@mushi-mushi/mcp 0.28.0 → 0.29.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Kenji Sakuramoto
+Copyright (c) 2026 Kenji Sakuramoto / Kensaurus 合同会社
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -29,7 +29,7 @@ Restart the editor and ask *"what's broken in prod?"*. For Cursor and Claude, `s
   "mcpServers": {
     "mushi-mushi": {
       "command": "npx",
-      "args": ["-y", "@mushi-mushi/mcp@0.28.0"],
+      "args": ["-y", "@mushi-mushi/mcp@0.29.0"],
       "env": {
         "MUSHI_API_KEY": "mushi_xxxxxxxxxxxxxxxxxxxx",
         "MUSHI_PROJECT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
@@ -59,7 +59,7 @@ Claude Desktop does not expand `${VAR}` references in this file; Cursor and VS C
 | `diagnose_setup` | Explains a broken install and the one next step |
 | `search_mushi_docs` | Answers setup and API questions from the docs |
 
-The full catalog has 119 tools, plus 8 resources (`project://dashboard`, `project://stats`, …) and 4 prompts (`summarize_report_for_fix`, `triage_next_steps`, …). Every tool carries read-only and destructive hints, so your editor can ask before it changes anything. Full list: [MCP tool reference](https://kensaur.us/mushi-mushi/docs/sdks/mcp-tools).
+The full catalog has 124 tools, plus 8 resources (`project://dashboard`, `project://stats`, …) and 4 prompts (`summarize_report_for_fix`, `triage_next_steps`, …). Every tool carries read-only and destructive hints, so your editor can ask before it changes anything. Full list: [MCP tool reference](https://kensaur.us/mushi-mushi/docs/sdks/mcp-tools).
 
 **Tool groups.** New installs get a lean default: `triage`, `fixes`, `inventory`, `setup`, `docs`. Turn on more with `MUSHI_FEATURES=triage,qa,codebase` (stdio) or `?features=…` on the hosted URL, or everything with `all`. Groups: `qa`, `skills`, `codebase`, `rewards`, `admin`, `audit`, `usage`. Add `?read_only=1` to the hosted URL to hide every write tool.
 

package/dist/catalog.js

@@ -8,7 +8,7 @@ import {
   TOOL_CATALOG,
   USE_MUSHI_INTENTS,
   routeUseMushiIntent
-} from "./chunk-PVN7VPVW.js";
+} from "./chunk-MOW6PVHK.js";
 export {
   ALL_SCOPES,
   CODEBASE_TOOL_CATALOG,

package/dist/{chunk-DJCVJ3YZ.js → chunk-7RWHDJPZ.js}

@@ -41,6 +41,7 @@ var TOOL_FEATURE_MAP = {
   get_report_evidence: "triage",
   triage_issue: "triage",
   import_sentry_issues: "triage",
+  file_report: "triage",
   query_lessons: "triage",
   list_lessons: "triage",
   suggest_fix: "triage",
@@ -92,6 +93,10 @@ var TOOL_FEATURE_MAP = {
   transition_status: "fixes",
   merge_fix: "fixes",
   refresh_ci: "fixes",
+  get_ci_overview: "fixes",
+  get_ci_costs: "fixes",
+  request_ci_placement_change: "fixes",
+  get_fix_verification: "fixes",
   reopen_report: "fixes",
   reply_to_reporter: "fixes",
   request_reporter_info: "fixes",

