@mutmutco/claude-plugin 4.5.113 → 4.5.115

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.5.113",
+  "version": "4.5.115",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -957,6 +957,8 @@ var init_house_map = __esm({
       // register/run/park schedule rows under the one lane contract
       // --- devops — shipping --------------------------------------------------------------------------
       pr: "devops",
+      read: "devops",
+      // closed typed GitHub reads on the App pool (run/pr/issue broker, #8042)
       api: "devops",
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       ci: "devops",
@@ -5746,6 +5748,19 @@ var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
 var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
   "pr checks-wait",
+  // #8042: App-native required-only read (`pr checks-required`) — REST check/status rows scoped by
+  // fetchRequiredCheckContexts, never native `gh pr checks` for the required verdict (historical EMPTY
+  // App table on the #3035 fixture/profile — REST is the deterministic adapter, not a claim native
+  // always fails: same-token parity on later fixtures agrees).
+  "pr checks-required",
+  // #8042: the closed typed read broker — run/pr/issue families, REST pr-checks, allowlisted api get.
+  "read run view",
+  "read run list",
+  "read run watch",
+  "read pr view",
+  "read pr checks",
+  "read issue view",
+  "read issue list",
   "pr view",
   "issue list",
   "issue view",
@@ -6308,6 +6323,9 @@ async function ghReadEnv() {
   const appToken = await pollToken();
   return appToken ? { ...process.env, GH_TOKEN: appToken } : void 0;
 }
+function ghApiWithEnv(env) {
+  return (args) => defaultGhApi(args, env);
+}
 var INCLUDED_HEADER_BLOCK = /^(?:\r?\n)?HTTP\/\d(?:\.\d)? (\d{3})[^\n]*\n(?:[^\n]+\n)*?\r?\n/gm;
 function parseIncludedOutput(out) {
   let status;
@@ -6361,7 +6379,7 @@ function observedCorePool(source, nowMs) {
   const seen = source ? observedPool.get(source) : void 0;
   return seen && nowMs - seen.atMs <= OBSERVED_POOL_MAX_AGE_MS && seen.reset * 1e3 > nowMs ? { remaining: seen.remaining, reset: seen.reset } : void 0;
 }
-async function defaultGhApi(args) {
+async function defaultGhApi(args, env = process.env) {
   const appToken = await pollToken();
   const source = appToken ? "app" : "user";
   const key = `${source}\0${args.join("\0")}`;
@@ -6372,7 +6390,9 @@ async function defaultGhApi(args) {
       timeout: REST_GH_TIMEOUT_MS,
       // Only on the App source: passing `env` at all replaces the inherited environment wholesale,
       // and `gh` needs the rest of it (PATH, GH_HOST, config home). Ambient rides the inherited env.
-      ...source === "app" && appToken ? { env: { ...process.env, GH_TOKEN: appToken } } : {}
+      // #8042: callers may pass a scrubbed env (brokerChildEnv) to pin the host and drop enterprise
+      // credentials; the default is the process env (legacy waiter behavior, unchanged).
+      ...source === "app" && appToken ? { env: { ...env, GH_TOKEN: appToken } } : env === process.env ? {} : { env }
     }));
   } catch (e) {
     const out = e.stdout;
@@ -6601,13 +6621,13 @@ async function fetchRestClosingGuardPayload(prNumber, repo, gh2 = defaultGhApi)
   return { pr, commits };
 }
 async function fetchHeadCheckRuns(headSha, repo, gh2) {
-  const runsOut = await gh2(["--paginate", `repos/${repo}/commits/${headSha}/check-runs?per_page=100`, "--jq", ".check_runs[] | {id, name, status, conclusion, app_id: .app.id, details_url}"]);
+  const runsOut = await gh2(["--paginate", `repos/${repo}/commits/${headSha}/check-runs?per_page=100`, "--jq", ".check_runs[] | {id, name, status, conclusion, app_id: .app.id, details_url, started_at, completed_at}"]);
   return dedupeLatestCheckRuns(parseNdjsonLines(runsOut));
 }
 async function fetchHeadCheckEntries(headSha, repo, gh2) {
   const [runs, statusesOut] = await Promise.all([
     fetchHeadCheckRuns(headSha, repo, gh2),
-    gh2(["--paginate", `repos/${repo}/commits/${headSha}/status?per_page=100`, "--jq", ".statuses[] | {context, state}"])
+    gh2(["--paginate", `repos/${repo}/commits/${headSha}/status?per_page=100`, "--jq", ".statuses[] | {context, state, target_url, description}"])
   ]);
   const statuses = parseNdjsonLines(statusesOut);
   return [
@@ -6654,6 +6674,212 @@ async function pollRestPrChecksWithWorkflowEvidence(prNumber, repo, gh2 = defaul
 async function pollRestCommitChecks(sha, repo, gh2 = defaultGhApi) {
   return derivePollState(partitionByRequired(await fetchHeadCheckEntries(sha, repo, gh2), null).relevant);
 }
+var GH_ZERO_TIME = "0001-01-01T00:00:00Z";
+var GH_PR_CHECKS_JSON_FIELDS = ["bucket", "completedAt", "description", "link", "name", "startedAt", "state"];
+function nativeStateForRun(run) {
+  if (run.status !== "completed") {
+    const raw2 = (run.status ?? "pending").toUpperCase();
+    if (raw2 === "QUEUED" || raw2 === "IN_PROGRESS" || raw2 === "WAITING" || raw2 === "REQUESTED" || raw2 === "PENDING") return raw2;
+    return "PENDING";
+  }
+  const raw = (run.conclusion ?? "").toUpperCase();
+  if (raw === "SUCCESS" || raw === "SKIPPED" || raw === "NEUTRAL" || raw === "ERROR" || raw === "FAILURE" || raw === "TIMED_OUT" || raw === "ACTION_REQUIRED" || raw === "CANCELLED" || raw === "STALE") return raw;
+  return "PENDING";
+}
+function nativeStateForStatus(state) {
+  const raw = (state ?? "").toUpperCase();
+  if (raw === "SUCCESS" || raw === "FAILURE" || raw === "ERROR" || raw === "PENDING" || raw === "EXPECTED") return raw;
+  return "PENDING";
+}
+function bucketForNativeState(state) {
+  if (state === "SUCCESS") return "pass";
+  if (state === "SKIPPED" || state === "NEUTRAL") return "skipping";
+  if (state === "FAILURE" || state === "ERROR" || state === "TIMED_OUT" || state === "ACTION_REQUIRED") return "fail";
+  if (state === "CANCELLED") return "cancel";
+  return "pending";
+}
+async function fetchHeadCheckRows(headSha, repo, gh2 = defaultGhApi) {
+  const [runs, statusesOut] = await Promise.all([
+    fetchHeadCheckRuns(headSha, repo, gh2),
+    gh2(["--paginate", `repos/${repo}/commits/${headSha}/status?per_page=100`, "--jq", ".statuses[] | {context, state, target_url, description}"])
+  ]);
+  const statuses = parseNdjsonLines(statusesOut);
+  const rows = [];
+  const nameAppIds = /* @__PURE__ */ new Map();
+  for (const run of runs) {
+    if (AUXILIARY_RELEASE_CHECK_CONTEXTS.has(run.name ?? "")) continue;
+    const runName = run.name ?? `check-run ${run.id ?? "unknown"}`;
+    if (typeof run.app_id === "number") {
+      const known = nameAppIds.get(runName) ?? [];
+      if (!known.includes(run.app_id)) known.push(run.app_id);
+      nameAppIds.set(runName, known);
+    }
+    const state = nativeStateForRun(run);
+    rows.push({
+      bucket: bucketForNativeState(state),
+      completedAt: typeof run.completed_at === "string" && run.completed_at ? run.completed_at : GH_ZERO_TIME,
+      // Check-runs carry no description in this endpoint (no output join — never invented).
