@mutmutco/claude-plugin 4.5.230 → 4.5.232

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.5.230",
+  "version": "4.5.232",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -1469,8 +1469,8 @@ function commandFromFailMessage(msg) {
   const head = msg.split(":", 1)[0].trim();
   if (!head || head.startsWith("-")) return "mmi-cli";
   if (!/^[a-z][a-z0-9-]*(?: [a-z][a-z0-9-]*){0,5}$/.test(head)) return "mmi-cli";
-  const canonical2 = canonicalPathFor(head);
-  if (canonical2) return canonical2;
+  const canonical = canonicalPathFor(head);
+  if (canonical) return canonical;
   return HOUSE_ROOTS.includes(head.split(" ")[0]) ? head : "mmi-cli";
 }
 function canonicalFailMessage(msg) {
@@ -24015,20 +24015,20 @@ function reseedProductRulesetStrictness(current, seed, declared = {}) {
     }
     return { policy: policy2, parameters: parameters2 };
   };
-  const canonical2 = parse2(seed);
-  const strict = canonical2.parameters.strict_required_status_checks_policy;
+  const canonical = parse2(seed);
+  const strict = canonical.parameters.strict_required_status_checks_policy;
   if (typeof strict !== "boolean") throw new Error("canonical product ruleset must declare boolean strictness");
   if (current === null) return seed;
   const { policy, parameters } = parse2(current);
   let changed = parameters.strict_required_status_checks_policy !== strict;
   parameters.strict_required_status_checks_policy = strict;
   if (declared.requiredChecks) {
-    const checks = canonical2.parameters.required_status_checks.map((check) => parameters.required_status_checks.find((old) => old.context === check.context) ?? check);
+    const checks = canonical.parameters.required_status_checks.map((check) => parameters.required_status_checks.find((old) => old.context === check.context) ?? check);
     if (JSON.stringify(parameters.required_status_checks) !== JSON.stringify(checks)) changed = true;
     parameters.required_status_checks = checks;
   }
   if (declared.requiredCheckBranches) {
-    const refs = canonical2.policy.conditions?.ref_name?.include;
+    const refs = canonical.policy.conditions?.ref_name?.include;
     if (!Array.isArray(refs) || !refs.length) throw new Error("canonical product ruleset must declare branch includes");
     const conditions = policy.conditions;
     const refName = conditions?.ref_name;
@@ -24297,13 +24297,13 @@ function upsertManagedSeedBlock(current, desired, begin, end) {
   if (desired.slice(0, desiredBegin.start).trim() || desired.slice(desiredEnd.end).trim()) {
     return { ok: false, reason: "managed block source must contain only the bounded block" };
   }
-  const canonical2 = desired.slice(desiredBegin.start, desiredEnd.textEnd);
+  const canonical = desired.slice(desiredBegin.start, desiredEnd.textEnd);
   const currentLines = sourceLines(current);
   const begins = currentLines.filter((line) => line.text === begin);
   const ends = currentLines.filter((line) => line.text === end);
   if (begins.length === 0 && ends.length === 0) {
     const eol2 = current.match(/\r\n|\n|\r/)?.[0] ?? "\n";
-    const block2 = normalizeEol(canonical2).replace(/\n/g, eol2);
+    const block2 = normalizeEol(canonical).replace(/\n/g, eol2);
     if (current.length === 0) return { ok: true, content: `${block2}${eol2}`, changed: true, action: "insert" };
     const separator = /(?:\r\n|\n|\r)$/.test(current) ? eol2 : `${eol2}${eol2}`;
     return { ok: true, content: `${current}${separator}${block2}${eol2}`, changed: true, action: "insert" };
@@ -24317,11 +24317,11 @@ function upsertManagedSeedBlock(current, desired, begin, end) {
     return { ok: false, reason: "malformed managed block markers (end precedes begin)" };
   }
   const existing = current.slice(currentBegin.start, currentEnd.textEnd);
-  if (normalizeEol(existing) === normalizeEol(canonical2)) {
+  if (normalizeEol(existing) === normalizeEol(canonical)) {
     return { ok: true, content: current, changed: false, action: "current" };
   }
   const eol = current.match(/\r\n|\n|\r/)?.[0] ?? "\n";
-  const block = normalizeEol(canonical2).replace(/\n/g, eol);
+  const block = normalizeEol(canonical).replace(/\n/g, eol);
   return {
     ok: true,
     content: `${current.slice(0, currentBegin.start)}${block}${current.slice(currentEnd.textEnd)}`,
@@ -27242,10 +27242,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.230",
-    tag: "v4.5.230",
-    commit: "faa22acbc289",
-    npm: "@mutmutco/cli@4.5.230"
+    version: "4.5.232",
+    tag: "v4.5.232",
+    commit: "cd546199eccb",
+    npm: "@mutmutco/cli@4.5.232"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27262,14 +27262,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.230"