package/dist/{chunk-PVN7VPVW.js → chunk-MOW6PVHK.js}

@@ -64,6 +64,15 @@ var TOOL_CATALOG = [
     returnsUntrusted: true,
     useCase: "Why did this fix attempt fail \u2014 show me every step."
   },
+  {
+    name: "get_fix_verification",
+    title: "Fix merge checks",
+    description: "Return whether one fix attempt's PR is proven to work on its current head commit (ADR 0035): gates in order review (Opus review says merge), ci (every check green; a stopped test machine is pending, not a failure), fail_to_pass (the host's Mushi verify check: a changed test fails without the fix and passes with it; not_set_up until .github/workflows/mushi-verify.yml exists), protected (no deleted or weakened tests, no test skips or lint/type suppressions added, no CI config or lockfile change, no protected path), budget (small enough to merge on its own) and second_review (a second model family; runs only after the others pass). Each gate is { id, status (pass | fail | pending | unavailable | not_set_up), label, detail (what to do when it is not pass), evidence }. Also passed, secondJudge (summary and findings are model output from untrusted input), autoMerge { state (none | eligible | merged | skipped | failed), detail }, and regressions after a Mushi merge [{ signal (ci_failed_on_merge | report_reopened | new_report_in_changed_file), revertState, revertPrUrl }]. Returns { headSha, gates, passed, secondJudge, autoMerge, regressions, mergedAt, mergeSha, evaluatedAt }; 404 NOT_FOUND until Mushi first checks the fix (every 10 minutes for open cloud-agent PRs). Read-only. Use before merge_fix to see what is still unproven; use get_fix_timeline for the attempt's full lifecycle.",
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: true },
+    returnsUntrusted: true,
+    useCase: "Is this agent fix proven to work, and what is still missing before it can merge?"
+  },
   {
     name: "get_blast_radius",
     title: "Blast radius",
@@ -277,6 +286,33 @@ var TOOL_CATALOG = [
     returnsUntrusted: true,
     useCase: "Which files are too big to change safely, and is the bundle growing?"
   },
+  {
+    name: "get_ci_overview",
+    title: "CI runners and why fixes wait",
+    description: "Return where this project's tests run and why a fix is slow to land (ADR 0033): the machines that send a runner heartbeat (hostname, platform, memory, swap, load, free disk, and per runner service its memory use, memory limit and out-of-memory kills), the GitHub runners seen (online | offline, busy, labels), repos, the latest jobs with their verdict (passed, running, queued, waiting_for_runner, runner_lost, queue_expired, cancelled, code_failure; waiting_for_runner, runner_lost and queue_expired are infra: the test machine stopped and the fix was not tested, which is not a code failure), and stats { queueP50s, queueP95s, durationP50s, durationP95s, passRate, infraFailures, codeFailures, byRunner, byWorkflow, slowSteps }, plus advice [{ id, severity (high | medium | low), title, detail, evidence, fix }] with the evidence for each rule. Optional projectId (default: the configured project; with an account-level key and no project, every project you can read), days (1-30, default 7) and refresh (true reads GitHub first instead of the last 10-minute sync, at most once a minute per project). permissions { jobs, runners } is ok | missing | unknown: jobs need Actions: read on GitHub, the runner list needs Administration: read (without it runners come from jobs only). Repo, workflow, job, step and runner names come from the repos. Returns { generatedAt, refreshedAt, window, permissions, hosts, runners, repos, jobs, stats, advice }. Read-only. When a fix's CI failed with an infra verdict, re-run the tests instead of changing code.",
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: true },
+    returnsUntrusted: true,
+    useCase: "Did my fix fail, or did the test machine stop? Why do my fixes wait to be tested?"
+  },
+  {
+    name: "get_ci_costs",
+    title: "CI cost and speed",
+    description: "Return what this project's CI costs and how fast it runs on GitHub-hosted runners versus your own machines (Plan 022, ADR 0037). Rows per repo \xD7 runner class [{ repo, runnerClass (github_hosted | self_hosted | unknown = never picked up), os, labels, runner, machine, jobs, expired, queueP50s, queueP95s, runP50s, runP95s, prPassRate (pull-request jobs only), infraRate, rawMinutes, billedMinutes (each job rounded up to a whole minute), rerunJobs, tinyJobs, monthCost, costBasis (github_list | github_public_free | github_larger_unpriced | self_hosted | unknown), currency }]; repos with visibility (public repos run GitHub-hosted minutes free); accounts per GitHub owner (plan, includedMinutes, monthMinutes, monthListCost, monthCost after included minutes); machines (busyHours as the union of job intervals, busyShare, monthEnergyCost and monthWearCost from the organization's own figures); speed factors (only passed jobs that ran on both classes, at least 5 each, with sample sizes); whatIfs for moving a workflow (minutes moved, jobs that stay and why, speed, cost delta, target wait and busy share, warnings); explain (re-runs, tiny jobs, expired jobs, pinned-to-GitHub jobs with their YAML reason, main and Dependabot runs that always use GitHub); advice with evidence; fields says which numbers are measured and which estimated; rates gives GitHub's list prices and the date they were read. Optional projectId (default: the configured project; an account-level key with none reads every project) and days (1-30, default 30). lowConfidence is true under 7 days of data. Returns { window, dataDays, lowConfidence, source, sourceNote, rates, fields, settings, repos, rows, accounts, machines, speed, whatIfs, explain, advice }. Read-only: it changes nothing on GitHub. Every money figure is an estimate.",
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: true },
+    returnsUntrusted: true,
+    useCase: "What does my CI cost, and would it be cheaper or faster on my own machine?"
+  },
+  {
+    name: "request_ci_placement_change",
+    title: "Ask to change where CI runs (needs approval)",
+    description: `Ask to change where one repository's CI runs by setting or removing one repo Actions variable that its workflows read in runs-on (ADR 0037). Only LINUX_RUNNER and RUNNER_<WORKFLOW> may be changed; value is one runner label, or null to remove the variable so jobs use the workflow's fallback (usually GitHub-hosted). Mushi builds the change itself from a fresh preview: the jobs that move and the ones that stay (pinned to GitHub, main-branch and Dependabot runs), the target runners and their wait, the cost change, and the variable's current value, which the change must still match when it runs. Your organization's CI policy is checked now and again when it runs: no paid GitHub-hosted minutes on private repos when that rule is on, repos managed by an external controller are refused, standby runners are never a target. This only creates a request: a team owner or admin approves it in the console and runs it there within an hour; this tool can never approve or run it, and Mushi never changes runner labels or registrations. Confirm with the user first. Returns { id, status: "pending_approval", payloadSha256, preview }, or an error with the reason (VARIABLE_NOT_ALLOWED, POLICY_NO_PAID_HOSTED, EXTERNAL_CONTROLLER, POLICY_STANDBY_TARGET, VARIABLE_UNREADABLE, NO_CHANGE) and the preview. Write.`,
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
+    returnsUntrusted: true,
+    useCase: "Ask to run yen-yen's PR jobs on the Alienware runner instead of paid GitHub minutes, for a person to approve."
+  },
   {
     name: "explain_finding",
     title: "Explain one finding",
@@ -629,6 +665,14 @@ var TOOL_CATALOG = [
     hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
     useCase: "Pull my open Sentry issues into Mushi so I can triage and fix them."
   },
+  {
+    name: "file_report",
+    title: "File a report",
+    description: "File a free-form report on a project by hand: a bug you found yourself, a backlog item, or work for an agent. Pass title (3-200 chars) and description (up to 10000 chars: what happens, steps, what you expected, how to check it is fixed); severity (critical | high | medium | low) and component are optional hints that triage may refine. The report is stored with status new and goes through the same triage as a user report (classification, diagnosis), so it can then be dispatched with dispatch_fix. Returns { reportId, projectId, title, status, severity, component }. Write; not idempotent (a retry files a second report); at most 30 filed reports per project an hour; viewers cannot file. Use for work no user reported; for issues already in Sentry use import_sentry_issues. Then call triage_issue on the new reportId.",
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
+    useCase: "Log this bug I found (or this backlog item) in Mushi so it gets triaged and fixed."
+  },
   {
     name: "triage_next_steps",
     title: "What should I work on now?",
@@ -820,7 +864,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "list_byok_keys",
     title: "List your API key pool",
-    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | openrouter | firecrawl | browserbase | cursor | supabase). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at }] } plus read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, or rate-limited; use add_byok_key to add one.",
+    description: "List the BYOK API keys this project uses, grouped by provider (anthropic | openai | openrouter | firecrawl | browserbase | cursor | supabase). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at, scope }] } where scope is project (this app), organization (every app in its organization) or universal (every app its organization owner owns); they are tried in that order, after the legacy credential. Also read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, shared, or rate-limited; use add_byok_key to add one.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Which API keys are active and which are rate-limited?"
@@ -828,7 +872,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "add_byok_key",
     title: "Add an API key",
-    description: "Add and immediately validate a BYOK API key for anthropic | openai | openrouter | firecrawl | browserbase | cursor | supabase (a scoped, read-only Supabase access token, checked against the linked supabase_project_ref). The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. Write; NOT idempotent.",
+    description: "Add and immediately validate a BYOK API key for anthropic | openai | openrouter | firecrawl | browserbase | cursor | supabase (a scoped, read-only Supabase access token, checked against the linked supabase_project_ref). The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. The key is added to this one app; a key for every app in the organization or every app you own (universal) is added in the console, Settings \u2192 AI keys. Write; NOT idempotent.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Add a backup Anthropic key to the pool."
@@ -852,7 +896,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "get_spend_down_status",
     title: "Spend-down status of Cursor keys",
-    description: "For each Cursor key this project can use, show spend-down mode (ADR 0028): whether it is on, when the credits expire, the window state (off | not_started | active | expired | key_unusable), fixes started today out of the daily limit, the apps the key pays for, and what the last worker tick did. Returns { keys: [{ id, label, keyHint, scope, enabled, creditsExpireAt, model, dailyLimit, windowDays, state, startsAt, dispatchedToday, remainingToday, projects, lastRunAt, lastSummary }] }. Read-only. Use to see whether expiring Cursor credits are being used; use set_byok_spend_down to change it.",
+    description: "For each Cursor key this project can use, show spend-down mode (ADR 0028): whether it is on, when the credits expire, the window state (off | not_started | active | expired | key_unusable), fixes started today out of the daily limit, the apps the key pays for that this project can see (each with its stop-loss state: paused when, over its spend-down runs of the last 14 days with 20+ samples, the 95% Wilson bound puts its Opus merge rate under 20%, hold rate over 35% or no-PR share over 50%; a paused app still gets 1 probe fix a day), a count of its other apps, the last 7 days' scoreboard (key-wide totals; per app \xD7 model \xD7 day rows for visible apps: runs, PRs, no-PR verdicts, other failures, Opus merge / fix_first / hold, merged, latest review cost per PR, merge and mergeable yield), and what the last worker tick did. Returns { keys: [{ id, label, keyHint, scope, enabled, creditsExpireAt, model, dailyLimit, windowDays, state, startsAt, dispatchedToday, remainingToday, projects: [{ id, name, canResume, stopLoss }], otherApps, projectsNote, stopLossNote, scoreboard: { days, since, totals, rows } | null, scoreboardNote, lastRunAt, lastSummary }], reviewFollowups: { days, dispatched, finished, pushed, noChange, verdictsAfter: { merge, fix_first, hold }, awaitingReview, conversionRate, skipped, apps } | null } \u2014 reviewFollowups (ADR 0032) is what sending fix_first PRs back to an agent with the Opus findings produced in the last 7 days, over the apps you can access. Read-only. Use to see whether expiring Cursor credits are being used and what they produce; use set_byok_spend_down to change it.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: false },
     useCase: "Are my expiring Cursor credits being spent on fixes?"

package/dist/clients.d.ts

@@ -49,7 +49,7 @@ import { FeatureGroup } from './feature-groups.js';
  * editor launch. Synced to package.json by `scripts/sync-mcp-pin.mjs` — never
  * hand-edit the version.
  */
-declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.28.0";
+declare const MCP_PIN_SPEC = "@mushi-mushi/mcp@0.29.0";
 interface StdioConfig {
     command: string;
     args: string[];

package/dist/clients.js

@@ -5,10 +5,10 @@ import {
   DEFAULT_FEATURE_GROUPS,
   appendFeaturesToUrl,
   featuresQueryString
-} from "./chunk-DJCVJ3YZ.js";
+} from "./chunk-7RWHDJPZ.js";
 