+      description: "",
+      link: typeof run.details_url === "string" && run.details_url ? run.details_url : "",
+      name: runName,
+      startedAt: typeof run.started_at === "string" && run.started_at ? run.started_at : GH_ZERO_TIME,
+      state
+    });
+  }
+  for (const s of statuses) {
+    if (AUXILIARY_RELEASE_CHECK_CONTEXTS.has(s.context ?? "")) continue;
+    const state = nativeStateForStatus(s.state);
+    rows.push({
+      bucket: bucketForNativeState(state),
+      // Legacy statuses carry no timestamps: native-compatible zero, never omitted.
+      completedAt: GH_ZERO_TIME,
+      description: typeof s.description === "string" ? s.description : "",
+      link: typeof s.target_url === "string" && s.target_url ? s.target_url : "",
+      name: s.context ?? "unknown-status",
+      startedAt: GH_ZERO_TIME,
+      state
+    });
+  }
+  return { rows, nameAppIds };
+}
+function identitiesFromProtectionPayload(parsed) {
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error("malformed requirements metadata: protection body is not an object");
+  }
+  const { contexts, checks } = parsed;
+  const entries = [];
+  if (checks !== void 0) {
+    if (!Array.isArray(checks)) throw new Error("malformed requirements metadata: protection checks is not an array");
+    for (const c of checks) {
+      entries.push(protectionCheckToEntry(c, "protection checks[]"));
+    }
+  }
+  if (contexts !== void 0) {
+    if (!Array.isArray(contexts)) throw new Error("malformed requirements metadata: protection contexts is not an array");
+    for (const c of contexts) {
+      if (typeof c !== "string" || !c) throw new Error("malformed requirements metadata: protection contexts holds a non-string entry");
+      if (!entries.some((e) => e.context === c)) entries.push({ context: c, appId: null });
+    }
+  }
+  if (!Array.isArray(checks) && !Array.isArray(contexts)) {
+    throw new Error("malformed requirements metadata: protection body carries neither contexts nor checks");
+  }
+  return entries;
+}
+function protectionCheckToEntry(c, where) {
+  if (typeof c?.context !== "string" || !c.context) {
+    throw new Error(`malformed requirements metadata: ${where} holds an entry without a string context`);
+  }
+  return { context: c.context, appId: readAppId(c, where) };
+}
+function readAppId(c, where) {
+  if (c.app_id === void 0 || c.app_id === null) {
+    if (c.integration_id === void 0 || c.integration_id === null) return null;
+    if (typeof c.integration_id !== "number") throw new Error(`malformed requirements metadata: ${where} holds a non-numeric integration id`);
+    return c.integration_id;
+  }
+  if (typeof c.app_id !== "number") throw new Error(`malformed requirements metadata: ${where} holds a non-numeric app id`);
+  return c.app_id;
+}
+function identitiesFromRulesetPayload(parsed) {
+  if (!Array.isArray(parsed)) {
+    throw new Error("malformed requirements metadata: ruleset body is not an array");
+  }
+  const entries = [];
+  for (const rule of parsed) {
+    if (!rule || typeof rule.type !== "string" || !rule.type) throw new Error("malformed requirements metadata: ruleset entry has no rule type");
+    if (rule.type !== "required_status_checks") continue;
+    const list = rule.parameters?.required_status_checks;
+    if (!Array.isArray(list)) throw new Error("malformed requirements metadata: ruleset required_status_checks is not an array");
+    for (const check of list) {
+      entries.push(protectionCheckToEntry(check, "ruleset required_status_checks"));
+    }
+  }
+  return entries;
+}
+async function fetchRequiredCheckIdentities(repo, branch, gh2 = defaultGhApi) {
+  const byIdentity = /* @__PURE__ */ new Map();
+  const keyOf = (context, appId) => `${context}\0${appId ?? ""}`;
+  const add = (entry) => {
+    const key = keyOf(entry.context, entry.appId);
+    if (!byIdentity.has(key)) byIdentity.set(key, entry);
+  };
+  try {
+    const raw = await gh2([`repos/${repo}/branches/${encodeURIComponent(branch)}/protection/required_status_checks`]);
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error("malformed requirements metadata: protection body is not JSON");
+    }
+    for (const entry of identitiesFromProtectionPayload(parsed)) add(entry);
+  } catch (e) {
+    if (!isNotFoundError(e)) {
+      if (e instanceof Error && e.message.startsWith("malformed requirements metadata")) throw e;
+      return null;
+    }
+  }
+  try {
+    const raw = await gh2([`repos/${repo}/rules/branches/${encodeURIComponent(branch)}`]);
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error("malformed requirements metadata: ruleset body is not JSON");
+    }
+    for (const entry of identitiesFromRulesetPayload(parsed)) add(entry);
+  } catch (e) {
+    if (!isNotFoundError(e)) {
+      if (e instanceof Error && e.message.startsWith("malformed requirements metadata")) throw e;
+      return null;
+    }
+  }
+  return [...byIdentity.values()];
+}
+async function readRequiredCheckRows(prNumber, repo, gh2 = defaultGhApi) {
+  const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh2);
+  let entries;
+  try {
+    entries = await fetchRequiredCheckIdentities(repo, snapshot.baseRef, gh2);
+  } catch (e) {
+    throw new Error(`required-context lookup failed for ${repo}@${snapshot.baseRef} (${readErrorText(e)}) \u2014 refusing a required verdict against unknown requirements`);
+  }
+  if (entries === null) {
+    throw new Error(`required-context lookup failed for ${repo}@${snapshot.baseRef} (protection/ruleset read failed) \u2014 refusing a required verdict against unknown requirements`);
+  }
+  const appScope = [...entries].sort((a, b) => a.context.localeCompare(b.context));
+  const required = [...new Set(appScope.map((e) => e.context))];
+  const { rows: reported, nameAppIds } = await fetchHeadCheckRows(snapshot.headSha, repo, gh2);
+  const scoped = required.length > 0;
+  const requiredNames = new Set(required);
+  const inScope = scoped ? reported.filter((row) => requiredNames.has(row.name)) : reported;
+  const reportedNames = new Set(reported.map((row) => row.name));
