@mutmutco/claude-plugin 4.5.215 → 4.5.217

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.5.215",
+  "version": "4.5.217",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -16148,6 +16148,32 @@ async function readRestPrSnapshotWithRetry(prNumber, repo, gh2 = defaultGhApi, o
     }
   }
 }
+var PR_LAND_PINNED_HEAD_READ_BUDGET_MS = 6e4;
+var PR_LAND_PINNED_HEAD_READ_404_ATTEMPTS = 3;
+async function readPrLandPinnedHeadSha(prNumber, repo, gh2 = defaultGhApi, options) {
+  const delayMs = options?.delayMs ?? PR_SNAPSHOT_READ_DELAY_MS;
+  const sleep2 = options?.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  let notFound = 0;
+  for (; ; ) {
+    const read = await readRestPrSnapshotWithRetry(prNumber, repo, gh2, {
+      retryTransientUntilMs: Date.now() + PR_LAND_PINNED_HEAD_READ_BUDGET_MS,
+      delayMs,
+      sleep: sleep2,
+      onTransientRetry: (error, attempt) => console.warn(`pr land: transient GitHub read (${error}) \u2014 retrying pinned-head read (attempt ${attempt}) within the ${PR_LAND_PINNED_HEAD_READ_BUDGET_MS / 1e3}s budget (#8957)`)
+    });
+    if (read.state === "ok") {
+      const sha = read.snapshot.headSha;
+      if (!sha) throw new Error(`pr land: could not read the head SHA of PR #${prNumber}`);
+      return sha.toLowerCase();
+    }
+    notFound += 1;
+    if (!/\b404\b/.test(read.error) || notFound >= PR_LAND_PINNED_HEAD_READ_404_ATTEMPTS) {
+      throw new Error(`pr land: pinned-head read of PR #${prNumber} failed: ${read.error}`);
+    }
+    console.warn(`pr land: transient GitHub read (HTTP 404) \u2014 retrying pinned-head read (attempt ${notFound} of ${PR_LAND_PINNED_HEAD_READ_404_ATTEMPTS}) (#8957)`);
+    await sleep2(delayMs);
+  }
+}
 async function fetchRestClosingGuardPayload(prNumber, repo, gh2 = defaultGhApi) {
   const pr = JSON.parse(await gh2([`repos/${repo}/pulls/${prNumber}`]));
   const commits = await gh2([`repos/${repo}/pulls/${prNumber}/commits?per_page=100`]).then((out) => JSON.parse(out)).catch(() => void 0);
@@ -27030,10 +27056,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.215",
-    tag: "v4.5.215",
-    commit: "9e1bef2d6b0c",
-    npm: "@mutmutco/cli@4.5.215"
+    version: "4.5.217",
+    tag: "v4.5.217",
+    commit: "6888824b66e5",
+    npm: "@mutmutco/cli@4.5.217"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27050,14 +27076,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.215"
+          v3Target: "v4.5.217"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.215 and redeploy the Hub Lambda from tag v4.5.215 (9e1bef2d6b0c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.215 (@mutmutco/cli@4.5.215, tag commit 9e1bef2d6b0c \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.217 and redeploy the Hub Lambda from tag v4.5.217 (6888824b66e5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.217 (@mutmutco/cli@4.5.217, tag commit 6888824b66e5 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -56665,11 +56691,9 @@ ${list}`);
       if (landClosingGuardVerdict.message) console.warn(landClosingGuardVerdict.message);
       let mergeQueueEnabled = false;
       const result = await runPrLand(number, { repo: o.repo, requireTrain: o.requireTrain !== false, enqueueOnly: o.enqueueOnly, queueTimeoutMs, expectHead: o.expectHead }, {
-        readHeadSha: async (prNumber, repo) => {
-          const sha = (await fetchRestPrSnapshot(prNumber, repo)).headSha;
-          if (!sha) throw new Error(`pr land: could not read the head SHA of PR #${prNumber}`);
-          return sha.toLowerCase();
-        },
+        // #8957: the pinned-head read re-reads a PR this run already read successfully — survive its
+        // transient GitHub faults (and a lone 404) caller-scoped instead of dying on one blip.
+        readHeadSha: (prNumber, repo) => readPrLandPinnedHeadSha(prNumber, repo),
         pollDelayMs: (attempt) => prLandPollDelayMs(attempt, inFlight),
         hasMergeQueue: async (repo, base) => mergeQueueEnabled = await hasPrMergeQueue(repo, base),
         readMergeQueue: readPrMergeQueue,