+          v3Target: "v4.5.232"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.230 and redeploy the Hub Lambda from tag v4.5.230 (faa22acbc289); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.230 (@mutmutco/cli@4.5.230, tag commit faa22acbc289 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.232 and redeploy the Hub Lambda from tag v4.5.232 (cd546199eccb); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.232 (@mutmutco/cli@4.5.232, tag commit cd546199eccb \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -28931,15 +28931,15 @@ function planFleetLockstepEnforcement(read, enrollment, stagePlan, statusFinding
   };
 }
 async function resolveCanonicalRepoNames(client, repos) {
-  const canonical2 = /* @__PURE__ */ new Map();
+  const canonical = /* @__PURE__ */ new Map();
   for (const repo of repos) {
     const detail = await client.rest("GET", `repos/${repo}`, { timeoutMs: 2e4 });
     if (typeof detail?.name !== "string" || !detail.name) {
       throw new Error(`could not resolve the canonical repository name for ${repo} \u2014 refusing to write a ruleset include entry from guessed casing`);
     }
-    canonical2.set(repo.toLowerCase(), detail.name);
+    canonical.set(repo.toLowerCase(), detail.name);
   }
-  return canonical2;
+  return canonical;
 }
 async function writeFleetLockstepRuleset(client, body, liveId, target, org) {
   if (liveId == null) {
@@ -28963,7 +28963,7 @@ async function writeFleetLockstepRuleset(client, body, liveId, target, org) {
     verified: true
   };
 }
-async function applyFleetLockstepStage(client, plan, target, canonical2, org = ORG_LOGIN) {
+async function applyFleetLockstepStage(client, plan, target, canonical, org = ORG_LOGIN) {
   const stage = plan.stages.find((s) => s.stage === target);
   if (!stage) throw new Error(`unknown arming stage ${target} \u2014 stages run 1..${plan.totalStages}`);
   if (target > plan.armedThroughStage + 1 && plan.state !== "disarmed") {
@@ -28972,7 +28972,7 @@ async function applyFleetLockstepStage(client, plan, target, canonical2, org = O
     );
   }
   const include = stage.cumulativeRepos.map((repo) => {
-    const name = canonical2.get(repo.toLowerCase());
+    const name = canonical.get(repo.toLowerCase());
     if (!name) throw new Error(`no canonical name resolved for ${repo}`);
     return name;
   });
@@ -29276,8 +29276,8 @@ function registerFleetLockstepEnforce(program3) {
 rollback stays available: mmi-cli devops train enforce --apply --disarm`
         );
       }
-      const canonical2 = await resolveCanonicalRepoNames(client, plan.stages.find((s) => s.stage === target).cumulativeRepos);
-      const result = await applyFleetLockstepStage(client, plan, target, canonical2);
+      const canonical = await resolveCanonicalRepoNames(client, plan.stages.find((s) => s.stage === target).cumulativeRepos);
+      const result = await applyFleetLockstepStage(client, plan, target, canonical);
       const { plan: after } = await readEnforcementPlan(client);
       if (o.json) console.log(JSON.stringify({ result, plan: after }, null, 2));
       else {
@@ -30433,15 +30433,15 @@ function parseRuntimeIdentity(log, expected) {
   if (proofs.length !== 1) return unavailable("invalid-proof");
   const encoded = proofs[0].slice(prefix.length).trim();
   if (encoded.length > 16384) return unavailable("invalid-proof");
-  const object2 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+  const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
   const keys = (v, allowed) => Object.keys(v).length === allowed.length && Object.keys(v).every((k) => allowed.includes(k));
   const text = (v, re) => typeof v === "string" && re.test(v);
   try {
     const p = JSON.parse(encoded);
-    if (JSON.stringify(p) !== encoded || !object2(p)) return unavailable("invalid-proof");
+    if (JSON.stringify(p) !== encoded || !object(p)) return unavailable("invalid-proof");
     if (p.version !== 1) return unavailable("unsupported-version");
     const parts = expected.repo.split("/");
-    if (parts.length !== 2 || !parts.every(Boolean) || !object2(p.target) || !keys(p.target, ["slug", "stage"]) || p.target.slug !== parts[1].toLowerCase() || p.target.stage !== expected.stage) return unavailable("target-mismatch");
+    if (parts.length !== 2 || !parts.every(Boolean) || !object(p.target) || !keys(p.target, ["slug", "stage"]) || p.target.slug !== parts[1].toLowerCase() || p.target.stage !== expected.stage) return unavailable("target-mismatch");
     if (p.status === "unavailable") {
       if (!keys(p, ["version", "target", "status", "reason"]) || typeof p.reason !== "string" || !["selection-unavailable", "inspection-failed", "snapshot-changed", "output-too-large"].includes(p.reason)) return unavailable("invalid-proof");
       return unavailable(p.reason);
@@ -30449,7 +30449,7 @@ function parseRuntimeIdentity(log, expected) {
     if (!keys(p, ["version", "target", "status", "slot", "replicas"]) || p.status !== "available" || p.slot !== "blue" && p.slot !== "green" || !Array.isArray(p.replicas) || !p.replicas.length) return unavailable("invalid-proof");
     const seen = /* @__PURE__ */ new Set();