+  const missing = appScope.filter((entry) => !isRequirementMet(entry, reportedNames, nameAppIds)).map((entry) => entry.appId === null ? entry.context : `${entry.context} (app ${entry.appId})`);
+  let state;
+  if (missing.length > 0) {
+    state = "pending";
+  } else if (inScope.length === 0) {
+    state = "no-checks-reported";
+  } else {
+    state = verdictFromBuckets(inScope.map((row) => row.bucket));
+  }
+  return { headSha: snapshot.headSha, baseRef: snapshot.baseRef, required, appScope, missing, rows: inScope, state, scoped };
+}
+function isRequirementMet(entry, reportedNames, nameAppIds) {
+  if (entry.appId === null) return reportedNames.has(entry.context);
+  return nameAppIds.get(entry.context)?.includes(entry.appId) ?? false;
+}
+function verdictFromBuckets(buckets) {
+  const anyFail = buckets.includes("fail") || buckets.includes("cancel");
+  const anyPending = buckets.includes("pending");
+  if (buckets.length === 0) return "no-checks-reported";
+  return anyFail ? anyPending ? "failing" : "failure" : anyPending ? "pending" : "success";
+}
+function checkRowsExitCode(state) {
+  if (state === "success") return 0;
+  if (state === "failure" || state === "failing") return 1;
+  return 8;
+}
 async function pollRestPrMergeable(prNumber, repo, gh2 = defaultGhApi) {
   try {
     return (await fetchRestPrSnapshot(prNumber, repo, gh2)).mergeable;
@@ -6885,6 +7111,20 @@ async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
 }
 
 // src/claim-marker-client.ts
+async function selectLivenessClient(client, appClient) {
+  if (appClient) return appClient;
+  let token;
+  try {
+    token = await pollToken();
+  } catch (e) {
+    const failing = async () => {
+      throw e;
+    };
+    return { ...client, rest: failing, restPaginate: failing, graphql: failing };
+  }
+  if (!token) return client;
+  return createGitHubClient({ token: async () => token });
+}
 function withAppClaimMarkerRead(client, appClient) {
   const commentsPath = /^repos\/[^/]+\/[^/]+\/issues\/\d+\/comments$/;
   return {
@@ -13850,10 +14090,10 @@ function laneResumeEvidence(evidence) {
   return `prior claim by lane ${describeClaimMarker(evidence.marker)} (@${evidence.markerBy}, ${formatClaimAge(evidence.markerAgeMs)} old) is verifiably not running on this host \u2014 its local session transcript is gone or stale${artifacts.length ? `; resuming over ${artifacts.join("; ")}` : ""}`;
 }
 async function checkLaneContest(client, item, actor = describeSessionIdentity(), viewerLogin, appClient) {
-  const markerClient = withAppClaimMarkerRead(client, appClient);
-  let evidence = await gatherClaimLiveness(markerClient, item.repository, item.number, openPullsFetcher(client));
+  const livenessClient = await selectLivenessClient(client, appClient);
+  let evidence = await gatherClaimLiveness(livenessClient, item.repository, item.number, openPullsFetcher(livenessClient));
   if (evidence.failed.some((channel) => channel !== "session")) {
-    evidence = await gatherClaimLiveness(markerClient, item.repository, item.number, openPullsFetcher(client));
+    evidence = await gatherClaimLiveness(livenessClient, item.repository, item.number, openPullsFetcher(livenessClient));
   }
   const ownership = laneOwnership(evidence.marker, actor);
   const sameOwner = Boolean(viewerLogin && evidence.markerBy && evidence.markerBy.toLowerCase() === viewerLogin.toLowerCase());
@@ -13874,13 +14114,19 @@ async function checkLaneContest(client, item, actor = describeSessionIdentity(),
   };
 }
 function laneContestParts(contest) {
-  const holder = contest.marker ? `lane ${describeClaimMarker(contest.marker)}` : contest.unverifiable.includes("comments") ? "an unreadable lane (its claim-marker comments could not be read, so no holder can be named)" : "another lane";
+  const holder = contest.marker ? `lane ${describeClaimMarker(contest.marker)}` : contest.unverifiable.includes("comments") ? "an unreadable lane (its claim-marker comments could not be read, so no holder can be named)" : contest.live.length === 0 && contest.unverifiable.length > 0 ? "an unknown holder (no claim marker was read and liveness could not be fully verified, so no holder can be named)" : "another lane";
   const seen = contest.live.join("; ");
   const unreadable = contest.unverifiable.length ? `liveness could not be fully verified (failed to read: ${contest.unverifiable.join(", ")})` : "";
   return { holder, why: [seen, unreadable].filter(Boolean).join("; ") };
 }
+function isUnknownHold(contest) {
+  return !contest.marker && contest.live.length === 0 && contest.unverifiable.length > 0;
+}
 function laneContestMessage(ref, contest, verb) {
   const { holder, why } = laneContestParts(contest);
+  if (isUnknownHold(contest)) {
+    return verb === "claim" ? `${ref} cannot be verified as free: ${holder} (${why}); the liveness reads failed so the claim is refused fail-closed \u2014 re-run with --force to take it anyway` : `refusing to unclaim ${ref}: ${holder} (${why}); the liveness reads failed so the unclaim is refused fail-closed \u2014 re-run with --force --holder-dead once you have evidence the holder lane is dead, or wait for it to go stale (#6625)`;
+  }
   return verb === "claim" ? `${ref} is already claimed by ${holder} with live evidence of active work (${why}); re-run with --force to take it anyway` : `refusing to unclaim ${ref}: ${holder} shows live evidence of active work (${why}); re-run with --force --holder-dead once you have evidence the holder lane is dead, or wait for it to go stale (#6625)`;
 }
 function ghError(e) {
@@ -14547,8 +14793,9 @@ async function unclaimBoardIssue(options, deps = {}) {
       }
       if (!options.holderDead) {
         const { holder, why } = laneContestParts(contest);
+        const still = isUnknownHold(contest) ? `${holder} (${why}); the liveness reads failed` : `${holder} still shows live evidence of active work (${why})`;
         throw new Error(withGatedWriteChainHint(
-          `refusing to unclaim ${item.ref} with --force: ${holder} still shows live evidence of active work (${why}); --force no longer overrides a live lane alone \u2014 re-run with --holder-dead once you have evidence the holder's session is dead, or wait for its lane to go stale (#6625)`