 // src/clients.ts
-var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.28.0";
+var MCP_PIN_SPEC = "@mushi-mushi/mcp@0.29.0";
 var PIN_SPEC_RE = /^@mushi-mushi\/mcp@\d+\.\d+\.\d+$/;
 function pinOf(pinSpec) {
   return pinSpec && PIN_SPEC_RE.test(pinSpec) ? pinSpec : MCP_PIN_SPEC;

package/dist/feature-groups.js

@@ -9,7 +9,7 @@ import {
   parseFeaturesCsv,
   parseFeaturesParam,
   toolMatchesFeatures
-} from "./chunk-DJCVJ3YZ.js";
+} from "./chunk-7RWHDJPZ.js";
 export {
   ALL_FEATURE_GROUPS,
   DEFAULT_FEATURE_GROUPS,

package/dist/index.js

@@ -140,6 +140,15 @@ var TOOL_CATALOG = [
     returnsUntrusted: true,
     useCase: "Why did this fix attempt fail \u2014 show me every step."
   },
+  {
+    name: "get_fix_verification",
+    title: "Fix merge checks",
+    description: "Return whether one fix attempt's PR is proven to work on its current head commit (ADR 0035): gates in order review (Opus review says merge), ci (every check green; a stopped test machine is pending, not a failure), fail_to_pass (the host's Mushi verify check: a changed test fails without the fix and passes with it; not_set_up until .github/workflows/mushi-verify.yml exists), protected (no deleted or weakened tests, no test skips or lint/type suppressions added, no CI config or lockfile change, no protected path), budget (small enough to merge on its own) and second_review (a second model family; runs only after the others pass). Each gate is { id, status (pass | fail | pending | unavailable | not_set_up), label, detail (what to do when it is not pass), evidence }. Also passed, secondJudge (summary and findings are model output from untrusted input), autoMerge { state (none | eligible | merged | skipped | failed), detail }, and regressions after a Mushi merge [{ signal (ci_failed_on_merge | report_reopened | new_report_in_changed_file), revertState, revertPrUrl }]. Returns { headSha, gates, passed, secondJudge, autoMerge, regressions, mergedAt, mergeSha, evaluatedAt }; 404 NOT_FOUND until Mushi first checks the fix (every 10 minutes for open cloud-agent PRs). Read-only. Use before merge_fix to see what is still unproven; use get_fix_timeline for the attempt's full lifecycle.",
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: true },
+    returnsUntrusted: true,
+    useCase: "Is this agent fix proven to work, and what is still missing before it can merge?"
+  },
   {
     name: "get_blast_radius",
     title: "Blast radius",
@@ -353,6 +362,33 @@ var TOOL_CATALOG = [
     returnsUntrusted: true,
     useCase: "Which files are too big to change safely, and is the bundle growing?"
   },
+  {
+    name: "get_ci_overview",
+    title: "CI runners and why fixes wait",
+    description: "Return where this project's tests run and why a fix is slow to land (ADR 0033): the machines that send a runner heartbeat (hostname, platform, memory, swap, load, free disk, and per runner service its memory use, memory limit and out-of-memory kills), the GitHub runners seen (online | offline, busy, labels), repos, the latest jobs with their verdict (passed, running, queued, waiting_for_runner, runner_lost, queue_expired, cancelled, code_failure; waiting_for_runner, runner_lost and queue_expired are infra: the test machine stopped and the fix was not tested, which is not a code failure), and stats { queueP50s, queueP95s, durationP50s, durationP95s, passRate, infraFailures, codeFailures, byRunner, byWorkflow, slowSteps }, plus advice [{ id, severity (high | medium | low), title, detail, evidence, fix }] with the evidence for each rule. Optional projectId (default: the configured project; with an account-level key and no project, every project you can read), days (1-30, default 7) and refresh (true reads GitHub first instead of the last 10-minute sync, at most once a minute per project). permissions { jobs, runners } is ok | missing | unknown: jobs need Actions: read on GitHub, the runner list needs Administration: read (without it runners come from jobs only). Repo, workflow, job, step and runner names come from the repos. Returns { generatedAt, refreshedAt, window, permissions, hosts, runners, repos, jobs, stats, advice }. Read-only. When a fix's CI failed with an infra verdict, re-run the tests instead of changing code.",
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: true },
+    returnsUntrusted: true,
+    useCase: "Did my fix fail, or did the test machine stop? Why do my fixes wait to be tested?"
+  },
+  {
+    name: "get_ci_costs",
+    title: "CI cost and speed",
+    description: "Return what this project's CI costs and how fast it runs on GitHub-hosted runners versus your own machines (Plan 022, ADR 0037). Rows per repo \xD7 runner class [{ repo, runnerClass (github_hosted | self_hosted | unknown = never picked up), os, labels, runner, machine, jobs, expired, queueP50s, queueP95s, runP50s, runP95s, prPassRate (pull-request jobs only), infraRate, rawMinutes, billedMinutes (each job rounded up to a whole minute), rerunJobs, tinyJobs, monthCost, costBasis (github_list | github_public_free | github_larger_unpriced | self_hosted | unknown), currency }]; repos with visibility (public repos run GitHub-hosted minutes free); accounts per GitHub owner (plan, includedMinutes, monthMinutes, monthListCost, monthCost after included minutes); machines (busyHours as the union of job intervals, busyShare, monthEnergyCost and monthWearCost from the organization's own figures); speed factors (only passed jobs that ran on both classes, at least 5 each, with sample sizes); whatIfs for moving a workflow (minutes moved, jobs that stay and why, speed, cost delta, target wait and busy share, warnings); explain (re-runs, tiny jobs, expired jobs, pinned-to-GitHub jobs with their YAML reason, main and Dependabot runs that always use GitHub); advice with evidence; fields says which numbers are measured and which estimated; rates gives GitHub's list prices and the date they were read. Optional projectId (default: the configured project; an account-level key with none reads every project) and days (1-30, default 30). lowConfidence is true under 7 days of data. Returns { window, dataDays, lowConfidence, source, sourceNote, rates, fields, settings, repos, rows, accounts, machines, speed, whatIfs, explain, advice }. Read-only: it changes nothing on GitHub. Every money figure is an estimate.",
+    scope: "mcp:read",
+    hints: { readOnly: true, idempotent: true, openWorld: true },
+    returnsUntrusted: true,
+    useCase: "What does my CI cost, and would it be cheaper or faster on my own machine?"
+  },
+  {
+    name: "request_ci_placement_change",
+    title: "Ask to change where CI runs (needs approval)",
+    description: `Ask to change where one repository's CI runs by setting or removing one repo Actions variable that its workflows read in runs-on (ADR 0037). Only LINUX_RUNNER and RUNNER_<WORKFLOW> may be changed; value is one runner label, or null to remove the variable so jobs use the workflow's fallback (usually GitHub-hosted). Mushi builds the change itself from a fresh preview: the jobs that move and the ones that stay (pinned to GitHub, main-branch and Dependabot runs), the target runners and their wait, the cost change, and the variable's current value, which the change must still match when it runs. Your organization's CI policy is checked now and again when it runs: no paid GitHub-hosted minutes on private repos when that rule is on, repos managed by an external controller are refused, standby runners are never a target. This only creates a request: a team owner or admin approves it in the console and runs it there within an hour; this tool can never approve or run it, and Mushi never changes runner labels or registrations. Confirm with the user first. Returns { id, status: "pending_approval", payloadSha256, preview }, or an error with the reason (VARIABLE_NOT_ALLOWED, POLICY_NO_PAID_HOSTED, EXTERNAL_CONTROLLER, POLICY_STANDBY_TARGET, VARIABLE_UNREADABLE, NO_CHANGE) and the preview. Write.`,
