@mutmutco/claude-plugin 4.5.130 → 4.5.132

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.5.130",
+  "version": "4.5.132",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -8162,6 +8162,11 @@ var DECLARED_ENTRIES = [
   // archived stage (including a stage whose containers are down) into scratch Postgres and compare
   // row counts, and read-verify every storage archive against its listing; per-stage PASS/FAIL.
   { name: "mmi-backup-restore-check (mm-central, mm-work)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); owner-approved mmi-oguz rebuild as CI-only mmi-runner2 with full erasure and no backups (#7859); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
+  // #8176: continuous WAL archiving of the mm-work dev Postgres (owner targets RPO <= 5 min, RTO <= 1 h). Postgres copies each
+  // finished WAL file into a host spool (MM-Work#4170); this timer ships it encrypted to the Storage Box with WAL-G.
+  { name: "mmi-walg-ship@mm-work-dev (mm-work)", cadence: "every 30s (systemd OnUnitInactiveSec=30s)", executor: "box systemd", llm: "no", resolved: "declared", source: "/etc/systemd/system/mmi-walg-ship@.timer \u2192 /opt/mmi-control/walg-ship.sh mm-work-dev; spool /srv/mm-work/walspool/mm-work-dev \u2192 Storage Box backups/walg/mmi-tools/mm-work-dev, libsodium-encrypted (#8176; source scripts/walg/; status /var/lib/mmi-backup-status/mm-work-dev.ship.json)" },
+  { name: "mmi-walg-base (mm-work)", cadence: "30 3 * * 0", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-walg-base \u2192 /opt/mmi-control/walg-base.sh mm-work-dev; weekly WAL-G base backup + age-based retention (keep the base at or before now-7d and everything after, #8193) (#8176; source scripts/walg/; log /var/log/mmi-walg.log; status /var/lib/mmi-backup-status/mm-work-dev.base.json)" },
+  { name: "mmi-walg-drill (mm-work)", cadence: "0 4 2 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-walg-drill \u2192 /opt/mmi-control/walg-drill.sh mm-work-dev; monthly restore drill measuring RPO/RTO against the owner targets (300s/3600s) into a throwaway --network none container (#8177; source scripts/walg/; status /var/lib/mmi-backup-status/mm-work-dev.drill.json; alarm: backup-health.yml)" },
   // #7662 (MM-Work#1520): Vercel Cron's 15-minute central mail call, moved to the box with MM-Work. The app
   // calls its own endpoint with its own CRON_SECRET via docker exec, so the secret stays in the container.
   { name: "mm-work-mail-tick (mm-work)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mm-work-mail-tick \u2192 /opt/mmi-control/mm-work-mail-tick.sh; GET /api/internal/mail per stage listed in MM_WORK_MAIL_STAGES (source scripts/mm-work-mail-tick.sh; log /var/log/mm-work-mail-tick.log)" },
@@ -16681,6 +16686,7 @@ function gateExtraStepsYaml(steps) {
   return steps.map((step) => [
     `
       - name: ${yamlScalar(step.name)}`,
+    "\n        if: ${{ steps.development-gate.outputs.reuse != 'true' }}",
     step.env && Object.keys(step.env).length ? `
         env:${envYaml(step.env, "          ")}` : "",
     "\n        uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}",
@@ -17240,23 +17246,33 @@ async function installAppFoldDeps(deps) {
 }
 var SHARED_INSTALLER_PACKAGES = ["@mutmutco/installer-face", "@mutmutco/installer-launcher", "@mutmutco/installer-gate"];
 async function refreshSharedInstallerDeps(deps) {
-  let declared;
+  let lockPaths;
   try {
-    const lock = JSON.parse(await deps.run("git", ["show", "HEAD:package-lock.json"]));
-    const present = Object.keys(lock.packages ?? {});
-    declared = SHARED_INSTALLER_PACKAGES.filter((name) => present.some((key) => key === `node_modules/${name}` || key.endsWith(`/node_modules/${name}`)));
-  } catch {
-    return null;
-  }
-  if (declared.length === 0) return null;
-  try {
-    await deps.run("npm", ["update", ...declared, "--package-lock-only", "--no-audit", "--no-fund"]);
+    lockPaths = (await deps.run("git", ["ls-tree", "-r", "--name-only", "HEAD"])).split("\n").filter((path2) => path2 === "package-lock.json" || path2.endsWith("/package-lock.json"));
   } catch (e) {
-    const why = e instanceof Error ? e.message.split("\n")[0] : String(e);
-    deps.warn?.(`shared installer refresh skipped (${why}) \u2014 shipping the locked versions`);
-    return `shared installer refresh skipped (${why}); the locked ${declared.join(", ")} still satisfy their ranges`;
+    throw trainReadFailure(
+      "shared installer refresh: `git ls-tree -r --name-only HEAD`",
+      e,
+      "rerun in a readable checkout \u2014 lockfile roots must be discovered, never guessed"
+    );
+  }
+  const notes = [];
+  for (const lockPath of lockPaths) {
+    const lock = JSON.parse(await deps.run("git", ["show", `HEAD:${lockPath}`]));
+    const present = Object.keys(lock.packages ?? {});
+    const declared = SHARED_INSTALLER_PACKAGES.filter((name) => present.some((key) => key === `node_modules/${name}` || key.endsWith(`/node_modules/${name}`)));
+    if (declared.length === 0) continue;
+    const prefix = lockPath.includes("/") ? lockPath.slice(0, lockPath.lastIndexOf("/")) : null;
+    try {
+      await deps.run("npm", [...prefix ? ["--prefix", prefix] : [], "update", ...declared, "--package-lock-only", "--no-audit", "--no-fund"]);
+      notes.push(`shared installer deps refreshed in ${prefix ?? "."} (${declared.join(", ")})`);
+    } catch (e) {
+      const why = e instanceof Error ? e.message.split("\n")[0] : String(e);