+          `refusing to unclaim ${item.ref} with --force: ${still}; --force no longer overrides a live lane alone \u2014 re-run with --holder-dead once you have evidence the holder's session is dead, or wait for its lane to go stale (#6625)`
         ));
       }
     }
@@ -17692,10 +17939,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.113",
-    tag: "v4.5.113",
-    commit: "c5ad425d42e2",
-    npm: "@mutmutco/cli@4.5.113"
+    version: "4.5.115",
+    tag: "v4.5.115",
+    commit: "8d0add650762",
+    npm: "@mutmutco/cli@4.5.115"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17712,14 +17959,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.113"
+          v3Target: "v4.5.115"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.113 and redeploy the Hub Lambda from tag v4.5.113 (c5ad425d42e2); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.113 (@mutmutco/cli@4.5.113, tag commit c5ad425d42e2 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.115 and redeploy the Hub Lambda from tag v4.5.115 (8d0add650762); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.115 (@mutmutco/cli@4.5.115, tag commit 8d0add650762 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -29503,7 +29750,7 @@ var PRIMARY_GROUPS = [
   ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
 var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin", "packages"]);
-var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup"]);
+var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup", "read"]);
 var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "dist", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
 var HELP_GROUP_ORDER = /* @__PURE__ */ new Map();
@@ -29543,6 +29790,7 @@ var COMMAND_OWNERSHIP = {
   stage: { module_owner: "cli/src/stage-commands.ts", consumer: "agent-workflow" },
   pr: { module_owner: "cli/src/pr-commands.ts", consumer: "agent-workflow" },
   api: { module_owner: "cli/src/api-read.ts", consumer: "agent-workflow" },
+  read: { module_owner: "cli/src/app-read-broker.ts", consumer: "agent-workflow" },
   ci: { module_owner: "cli/src/ci-audit.ts", consumer: "release-operator" },
   rcand: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
   release: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
@@ -43080,7 +43328,7 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
       }
     }
     if (state?.toLowerCase() === "closed") continue;
-    const contest = await checkContest(client, { repository: repo, number }, actor, viewerLogin);
+    const contest = await checkContest(client, { repository: repo, number }, actor, viewerLogin, deps.appClient);
     if (!contest.contested) continue;
     const ref = `${repo}#${number}`;
     const commentsPath = `repos/${repo}/issues/${number}/comments`;
@@ -43164,6 +43412,7 @@ var SERVICE_NAME_RE = /^[A-Za-z0-9_.-]+$/;
 var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var EXCLUDE_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
 var EXCLUDE_LABEL = "mmi.runtime-env.exclude";
+var KEYS_LABEL = "mmi.runtime-env.keys";
 var RUNTIME_ENV_OVERRIDE_RELPATH = "tmp/stage/runtime-env.override.yml";
 function labelsMarkRuntimeEnv(labels) {
   if (Array.isArray(labels)) {
@@ -43190,12 +43439,16 @@ function labelValue(labels, name) {
   if (labels && typeof labels === "object") return String(labels[name] ?? "");
   return "";
 }
-function parseRuntimeEnvExclude(value, service = "?") {
+function labelPresent(labels, name) {
+  if (Array.isArray(labels)) return labels.some((l) => typeof l === "string" && (l.trim() === name || l.slice(0, l.indexOf("=")).trim() === name));
+  return !!labels && typeof labels === "object" && name in labels;
+}
+function parseRuntimeEnvExclude(value, service = "?", label = EXCLUDE_LABEL) {
   if (!value.trim()) return [];
   return value.split(",").map((raw) => {
     const key = raw.trim();
     if (!EXCLUDE_KEY_RE.test(key)) {
-      throw new Error(`invalid ${EXCLUDE_LABEL} entry on service ${service}: '${key}' (comma-separated env-var names matching ^[A-Z_][A-Z0-9_]*$)`);
+      throw new Error(`invalid ${label} entry on service ${service}: '${key}' (comma-separated env-var names matching ^[A-Z_][A-Z0-9_]*$)`);
     }
     return key;
   });
@@ -43218,6 +43471,23 @@ function runtimeEnvExcludes(composeConfigJson) {
   }
   return out;
 }
+function runtimeEnvSelects(composeConfigJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(composeConfigJson);
+  } catch {
+    return {};
+  }
+  const services = parsed?.services;
+  if (!services || typeof services !== "object" || Array.isArray(services)) return {};
+  const out = {};
+  for (const [name, svc] of Object.entries(services)) {
+    const labels = svc?.labels;
+    if (!SERVICE_NAME_RE.test(name) || !labelsMarkRuntimeEnv(labels) || !labelPresent(labels, KEYS_LABEL)) continue;
+    out[name] = parseRuntimeEnvExclude(labelValue(labels, KEYS_LABEL), name, KEYS_LABEL);
+  }
+  return out;
+}
 function runtimeEnvMarkedServices(composeConfigJson) {
   let parsed;
   try {
@@ -43229,12 +43499,16 @@ function runtimeEnvMarkedServices(composeConfigJson) {
   if (!services || typeof services !== "object" || Array.isArray(services)) return [];
   return Object.entries(services).filter(([name, svc]) => SERVICE_NAME_RE.test(name) && labelsMarkRuntimeEnv(svc?.labels)).map(([name]) => name).sort();
 }
-function renderRuntimeEnvOverride(services, keys, excludes = {}) {
+function renderRuntimeEnvOverride(services, keys, excludes = {}, selects = {}) {
   const safeServices = services.filter((s) => SERVICE_NAME_RE.test(s)).sort();
   const safeKeys = [...new Set(keys.filter((k) => ENV_KEY_RE.test(k)))].sort();
   const keysFor = (service) => {
     const skip = new Set(excludes[service] ?? []);
-    return safeKeys.filter((k) => !skip.has(k));
+    const picked = selects[service];
+    for (const k of picked ?? []) {
+      if (!safeKeys.includes(k)) throw new Error(`${KEYS_LABEL} on service ${service} names '${k}', which is not a declared runtime key`);
+    }
+    return safeKeys.filter((k) => !skip.has(k) && (!picked || picked.includes(k)));