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
+    returnsUntrusted: true,
+    useCase: "Ask to run yen-yen's PR jobs on the Alienware runner instead of paid GitHub minutes, for a person to approve."
+  },
   {
     name: "explain_finding",
     title: "Explain one finding",
@@ -705,6 +741,14 @@ var TOOL_CATALOG = [
     hints: { readOnly: false, destructive: false, idempotent: true, openWorld: true },
     useCase: "Pull my open Sentry issues into Mushi so I can triage and fix them."
   },
+  {
+    name: "file_report",
+    title: "File a report",
+    description: "File a free-form report on a project by hand: a bug you found yourself, a backlog item, or work for an agent. Pass title (3-200 chars) and description (up to 10000 chars: what happens, steps, what you expected, how to check it is fixed); severity (critical | high | medium | low) and component are optional hints that triage may refine. The report is stored with status new and goes through the same triage as a user report (classification, diagnosis), so it can then be dispatched with dispatch_fix. Returns { reportId, projectId, title, status, severity, component }. Write; not idempotent (a retry files a second report); at most 30 filed reports per project an hour; viewers cannot file. Use for work no user reported; for issues already in Sentry use import_sentry_issues. Then call triage_issue on the new reportId.",
+    scope: "mcp:write",
+    hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
+    useCase: "Log this bug I found (or this backlog item) in Mushi so it gets triaged and fixed."
+  },
   {
     name: "triage_next_steps",
     title: "What should I work on now?",
@@ -812,7 +856,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "list_byok_keys",
     title: "List your API key pool",
-    description: "List the project's BYOK API keys grouped by provider (anthropic | openai | openrouter | firecrawl | browserbase | cursor | supabase). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at }] } plus read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, or rate-limited; use add_byok_key to add one.",
+    description: "List the BYOK API keys this project uses, grouped by provider (anthropic | openai | openrouter | firecrawl | browserbase | cursor | supabase). Returns pooled { keys: [{ id, provider_slug, label, priority, status, cooldown_until, test_status, key_hint, base_url, last_tested_at, last_used_at, scope }] } where scope is project (this app), organization (every app in its organization) or universal (every app its organization owner owns); they are tried in that order, after the legacy credential. Also read-only { legacyKeys } metadata for credentials saved before the pooled lifecycle \u2014 never the raw secret. Read-only. Use to see which keys are validated, active, pending, legacy, shared, or rate-limited; use add_byok_key to add one.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: true },
     useCase: "Which API keys are active and which are rate-limited?"
@@ -820,7 +864,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "add_byok_key",
     title: "Add an API key",
-    description: "Add and immediately validate a BYOK API key for anthropic | openai | openrouter | firecrawl | browserbase | cursor | supabase (a scoped, read-only Supabase access token, checked against the linked supabase_project_ref). The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. Write; NOT idempotent.",
+    description: "Add and immediately validate a BYOK API key for anthropic | openai | openrouter | firecrawl | browserbase | cursor | supabase (a scoped, read-only Supabase access token, checked against the linked supabase_project_ref). The raw key is stored encrypted in Supabase Vault and never returned; failed probes remain quarantined. Optional baseUrl is accepted only for allow-listed OpenAI-compatible HTTPS providers. The key is added to this one app; a key for every app in the organization or every app you own (universal) is added in the console, Settings \u2192 AI keys. Write; NOT idempotent.",
     scope: "mcp:write",
     hints: { readOnly: false, destructive: false, idempotent: false, openWorld: true },
     useCase: "Add a backup Anthropic key to the pool."
@@ -844,7 +888,7 @@ var TDD_TOOL_CATALOG = [
   {
     name: "get_spend_down_status",
     title: "Spend-down status of Cursor keys",
-    description: "For each Cursor key this project can use, show spend-down mode (ADR 0028): whether it is on, when the credits expire, the window state (off | not_started | active | expired | key_unusable), fixes started today out of the daily limit, the apps the key pays for, and what the last worker tick did. Returns { keys: [{ id, label, keyHint, scope, enabled, creditsExpireAt, model, dailyLimit, windowDays, state, startsAt, dispatchedToday, remainingToday, projects, lastRunAt, lastSummary }] }. Read-only. Use to see whether expiring Cursor credits are being used; use set_byok_spend_down to change it.",
+    description: "For each Cursor key this project can use, show spend-down mode (ADR 0028): whether it is on, when the credits expire, the window state (off | not_started | active | expired | key_unusable), fixes started today out of the daily limit, the apps the key pays for that this project can see (each with its stop-loss state: paused when, over its spend-down runs of the last 14 days with 20+ samples, the 95% Wilson bound puts its Opus merge rate under 20%, hold rate over 35% or no-PR share over 50%; a paused app still gets 1 probe fix a day), a count of its other apps, the last 7 days' scoreboard (key-wide totals; per app \xD7 model \xD7 day rows for visible apps: runs, PRs, no-PR verdicts, other failures, Opus merge / fix_first / hold, merged, latest review cost per PR, merge and mergeable yield), and what the last worker tick did. Returns { keys: [{ id, label, keyHint, scope, enabled, creditsExpireAt, model, dailyLimit, windowDays, state, startsAt, dispatchedToday, remainingToday, projects: [{ id, name, canResume, stopLoss }], otherApps, projectsNote, stopLossNote, scoreboard: { days, since, totals, rows } | null, scoreboardNote, lastRunAt, lastSummary }], reviewFollowups: { days, dispatched, finished, pushed, noChange, verdictsAfter: { merge, fix_first, hold }, awaitingReview, conversionRate, skipped, apps } | null } \u2014 reviewFollowups (ADR 0032) is what sending fix_first PRs back to an agent with the Opus findings produced in the last 7 days, over the apps you can access. Read-only. Use to see whether expiring Cursor credits are being used and what they produce; use set_byok_spend_down to change it.",
     scope: "mcp:read",
     hints: { readOnly: true, idempotent: true, openWorld: false },
     useCase: "Are my expiring Cursor credits being spent on fixes?"
@@ -1240,6 +1284,7 @@ var TOOL_FEATURE_MAP = {
   get_report_evidence: "triage",
   triage_issue: "triage",
   import_sentry_issues: "triage",
+  file_report: "triage",
   query_lessons: "triage",
   list_lessons: "triage",
   suggest_fix: "triage",
@@ -1291,6 +1336,10 @@ var TOOL_FEATURE_MAP = {
   transition_status: "fixes",
   merge_fix: "fixes",
   refresh_ci: "fixes",
+  get_ci_overview: "fixes",
+  get_ci_costs: "fixes",
+  request_ci_placement_change: "fixes",
+  get_fix_verification: "fixes",
   reopen_report: "fixes",
   reply_to_reporter: "fixes",
   request_reporter_info: "fixes",
@@ -1497,6 +1546,24 @@ var MUSHI_DOCS_INDEX = [
     headings: ["Reading your usage card", "Usage breakdown", "Predictability controls", "Upgrading your plan", "Changing plan", "Managing payment and invoices", "CLI parity", "Related docs"],
     excerpt: "The Billing page shows your diagnosis quota, usage alerts at 50% and 80%, your projected bill, and spend caps for your Mushi plan."
   },
+  {
+    title: "Checks",
+    url: docUrl("/admin/checks"),
+    route: "/admin/checks",
+    markdown: "admin/checks.md",