+      deps.warn?.(`shared installer refresh skipped for ${prefix ?? "."} (${why}) \u2014 shipping the locked versions`);
+      notes.push(`shared installer refresh skipped for ${prefix ?? "."} (${why}); the locked ${declared.join(", ")} still satisfy their ranges`);
+    }
   }
-  return `shared installer deps refreshed to the newest their ranges allow (${declared.join(", ")})`;
+  return notes.length > 0 ? notes.join("; ") : null;
 }
 async function restoreMainNpmPackIdentities(deps, version) {
   const bomPath = "distribution-bom.json";
@@ -18258,10 +18274,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.130",
-    tag: "v4.5.130",
-    commit: "6564bc03d8ee",
-    npm: "@mutmutco/cli@4.5.130"
+    version: "4.5.132",
+    tag: "v4.5.132",
+    commit: "80a4c6f78d39",
+    npm: "@mutmutco/cli@4.5.132"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18278,14 +18294,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.130"
+          v3Target: "v4.5.132"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.130 and redeploy the Hub Lambda from tag v4.5.130 (6564bc03d8ee); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.130 (@mutmutco/cli@4.5.130, tag commit 6564bc03d8ee \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.132 and redeploy the Hub Lambda from tag v4.5.132 (80a4c6f78d39); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.132 (@mutmutco/cli@4.5.132, tag commit 80a4c6f78d39 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -29517,10 +29533,17 @@ ${r.repo} (${r.class}, policy=${r.mergePolicy}) ${verdict}`);
   }
   return lines2.join("\n");
 }
+function unauditedReconcileError(reason) {
+  return `cannot audit \u2014 ${reason}; no reconcile change made (unaudited, not canonical)`;
+}
 async function applyCiReconcileMergeSettingsFromReport(repo, deps, report) {
   const applied = [];
   const skipped = [];
   const errors = [];
+  if (report.unauditedReason) {
+    errors.push(unauditedReconcileError(report.unauditedReason));
+    return { repo, applied, skipped, errors };
+  }
   const mergeChecks = report.checks.filter((c) => c.label.startsWith("allow_") || c.label.startsWith("delete_branch") || c.label.startsWith("has_wiki"));
   const needsPatch = mergeChecks.some((c) => !c.ok);
   if (!needsPatch) {
@@ -29824,6 +29847,9 @@ async function applyCiReconcileRepo(repo, deps, options = {}) {
     return { repo, applied: [], skipped: [], errors: ["product-ruleset requires registry META requiredChecks"] };
   }
   const report = await auditRepoCi(repo, deps);
+  if (report.unauditedReason) {
+    return { repo, applied: [], skipped: [], errors: [unauditedReconcileError(report.unauditedReason)] };
+  }
   const finish = (result2, pendingReason) => options.productRulesetOnly ? Promise.resolve(result2) : finalizeCiReconcile(repo, deps, result2, report, pendingReason);
   const baseBranch = "development";
   let raw = report.class === "deployable" && !report.explicitNoCi ? await fetchRulesetSeedBody(deps, repo) : null;

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.130",
+  "version": "4.5.132",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.5.130",
+  "version": "4.5.132",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -50,6 +50,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read # #8206: exact-SHA development workflow verdict
   contents: read
   # MMI-Hub#7542: the product image build below reads org private packages with the workflow's
   # own ephemeral token (NODE_AUTH_TOKEN) — the same reader the central deploy uses.
@@ -65,12 +66,40 @@ jobs:
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }{{GATE_SERVICES_YAML}}
     steps:
-      - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
+      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
+      - name: Reuse development gate for rc tag
+        id: development-gate
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        with:
+          script: |
+            core.setOutput('reuse', 'false');
+            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
+            try {
+              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
+              const { data } = await github.rest.actions.listWorkflowRuns({
+                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
+                event: 'push', head_sha: context.sha, per_page: 100
+              });
+              // API returns newest first: a newer red/pending rerun must not reuse an older green.
+              const run = data.workflow_runs[0];
+              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
+                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
+              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
+                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
+              });
+              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
+              core.setOutput('reuse', 'true');
+              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
+            } catch (error) {
+              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
+            }
+      - if: ${{ steps.development-gate.outputs.reuse != 'true' }}
+        uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:
           lockfile-path: {{GATE_CACHE_DEP_PATH}}
           fetch-depth: 0 # #8129: runbook freshness needs the PR merge-base history.