   };
   const withKeys = safeServices.filter((s) => keysFor(s).length);
   if (!withKeys.length) return null;
@@ -43657,7 +43931,7 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   } catch {
     return {};
   }
-  const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson));
+  const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson), runtimeEnvSelects(configJson));
   if (!body) return {};
   const overridePath = (0, import_node_path38.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
   (0, import_node_fs39.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
@@ -51556,6 +51830,352 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
   });
 }
 
+// src/app-read-broker.ts
+init_cli_shared();
+var OWNER_REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+var JSON_FIELD_RE = /^[A-Za-z0-9_,]+$/;
+var ID_RE = /^\d+$/;
+function parseBrokerRepo(raw, flag) {
+  if (raw === void 0) return void 0;
+  const repo = raw.trim();
+  if (!OWNER_REPO_RE.test(repo)) {
+    throw new Error(`read: ${flag} must be owner/repo on github.com (received '${raw}') \u2014 hosts, URLs and empty segments are refused`);
+  }
+  return repo;
+}
+function parseBrokerId(raw, what) {
+  if (!ID_RE.test(raw.trim())) {
+    throw new Error(`read: ${what} must be a number (received '${raw}') \u2014 URLs and branch names are refused`);
+  }
+  return raw.trim();
+}
+function parseBrokerInt(raw, flag, min, max) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < min || n > max) {
+    throw new Error(`read: ${flag} must be an integer ${min}-${max} (received '${raw}')`);
+  }
+  return n;
+}
+function parseBrokerJsonFields(raw, allowed) {
+  if (raw === void 0 || raw === false) return void 0;
+  if (raw === true) return void 0;
+  const value = raw.trim();
+  if (!JSON_FIELD_RE.test(value) || value.split(",").some((f) => !f)) {
+    throw new Error(`read: --json fields must be comma-separated names (received '${raw}')`);
+  }
+  if (allowed) {
+    const unknown = value.split(",").filter((f) => !allowed.includes(f));
+    if (unknown.length > 0) {
+      throw new Error(`read: unknown --json field(s): ${unknown.join(", ")} \u2014 one of: ${allowed.join(",")}`);
+    }
+  }
+  return value;
+}
+var BROKER_JSON_FLAGS_NOTE = "formatter flags are refused (--jq/--template can read child credentials; --web opens a browser) \u2014 use --json with field selection";
+function parseBrokerIssueState(raw) {
+  if (raw === void 0) return void 0;
+  const v = raw.trim().toLowerCase();
+  if (v !== "open" && v !== "closed" && v !== "all") {
+    throw new Error(`read: --state must be one of: open, closed, all (received '${raw}')`);
+  }
+  return v;
+}
+var RUN_LIST_STATUSES = ["queued", "completed", "in_progress", "requested", "waiting", "pending", "action_required", "cancelled", "failure", "neutral", "skipped", "stale", "startup_failure", "success", "timed_out"];
+function parseBrokerRunStatus(raw) {
+  if (raw === void 0) return void 0;
+  const v = raw.trim().toLowerCase();
+  if (!RUN_LIST_STATUSES.includes(v)) {
+    throw new Error(`read: --status must be one of: ${RUN_LIST_STATUSES.join("|")} (received '${raw}')`);
+  }
+  return v;
+}
+function parseBrokerAssignee(raw) {
+  if (raw === void 0) return void 0;
+  const v = raw.trim();
+  if (/^@?me$/i.test(v) || /^viewer$/i.test(v)) {
+    throw new Error(`read: --assignee '${raw}' resolves the viewer \u2014 viewer-scoped reads stay personal, never the App pool`);
+  }
+  if (!/^[A-Za-z0-9_.-]+$/.test(v.replace(/^@/, ""))) {
+    throw new Error(`read: --assignee must be a login (received '${raw}')`);
+  }
+  return v;
+}
+var SINGLE_SHOT_TIMEOUT_MS = 6e4;
+function withRepo(args, repo) {
+  return repo ? [...args, "--repo", repo] : args;
+}
+function withJson(args, jsonFields, jsonFlag) {
+  if (jsonFlag === void 0 || jsonFlag === false) return args;
+  return typeof jsonFields === "string" ? [...args, "--json", jsonFields] : [...args, "--json"];
+}
+function buildRunViewSpec(id, o) {
+  const args = withJson(withRepo(["run", "view", parseBrokerId(id, "run id"), ...o.attempt !== void 0 ? ["--attempt", String(parseBrokerInt(o.attempt, "--attempt", 1, 1e3))] : []], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
+  if (o.exitStatus) args.push("--exit-status");
+  return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
+}
+function buildRunListSpec(o) {
+  const args = withJson(withRepo(["run", "list"], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
+  const workflow = parseBrokerWorkflow(o.workflow);
+  if (workflow) args.push("--workflow", workflow);
+  const branch = parseBrokerBranch(o.branch);
+  if (branch) args.push("--branch", branch);
+  const status = parseBrokerRunStatus(o.status);
+  if (status) args.push("--status", status);
+  if (o.limit !== void 0) args.push("--limit", String(parseBrokerInt(o.limit, "--limit", 1, 100)));
+  return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
+}
+function buildRunWatchSpec(id, o) {
+  const args = withRepo(["run", "watch", parseBrokerId(id, "run id")], parseBrokerRepo(o.repo, "--repo"));
+  if (o.exitStatus) args.push("--exit-status");
+  if (o.compact) args.push("--compact");
+  args.push("--interval", String(parseBrokerInt(o.interval ?? "60", "--interval", 60, 300)));
+  const timeoutMin = o.timeoutMin !== void 0 ? parseBrokerInt(o.timeoutMin, "--timeout", 1, 120) : 30;
+  return { program: "gh", args, timeoutMs: timeoutMin * 6e4 };
+}
+function buildPrViewSpec(ref, o) {
+  const args = withJson(withRepo(["pr", "view", parseBrokerId(ref, "PR number")], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
+  if (o.comments) args.push("--comments");
+  return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
+}
+function buildPrChecksSpec(number, o) {
+  return {
+    program: "rest-checks",
+    number: parseBrokerId(number, "PR number"),
+    repo: parseBrokerRepo(o.repo, "--repo"),
+    required: o.required === true,
+    jsonFields: parseBrokerJsonFields(o.json, GH_PR_CHECKS_JSON_FIELDS)
+  };
+}
+function buildIssueViewSpec(number, o) {
+  const args = withJson(withRepo(["issue", "view", parseBrokerId(number, "issue number")], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