+    keywords: ["admin", "checks"],
+    headings: ["App checks", "AI quality"],
+    excerpt: "The Checks page lists every automatic check on this app. Each card opens that check, with the same live count the sidebar shows."
+  },
+  {
+    title: "CI runners",
+    url: docUrl("/admin/ci"),
+    route: "/admin/ci",
+    markdown: "admin/ci.md",
+    keywords: ["admin", "ci", "runners"],
+    headings: ["Test machine or your code", "Queue and wait", "Runner map", "What would make fixes land sooner", "When nothing has reported in", "Related pages"],
+    excerpt: "The console CI runners page shows where tests run, how long they wait for a machine, and whether a red check was your code or the test machine."
+  },
   {
     title: "CLI device auth",
     url: docUrl("/admin/cli-auth"),
@@ -1560,6 +1627,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["What to look for first", "Flow canvas", "KPI tiles (14-day window)", "Charts row (14 days)", "Triage queue", "Insights row", "Common tasks", "Morning check (2 minutes)"],
     excerpt: "The Mushi dashboard answers whether anything broke since your last release \u2014 new reports, overnight fix runs and pipeline health on one screen."
   },
+  {
+    title: "Design system",
+    url: docUrl("/admin/design"),
+    route: "/admin/design",
+    markdown: "admin/design.md",
+    keywords: ["admin", "design", "system"],
+    headings: ["Tokens", "The deviance score", "How an edit becomes a draft PR", "Related"],
+    excerpt: "The Design system page shows your tokens, contrast pairs, type scale and a deviance score for off-token code. Token and rule edits open a draft pull request."
+  },
   {
     title: "Docs bridge",
     url: docUrl("/admin/docs-bridge"),
@@ -1839,6 +1915,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["Presence", "Comments", "Writing a comment", "Editing and deleting", "Timestamps", "Notifications", "Audit log", "See also"],
     excerpt: "How Mushi report pages support real-time collaboration \u2014 see who else is viewing a report and watch new comments arrive without a refresh."
   },
+  {
+    title: "App blueprint",
+    url: docUrl("/admin/recipe"),
+    route: "/admin/recipe",
+    markdown: "admin/recipe.md",
+    keywords: ["admin", "recipe", "app", "blueprint"],
+    headings: ["Refresh and status", "Diagram and list", 'What "not connected" means', "Side panel", "Risk checks", "Related"],
+    excerpt: "The App blueprint page shows what this app is built from, the state of each part, and the draft pull request a change opens."
+  },
   {
     title: "Releases",
     url: docUrl("/admin/releases"),
@@ -1983,6 +2068,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["Run in the cloud", "What you see", "File as bug", "Where the changes are"],
     excerpt: "Each screen your coding agent worked on in a mushi ux run, with its plan, every attempt, before and after screenshots, and what was kept."
   },
+  {
+    title: "Verified merge",
+    url: docUrl("/admin/verified-merge"),
+    route: "/admin/verified-merge",
+    markdown: "admin/verified-merge.md",
+    keywords: ["admin", "verified-merge", "verified", "merge"],
+    headings: ["The gates", "Add the workflow", "What the check does", "The test command", "Run it on your own machine", "Turn on automatic merge", "After the merge", "Check one fix"],
+    excerpt: "Mushi merges an agent's fix on its own only with proof \u2014 a test that fails without the fix and passes with it, run in your own CI."
+  },
   {
     title: "Voice intake",
     url: docUrl("/admin/voice"),
@@ -2124,7 +2218,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/concepts/agent-pr-review",
     markdown: "concepts/agent-pr-review.md",
     keywords: ["concepts", "agent-pr-review", "agent", "review", "pr"],
-    headings: ["What you see", "What the review checks", "Re-running a review", "Cost and keys", "For operators"],
+    headings: ["What you see", "What the review checks", "Re-running a review", 'When the review says "fix first"', "Spend-down and its safety stop", "Cost and keys", "For operators"],
     excerpt: 'Claude Opus 5.5 reviews every pull request a cloud coding agent opens as a fix, and a "hold" stops Mushi from merging it until you choose to.'
   },
   {
@@ -2259,8 +2353,8 @@ var MUSHI_DOCS_INDEX = [
     route: "/concepts/open-source",
     markdown: "concepts/open-source.md",
     keywords: ["concepts", "open-source", "open", "source", "licensing"],
-    headings: ["Open-core, one repo", "Why MIT for the SDK?", "Why AGPLv3 for the server?", "No lock-in", "What's paid and what's free", "Run it yourself", "Trademarks"],
-    excerpt: "What is open source in Mushi \u2014 MIT SDKs you can embed anywhere, an AGPLv3 server you can self-host, and the small commercial enterprise edition."
+    headings: ["Open-core, one repo", "Why MIT for the SDK?", "Why AGPLv3 for the server?", "Why AGPLv3 for the console?", "What the hosted service keeps", "Contributing", "No lock-in", "What's paid and what's free"],
+    excerpt: "What is open in Mushi: MIT SDKs to embed anywhere, an AGPLv3 server and console to self-host, a small commercial edition, and what the hosted service keeps."
   },
   {
     title: "Connecting your orchestrator (MCP / A2A / REST / AG-UI)",
@@ -2532,6 +2626,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["What lives here", "The four independent deploy paths"],
     excerpt: "Runbooks for maintainers running Mushi Cloud or publishing the open-source packages \u2014 deployment, releases and status. Not needed to use the SDK."
   },
+  {
+    title: "CI runners",
+    url: docUrl("/operating/ci-runners"),
+    route: "/operating/ci-runners",
+    markdown: "operating/ci-runners.md",
+    keywords: ["operating", "ci-runners", "runners", "ci"],
+    headings: ["Your fix failed, or the test machine stopped", "The CI view", "GitHub permissions", "What CI costs, and where it should run", "Why it costs what it costs", "Your figures", "Advice", "Change where CI runs"],
+    excerpt: "See where your tests run and why a fix waits. Tell a broken fix from a stopped test machine, and add your own machine as a runner safely."
+  },
   {
     title: "Deployment & releases",
     url: docUrl("/operating/deployment"),
@@ -2844,7 +2947,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/roadmap",
     markdown: "roadmap.md",
     keywords: ["roadmap"],
-    headings: ["Live boards", "Release waves", "Wave E details (in-flight)", "Wave D highlights (shipped)", "Completed highlights (Wave C, v0.8.0)"],
+    headings: ["Live boards", "Release waves", "Wave E details (in-flight)", "Agent fixes you can trust (October 2026)", "Wave D highlights (shipped)", "Completed highlights (Wave C, v0.8.0)"],
     excerpt: "Where Mushi Mushi is headed \u2014 upcoming SDK platforms, diagnosis speed targets, and console features, updated as work lands."
   },
   {
@@ -2925,7 +3028,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/sdks/cli",
     markdown: "sdks/cli.md",
     keywords: ["sdks", "cli", "@mushi-mushi/cli"],
-    headings: ["Console \u2194 CLI setup loop", "Setup & health", "mushi doctor", "mushi nudge", "Reports & lessons", "Sentry issues already open", "Reporter updates held for review", "Agentic fixes"],
+    headings: ["Console \u2194 CLI setup loop", "Setup & health", "mushi doctor", "mushi nudge", "Reports & lessons", "Sentry issues already open", "File a report yourself", "Reporter updates held for review"],
     excerpt: "Reference for @mushi-mushi/cli \u2014 log in, connect a project, run doctor, list reports, dispatch agent fixes and merge their pull requests from the terminal."
   },
   {
@@ -4328,6 +4431,22 @@ function createMushiServer(config) {
       return jsonText(await apiCall(`/v1/admin/fixes/${args.fixId}/timeline`, { headers }));
     }
   );
+  server.registerTool(
+    "get_fix_verification",
+    {
+      title: titleOf("get_fix_verification"),