     for (const r of p.replicas) {
-      if (!object2(r) || !keys(r, ["service", "container", "configuredRef", "actualImageID", "repoDigests", "health", "state"]) || !text(r.service, /^[A-Za-z0-9][A-Za-z0-9_-]*$/) || !text(r.container, /^[a-f0-9]{64}$/) || !text(r.configuredRef, /^[A-Za-z0-9][A-Za-z0-9._/@:-]*$/) || !text(r.actualImageID, /^sha256:[a-f0-9]{64}$/) || !Array.isArray(r.repoDigests) || !r.repoDigests.every((d) => text(d, /^[A-Za-z0-9][A-Za-z0-9._/:-]*@sha256:[a-f0-9]{64}$/)) || (typeof r.health !== "string" || !["healthy", "unhealthy", "starting", "not-configured", "unknown"].includes(r.health)) || r.state !== "running" || seen.has(r.container)) return unavailable("invalid-proof");
+      if (!object(r) || !keys(r, ["service", "container", "configuredRef", "actualImageID", "repoDigests", "health", "state"]) || !text(r.service, /^[A-Za-z0-9][A-Za-z0-9_-]*$/) || !text(r.container, /^[a-f0-9]{64}$/) || !text(r.configuredRef, /^[A-Za-z0-9][A-Za-z0-9._/@:-]*$/) || !text(r.actualImageID, /^sha256:[a-f0-9]{64}$/) || !Array.isArray(r.repoDigests) || !r.repoDigests.every((d) => text(d, /^[A-Za-z0-9][A-Za-z0-9._/:-]*@sha256:[a-f0-9]{64}$/)) || (typeof r.health !== "string" || !["healthy", "unhealthy", "starting", "not-configured", "unknown"].includes(r.health)) || r.state !== "running" || seen.has(r.container)) return unavailable("invalid-proof");
       seen.add(r.container);
     }
     return p;
@@ -31932,114 +31932,6 @@ function parseRunnerJobs(source) {
     return void 0;
   }
 }
-function parseRunnerWorkflowContract(source) {
-  if (!source || source.length > 15e5) return void 0;
-  try {
-    const doc = (0, import_yaml.parseDocument)(source, { uniqueKeys: true, stringKeys: true, merge: false, prettyErrors: false });
-    if (doc.errors.length || doc.warnings.length || !literalMap(doc.contents)) return void 0;
-    let invalid = false, nodes = 0;
-    (0, import_yaml.visit)(doc, (_key, node, path2) => {
-      if (++nodes > 1e5 || path2.length > 64 || !literal(node) || (0, import_yaml.isPair)(node) && (0, import_yaml.isScalar)(node.key) && node.key.value === "<<") {
-        invalid = true;
-        return import_yaml.visit.BREAK;
-      }
-    });
-    return invalid ? void 0 : doc.toJS({ maxAliasCount: 0 });
-  } catch {
-    return void 0;
-  }
-}
-
-// ../shared/ci-allowance-contract.ts
-var import_node_crypto9 = require("node:crypto");
-var CLI_ALLOWANCE_MANIFEST = Object.freeze({
-  id: "hub-cli-v1",
-  parts: ["tests-1", "tests-2", "checks"],
-  // Includes checkout, toolchain, installation and teardown, not just the test subprocess.
-  jobMinutes: 10,
-  aggregateMinutes: 1,
-  maxAttempts: 3,
-  storageBytes: 0
-});
-var CLI_ATTEMPT_MINUTES = CLI_ALLOWANCE_MANIFEST.parts.length * CLI_ALLOWANCE_MANIFEST.jobMinutes + CLI_ALLOWANCE_MANIFEST.aggregateMinutes;
-var CI_PROFILES = Object.freeze({
-  "included-linux": "ubuntu-latest",
-  "owned-linux": ["self-hosted", "linux", "x64", "mmi-live"]
-});
-var CLI_ADMISSION_IF = "${{ always() && !cancelled() && needs.cli-admission.result == 'success' && needs.cli-admission.outputs.admitted == 'true' && needs.cli-admission.outputs.attempt == format('{0}', github.run_attempt) && needs.cli-admission.outputs.candidate == github.sha && (needs.cli-admission.outputs.profile == 'included-linux' || needs.cli-admission.outputs.profile == 'owned-linux') }}";
-var CLI_ADMISSION_RUNNER = `\${{ needs.cli-admission.outputs.profile == 'included-linux' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","x64","mmi-live"]') }}`;
-var CLI_AGGREGATE_SCRIPT = `test "$ADMISSION_RESULT" = success
-test "$ADMITTED" = true
-test "$ADMITTED_ATTEMPT" = "$CURRENT_ATTEMPT"
-test "$ADMITTED_CANDIDATE" = "$CURRENT_CANDIDATE"
-test "$PART_RESULT" = success`;
-var aggregateEnv = {
-  ADMISSION_RESULT: "${{ needs.cli-admission.result }}",
-  ADMITTED: "${{ needs.cli-admission.outputs.admitted }}",
-  ADMITTED_ATTEMPT: "${{ needs.cli-admission.outputs.attempt }}",
-  CURRENT_ATTEMPT: "${{ github.run_attempt }}",
-  ADMITTED_CANDIDATE: "${{ needs.cli-admission.outputs.candidate }}",
-  CURRENT_CANDIDATE: "${{ github.sha }}",
-  PART_RESULT: "${{ needs.cli-part.result }}"
-};
-function object(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function equal(a, b) {
-  return canonical(a) === canonical(b);
-}
-function canonical(value) {
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  if (object(value)) return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonical(value[k])}`).join(",")}}`;
-  return JSON.stringify(value);
-}
-function cliAdmissionJobs(coordinatorSha) {
-  if (!/^[a-f0-9]{40}$/.test(coordinatorSha)) throw new Error("immutable coordinator SHA required");
-  return {
-    "cli-admission": { uses: `mutmutco/MMI-Hub/.github/workflows/ci-allowance.yml@${coordinatorSha}`, permissions: { "id-token": "write" } },
-    // Merge these keys into the EXISTING cli-part; retain every test/build step.