+  if (o.comments) args.push("--comments");
+  return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
+}
+function parseBrokerWorkflow(raw) {
+  if (raw === void 0) return void 0;
+  if (!/^[A-Za-z0-9_./-]{1,200}$/.test(raw)) throw new Error(`read: --workflow must be a workflow name or file (received '${raw}')`);
+  return raw;
+}
+function parseBrokerBranch(raw) {
+  if (raw === void 0) return void 0;
+  if (!/^[A-Za-z0-9_./-]{1,200}$/.test(raw)) throw new Error(`read: --branch must be a branch name (received '${raw}')`);
+  return raw;
+}
+function parseBrokerSearch(raw) {
+  if (raw === void 0) return void 0;
+  if (!raw.trim()) throw new Error("read: --search must not be empty");
+  return raw;
+}
+function parseBrokerLabel(raw) {
+  if (raw === void 0) return void 0;
+  if (!/^[A-Za-z0-9_.,: /-]{1,200}$/.test(raw)) throw new Error(`read: --label must be label text (received '${raw}')`);
+  return raw;
+}
+function buildIssueListSpec(o) {
+  const args = withJson(withRepo(["issue", "list"], parseBrokerRepo(o.repo, "--repo")), parseBrokerJsonFields(o.json), o.json);
+  const search = parseBrokerSearch(o.search);
+  if (search !== void 0) args.push("--search", search);
+  const assignee = parseBrokerAssignee(o.assignee);
+  if (assignee) args.push("--assignee", assignee);
+  const label = parseBrokerLabel(o.label);
+  if (label !== void 0) args.push("--label", label);
+  const state = parseBrokerIssueState(o.state);
+  if (state) args.push("--state", state);
+  if (o.limit !== void 0) args.push("--limit", String(parseBrokerInt(o.limit, "--limit", 1, 100)));
+  return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
+}
+function brokerChildEnv(base = process.env) {
+  const env = { ...base };
+  delete env.GITHUB_TOKEN;
+  delete env.GH_ENTERPRISE_TOKEN;
+  delete env.GITHUB_ENTERPRISE_TOKEN;
+  delete env.GH_ENTERPRISE_URL;
+  delete env.GITHUB_ENTERPRISE_URL;
+  delete env.GH_REPO;
+  delete env.GITHUB_REPOSITORY;
+  delete env.GH_DEBUG;
+  env.GH_HOST = "github.com";
+  return env;
+}
+function redactPrivateCredential(text, env) {
+  const credential = env.GH_TOKEN;
+  if (!credential) return text;
+  return text.split(credential).join("[redacted-credential]");
+}
+function ghExitCodeOf(error) {
+  const code = error.code;
+  return typeof code === "number" ? code : null;
+}
+async function runBrokerGh(run, spec, write = (chunk) => process.stdout.write(chunk)) {
+  const env = brokerChildEnv();
+  try {
+    write(redactPrivateCredential(await run(spec.args, { timeoutMs: spec.timeoutMs, env }), env));
+    return 0;
+  } catch (e) {
+    const err = e;
+    if (typeof err.stdout === "string" && err.stdout) write(redactPrivateCredential(err.stdout, env));
+    const code = ghExitCodeOf(e);
+    if (code !== null) {
+      if (typeof err.stderr === "string" && err.stderr) process.stderr.write(redactPrivateCredential(err.stderr, env));
+      return code;
+    }
+    throw new Error(`read: gh ${spec.args.slice(0, 2).join(" ")} did not finish on the App pool (${err.message ?? e}) \u2014 re-run the same command to refresh (same custody); reads never fall back to personal`);
+  }
+}
+async function runBrokerRestChecks(deps, spec, resolveRepo2) {
+  const repo = await resolveRepo2(spec.repo);
+  const ghApi = deps.restGhApi(brokerChildEnv());
+  if (!spec.required) {
+    const snapshot = await deps.fetchSnapshot(spec.number, repo, ghApi).catch((e) => {
+      throw new Error(`read pr checks: cannot resolve PR #${spec.number} on ${repo}: ${e?.message ?? e}`);
+    });
+    const { rows } = await deps.fetchRows(snapshot.headSha, repo, ghApi).catch((e) => {
+      throw new Error(`read pr checks: check read failed for PR #${spec.number} on ${repo}: ${e?.message ?? e}`);
+    });
+    const state = verdictFromBuckets(rows.map((row) => row.bucket));
+    return { rows, state, exitCode: checkRowsExitCode(state) };
+  }
+  const read = await deps.readRequired(spec.number, repo, ghApi).catch((e) => {
+    throw new Error(`read pr checks: ${e?.message ?? e}`);
+  });
+  return { rows: read.rows, state: read.state, exitCode: checkRowsExitCode(read.state) };
+}
+function requireBrokerApp(label) {
+  if (process.env.MMI_ACTOR !== "app") {
+    fail(`${label}: App-only read \u2014 re-run with spawn-scoped MMI_ACTOR=app (reads never fall back to personal; interactive use keeps gh and the human commands)`);
+  }
+}
+function registerPrChecksRequiredCommand(prRoot, resolveRepo2, overrides) {
+  const deps = {
+    readRequired: readRequiredCheckRows,
+    fetchSnapshot: fetchRestPrSnapshot,
+    fetchRows: fetchHeadCheckRows,
+    restGhApi: overrides?.restGhApi ?? ((env) => ghApiWithEnv(env))
+  };
+  prRoot.command("checks-required").description(`required-only PR check read on the PR head (#8042): the GitHub merge-button verdict \u2014 REST check-runs + commit statuses scoped to GitHub's own required-status-check contexts (branch protection + rulesets), printed as native \`gh pr checks --json\` rows. Single shot, no wait. Never the ALL-checks waiter (#5336). REST is the deterministic closed-custody adapter: native returned an EMPTY table on the historical #3035 fixture/profile, and same-token parity on later fixtures agrees \u2014 not a claim native always fails. Reads merged/closed PRs like native does \u2014 the merge gate (not this read) decides what a state means. Exit 0 = required checks all pass (or no required contexts: every reported check passes); exit 1 = a required check FAILED or the read itself failed; exit 8 = required checks still pending (native pending code)`).option("--json [fields]", "machine-readable native-shaped rows (default: all known fields; comma-separated subset of: " + GH_PR_CHECKS_JSON_FIELDS.join(",") + ")", (v) => parseBrokerJsonFields(v, GH_PR_CHECKS_JSON_FIELDS)).option("--repo <owner/repo>", "target repo (defaults to the current repo)", (v) => parseBrokerRepo(v, "--repo")).argument("<number>", "PR number", (v) => parseBrokerId(v, "PR number")).action(async (number, o) => {
+    let spec;
+    try {
+      spec = buildPrChecksSpec(number, { repo: o.repo, json: o.json, required: true });