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.215",
+  "version": "4.5.217",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.5.215",
+  "version": "4.5.217",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -36,7 +36,7 @@ The bible for the MM open design system; every agent doing UI, design or MM Arti
 Four owner decisions (2026-10-25T15:35:52Z):
 
 1. **Doc vs. app kit — add a Document Design System too.** Keep the MM-Work Atomic Design System (`3a5c79df-5274-40ad-a1b5-a75e67a74dac`) for MM-Work and module app UI (and as the fallback for now), and add a dedicated Document/Editorial Design System Artifact in Live Docs for reports, checklists, decks and client documents made by Junior or agents.
-2. **Where to save — local HTML for dev, Live Docs for shared.** Coding agents build and open local `.html` MM Artifacts for fast iteration — interactive owner A/B reviews with `node artifacts/review/review.mjs <folder> --open` on the live loopback HTTP review server (`http://127.0.0.1:<port>/` with `Send answers`), and offline HTML previews/exports or SSR pre-render verification (`impeccable detect --json`) with `node artifacts/review/review.mjs <folder> --standalone [<out.html>]` — and publish to Live Docs only for a shared deliverable, an A/B decision canvas or a Design System. Junior inside MM-Work saves directly to Live Docs.
+2. **Where to save — local HTML for dev, Live Docs for shared.** Coding agents build local `.html` MM Artifacts for fast iteration. Interactive owner A/B reviews use the live loopback HTTP review server (`http://127.0.0.1:<port>/` with `Send answers`); seats send the orchestrator only the review URL and issue number, keep the server running until the owner answers, and never open the owner's browser (#8987, relay wording). A kept-alive canvas review server must stay light (no dev/watch build pinning gigabytes); a seat whose canvas needs a heavy local server flags that to the orchestrator instead of holding the RAM silently, and stops it as soon as the owner has answered. Publish to Live Docs only for a shared deliverable, an A/B decision canvas or a Design System. Junior inside MM-Work saves directly to Live Docs.
 3. **Artifact shape — single HTML by default, Canvas for A/B.** A single self-contained HTML view for documents, checklists and single-screen work; a multi-board spatial Canvas only for A/B choices or `1440`/`1024`/`390` side-by-side comparisons.
 4. **Kit binding — Live Docs hosts kits; npm only for MM-Work.** Every Design System Artifact in Live Docs stores its tokens/CSS/components and `DESIGN.md` so any HTML artifact can bind to it (`kit: { id, version }`); only the MM-Work app design system is also exported as `@mutmutco/mmwork-ds`, because the MM-Work app and the 10 suite modules compile against it.
 
@@ -62,6 +62,10 @@ Autolearn watches for ad-hoc build/render/verify scripts under `tmp/`, empty `#r
 Settled owner ruling: present clear, distinct choices in the existing MM Artifact viewer, not a
 "shell over a shell". These are authoring and viewer requirements, not proof of installed capabilities.
 
+**Canvases carry design choices only (Hub#8986, relay wording).** An A/B canvas asks how something
+looks or works on screen. Approvals for keys, releases, deletions, data access or tooling never go on
+a canvas: send them to the orchestrator, who asks the owner in plain words.
+
 1. **No "shell over a shell" — designer agents build only the alternatives, never their own A/B switcher.**
    The outer MM Artifact viewer (the local review shell and `CanvasStage` / `CompareView` in Live Docs)
    already IS the A/B selector shell: it renders the question prompt, Option A / Option B / Neither
@@ -112,11 +116,12 @@ requests like this should follow this structure, not prose guide."
      `distill`, `typeset`, `layout`, `colorize`, `polish`) to create 2–3 genuinely distinct visual
      designs that honor every constraint in the owner's brief: Option A, Option B and optionally
      Option C, each its own full-resolution `1440x900` live HTML board in one MM Artifact A/B canvas
-     (Part 3 rules: content-only `Ctrl + Mousewheel` zoom, 1:1 or side-by-side live comparison). Open
-     the verified canvas in the browser automatically with
-     `node artifacts/review/review.mjs <folder> --open`, which serves it over the live loopback HTTP
-     review server (`http://127.0.0.1:<port>/`) so the owner's `Send answers` posts straight back to
-     `POST /answers`. Never open a `--standalone` `file://` export (`Download answers.json`) for an
+     (Part 3 rules: content-only `Ctrl + Mousewheel` zoom, 1:1 or side-by-side live comparison). Serve
+     the verified canvas on the live loopback HTTP review server without opening the owner's browser,
+     so the owner's `Send answers` posts straight back to `POST /answers`. Once review passes, send
+     the orchestrator only the review URL and issue number and keep the server running through Stage 2;
+     the orchestrator opens it on the owner's screen (#8987, relay wording). Never open a `--standalone`
+     `file://` export (`Download answers.json`) for an
      interactive owner A/B decision: `--standalone [<out.html>]` is only for offline previews/exports
      and SSR detector checks. Spawn a dedicated, fresh
      `designer` subagent for each distinct design task (item 3); never reuse a busy designer seat.
@@ -141,9 +146,9 @@ requests like this should follow this structure, not prose guide."
 