-    "cli-part": { needs: ["cli-admission"], if: CLI_ADMISSION_IF, "runs-on": CLI_ADMISSION_RUNNER, "timeout-minutes": CLI_ALLOWANCE_MANIFEST.jobMinutes },
-    cli: {
-      needs: ["cli-admission", "cli-part"],
-      if: "${{ always() && !cancelled() }}",
-      "runs-on": CI_PROFILES["owned-linux"],
-      "timeout-minutes": 1,
-      permissions: {},
-      steps: [{ name: "Require fresh admission and every CLI part", shell: "bash", env: aggregateEnv, run: CLI_AGGREGATE_SCRIPT }]
-    }
-  };
-}
-function verifyCliAdmissionContract(workflow, coordinatorSha) {
-  if (!object(workflow) || !object(workflow.jobs)) return null;
-  if (!equal(workflow.permissions, { contents: "read", "pull-requests": "read" })) return null;
-  const expected = cliAdmissionJobs(coordinatorSha);
-  const admission = workflow.jobs["cli-admission"], part = workflow.jobs["cli-part"], aggregate = workflow.jobs.cli;
-  if (!equal(admission, expected["cli-admission"]) || !equal(aggregate, expected.cli) || !object(part)) return null;
-  if (!Object.entries(expected["cli-part"]).every(([key, value]) => equal(part[key], value))) return null;
-  if (!object(part.strategy) || part.strategy["fail-fast"] !== false || !object(part.strategy.matrix) || !equal(part.strategy.matrix, { part: [...CLI_ALLOWANCE_MANIFEST.parts] }) || part["continue-on-error"]) return null;
-  if (!Array.isArray(part.steps) || !part.steps.every(object)) return null;
-  const toolchains = part.steps.filter((step) => step.uses === "./.github/actions/runner-node-toolchain");
-  if (toolchains.length !== 1 || !object(toolchains[0].with) || toolchains[0].with["package-manager-cache"] !== "false" || toolchains[0].with.cache !== "") return null;
-  if (part.steps.some((step) => typeof step.uses === "string" && /(?:upload-artifact|actions\/cache)/.test(step.uses))) return null;
-  return (0, import_node_crypto9.createHash)("sha256").update(canonical(workflow)).digest("hex");
-}
-var CLI_ALLOWANCE_SOURCE = Object.freeze({
-  repository: "mutmutco/MMI-Hub",
-  callerPath: ".github/workflows/gate.yml",
-  coordinatorPath: ".github/workflows/ci-allowance.yml",
-  coordinatorSha: "50f0bd4d8e35f3f09119bd3fa1bb7705fcc6f09b",
-  coordinatorSha256: "7b23f22131c5e08292f142eeed3899c8ecf49b1bdcc96bfdfe114cf1dca47b48",
-  executionSha256: "6198e0896a5533f9546e084642ceb214336c930561fe9f8292eb7e6a0972933b"
-});
-function verifyCliAdmissionSourceContract(workflow, coordinator) {
-  const source = CLI_ALLOWANCE_SOURCE;
-  if (coordinator.repo !== source.repository || coordinator.path !== source.coordinatorPath || coordinator.ref !== source.coordinatorSha || (0, import_node_crypto9.createHash)("sha256").update(coordinator.body).digest("hex") !== source.coordinatorSha256) return null;
-  const digest = verifyCliAdmissionContract(workflow, source.coordinatorSha);
-  if (!digest) return null;
-  const { jobs, ...context } = workflow;
-  const execution = { ...context, jobs: { "cli-admission": jobs["cli-admission"], "cli-part": jobs["cli-part"], cli: jobs.cli } };
-  return (0, import_node_crypto9.createHash)("sha256").update(canonical(execution)).digest("hex") === source.executionSha256 ? digest : null;
-}
 
 // src/workflow-runner-source.ts
 var WORKFLOW_PATH = /^\.github\/workflows\/[\w.-]+\.ya?ml$/;
@@ -32161,15 +32053,12 @@ function classifyRunnerWorkflows(files) {
   return files.flatMap((file) => {
     const jobs = parsed.get(locationOf(file));
     if (!jobs) return [{ repo: file.repo, path: file.path, job: "(invalid YAML)", cost: "unknown", callee: false }];
-    const source = CLI_ALLOWANCE_SOURCE;
-    const coordinator = known.get(locationOf({ repo: source.repository, path: source.coordinatorPath, ref: source.coordinatorSha }));
-    const allowance2 = file.repo === source.repository && file.path === source.callerPath && coordinator && resolved(file, /* @__PURE__ */ new Set()) && verifyCliAdmissionSourceContract(parseRunnerWorkflowContract(file.body), coordinator) !== null;
     return [...jobs].flatMap(([id, job]) => {
       const hasCallee = Object.hasOwn(job, "uses");
       const uses = hasCallee && typeof job.uses === "string" && !Object.hasOwn(job, "runs-on") ? job.uses : void 0;
       const target = uses && resolveCallee(file, uses);
       if (target && known.has(locationOf(target)) && resolved(file, /* @__PURE__ */ new Set())) return [];
-      const cost = hasCallee ? "unknown" : id === "cli-part" && allowance2 ? "standard-hosted" : classifyJobRunnerCost(job, standardHostedLabelFor(file.repo, file.path, id));
+      const cost = hasCallee ? "unknown" : classifyJobRunnerCost(job, standardHostedLabelFor(file.repo, file.path, id));
       return [{ repo: file.repo, path: file.path, job: id, cost, callee: hasCallee }];
     });
   });
@@ -33129,7 +33018,7 @@ function checkLineEndings(probe) {
 // src/release-ledger.ts
 var import_node_fs28 = require("node:fs");
 var import_node_path26 = require("node:path");
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
@@ -33491,7 +33380,7 @@ function releaseLedgerPath(cwd) {