       - name: Runbook guard
-        if: ${{ github.event_name == 'pull_request' }}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' && (github.event_name == 'pull_request') }}
         uses: mutmutco/MMI-Hub/.github/actions/runbook-guard@{{GATE_RUNBOOK_SHA}}
         with:
           base-ref: origin/${{ github.base_ref }}
@@ -81,11 +110,13 @@ jobs:
       # `npm config get cache` for any explicit cache restore). Job-level `env:` cannot use the
       # `runner` context — write via GITHUB_ENV from the shell `$RUNNER_TEMP` instead.
       - name: Isolate npm cache (per-job)
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         shell: bash
         run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
       # MMI-Hub#5111: Windows CRLF in tracked shell scripts breaks Linux runners before the real
       # check can explain it. Inspect only tracked files before install; .gitattributes is the fix.
       - name: Line-ending guard
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         shell: bash
         run: |
           offenders=$(mktemp)
@@ -116,6 +147,7 @@ jobs:
       # files (Dockerfile + docker-compose.yml) skip in a second — no new job, no new required
       # context, no ruleset or registry change (#7012 needs nothing to cover).
       - name: Product image build (tenant-container only)
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         env:
           # The documented build-secret opt-in (compose `build.secrets` + registry
           # requiredBuildSecrets `NODE_AUTH_TOKEN=@github-packages-token`): the workflow's own
@@ -146,25 +178,27 @@ jobs:
       # MMI-Hub#5871: declare the npm MAJOR rather than inheriting whatever the runner's node bundles.
       # A bare major, never an exact patch (it goes stale and then prescribes downgrading operator
       # hosts toward it, #5862) and never `latest` (it takes the next major silently, #4782).
-      - if: ${{ '{{GATE_RUNTIME}}' == 'node' }}
+      - if: ${{ steps.development-gate.outputs.reuse != 'true' && ('{{GATE_RUNTIME}}' == 'node') }}
         uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
         with:
           node-version: 24
           npm-version: '12'
-      - if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
+      - if: ${{ steps.development-gate.outputs.reuse != 'true' && ('{{GATE_RUNTIME}}' == 'python') }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: { python-version: '{{GATE_PY_VERSION}}' }
       # MMI-Hub#3446: assert the runtime toolchain is on PATH BEFORE the install step. Node uses the
       # runner-node-toolchain composite above (setup-node + preflight in one action, #5610). Python
       # keeps the inline preflight below.
       - name: Toolchain preflight
-        if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' && ('{{GATE_RUNTIME}}' == 'python') }}
         run: |
           python3 --version || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — python3 not on PATH after setup-python. This is the runner, not your diff; no install or test ran. Re-run the job; if it persists the mmi-runner python toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
       - run: {{GATE_INSTALL_CMD}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
       # #3178: the check runs under the org wall-clock budget — a hung suite dies at the ceiling instead
       # of squatting a runner lane for GitHub's 6h default. ci-audit + the release train enforce this step.
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with:
           command: {{GATE_CMD}}
           max-seconds: {{GATE_MAX_SECONDS}}

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -8,6 +8,7 @@ concurrency:
   group: gate-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read # #8206: exact-SHA development workflow verdict
   contents: read
   packages: read
 jobs:
@@ -15,26 +16,59 @@ jobs:
     runs-on: [self-hosted, linux, x64, mmi-live]
     timeout-minutes: 10
     steps:
-      - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
+      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
+      - name: Reuse development gate for rc tag
+        id: development-gate
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        with:
+          script: |
+            core.setOutput('reuse', 'false');
+            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
+            try {
+              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
+              const { data } = await github.rest.actions.listWorkflowRuns({
+                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
+                event: 'push', head_sha: context.sha, per_page: 100
+              });
+              // API returns newest first: a newer red/pending rerun must not reuse an older green.
+              const run = data.workflow_runs[0];
+              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
+                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
+              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
+                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
+              });
+              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
+              core.setOutput('reuse', 'true');
+              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
+            } catch (error) {
+              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
+            }
+      - if: ${{ steps.development-gate.outputs.reuse != 'true' }}
+        uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:
           lockfile-path: package-lock.json
           fetch-depth: 0 # #8129: runbook freshness needs the PR merge-base history.
       - name: Runbook guard
-        if: ${{ github.event_name == 'pull_request' }}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' && (github.event_name == 'pull_request') }}
         uses: mutmutco/MMI-Hub/.github/actions/runbook-guard@{{GATE_RUNBOOK_SHA}}
         with:
           base-ref: origin/${{ github.base_ref }}
       - name: Isolate npm cache
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
       - uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with:
           node-version: 24
           npm-version: '12'
       - run: npm ci --no-audit --no-fund
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
       - run: npm ci --prefix module --no-audit --no-fund
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with:
           command: npm run typecheck && npm run build && npm --prefix module run check
           max-seconds: {{GATE_MAX_SECONDS}}