 ## Mandatory Impeccable workflow (owner, 2026-10-25; Hub#8814 / MM-Work#7629)
 
-UI and design verification uses `@mutmutco/mmwork-ds` (`mmwork-check-ui`) plus Impeccable on every design task: inspect the toolkit for applicable capabilities, work directly on the live app, and use our own MM Artifacts A/B canvas only when an owner A/B choice is needed. Functional journeys, where separately permitted, stay opt-in `workflow_dispatch`-only and never act as design checks.
+UI and design verification uses `@mutmutco/mmwork-ds` (`mmwork-check-ui`) plus Impeccable on every design task: inspect the toolkit for applicable capabilities, work directly on the live app, and use our own MM Artifacts A/B canvas only when an owner design A/B choice is needed (approvals for keys, releases, deletions, data access or tooling go to the orchestrator in plain words, never on a canvas; Hub#8986). Functional journeys, where separately permitted, stay opt-in `workflow_dispatch`-only and never act as design checks.
 
-Front-load Impeccable before any UI or MM Artifact authoring: `impeccable context --target <path>`, `DESIGN.md` + the `design.json` sidecar in `.impeccable`, `.impeccable/config.json` (`hook.enabled: true`), `reference/craft-floor.md` + `reference/operate.md`, and `impeccable detect --json <target>`. Local/canvas MM Artifacts (`mm-artifact` v3 format) are checked with one command, `node artifacts/review/review.mjs <folder>`, which runs `check.mjs`, `check-ui.mjs` and `geometry.mjs`, pre-renders the board in `node:vm` (`ReactDOMServer.renderToStaticMarkup` into `#root`) and runs `impeccable detect --json` on that rendered HTML. Interactive owner A/B reviews use `node artifacts/review/review.mjs <folder> --open`, which serves the canvas over the live loopback HTTP review server (`http://127.0.0.1:<port>/`) where the owner presses `Send answers`; `--standalone [<out.html>]` is only for offline HTML previews/exports and SSR pre-render verification, never for an interactive owner decision.
+Front-load Impeccable before any UI or MM Artifact authoring: `impeccable context --target <path>`, `DESIGN.md` + the `design.json` sidecar in `.impeccable`, `.impeccable/config.json` (`hook.enabled: true`), `reference/craft-floor.md` + `reference/operate.md`, and `impeccable detect --json <target>`. Local/canvas MM Artifacts (`mm-artifact` v3 format) are checked with one command, `node artifacts/review/review.mjs <folder>`, which runs `check.mjs`, `check-ui.mjs` and `geometry.mjs`, pre-renders the board in `node:vm` (`ReactDOMServer.renderToStaticMarkup` into `#root`) and runs `impeccable detect --json` on that rendered HTML. Interactive owner A/B reviews use the live loopback HTTP review server (`http://127.0.0.1:<port>/`), where the owner presses `Send answers`; seats never open the owner's browser. Once review passes, send the orchestrator only the review URL and issue number, and keep the server running until the owner answers. A kept-alive canvas review server must stay light (no dev/watch build pinning gigabytes); a seat whose canvas needs a heavy local server flags that to the orchestrator instead of holding the RAM silently, and stops it as soon as the owner has answered. The orchestrator opens it on the owner's screen (#8987, relay wording). `--standalone [<out.html>]` is only for offline HTML previews/exports and SSR pre-render verification, never for an interactive owner decision.
 