+    } catch (e) {
+      return fail(e.message);
+    }
+    await dispatchRestChecksRead(deps, resolveRepo2, "pr checks-required", spec, o.json);
+  });
+}
+function selectCheckRowFields(rows, jsonFields) {
+  if (jsonFields === void 0) return rows.map((row) => ({ ...row }));
+  const fields = jsonFields.split(",");
+  return rows.map((row) => Object.fromEntries(fields.map((f) => [f, row[f]])));
+}
+async function dispatchRestChecksRead(deps, resolveRepo2, label, spec, json) {
+  requireBrokerApp(label);
+  let result;
+  try {
+    result = await runBrokerRestChecks(deps, spec, resolveRepo2);
+  } catch (e) {
+    return fail(`${label}: ${e.message}`);
+  }
+  if (json !== void 0 && json !== false) {
+    printLine(JSON.stringify(selectCheckRowFields(result.rows, spec.jsonFields)));
+  } else {
+    for (const row of result.rows) printLine(`${row.state} ${row.bucket} ${row.name}${row.link ? ` ${row.link}` : ""}`);
+    if (result.rows.length === 0) printLine(`${label}: no checks reported`);
+  }
+  process.exitCode = result.exitCode;
+}
+function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
+  const ghRun = overrides?.ghRunner ?? (async (args, opts) => (await execFileP("gh", args, { timeout: opts.timeoutMs, env: opts.env })).stdout);
+  const restGhApi = overrides?.restGhApi ?? ((env) => ghApiWithEnv(env));
+  const deps = { readRequired: readRequiredCheckRows, fetchSnapshot: fetchRestPrSnapshot, fetchRows: fetchHeadCheckRows, restGhApi };
+  const dispatchGh = (spec, label) => (async () => {
+    requireBrokerApp(label);
+    try {
+      process.exitCode = await runBrokerGh(ghRun, spec);
+    } catch (e) {
+      return fail(`${label}: ${e.message}`);
+    }
+  })();
+  const dispatchRestChecks = (spec, label, json) => dispatchRestChecksRead(deps, resolveRepo2, label, spec, json);
+  const repoOpt = (v) => parseBrokerRepo(v, "--repo");
+  const idOpt = (what) => (v) => parseBrokerId(v, what);
+  const intOpt = (flag, min, max) => (v) => String(parseBrokerInt(v, flag, min, max));
+  const jsonOpt = (v) => parseBrokerJsonFields(v);
+  const checksJsonOpt = (v) => parseBrokerJsonFields(v, GH_PR_CHECKS_JSON_FIELDS);
+  const workflowOpt = (v) => parseBrokerWorkflow(v);
+  const branchOpt = (v) => parseBrokerBranch(v);
+  const searchOpt = (v) => parseBrokerSearch(v);
+  const labelOpt = (v) => parseBrokerLabel(v);
+  const runStatusOpt = (v) => parseBrokerRunStatus(v);
+  const assigneeOpt = (v) => parseBrokerAssignee(v);
+  const read = program3.command("read").description(`closed typed GitHub reads on the App pool (${BROKER_JSON_FLAGS_NOTE})`);
+  const run = read.command("run").description("workflow-run reads (view/list/watch) \u2014 stdout and exit codes pass gh through verbatim");
+  run.command("view").description("read a workflow run (attempt/exit-status/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--exit-status", "exit non-zero when the run failed").option("--attempt <n>", "the attempt number of the run (1-1000)", intOpt("--attempt", 1, 1e3)).argument("<id>", "workflow run number", idOpt("run id")).action(async (id, o) => {
+    let spec;
+    try {
+      spec = buildRunViewSpec(id, o);
+    } catch (e) {
+      return fail(e.message);
+    }
+    await dispatchGh(spec, "read run view");
+  });
+  run.command("list").description("list workflow runs (workflow/branch/status/limit/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--workflow <name>", "filter by workflow name or file", workflowOpt).option("--branch <name>", "filter by branch", branchOpt).option("--status <status>", "filter by run status", runStatusOpt).option("--limit <n>", "maximum runs to fetch (1-100)", intOpt("--limit", 1, 100)).action(async (o) => {
+    let spec;
+    try {
+      spec = buildRunListSpec(o);
+    } catch (e) {
+      return fail(e.message);
+    }
+    await dispatchGh(spec, "read run list");
+  });
+  run.command("watch").description("watch a run until it finishes (exit-status passthrough; --timeout bounds the watch \u2014 expiry fails explicit App-pool, refresh re-runs the same command)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--exit-status", "exit non-zero when the run fails").option("--compact", "show only relevant/failed steps").option("--interval <n>", "refresh interval in seconds, 60-300 (pool pacing floor; default 60)", intOpt("--interval", 60, 300)).option("--timeout <minutes>", "watch bound in minutes, 1-120 (default 30)", intOpt("--timeout", 1, 120), "30").argument("<id>", "workflow run number", idOpt("run id")).action(async (id, o) => {
+    let spec;
+    try {
+      spec = buildRunWatchSpec(id, { repo: o.repo, exitStatus: o.exitStatus, compact: o.compact, interval: o.interval, timeoutMin: o.timeout });
+    } catch (e) {
+      return fail(e.message);
+    }
+    await dispatchGh(spec, "read run watch");
+  });
+  const pr = read.command("pr").description("pull-request reads \u2014 view rides gh; checks is REST-backed (deterministic closed-custody adapter; native was EMPTY only on the historical #3035 fixture)");
+  pr.command("view").description("read a PR as gh JSON (comments/json; --json supports statusCheckRollup selection; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--comments", "include PR comments").argument("<number>", "PR number", idOpt("PR number")).action(async (number, o) => {
+    let spec;
+    try {
+      spec = buildPrViewSpec(number, o);
+    } catch (e) {
+      return fail(e.message);
+    }
+    await dispatchGh(spec, "read pr view");
+  });
+  pr.command("checks").description(`PR checks as native --json rows (REST-backed; --required scopes to GitHub's required contexts, failed lookup errors instead of falling back; exit 0 pass, 1 fail, 8 pending; --watch/--fail-fast/--interval/--web have no route \u2014 unsupported by name)`).option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", `machine-readable rows (subset of: ${GH_PR_CHECKS_JSON_FIELDS.join(",")})`, checksJsonOpt).option("--required", "only checks GitHub requires for merge").argument("<number>", "PR number (explicit \u2014 current-branch inference is unsupported)", idOpt("PR number")).action(async (number, o) => {