+      description: descOf("get_fix_verification"),
+      annotations: annotationsFor("get_fix_verification"),
+      inputSchema: z.object({
+        fixId: z.string().describe("fix_attempt UUID"),
+        projectId: z.string().optional().describe("Project UUID \u2014 required for org-scoped keys with multiple projects.")
+      })
+    },
+    async (args) => {
+      const { headers } = await projectScopeHeaders(args.projectId);
+      return jsonText(await apiCall(`/v1/admin/fixes/${encodeURIComponent(args.fixId)}/verification`, { headers }));
+    }
+  );
   server.registerTool(
     "get_blast_radius",
     {
@@ -4792,6 +4911,104 @@ function createMushiServer(config) {
       return jsonText(await apiCall(`/v1/admin/code-health?${qs}`));
     }
   );
+  const CI_ADVICE_OUTPUT = z.looseObject({
+    id: z.string(),
+    severity: z.string(),
+    title: z.string(),
+    detail: z.string().nullable().optional(),
+    evidence: z.unknown().optional(),
+    fix: z.string().nullable().optional()
+  });
+  server.registerTool(
+    "get_ci_overview",
+    {
+      title: titleOf("get_ci_overview"),
+      description: descOf("get_ci_overview"),
+      annotations: annotationsFor("get_ci_overview"),
+      inputSchema: z.object({
+        projectId: z.string().optional().describe("Project UUID \u2014 defaults to the server-configured project; omitted with an account-level key, every project you can read"),
+        days: z.number().int().min(1).max(30).optional().describe("Window in days (default 7)"),
+        refresh: z.boolean().optional().describe("Read GitHub first instead of the last 10-minute sync (at most once a minute per project)")
+      }),
+      outputSchema: z.looseObject({
+        generatedAt: z.string().optional(),
+        refreshedAt: z.string().nullable().optional(),
+        window: z.unknown().optional(),
+        permissions: z.unknown().optional(),
+        hosts: z.array(z.looseObject({})).optional().describe("Machines that send a runner heartbeat"),
+        runners: z.array(z.looseObject({})).optional().describe("GitHub runners seen, with status"),
+        repos: z.array(z.looseObject({})).optional(),
+        jobs: z.array(z.looseObject({})).optional().describe("Latest jobs with their infra or code verdict"),
+        stats: z.looseObject({}).nullable().optional(),
+        advice: z.array(CI_ADVICE_OUTPUT).optional().describe("Rule-based advice with evidence, most severe first")
+      })
+    },
+    async (args) => {
+      const pid = args.projectId ? await resolveProjectId(args.projectId) : projectId || void 0;
+      const qs = new URLSearchParams({ days: String(args.days ?? 7) });
+      if (pid) qs.set("project_id", pid);
+      if (args.refresh) qs.set("refresh", "1");
+      return jsonResult(
+        await apiCall(`/v1/admin/ci/overview?${qs}`, void 0, args.refresh ? { minTimeoutMs: 6e4 } : void 0)
+      );
+    }
+  );
+  server.registerTool(
+    "get_ci_costs",
+    {
+      title: titleOf("get_ci_costs"),
+      description: descOf("get_ci_costs"),
+      annotations: annotationsFor("get_ci_costs"),
+      inputSchema: z.object({
+        projectId: z.string().optional().describe("Project UUID \u2014 defaults to the server-configured project; omitted with an account-level key, every project you can read"),
+        days: z.number().int().min(1).max(30).optional().describe("Window in days (default 30)")
+      }),
+      outputSchema: z.looseObject({
+        window: z.unknown().optional(),
+        dataDays: z.number().optional(),
+        lowConfidence: z.boolean().optional().describe("Under 7 days of data"),
+        source: z.string().optional(),
+        sourceNote: z.string().nullable().optional(),
+        rates: z.unknown().optional().describe("GitHub list prices and the date they were read"),
+        fields: z.record(z.string(), z.string()).optional().describe("measured | estimated per field"),
+        settings: z.array(z.looseObject({})).optional(),
+        repos: z.array(z.looseObject({})).optional(),
+        rows: z.array(z.looseObject({})).optional().describe("Per repo \xD7 runner class: wait, run time, pass rate, minutes, cost"),
+        accounts: z.array(z.looseObject({})).optional().describe("Included minutes per GitHub owner"),
+        machines: z.array(z.looseObject({})).optional(),
+        speed: z.array(z.looseObject({})).optional(),
+        whatIfs: z.array(z.looseObject({})).optional(),
+        explain: z.looseObject({}).optional(),
+        advice: z.array(CI_ADVICE_OUTPUT).optional()
+      })
+    },
+    async (args) => {
+      const pid = args.projectId ? await resolveProjectId(args.projectId) : projectId || void 0;
+      const qs = new URLSearchParams({ days: String(args.days ?? 30) });
+      if (pid) qs.set("project_id", pid);
+      return jsonResult(await apiCall(`/v1/admin/ci/compare?${qs}`, void 0, { minTimeoutMs: 6e4 }));
+    }
+  );
+  server.registerTool(
+    "request_ci_placement_change",
+    {
+      title: titleOf("request_ci_placement_change"),
+      description: descOf("request_ci_placement_change"),
+      annotations: annotationsFor("request_ci_placement_change"),
+      inputSchema: z.object({
+        projectId: z.string().optional().describe("Project UUID \u2014 defaults to the server-configured project"),
+        repo: z.string().regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/).describe("owner/repo, connected to the project"),
+        variable: z.string().regex(/^(?:LINUX_RUNNER|RUNNER_[A-Z0-9_]{1,60})$/).describe("LINUX_RUNNER or RUNNER_<WORKFLOW>"),
+        value: z.string().min(1).max(100).nullable().describe("One runner label, or null to remove the variable"),
+        reason: z.string().max(500).optional().describe("Why, shown to the approver")
+      })
+    },
+    async (args) => {
+      const pid = await resolveProjectId(args.projectId);
+      const body = { projectId: pid, repo: args.repo, variable: args.variable, value: args.value, ...args.reason ? { reason: args.reason } : {} };
+      return jsonText(await apiCall("/v1/admin/ci/placement/requests", { method: "POST", body: JSON.stringify(body) }));
+    }
+  );
   server.registerTool(
     "explain_finding",
     {
@@ -6078,6 +6295,42 @@ function createMushiServer(config) {
       return jsonResult(data);
     }
   );
+  server.registerTool(
+    "file_report",
+    {
+      title: titleOf("file_report"),
+      description: descOf("file_report"),
+      annotations: annotationsFor("file_report"),
+      inputSchema: z.object({
+        title: z.string().min(3).max(200).describe("One-line title (3-200 characters)"),
+        description: z.string().min(1).max(1e4).describe("What happens, steps to reproduce, what you expected, and how to check it is fixed"),
+        severity: z.enum(["critical", "high", "medium", "low"]).optional().describe("Your severity hint; triage may refine it"),
+        component: z.string().max(200).optional().describe('Area of the app, e.g. "checkout"'),
+        projectId: z.string().optional().describe("Project UUID. Defaults to configured project.")
+      }),
+      outputSchema: z.object({
+        reportId: z.string().describe("The new report id; pass it to triage_issue or dispatch_fix"),
+        projectId: z.string(),
+        title: z.string(),
+        status: z.string().describe("Always new: triage starts right away"),
+        severity: z.string().nullable(),
+        component: z.string().nullable()
+      })
+    },
+    async (args) => {
+      const pid = await resolveProjectId(args.projectId);
+      const data = await apiCall(`/v1/admin/projects/${pid}/reports`, {
+        method: "POST",
+        body: JSON.stringify({
+          title: args.title,
+          description: args.description,
+          severity: args.severity,
+          component: args.component
+        })
+      });
+      return jsonResult(data);
+    }
+  );
   server.registerTool(
     "transition_status",
     {