 Impeccable v4.7.0 (engine v0.1.16) workflow; CLI verbs and agent playbooks are distinct:
 

package/skills/org-guide/references/work-and-releases.md

@@ -41,7 +41,10 @@ Owner ruling 2026-10-25 (#8814, #8816, MM-Work#7629; `docs/decisions/2026-10-06-
 the required `gate` holds fast deterministic checks only; UI/design uses `@mutmutco/mmwork-ds`
 (`mmwork-check-ui`) and the mandatory Impeccable skill/toolkit. Inspect all applicable toolkit
 capabilities for every design task. Work on the live app; use our own MM Artifacts A/B canvas only
-for owner choices, with live kit pieces and recorded choice ID / owner-decision reference.
+for owner design choices, with live kit pieces and recorded choice ID / owner-decision reference.
+A canvas is for how something looks or works on screen only (#8986, relay wording): approvals for
+keys, releases, deletions, data access or tooling never go on a canvas; send them to the
+orchestrator, who asks the owner in plain words.
 Functional browser journeys remain opt-in `workflow_dispatch`-only, never design checks or gates.
 
 ## The MM Open Design System Bible (#8837, #8839)
@@ -65,11 +68,17 @@ design work follows one harmonized **Front-Loaded Impeccable v4.7.0 + MM Artifac
   `node artifacts/review/review.mjs <folder>`. It runs `check.mjs`, `check-ui.mjs` and
   `geometry.mjs`, pre-renders the board in `node:vm` via `ReactDOMServer.renderToStaticMarkup` into
   `#root` and runs `impeccable detect --json` on that SSR-rendered HTML. Interactive owner A/B
-  reviews use `node artifacts/review/review.mjs <folder> --open`: it serves the canvas over the live
-  loopback HTTP review server (`http://127.0.0.1:<port>/`) and the owner's `Send answers` posts back
-  to `POST /answers`. `--standalone [<out.html>]` is only for offline HTML previews/exports and SSR
-  pre-render verification, never for an interactive owner decision.
-  **Headless seat rule:** `--open` is review.mjs-only; never pass `--open` to `vite`.
+  reviews use the live loopback HTTP review server (`http://127.0.0.1:<port>/`), where the owner's
+  `Send answers` posts back to `POST /answers`; a seat must not open the owner's browser. An A/B is
+  shown as the live canvas link, never as prose (#8987, relay wording). Once the canvas passes review,
+  send the orchestrator only the review URL and issue number, and keep the server running until the
+  owner answers. A kept-alive canvas review server must stay light (no dev/watch build pinning
+  gigabytes); a seat whose canvas needs a heavy local server flags that to the orchestrator instead
+  of holding the RAM silently, and stops it as soon as the owner has answered. The orchestrator opens
+  it on the owner's screen. `--standalone [<out.html>]` is only
+  for offline HTML previews/exports and SSR pre-render verification, never for an interactive owner
+  decision.
+  **Headless seat rule:** `--open` is review.mjs-only; never pass `--open` to `vite`, and never use it from a seat to open the owner's browser for an A/B review.
   Vite parses its value as a URL path, so `vite --open false` opens the owner's real browser at `/false`;
   run dev/preview servers with `BROWSER=none` and no `--open` flag.
 - **Live Docs** (`Canlı belgeler` viewer) carry the living references, including the live
@@ -89,7 +98,7 @@ How the five pillars fit together (owner, 2026-10-25):
 Four owner decisions (2026-10-25T15:35:52Z):
 
