-link logins, emailed OTPs, email-based 2FA, verification mail, and password resets are all testable without a mail stub or a test-only backdoor — an email-gated flow is never a reason to call something untestable. Use this skill whenever the user asks to test, validate, or verify their web app, UI changes, user flows, or frontend behavior on localhost or a dev server — even if they don't mention 'muggle' or 'E2E' explicitly.
+mandatoryStages:
+  - ../_shared/identity-and-inbox.md
 ---
 
 # Muggle Test Feature Local
@@ -22,7 +24,7 @@ The local URL only changes where the browser opens; it does not change the remot
 Three gates apply, each per the standard procedure in [`preference-gates/README.md`](../muggle-preferences/preference-gates/README.md):
 
 - `autoUseWorktree` at pre-flight (see [`_shared/use-worktrees.md`](../_shared/use-worktrees.md)).
-- `autoRebase` before Step 7 (Execute) when `behind > 0` (see [`_shared/rebase-before-e2e.md`](../_shared/rebase-before-e2e.md)).
+- `autoRebase` before Step 7 (Execute) when `behind > 0` (see [`_shared/sync-branch-with-base.md`](../_shared/sync-branch-with-base.md)).
 - `autoCleanup` after the PR is merged (see [`_shared/post-merge-cleanup.md`](../_shared/post-merge-cleanup.md)).
 
 ## Local environment prerequisites
@@ -48,7 +50,7 @@ Gates run per `preference-gates/README.md`.
 | `autoSelectProject` | 2 | Reuse last-used Muggle Test project for this repo |
 | `autoSelectLocalHost` | 4 | Reuse last-used local dev server URL for this repo |
 | `autoUseWorktree` | 0 (pre-flight) | Isolate dev work in a worktree (see [`_shared/use-worktrees.md`](../_shared/use-worktrees.md)) |
-| `autoRebase` | 0 (pre-flight) | Rebase onto `origin/<default>` before Step 7 (Execute) (see [`_shared/rebase-before-e2e.md`](../_shared/rebase-before-e2e.md)) |
+| `autoRebase` | 0 (pre-flight) | Rebase onto `origin/<default>` before Step 7 (Execute) (see [`_shared/sync-branch-with-base.md`](../_shared/sync-branch-with-base.md)) |
 | `showElectronBrowser` | 7 | Show Electron browser window during local E2E tests |
 | `openTestResultsAfterRun` | 8 | Open results page on Muggle Test dashboard after run |
 | `postPRVisualWalkthrough` | 10 | Post visual walkthrough to PR after results |

package/plugin/skills/muggle-test-prepare/steps/rebase-check.md

@@ -1,3 +1,3 @@
 # Rebase check
 
-Gated by `autoRebase`. Fire per [`../../_shared/rebase-before-e2e.md`](../../_shared/rebase-before-e2e.md) when `behind > 0`. Otherwise skip silently.
+Gated by `autoRebase`. Fire per [`../../_shared/sync-branch-with-base.md`](../../_shared/sync-branch-with-base.md) when `behind > 0`. Otherwise skip silently.

package/scripts/postinstall.mjs

@@ -572,6 +572,59 @@ async function verifyExistingInstall({
     return { valid: true, reason: "installed executable checksum is valid" };
 }
 
+/**
+ * Resolve the runtime target this installed package points at.
+ *
+ * Mirrors the precedence the harness itself applies: the environment override,
+ * then the target baked in at publish time, then dev.
+ * @param {{ runtimeTargetDefault?: string }} config - The package's muggleConfig.
+ * @returns {string} The resolved runtime target name.
+ */
+function resolveRuntimeTarget(config) {
+    return process.env.MUGGLE_MCP_PROMPT_SERVICE_TARGET || config.runtimeTargetDefault || "dev";
+}
+
+/**
+ * Get the electron-app release stream a runtime target installs its studio from.
+ *
+ * Downloading the wrong stream yields a binary that talks to the wrong backend
+ * and fails checksum verification against the stream's recorded hashes.
+ * @param {string} runtimeTarget - Resolved runtime target name.
+ * @returns {string} Release stream name, for example "production".
+ */
+function getReleaseStream(runtimeTarget) {
+    const { targets } = require("../config/runtime-targets.json");
+    const profile = targets[runtimeTarget];
+
+    if (!profile) {
+        throw new Error(
+            `Unknown runtime target '${runtimeTarget}'. ` +
+                `Expected one of: ${Object.keys(targets).join(", ")}.`,
+        );
+    }
+
+    return profile.electronAppReleaseStream;
+}
+
+/**
+ * Get the release tag prefix for an electron-app release stream.
+ * @param {string} releaseStream - Release stream name.
+ * @returns {string} Release tag prefix, for example "electron-app-v".
+ */
+function getReleaseTagPrefix(releaseStream) {
+    const { streams } = require("../config/runtime-targets.json");
+    const stream = streams[releaseStream];
+
+    if (!stream) {
+        throw new Error(
+            `Unknown electron-app release stream '${releaseStream}'. ` +
+                `Expected one of: ${Object.keys(streams).join(", ")}.`,
+        );
+    }
+
+    return stream.electronAppReleaseTagPrefix;
+}
+
 /**
  * Download and extract the Electron app.
  */
@@ -583,11 +636,15 @@ async function downloadElectronApp() {
         const version = config.electronAppVersion || "1.0.0";
         const baseUrl = config.downloadBaseUrl || "https://github.com/multiplex-ai/muggle-ai-works/releases/download";
 