package/dist/server.js

@@ -4,7 +4,7 @@ import {
   TDD_TOOL_CATALOG,
   TOOL_CATALOG,
   routeUseMushiIntent
-} from "./chunk-PVN7VPVW.js";
+} from "./chunk-MOW6PVHK.js";
 import {
   MUSHI_SERVER_METADATA
 } from "./chunk-FJRPC4VR.js";
@@ -12,7 +12,7 @@ import {
   DEPRECATED_TOOL_ALIASES,
   TOOL_FEATURE_MAP,
   toolMatchesFeatures
-} from "./chunk-DJCVJ3YZ.js";
+} from "./chunk-7RWHDJPZ.js";
 
 // src/server.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -89,6 +89,24 @@ var MUSHI_DOCS_INDEX = [
     headings: ["Reading your usage card", "Usage breakdown", "Predictability controls", "Upgrading your plan", "Changing plan", "Managing payment and invoices", "CLI parity", "Related docs"],
     excerpt: "The Billing page shows your diagnosis quota, usage alerts at 50% and 80%, your projected bill, and spend caps for your Mushi plan."
   },
+  {
+    title: "Checks",
+    url: docUrl("/admin/checks"),
+    route: "/admin/checks",
+    markdown: "admin/checks.md",
+    keywords: ["admin", "checks"],
+    headings: ["App checks", "AI quality"],
+    excerpt: "The Checks page lists every automatic check on this app. Each card opens that check, with the same live count the sidebar shows."
+  },
+  {
+    title: "CI runners",
+    url: docUrl("/admin/ci"),
+    route: "/admin/ci",
+    markdown: "admin/ci.md",
+    keywords: ["admin", "ci", "runners"],
+    headings: ["Test machine or your code", "Queue and wait", "Runner map", "What would make fixes land sooner", "When nothing has reported in", "Related pages"],
+    excerpt: "The console CI runners page shows where tests run, how long they wait for a machine, and whether a red check was your code or the test machine."
+  },
   {
     title: "CLI device auth",
     url: docUrl("/admin/cli-auth"),
@@ -152,6 +170,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["What to look for first", "Flow canvas", "KPI tiles (14-day window)", "Charts row (14 days)", "Triage queue", "Insights row", "Common tasks", "Morning check (2 minutes)"],
     excerpt: "The Mushi dashboard answers whether anything broke since your last release \u2014 new reports, overnight fix runs and pipeline health on one screen."
   },
+  {
+    title: "Design system",
+    url: docUrl("/admin/design"),
+    route: "/admin/design",
+    markdown: "admin/design.md",
+    keywords: ["admin", "design", "system"],
+    headings: ["Tokens", "The deviance score", "How an edit becomes a draft PR", "Related"],
+    excerpt: "The Design system page shows your tokens, contrast pairs, type scale and a deviance score for off-token code. Token and rule edits open a draft pull request."
+  },
   {
     title: "Docs bridge",
     url: docUrl("/admin/docs-bridge"),
@@ -431,6 +458,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["Presence", "Comments", "Writing a comment", "Editing and deleting", "Timestamps", "Notifications", "Audit log", "See also"],
     excerpt: "How Mushi report pages support real-time collaboration \u2014 see who else is viewing a report and watch new comments arrive without a refresh."
   },
+  {
+    title: "App blueprint",
+    url: docUrl("/admin/recipe"),
+    route: "/admin/recipe",
+    markdown: "admin/recipe.md",
+    keywords: ["admin", "recipe", "app", "blueprint"],
+    headings: ["Refresh and status", "Diagram and list", 'What "not connected" means', "Side panel", "Risk checks", "Related"],
+    excerpt: "The App blueprint page shows what this app is built from, the state of each part, and the draft pull request a change opens."
+  },
   {
     title: "Releases",
     url: docUrl("/admin/releases"),
@@ -575,6 +611,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["Run in the cloud", "What you see", "File as bug", "Where the changes are"],
     excerpt: "Each screen your coding agent worked on in a mushi ux run, with its plan, every attempt, before and after screenshots, and what was kept."
   },
+  {
+    title: "Verified merge",
+    url: docUrl("/admin/verified-merge"),
+    route: "/admin/verified-merge",
+    markdown: "admin/verified-merge.md",
+    keywords: ["admin", "verified-merge", "verified", "merge"],
+    headings: ["The gates", "Add the workflow", "What the check does", "The test command", "Run it on your own machine", "Turn on automatic merge", "After the merge", "Check one fix"],
+    excerpt: "Mushi merges an agent's fix on its own only with proof \u2014 a test that fails without the fix and passes with it, run in your own CI."
+  },
   {
     title: "Voice intake",
     url: docUrl("/admin/voice"),
@@ -716,7 +761,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/concepts/agent-pr-review",
     markdown: "concepts/agent-pr-review.md",
     keywords: ["concepts", "agent-pr-review", "agent", "review", "pr"],
-    headings: ["What you see", "What the review checks", "Re-running a review", "Cost and keys", "For operators"],
+    headings: ["What you see", "What the review checks", "Re-running a review", 'When the review says "fix first"', "Spend-down and its safety stop", "Cost and keys", "For operators"],
     excerpt: 'Claude Opus 5.5 reviews every pull request a cloud coding agent opens as a fix, and a "hold" stops Mushi from merging it until you choose to.'
   },
   {
@@ -851,8 +896,8 @@ var MUSHI_DOCS_INDEX = [
     route: "/concepts/open-source",
     markdown: "concepts/open-source.md",
     keywords: ["concepts", "open-source", "open", "source", "licensing"],
-    headings: ["Open-core, one repo", "Why MIT for the SDK?", "Why AGPLv3 for the server?", "No lock-in", "What's paid and what's free", "Run it yourself", "Trademarks"],
-    excerpt: "What is open source in Mushi \u2014 MIT SDKs you can embed anywhere, an AGPLv3 server you can self-host, and the small commercial enterprise edition."
+    headings: ["Open-core, one repo", "Why MIT for the SDK?", "Why AGPLv3 for the server?", "Why AGPLv3 for the console?", "What the hosted service keeps", "Contributing", "No lock-in", "What's paid and what's free"],
+    excerpt: "What is open in Mushi: MIT SDKs to embed anywhere, an AGPLv3 server and console to self-host, a small commercial edition, and what the hosted service keeps."
   },
   {
     title: "Connecting your orchestrator (MCP / A2A / REST / AG-UI)",
@@ -1124,6 +1169,15 @@ var MUSHI_DOCS_INDEX = [
     headings: ["What lives here", "The four independent deploy paths"],
     excerpt: "Runbooks for maintainers running Mushi Cloud or publishing the open-source packages \u2014 deployment, releases and status. Not needed to use the SDK."
   },
+  {
+    title: "CI runners",
+    url: docUrl("/operating/ci-runners"),
+    route: "/operating/ci-runners",
+    markdown: "operating/ci-runners.md",
+    keywords: ["operating", "ci-runners", "runners", "ci"],
+    headings: ["Your fix failed, or the test machine stopped", "The CI view", "GitHub permissions", "What CI costs, and where it should run", "Why it costs what it costs", "Your figures", "Advice", "Change where CI runs"],
+    excerpt: "See where your tests run and why a fix waits. Tell a broken fix from a stopped test machine, and add your own machine as a runner safely."
+  },
   {
     title: "Deployment & releases",
     url: docUrl("/operating/deployment"),
@@ -1436,7 +1490,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/roadmap",
     markdown: "roadmap.md",
     keywords: ["roadmap"],
-    headings: ["Live boards", "Release waves", "Wave E details (in-flight)", "Wave D highlights (shipped)", "Completed highlights (Wave C, v0.8.0)"],
+    headings: ["Live boards", "Release waves", "Wave E details (in-flight)", "Agent fixes you can trust (October 2026)", "Wave D highlights (shipped)", "Completed highlights (Wave C, v0.8.0)"],
     excerpt: "Where Mushi Mushi is headed \u2014 upcoming SDK platforms, diagnosis speed targets, and console features, updated as work lands."
   },
   {
@@ -1517,7 +1571,7 @@ var MUSHI_DOCS_INDEX = [
     route: "/sdks/cli",
     markdown: "sdks/cli.md",
     keywords: ["sdks", "cli", "@mushi-mushi/cli"],
-    headings: ["Console \u2194 CLI setup loop", "Setup & health", "mushi doctor", "mushi nudge", "Reports & lessons", "Sentry issues already open", "Reporter updates held for review", "Agentic fixes"],
+    headings: ["Console \u2194 CLI setup loop", "Setup & health", "mushi doctor", "mushi nudge", "Reports & lessons", "Sentry issues already open", "File a report yourself", "Reporter updates held for review"],
     excerpt: "Reference for @mushi-mushi/cli \u2014 log in, connect a project, run doctor, list reports, dispatch agent fixes and merge their pull requests from the terminal."
   },
   {
@@ -2986,6 +3040,22 @@ function createMushiServer(config) {
       return jsonText(await apiCall(`/v1/admin/fixes/${args.fixId}/timeline`, { headers }));