 }
 function atomicWriteJson(path2, ledger) {
   (0, import_node_fs28.mkdirSync)((0, import_node_path26.dirname)(path2), { recursive: true });
-  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto10.randomBytes)(4).toString("hex")}`;
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto9.randomBytes)(4).toString("hex")}`;
   (0, import_node_fs28.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
   (0, import_node_fs28.renameSync)(tmp, path2);
@@ -40257,14 +40146,14 @@ function buildCommand(cmd, flatPath) {
     );
   }
   const aliases = cmd.aliases();
-  const canonical2 = canonicalPathFor(flatPath) ?? flatPath;
+  const canonical = canonicalPathFor(flatPath) ?? flatPath;
   const out = {
     name: cmd.name(),
-    path: canonical2,
+    path: canonical,
     flat_path: flatPath,
     ...aliases.length ? { aliases: [...aliases] } : {},
     house,
-    canonical: canonical2,
+    canonical,
     arguments: cmd.registeredArguments.map(buildArgument),
     // A hand-parsed command registers no Commander options, so its declared set is merged in (#3682).
     options: [...cmd.options.map(buildOption), ...readDeclaredOptions(cmd)],
@@ -40436,8 +40325,8 @@ function findCommandByPath(root, path2) {
 function buildDoorsCatalog(tree) {
   return DOOR_DECLARATIONS.map((decl) => {
     const house = houseForPath(decl.path);
-    const canonical2 = canonicalPathFor(decl.path);
-    if (!house || !canonical2) {
+    const canonical = canonicalPathFor(decl.path);
+    if (!house || !canonical) {
       throw new Error(
         `command-manifest: doors catalog entry '${decl.door}' names path '${decl.path}' with no house assignment \u2014 fix DOOR_DECLARATIONS or cli/src/house-map.ts.`
       );
@@ -40447,7 +40336,7 @@ function buildDoorsCatalog(tree) {
       question: decl.question,
       house,
       command: decl.path,
-      canonical: canonical2,
+      canonical,
       source: decl.source,
       live: Boolean(findCommandByPath(tree, decl.path))
     };
@@ -41270,8 +41159,8 @@ function registerBoardCommands(program3) {
     }
   });
   function resolveBoardStatus(status) {
-    const canonical2 = canonicalizeBoardStatus(status);
-    if (canonical2) return canonical2;
+    const canonical = canonicalizeBoardStatus(status);
+    if (canonical) return canonical;
     fail(`board move failed: unknown status '${status}'; expected one of ${BOARD_STATUSES.join(", ")}`, {
       code: ERROR_CODES.ERR_BAD_ENUM,
       expected: [...BOARD_STATUSES]
@@ -41731,7 +41620,7 @@ var import_node_os18 = require("node:os");
 var import_node_path31 = require("node:path");
 
 // src/box-control.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 var sshdPost = (dest) => `if sshd -t; then systemctl reload ssh; else rm -f ${dest}; echo 'sshd -t rejected ${dest}: removed, not reloaded' >&2; exit 1; fi`;
@@ -41835,7 +41724,7 @@ function laneCoverageAction(files, box, op) {
   return { notice: `LANE_COVERAGE: ${mismatch}` };
 }
 function md5(content) {
-  return (0, import_node_crypto11.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto10.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -42614,18 +42503,18 @@ function secretRemovalRefusal(existing, patch) {
       return `org project set: --unset-secret ${mapKey} is not declared in ${existing?.slug ?? "this project"}'s secrets catalog \u2014 nothing to remove`;
     }
     const at = mapKey.indexOf("@");
-    const canonical2 = at === -1 ? mapKey : mapKey.slice(0, at);
+    const canonical = at === -1 ? mapKey : mapKey.slice(0, at);
     for (const [stage, names] of Object.entries(runtime)) {
-      if (Array.isArray(names) && names.includes(canonical2)) {
-        return `org project set: ${canonical2} is still required by stage ${stage} \u2014 drop it there first (--var requiredRuntimeSecrets=...)`;
+      if (Array.isArray(names) && names.includes(canonical)) {
+        return `org project set: ${canonical} is still required by stage ${stage} \u2014 drop it there first (--var requiredRuntimeSecrets=...)`;
       }
     }
     for (const raw of build) {
       if (typeof raw !== "string") continue;
       const eq = raw.indexOf("=");
       const ref = eq === -1 ? raw : raw.slice(eq + 1);
-      if (ref === canonical2) {
-        return `org project set: ${canonical2} is still required by the build secret contract \u2014 drop it there first (--var requiredBuildSecrets=...)`;
+      if (ref === canonical) {
+        return `org project set: ${canonical} is still required by the build secret contract \u2014 drop it there first (--var requiredBuildSecrets=...)`;
       }
     }
   }
@@ -43933,7 +43822,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -43953,7 +43842,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto12.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -44130,7 +44019,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -44143,7 +44032,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto13.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto12.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -44663,11 +44552,11 @@ function boardGroupingDrift(board, wantColumn, wantSwimlane) {