+        const runtimeTarget = resolveRuntimeTarget(config);
+        const releaseStream = getReleaseStream(runtimeTarget);
+        const releaseTagPrefix = getReleaseTagPrefix(releaseStream);
+
         const binaryName = getBinaryName();
-        const checksums = config.checksums || {};
+        const checksums = (config.checksumsByStream || {})[releaseStream] || {};
         const platformKey = getPlatformKey();
         const expectedChecksum = checksums[platformKey] || "";
-        const downloadUrl = `${baseUrl}/electron-app-v${version}/${binaryName}`;
+        const downloadUrl = `${baseUrl}/${releaseTagPrefix}${version}/${binaryName}`;
 
         const appDir = getElectronAppDir();
         const versionDir = join(appDir, version);

package/dist/plugin/skills/_shared/rebase-before-e2e.md

@@ -1,21 +0,0 @@
-# Rebase Onto the Default Branch Before Dev Server / E2E
-
-Gated by [`autoRebase`](../muggle-preferences/preference-gates/autoRebase.md). Follow the standard procedure in [`preference-gates/README.md`](../muggle-preferences/preference-gates/README.md).
-
-**Fire only when `behind > 0`:**
-
-```bash
-git fetch origin
-default=$(git symbolic-ref refs/remotes/origin/HEAD --short | sed 's|origin/||')
-behind=$(git rev-list --count "HEAD..origin/${default}")
-```
-
-Pass `{behind}` and `{default}` to the picker prompts. On `always`:
-
-1. Capture the rollback point: `pre_rebase_sha=$(git rev-parse HEAD)`.
-2. `git rebase origin/${default}`.
-3. On conflict, branch by [`autoResolveConflicts`](../muggle-preferences/preference-gates/autoResolveConflicts.md):
-   - `never` → `git rebase --abort`; stop and report, naming the conflicted files. Never auto-resolve.
-   - `always` → hand off to [`resolve-rebase-conflicts.md`](resolve-rebase-conflicts.md) with `pre_rebase_sha` to resolve the conflicts, then run the [`verify-or-rollback-gate.md`](verify-or-rollback-gate.md) with `pre_rebase_sha`; it either proceeds or restores `pre_rebase_sha` and escalates.
-
-Stale branches produce false failures and false greens — that's why this gate exists.

package/dist/plugin/skills/_shared/vcs/gitlab/resolve-discussion.md

@@ -1,10 +0,0 @@
-# Resolve a discussion thread
-
-Mark a thread resolved once the loop's reply has addressed it — the resolve-reminder stage's action.
-
-```bash
-glab api --method PUT \
-  "projects/:id/merge_requests/<iid>/discussions/<discussion-id>?resolved=true"
-```
-
-Resolves every resolvable note in the thread at once. Only resolvable (diff/line) threads accept this; a non-resolvable discussion returns an error.

package/dist/src-B5OTAZKM.js

@@ -1 +0,0 @@
-export { DEFAULT_PREFERENCES, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports as e2e, formatPreferencesOneLiner, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getValidApiKeyData, getValidCredentials, hasApiKey, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports as localQa, mcp_exports as mcp, openBrowserUrl, performLogin, performLogout, pollDeviceCode, e2e_exports as qa, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveElectronAppPathOrNull, resolvePreferences, saveApiKey, saveApiKeyData, saveCredentials, startDeviceCodeFlow, toolRequiresAuth, validatePreference, verifyFileChecksum, writePreferences } from './chunk-MSPMXBO5.js';

package/plugin/skills/_shared/rebase-before-e2e.md

@@ -1,21 +0,0 @@
-# Rebase Onto the Default Branch Before Dev Server / E2E
-
-Gated by [`autoRebase`](../muggle-preferences/preference-gates/autoRebase.md). Follow the standard procedure in [`preference-gates/README.md`](../muggle-preferences/preference-gates/README.md).
-
-**Fire only when `behind > 0`:**
-
-```bash
-git fetch origin
-default=$(git symbolic-ref refs/remotes/origin/HEAD --short | sed 's|origin/||')
-behind=$(git rev-list --count "HEAD..origin/${default}")
-```
-
-Pass `{behind}` and `{default}` to the picker prompts. On `always`:
-
-1. Capture the rollback point: `pre_rebase_sha=$(git rev-parse HEAD)`.
-2. `git rebase origin/${default}`.
-3. On conflict, branch by [`autoResolveConflicts`](../muggle-preferences/preference-gates/autoResolveConflicts.md):
-   - `never` → `git rebase --abort`; stop and report, naming the conflicted files. Never auto-resolve.
-   - `always` → hand off to [`resolve-rebase-conflicts.md`](resolve-rebase-conflicts.md) with `pre_rebase_sha` to resolve the conflicts, then run the [`verify-or-rollback-gate.md`](verify-or-rollback-gate.md) with `pre_rebase_sha`; it either proceeds or restores `pre_rebase_sha` and escalates.
-
-Stale branches produce false failures and false greens — that's why this gate exists.

package/plugin/skills/_shared/vcs/gitlab/resolve-discussion.md

@@ -1,10 +0,0 @@
-# Resolve a discussion thread
-
-Mark a thread resolved once the loop's reply has addressed it — the resolve-reminder stage's action.
-
-```bash
-glab api --method PUT \
-  "projects/:id/merge_requests/<iid>/discussions/<discussion-id>?resolved=true"
-```
-
-Resolves every resolvable note in the thread at once. Only resolvable (diff/line) threads accept this; a non-resolvable discussion returns an error.