     }
   );
+  server.registerTool(
+    "get_fix_verification",
+    {
+      title: titleOf("get_fix_verification"),
+      description: descOf("get_fix_verification"),
+      annotations: annotationsFor("get_fix_verification"),
+      inputSchema: z.object({
+        fixId: z.string().describe("fix_attempt UUID"),
+        projectId: z.string().optional().describe("Project UUID \u2014 required for org-scoped keys with multiple projects.")
+      })
+    },
+    async (args) => {
+      const { headers } = await projectScopeHeaders(args.projectId);
+      return jsonText(await apiCall(`/v1/admin/fixes/${encodeURIComponent(args.fixId)}/verification`, { headers }));
+    }
+  );
   server.registerTool(
     "get_blast_radius",
     {
@@ -3450,6 +3520,104 @@ function createMushiServer(config) {
       return jsonText(await apiCall(`/v1/admin/code-health?${qs}`));
     }
   );
+  const CI_ADVICE_OUTPUT = z.looseObject({
+    id: z.string(),
+    severity: z.string(),
+    title: z.string(),
+    detail: z.string().nullable().optional(),
+    evidence: z.unknown().optional(),
+    fix: z.string().nullable().optional()
+  });
+  server.registerTool(
+    "get_ci_overview",
+    {
+      title: titleOf("get_ci_overview"),
+      description: descOf("get_ci_overview"),
+      annotations: annotationsFor("get_ci_overview"),
+      inputSchema: z.object({
+        projectId: z.string().optional().describe("Project UUID \u2014 defaults to the server-configured project; omitted with an account-level key, every project you can read"),
+        days: z.number().int().min(1).max(30).optional().describe("Window in days (default 7)"),
+        refresh: z.boolean().optional().describe("Read GitHub first instead of the last 10-minute sync (at most once a minute per project)")
+      }),
+      outputSchema: z.looseObject({
+        generatedAt: z.string().optional(),
+        refreshedAt: z.string().nullable().optional(),
+        window: z.unknown().optional(),
+        permissions: z.unknown().optional(),
+        hosts: z.array(z.looseObject({})).optional().describe("Machines that send a runner heartbeat"),
+        runners: z.array(z.looseObject({})).optional().describe("GitHub runners seen, with status"),
+        repos: z.array(z.looseObject({})).optional(),
+        jobs: z.array(z.looseObject({})).optional().describe("Latest jobs with their infra or code verdict"),
+        stats: z.looseObject({}).nullable().optional(),
+        advice: z.array(CI_ADVICE_OUTPUT).optional().describe("Rule-based advice with evidence, most severe first")
+      })
+    },
+    async (args) => {
+      const pid = args.projectId ? await resolveProjectId(args.projectId) : projectId || void 0;
+      const qs = new URLSearchParams({ days: String(args.days ?? 7) });
+      if (pid) qs.set("project_id", pid);
+      if (args.refresh) qs.set("refresh", "1");
+      return jsonResult(
+        await apiCall(`/v1/admin/ci/overview?${qs}`, void 0, args.refresh ? { minTimeoutMs: 6e4 } : void 0)
+      );
+    }
+  );
+  server.registerTool(
+    "get_ci_costs",
+    {
+      title: titleOf("get_ci_costs"),
+      description: descOf("get_ci_costs"),
+      annotations: annotationsFor("get_ci_costs"),
+      inputSchema: z.object({
+        projectId: z.string().optional().describe("Project UUID \u2014 defaults to the server-configured project; omitted with an account-level key, every project you can read"),
+        days: z.number().int().min(1).max(30).optional().describe("Window in days (default 30)")
+      }),
+      outputSchema: z.looseObject({
+        window: z.unknown().optional(),
+        dataDays: z.number().optional(),
+        lowConfidence: z.boolean().optional().describe("Under 7 days of data"),
+        source: z.string().optional(),
+        sourceNote: z.string().nullable().optional(),
+        rates: z.unknown().optional().describe("GitHub list prices and the date they were read"),
+        fields: z.record(z.string(), z.string()).optional().describe("measured | estimated per field"),
+        settings: z.array(z.looseObject({})).optional(),
+        repos: z.array(z.looseObject({})).optional(),
+        rows: z.array(z.looseObject({})).optional().describe("Per repo \xD7 runner class: wait, run time, pass rate, minutes, cost"),
+        accounts: z.array(z.looseObject({})).optional().describe("Included minutes per GitHub owner"),
+        machines: z.array(z.looseObject({})).optional(),
+        speed: z.array(z.looseObject({})).optional(),
+        whatIfs: z.array(z.looseObject({})).optional(),
+        explain: z.looseObject({}).optional(),
+        advice: z.array(CI_ADVICE_OUTPUT).optional()
+      })
+    },
+    async (args) => {
+      const pid = args.projectId ? await resolveProjectId(args.projectId) : projectId || void 0;
+      const qs = new URLSearchParams({ days: String(args.days ?? 30) });
+      if (pid) qs.set("project_id", pid);
+      return jsonResult(await apiCall(`/v1/admin/ci/compare?${qs}`, void 0, { minTimeoutMs: 6e4 }));
+    }
+  );
+  server.registerTool(
+    "request_ci_placement_change",
+    {
+      title: titleOf("request_ci_placement_change"),
+      description: descOf("request_ci_placement_change"),
+      annotations: annotationsFor("request_ci_placement_change"),
+      inputSchema: z.object({
+        projectId: z.string().optional().describe("Project UUID \u2014 defaults to the server-configured project"),
+        repo: z.string().regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/).describe("owner/repo, connected to the project"),
+        variable: z.string().regex(/^(?:LINUX_RUNNER|RUNNER_[A-Z0-9_]{1,60})$/).describe("LINUX_RUNNER or RUNNER_<WORKFLOW>"),
+        value: z.string().min(1).max(100).nullable().describe("One runner label, or null to remove the variable"),
+        reason: z.string().max(500).optional().describe("Why, shown to the approver")
+      })
+    },
+    async (args) => {
+      const pid = await resolveProjectId(args.projectId);
+      const body = { projectId: pid, repo: args.repo, variable: args.variable, value: args.value, ...args.reason ? { reason: args.reason } : {} };
+      return jsonText(await apiCall("/v1/admin/ci/placement/requests", { method: "POST", body: JSON.stringify(body) }));
+    }
+  );
   server.registerTool(
     "explain_finding",
     {
@@ -4736,6 +4904,42 @@ function createMushiServer(config) {
       return jsonResult(data);
     }
   );
+  server.registerTool(
+    "file_report",
+    {
+      title: titleOf("file_report"),
+      description: descOf("file_report"),
+      annotations: annotationsFor("file_report"),
+      inputSchema: z.object({
+        title: z.string().min(3).max(200).describe("One-line title (3-200 characters)"),
+        description: z.string().min(1).max(1e4).describe("What happens, steps to reproduce, what you expected, and how to check it is fixed"),
+        severity: z.enum(["critical", "high", "medium", "low"]).optional().describe("Your severity hint; triage may refine it"),
+        component: z.string().max(200).optional().describe('Area of the app, e.g. "checkout"'),
+        projectId: z.string().optional().describe("Project UUID. Defaults to configured project.")
+      }),
+      outputSchema: z.object({
+        reportId: z.string().describe("The new report id; pass it to triage_issue or dispatch_fix"),
+        projectId: z.string(),
+        title: z.string(),
+        status: z.string().describe("Always new: triage starts right away"),
+        severity: z.string().nullable(),
+        component: z.string().nullable()
+      })
+    },
+    async (args) => {
+      const pid = await resolveProjectId(args.projectId);
+      const data = await apiCall(`/v1/admin/projects/${pid}/reports`, {
+        method: "POST",
+        body: JSON.stringify({
+          title: args.title,
+          description: args.description,
+          severity: args.severity,
+          component: args.component
+        })
+      });
+      return jsonResult(data);
+    }
+  );
   server.registerTool(
     "transition_status",
     {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mushi-mushi/mcp",
   "mcpName": "io.github.kensaurus/mushi-mushi",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "license": "MIT",
   "description": "MCP server for Cursor, Claude Code and Copilot. The bug mediator for AI-built apps: plain-English diagnosis + a ready fix, in your editor.",
   "type": "module",
@@ -45,7 +45,7 @@
     "@modelcontextprotocol/core": "^2.3.1",
     "@modelcontextprotocol/server": "^2.3.1",
     "zod": "^4.4.3",
-    "@mushi-mushi/core": "^1.33.1"
+    "@mushi-mushi/core": "^1.33.2"
   },
   "peerDependencies": {
     "@sentry/node": "^10.57.0"