@mutmutco/claude-plugin 4.5.213 → 4.5.215

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.5.213",
+  "version": "4.5.215",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -27030,10 +27030,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.213",
-    tag: "v4.5.213",
-    commit: "e1ff49a784f5",
-    npm: "@mutmutco/cli@4.5.213"
+    version: "4.5.215",
+    tag: "v4.5.215",
+    commit: "9e1bef2d6b0c",
+    npm: "@mutmutco/cli@4.5.215"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27050,14 +27050,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.213"
+          v3Target: "v4.5.215"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.213 and redeploy the Hub Lambda from tag v4.5.213 (e1ff49a784f5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.213 (@mutmutco/cli@4.5.213, tag commit e1ff49a784f5 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.215 and redeploy the Hub Lambda from tag v4.5.215 (9e1bef2d6b0c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.215 (@mutmutco/cli@4.5.215, tag commit 9e1bef2d6b0c \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -31609,8 +31609,10 @@ var import_node_path28 = require("node:path");
 
 // ../shared/runner-fallback.ts
 var HOSTED_RUNNER_LABEL_RE = /\b(?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*)\b/i;
+var STANDARD_HOSTED_LABEL_RE = /^(?:ubuntu-(?:latest|24\.04|22\.04|24\.04-arm|22\.04-arm)|windows-(?:latest|2025|2022|11-arm)|macos-(?:latest|\d+|\d+-intel))$/i;
 function classifyRunnerCost(selector) {
   const raw = selector.replace(/\s+#.*$/gm, "").trim();
+  if (STANDARD_HOSTED_LABEL_RE.test(raw.replace(/^(['"])(.*)\1$/, "$2"))) return "standard-hosted";
   if (HOSTED_RUNNER_LABEL_RE.test(raw)) return "hosted";
   const json = /^\$\{\{\s*fromJSON\('([^']+)'\)\s*\}\}$/.exec(raw);
   if (json) {
@@ -31860,8 +31862,8 @@ async function assertActionsJobsCanStart(deps, targetRepo2) {
     throw new Error("release refused (#8911): workflow source inventory unreadable; " + detail + ". Resolve this source read before tagging.");
   }
   const unresolved = classifyRunnerWorkflows(files).filter((f) => f.cost !== "self-hosted" && f.cost !== "standard-hosted");
-  if (unresolved.length) throw new Error("release refused (#8911): paid or unresolved runner path(s): " + unresolved.map((f) => f.repo + "/" + f.path + ":" + f.job).join(", ") + ". Resolve unsupported selectors/callees before tagging; no paid capacity probe is permitted.");
-  process.stderr.write("actions preflight: " + targetRepo2 + " source selectors are self-hosted or explicitly approved standard-hosted; no canary dispatch; included allowance remaining, access/isolation/execution unproven (#8958)\n");
+  if (unresolved.length) throw new Error("release refused (#8911): paid or unresolved runner path(s): " + unresolved.map((f) => f.repo + "/" + f.path + ":" + f.job).join(", ") + ". Standard included GitHub-hosted labels are allowed (#8977, Jerv-Hub#2459); only larger/paid runners and unresolved selectors/callees are refused. Resolve them before tagging; no paid capacity probe is permitted.");
+  process.stderr.write("actions preflight: " + targetRepo2 + " source selectors are self-hosted or standard included GitHub-hosted (#8977); no canary dispatch; the org spending limit guards over-allowance spend (unprovable from source); access/isolation/execution unproven (#8958)\n");
 }
 
 // src/train-apply-recovery.ts
@@ -38029,8 +38031,8 @@ var SHARED_ACTION_PINS = [
 function auditRunnerFallbacks(repo, files, closure) {
   return classifyRunnerWorkflows(closure ?? files.map((file) => ({ ...file, repo }))).map((f) => ({
     ok: f.cost === "self-hosted" || f.cost === "standard-hosted",
-    label: f.cost === "standard-hosted" ? `runner uses approved standard-hosted source (#8912/#8958): ${f.repo}/${f.path}:${f.job}` : `runner is self-hosted only (#8911): ${f.repo}/${f.path}:${f.job}`,
-    detail: f.callee ? "unknown callee runner policy; source must be read at its referenced revision" : f.cost === "hosted" ? "unapproved GitHub-hosted runner selection is forbidden" : f.cost === "unknown" ? "unknown runner selector; source unresolved" : f.cost === "standard-hosted" ? "approved standard labels within included Enterprise minutes only; allowance remaining, runner access and isolation not established" : "self-hosted selection only; runner access and isolation not established",
+    label: f.cost === "standard-hosted" ? `runner uses approved standard-hosted source (#8912/#8958/#8977): ${f.repo}/${f.path}:${f.job}` : `runner is self-hosted only (#8911): ${f.repo}/${f.path}:${f.job}`,
+    detail: f.callee ? "unknown callee runner policy; source must be read at its referenced revision" : f.cost === "hosted" ? "larger/paid GitHub-hosted runner is forbidden; only standard included GitHub-hosted labels are allowed (#8977, Jerv-Hub#2459)" : f.cost === "unknown" ? "unknown runner selector; source unresolved" : f.cost === "standard-hosted" ? "standard GitHub-hosted labels within included Enterprise minutes only (#8977, Jerv-Hub#2459); the org spending limit guards over-allowance spend (unprovable from source); runner access and isolation not established" : "self-hosted selection only; runner access and isolation not established",
     remediation: f.cost === "hosted" || f.cost === "unknown" ? "Resolve source reads and unsupported selectors/callees; preserve checks and artifacts. See gh-runner-runbook.md." : void 0
   }));
 }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.213",
+  "version": "4.5.215",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.5.213",
+  "version": "4.5.215",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -21,7 +21,7 @@ accepts an incomplete board. The CLI partitions rows into **Yours**, **Free to c
 stamps (4 hours without work) hold nothing. Partition rules, stamp details and `--out` rationale:
 [reference.md](reference.md).
 
-Read single issues/PRs with `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`) and filter the JSON locally (append `--jq '<expr>'` to the typed read): under the App pool, gh `--jq`/`-q`/`--template`/`--web` are refused. Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those.
+**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`); `--jq '<expr>'` on that typed read filters locally. Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those.
 
 ## Step 2 — render it