   }
   return problems;
 }
-function boardCardFieldDrift(visibleFields, canonical2) {
+function boardCardFieldDrift(visibleFields, canonical) {
   const have = new Set(visibleFields);
-  const want = new Set(canonical2);
+  const want = new Set(canonical);
   return {
-    missing: canonical2.filter((f) => !have.has(f)),
+    missing: canonical.filter((f) => !have.has(f)),
     extra: visibleFields.filter((f) => !want.has(f))
   };
 }
@@ -45385,7 +45274,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -45418,7 +45307,7 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const identity = (0, import_node_crypto13.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
   const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
   const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
   return { ...scoped, baseSha, baseBranch };
@@ -47263,7 +47152,7 @@ init_github_client();
 init_cli_shared();
 
 // src/suite-status.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 var SUITE_REPO = "mutmutco/MM-Work";
 var REPOS = {
   "mmi-scout": "mutmutco/MMI-Scout",
@@ -47291,7 +47180,7 @@ function parseSuiteMapping(body) {
     return void 0;
   }
 }
-var sha256 = (b) => (0, import_node_crypto15.createHash)("sha256").update(b).digest("hex");
+var sha256 = (b) => (0, import_node_crypto14.createHash)("sha256").update(b).digest("hex");
 async function proveBundle(url, tag, fetchUrl) {
   const get = async (u) => {
     try {
@@ -47548,7 +47437,7 @@ async function waitSuiteDev(deps, opts) {
 // src/suite-train.ts
 var import_node_fs36 = require("node:fs");
 var import_node_path33 = require("node:path");
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 
 // src/kit-version.ts
 var parse = (v) => /^(\d+)\.(\d+)\.(\d+)(-.+)?$/.exec(typeof v === "string" ? v.trim() : "");
@@ -47650,7 +47539,7 @@ function readSuiteCut(path2) {
 }
 function writeSuiteCut(path2, record2) {
   (0, import_node_fs36.mkdirSync)((0, import_node_path33.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto16.randomBytes)(8).toString("hex")}.tmp`;
+  const temp = `${path2}.${(0, import_node_crypto15.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs36.writeFileSync)(temp, JSON.stringify(record2, null, 2), { flag: "wx" });
     (0, import_node_fs36.renameSync)(temp, path2);
@@ -51895,7 +51784,7 @@ async function deleteMergedRemoteBranch(options) {
 }
 
 // src/pr-merge-queue.ts
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var import_node_fs39 = require("node:fs");
 var import_node_os21 = require("node:os");
 var import_node_path36 = require("node:path");
@@ -51920,12 +51809,17 @@ async function queueGraphql(repo, fields, gh2) {
   if (!response.data?.repository) throw new Error("merge queue repository read failed");
   return response.data.repository;
 }
+async function readArrayPages(endpoint, gh2, error) {
+  const pages = parseNdjsonLines(await gh2([endpoint, "--paginate", "--jq", "{items: .}"]));
+  if (!pages.length || !pages.every((page) => Array.isArray(page?.items))) throw new Error(error);
+  return pages.flatMap((page) => page.items);
+}
 async function hasPrMergeQueue(repo, base, gh2 = readApi) {
-  const pages = JSON.parse(await gh2([`repos/${repo}/rules/branches/${encodeURIComponent(base)}?per_page=100`, "--paginate", "--slurp"]));
-  if (!Array.isArray(pages) || !pages.every((page) => Array.isArray(page) && page.every((rule) => rule && typeof rule.type === "string"))) {
+  const rules = await readArrayPages(`repos/${repo}/rules/branches/${encodeURIComponent(base)}?per_page=100`, gh2, `merge queue policy unreadable for ${repo}:${base}`);
+  if (!rules.every((rule) => typeof rule?.type === "string")) {
     throw new Error(`merge queue policy unreadable for ${repo}:${base}`);
   }
-  if (pages.flat().some((rule) => rule.type === "merge_queue")) return true;
+  if (rules.some((rule) => rule.type === "merge_queue")) return true;
   const result = await queueGraphql(repo, `mergeQueue(branch:${JSON.stringify(base)}) { id }`, gh2 === readApi ? actorReadApi : gh2);
   if (result.mergeQueue === void 0) throw new Error(`merge queue policy unreadable for ${repo}:${base}`);
   return result.mergeQueue !== null;
@@ -51935,7 +51829,7 @@ var ASYNC_HEADERS = ["-H", "Accept: application/vnd.github+json", "-H", "X-GitHu
 var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i;
 function admissionJournal(repo, pr, root) {
   const stateRoot = root ?? (process.platform === "win32" ? (0, import_node_path36.join)(process.env.LOCALAPPDATA || (0, import_node_path36.join)((0, import_node_os21.homedir)(), "AppData", "Local"), "MMI Future", "mmi-cli", "queue-admissions") : (0, import_node_path36.join)(process.env.XDG_STATE_HOME || (0, import_node_path36.join)((0, import_node_os21.homedir)(), ".local", "state"), "mmi-cli", "queue-admissions"));
-  const directory = (0, import_node_path36.join)(stateRoot, (0, import_node_crypto17.createHash)("sha256").update(`${repo.toLowerCase()}#${pr}`).digest("hex"));