+    let spec;
+    try {
+      spec = buildPrChecksSpec(number, o);
+    } catch (e) {
+      return fail(e.message);
+    }
+    await dispatchRestChecks(spec, "read pr checks", o.json);
+  });
+  const issue = read.command("issue").description("issue reads (view/list) \u2014 stdout and exit codes pass gh through verbatim");
+  issue.command("view").description("read an issue as gh JSON (comments/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--comments", "include issue comments").argument("<number>", "issue number", idOpt("issue number")).action(async (number, o) => {
+    let spec;
+    try {
+      spec = buildIssueViewSpec(number, o);
+    } catch (e) {
+      return fail(e.message);
+    }
+    await dispatchGh(spec, "read issue view");
+  });
+  issue.command("list").description("list/search issues (search/assignee/label/state/limit/json; viewer pronouns refused \u2014 viewer-scoped reads stay personal)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--search <query>", "search issues", searchOpt).option("--assignee <login>", "filter by assignee (viewer pronouns refused)", assigneeOpt).option("--label <label>", "filter by label", labelOpt).addOption(new Option("--state <state>", "open|closed|all").choices(["open", "closed", "all"])).option("--limit <n>", "maximum issues to fetch (1-100)", intOpt("--limit", 1, 100)).action(async (o) => {
+    let spec;
+    try {
+      spec = buildIssueListSpec(o);
+    } catch (e) {
+      return fail(e.message);
+    }
+    await dispatchGh(spec, "read issue list");
+  });
+}
+
 // src/api-read.ts
 init_cli_shared();
 var API_ACCEPT_HEADERS = {
@@ -51576,13 +52196,19 @@ var PULL_FILES_RE = new RegExp(`^repos/${NAME}/${NAME}/pulls/\\d+/files$`);
 var COMPARE_RE = new RegExp(`^repos/${NAME}/${NAME}/compare/${FREE}\\.\\.\\.${FREE}$`);
 var CONTENTS_BASE_RE = new RegExp(`^repos/${NAME}/${NAME}/contents/${FREE}$`);
 var CONTENTS_QUERY_RE = /^ref=[^&\s]+$/;
-var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>]";
+var ACTIONS_RUNS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs$`);
+var ACTIONS_RUN_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+$`);
+var ACTIONS_JOBS_RE = new RegExp(`^repos/${NAME}/${NAME}/actions/runs/\\d+/jobs$`);
+var API_GET_ALLOWED_SHAPES = "repos/{owner}/{repo}/pulls/{n}/files, repos/{owner}/{repo}/compare/{a}...{b}, repos/{owner}/{repo}/contents/{path}[?ref=<branch>], repos/{owner}/{repo}/actions/runs, repos/{owner}/{repo}/actions/runs/{id}, repos/{owner}/{repo}/actions/runs/{id}/jobs";
 function parseApiGetPath(rawPath) {
   const path2 = rawPath.trim();
   const refuse = () => new Error(`api get: refusing '${rawPath}' \u2014 only these GET reads are allowed (#7219): ${API_GET_ALLOWED_SHAPES}`);
   if (/[%#\\]/.test(path2) || path2.split("?")[0].split("/").some((seg) => seg === "." || seg === ".." || seg === "")) throw refuse();
   if (PULL_FILES_RE.test(path2)) return { kind: "pull-files", path: path2, paginate: true };
   if (COMPARE_RE.test(path2)) return { kind: "compare", path: path2, paginate: false };
+  if (ACTIONS_RUNS_RE.test(path2)) return { kind: "actions-runs", path: path2, paginate: true };
+  if (ACTIONS_RUN_RE.test(path2)) return { kind: "actions-run", path: path2, paginate: false };
+  if (ACTIONS_JOBS_RE.test(path2)) return { kind: "actions-jobs", path: path2, paginate: true };
   const q = path2.indexOf("?");
   const base = q === -1 ? path2 : path2.slice(0, q);
   const query = q === -1 ? "" : path2.slice(q + 1);
@@ -51602,14 +52228,21 @@ function buildApiGetArgs(path2, accept) {
 async function runApiGet(run, path2, accept) {
   return run(buildApiGetArgs(path2, accept), GIT_TIMEOUT_MS);
 }
-function registerApiReadCommands(program3) {
-  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents)");
-  api.command("get <path>").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", "json").action(async (path2, o) => {
+function registerApiReadCommands(program3, overrides) {
+  const spawn6 = overrides?.runner ?? (async (args, timeoutMs, env) => (await execFileP("gh", args, { timeout: timeoutMs, ...env ? { env } : {} })).stdout);
+  const api = program3.command("api").description("bounded GitHub REST reads for automation \u2014 GET only, allowlisted paths (pull files, compare, contents, actions runs/jobs)");
+  api.command("get").description("GET one allowlisted REST path and print the response body to stdout (JSON, or raw file bytes with --accept raw); refuses everything outside the allowlist").option("--accept <type>", "response media type: json (default) or raw (file bytes)", (v) => {
+    acceptHeaderFor(v);
+    return v.trim().toLowerCase();
+  }, "json").argument("<path>", "allowlisted GET path (shapes named on refusal)", (v) => parseApiGetPath(v)).action(async (req, o) => {
+    const actionsRoute = req.kind.startsWith("actions-");
+    if (actionsRoute) requireBrokerApp("api get");
+    const env = actionsRoute || process.env.MMI_ACTOR === "app" ? brokerChildEnv() : void 0;
     let body;
     try {
       body = await runApiGet(
-        async (args, timeoutMs) => (await execFileP("gh", args, { timeout: timeoutMs })).stdout,
-        path2,
+        async (args, timeoutMs) => spawn6(args, timeoutMs, env),
+        req.path,
         o.accept
       );
     } catch (e) {
@@ -55329,6 +55962,10 @@ registerDiscoveryCommands(program2);
 registerExplainCommand(program2);
 registerPrLifecycleCommands(program2);
 registerApiReadCommands(program2);
+registerAppReadBrokerCommands(program2, async (repo) => requireRepo(repo));
+var prBrokerRoot = program2.commands.find((c) => c.name() === "pr");
+if (!prBrokerRoot) throw new Error("read broker: pr root must be registered before pr checks-required");
+registerPrChecksRequiredCommand(prBrokerRoot, async (repo) => requireRepo(repo));
 registerSessionReport(program2);
 registerLearningClosureRateCommand(program2);
 registerLearningPickupCommand(program2);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.113",
+  "version": "4.5.115",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.5.113",
+  "version": "4.5.115",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",