 1. **Doc vs. app kit — add a Document Design System too.** Keep the MM-Work Atomic Design System (`3a5c79df-5274-40ad-a1b5-a75e67a74dac`) for MM-Work and module app UI (and as the fallback for now), and add a dedicated Document/Editorial Design System Artifact in Live Docs for reports, checklists, decks and client documents made by Junior or agents.
-2. **Where to save — local HTML for dev, Live Docs for shared.** Coding agents build and open local `.html` MM Artifacts for fast iteration — interactive owner A/B reviews with `node artifacts/review/review.mjs <folder> --open` on the live loopback HTTP review server (`http://127.0.0.1:<port>/` with `Send answers`), and offline HTML previews/exports or SSR pre-render verification (`impeccable detect --json`) with `node artifacts/review/review.mjs <folder> --standalone [<out.html>]` — and publish to Live Docs only for a shared deliverable, an A/B decision canvas or a Design System. Junior inside MM-Work saves directly to Live Docs.
+2. **Where to save — local HTML for dev, Live Docs for shared.** Coding agents build local `.html` MM Artifacts for fast iteration. For interactive owner A/B reviews, serve the canvas on the live loopback HTTP review server (`http://127.0.0.1:<port>/` with `Send answers`) without opening the owner's browser; relay the URL and issue number to the orchestrator and keep the server running until the owner answers (#8987, relay wording). A kept-alive canvas review server must stay light (no dev/watch build pinning gigabytes); a seat whose canvas needs a heavy local server flags that to the orchestrator instead of holding the RAM silently, and stops it as soon as the owner has answered. Use `node artifacts/review/review.mjs <folder> --standalone [<out.html>]` for offline HTML previews/exports or SSR pre-render verification. Publish to Live Docs only for a shared deliverable, an A/B decision canvas or a Design System. Junior inside MM-Work saves directly to Live Docs.
 3. **Artifact shape — single HTML by default, Canvas for A/B.** A single self-contained HTML view for documents, checklists and single-screen work; a multi-board spatial Canvas only for A/B choices or `1440`/`1024`/`390` side-by-side comparisons.
 4. **Kit binding — Live Docs hosts kits; npm only for MM-Work.** Every Design System Artifact in Live Docs stores its tokens/CSS/components and `DESIGN.md` so any HTML artifact can bind to it (`kit: { id, version }`); only the MM-Work app design system is also exported as `@mutmutco/mmwork-ds`, because the MM-Work app and the 10 suite modules compile against it.
 
@@ -211,6 +220,10 @@ agent, and is that improvement filed?
 Settled owner ruling: present clear, distinct choices in the existing MM Artifact viewer, not a
 "shell over a shell". These are authoring and viewer requirements, not proof of installed capabilities.
 
+**Canvases carry design choices only (#8986, relay wording).** An A/B canvas asks how something
+looks or works on screen. Approvals for keys, releases, deletions, data access or tooling never go on
+a canvas: send them to the orchestrator, who asks the owner in plain words.
+
 1. **No "shell over a shell" — designer agents build only the alternatives, never their own A/B switcher.**
    The outer MM Artifact viewer (the local review shell and `CanvasStage` / `CompareView` in Live Docs)
    already IS the A/B selector shell: it renders the question prompt, Option A / Option B / Neither
@@ -261,11 +274,12 @@ requests like this should follow this structure, not prose guide."
      `distill`, `typeset`, `layout`, `colorize`, `polish`) to create 2–3 genuinely distinct visual
      designs that honor every constraint in the owner's brief: Option A, Option B and optionally
      Option C, each its own full-resolution `1440x900` live HTML board in one MM Artifact A/B canvas
-     (Part 3 rules: content-only `Ctrl + Mousewheel` zoom, 1:1 or side-by-side live comparison). Open
-     the verified canvas in the browser automatically with
-     `node artifacts/review/review.mjs <folder> --open`, which serves it over the live loopback HTTP
-     review server (`http://127.0.0.1:<port>/`) so the owner's `Send answers` posts straight back to
-     `POST /answers`. Never open a `--standalone` `file://` export (`Download answers.json`) for an
+     (Part 3 rules: content-only `Ctrl + Mousewheel` zoom, 1:1 or side-by-side live comparison). Serve
+     the verified canvas on the live loopback HTTP review server without opening a browser from the
+     seat, so the owner's `Send answers` posts straight back to `POST /answers`. Once review passes,
+     send the orchestrator only the review URL and issue number, and keep the server running through
+     Stage 2; the orchestrator opens it on the owner's screen (#8987, relay wording). Never open a
+     `--standalone` `file://` export (`Download answers.json`) for an
      interactive owner A/B decision: `--standalone [<out.html>]` is only for offline previews/exports
      and SSR detector checks. Spawn a dedicated, fresh
      `designer` subagent for each distinct design task (item 3); never reuse a busy designer seat.