+  const directory = (0, import_node_path36.join)(stateRoot, (0, import_node_crypto16.createHash)("sha256").update(`${repo.toLowerCase()}#${pr}`).digest("hex"));
   (0, import_node_fs39.mkdirSync)(directory, { recursive: true, mode: 448 });
   const attempts = (0, import_node_fs39.readdirSync)(directory).map((name) => {
     if (!/^[1-9][0-9]*\.jsonl$/.test(name)) throw new Error("queue admission receipt directory contains an unrecognized record");
@@ -51965,7 +51859,7 @@ function admissionJournal(repo, pr, root) {
     receipt: attempt ? load() : void 0,
     create(head) {
       const createdAt = Date.now();
-      const initial = { version: 1, repo: repo.toLowerCase(), pr, head, intentId: (0, import_node_crypto17.randomUUID)(), createdAt, observedAt: createdAt, state: "dispatching" };
+      const initial = { version: 1, repo: repo.toLowerCase(), pr, head, intentId: (0, import_node_crypto16.randomUUID)(), createdAt, observedAt: createdAt, state: "dispatching" };
       try {
         (0, import_node_fs39.writeFileSync)(path2(attempt + 1), JSON.stringify(initial) + "\n", { flag: "wx", mode: 384, flush: true });
       } catch (error) {
@@ -52168,11 +52062,10 @@ async function enqueuePrMergeQueue(pr, repo, options = {}) {
     merge_commit_title: metadata.mergeCommitTitle,
     merge_commit_message: metadata.mergeCommitMessage
   };
-  const commitsPages = JSON.parse(await read([`repos/${repo}/pulls/${pr}/commits?per_page=100`, "--paginate", "--slurp"]));
-  if (!Array.isArray(commitsPages) || !commitsPages.every((rows) => Array.isArray(rows) && rows.every((row) => typeof row?.commit?.message === "string"))) {
+  const commits = await readArrayPages(`repos/${repo}/pulls/${pr}/commits?per_page=100`, read, `queue commit messages unreadable for PR #${pr}`);
+  if (!commits.every((row) => typeof row?.commit?.message === "string")) {
     throw new Error(`queue commit messages unreadable for PR #${pr}`);
   }
-  const commits = commitsPages.flat();
   if (!commits.length || commits.length !== pull.commits?.totalCount) throw new Error(`queue commit messages incomplete for PR #${pr}; no submission occurred`);
   const parsed = parseRestClosingGuardInput({ state: pull.state, title: pull.title, body: pull.body }, commits, repo);
   parsed.closing = closing;
@@ -52187,11 +52080,11 @@ async function enqueuePrMergeQueue(pr, repo, options = {}) {
     },
     error: `queue preparation needed: ${detail}`
   });
-  const rulePages = JSON.parse(await read([`repos/${repo}/rules/branches/${encodeURIComponent(pull.baseRefName)}?per_page=100`, "--paginate", "--slurp"]));
-  if (!Array.isArray(rulePages) || !rulePages.every((rules) => Array.isArray(rules) && rules.every((rule) => typeof rule?.type === "string"))) {
+  const rules = await readArrayPages(`repos/${repo}/rules/branches/${encodeURIComponent(pull.baseRefName)}?per_page=100`, read, "queue merge method unreadable");
+  if (!rules.every((rule) => typeof rule?.type === "string")) {
     throw new Error("queue merge method unreadable");
   }
-  const methods = [...new Set(rulePages.flat().filter((rule) => rule.type === "merge_queue").map((rule) => rule.parameters?.merge_method))];
+  const methods = [...new Set(rules.filter((rule) => rule.type === "merge_queue").map((rule) => rule.parameters?.merge_method))];
   let method = methods.length === 1 ? methods[0] : void 0;
   if (!methods.length) {
     const legacy = await queueGraphql(
@@ -52315,7 +52208,7 @@ function hubReleaseCiRun(env) {
 }
 
 // src/release-custody.ts
-var import_node_crypto18 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var import_node_fs40 = require("node:fs");
 var import_node_path37 = require("node:path");
 init_github_client();
@@ -52538,7 +52431,7 @@ var ReleaseCustodyError = class extends Error {
     this.name = "ReleaseCustodyError";
   }
 };
-var custodyDigest = (value) => (0, import_node_crypto18.createHash)("sha256").update(value).digest("hex");
+var custodyDigest = (value) => (0, import_node_crypto17.createHash)("sha256").update(value).digest("hex");
 function parseCustody(raw, repo) {
   const s = JSON.parse(raw);
   if (s.schema !== "mmi-release-custody/v1" || s.repo !== repo || !s.precutId || !Number.isSafeInteger(s.revision) || s.revision < 1 || !s.controller || !Number.isSafeInteger(s.controller.runId) || s.controller.runId <= 0 || !Number.isSafeInteger(s.controller.runAttempt) || s.controller.runAttempt <= 0 || !s.controller.token || !(s.ledger === null || typeof s.ledger === "string") || !s.archives || !s.effects) {
@@ -52626,7 +52519,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
       throw new ReleaseCustodyError(`previous controller run ${found.state.controller.runId} attempt ${found.state.controller.runAttempt} is not proven terminal`);
     }
     let state = {
-      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto18.randomUUID)(), effects: {}, ...await initialize() },
+      ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto17.randomUUID)(), effects: {}, ...await initialize() },
       revision: (found.state?.revision ?? 0) + 1,
       controller
     };
@@ -52634,44 +52527,6 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
     const sha = await store.compareAndSet(found.sha, state);
     return new _ReleaseCustodySession(store, sha, state);
   }
-  /** Incident recovery must already have custody: it cannot create, migrate or replace a release. */
-  static async acquireExisting(store, controller, repo) {
-    return this.acquire(store, controller, repo, async () => {
-      throw new ReleaseCustodyError("incident recovery requires existing authoritative custody; no initialization or migration");
-    }, async (state) => {
-      if (Object.values(state.archives).some((a) => a.disposition === "unresolved") || Object.values(state.effects).some((e) => e.state === "intent")) {
-        throw new ReleaseCustodyError("unresolved custody requires read-only reconciliation before incident recovery");
-      }
-      return state;
-    });
-  }
-  /** A fixed incident scope survives ledger replacement and a new precut ID. Even an acknowledged
-   * result is spent: a new controller can observe it but never re-execute the same operation kind. */
-  incidentEffect(incident, kind, identity, execute) {
-    const operation = this.effectTail.then(async () => {
-      this.assertWritable();
-      this.assertEvidenceResolved();
-      if (!/^[a-z0-9-]{1,80}$/.test(incident) || !/^[a-z0-9-]{1,80}$/.test(kind)) throw new ReleaseCustodyError("invalid incident identity");
-      const scope = `incident:${incident}`;
-      const id = custodyDigest(JSON.stringify({ scope, kind }));
-      if (this.state.effects[id] || Object.values(this.state.effects).some((e) => e.scope === scope && e.kind === kind)) {
-        throw new ReleaseCustodyError("incident operation is spent; observe it without another provider write");
-      }
-      if (Object.values(this.state.effects).some((e) => e.state === "intent")) throw new ReleaseCustodyError("unresolved effect blocks another provider write");
-      const effect = { id, scope, kind, identity, state: "intent", startedAt: (/* @__PURE__ */ new Date()).toISOString() };
-      await this.change((state) => ({ ...state, effects: { ...state.effects, [id]: effect } }));
-      let result;
-      try {
-        result = await execute();
-      } catch {
-        throw new ReleaseCustodyError("incident request outcome is unacknowledged; intent remains spent, observation only");
-      }
-      await this.change((state) => ({ ...state, effects: { ...state.effects, [id]: { ...effect, state: "observed", result } } }));
-      return result;
-    });
-    this.effectTail = operation.catch(() => void 0);
-    return operation;
-  }
   assertWritable() {
     if (this.poison) throw this.poison;
   }
@@ -52725,7 +52580,7 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
           proof: { kind: "ledger-lifecycle", controller: state.controller }
         };
       }
-      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto18.randomUUID)() : state.precutId };
+      return { ...state, ledger: raw, archives, precutId: state.ledger && !raw ? (0, import_node_crypto17.randomUUID)() : state.precutId };
     });
   }
   async preserveLocal(raw) {
@@ -52832,7 +52687,12 @@ async function commandIdentity(file, args, run, repo) {
     const fields = Object.fromEntries(args.flatMap((arg, i) => ["-f", "--field", "-F", "--raw-field"].includes(arg) ? [args[i + 1].split(/=(.*)/s).slice(0, 2)] : []));
     const ref = args.includes("--ref") ? args[args.indexOf("--ref") + 1] : "main";
     const sha = (await run("git", ["rev-parse", `origin/${ref}`])).trim();
-    const before = JSON.parse(await run("gh", ["api", `repos/${repo}/actions/workflows/${args[2]}/runs?event=workflow_dispatch&per_page=100`]));
+    const before = JSON.parse(await run("gh", [
+      "api",
+      `repos/${repo}/actions/workflows/${args[2]}/runs?event=workflow_dispatch&per_page=100`,
+      "--jq",
+      "{workflow_runs: [.workflow_runs[] | {id}]}"
+    ]));
     return { kind: "workflow-dispatch", identity: { repo, workflow: args[2], fields, sha, beforeRunIds: before.workflow_runs.map((row) => row.id) } };
   }
   if (file === "gh" && args[0] === "run" && args[1] === "rerun") {
@@ -52914,7 +52774,7 @@ function withHubReleaseCustody(deps) {
         if (!authority.ok || !authority.train || authority.authenticatedDelegation !== true) {
           throw new ReleaseCustodyError("repository custody requires the server-verified owner-triggered train session");
         }
-        const controller = { ...runIdentity, token: (0, import_node_crypto18.randomUUID)() };
+        const controller = { ...runIdentity, token: (0, import_node_crypto17.randomUUID)() };
         const raw = localRaw(path2);
         const requiredContexts = () => discoverRequiredCheckContexts(
           deps,
@@ -53619,7 +53479,7 @@ init_github_quota();
 
 // src/issue-commands.ts
 var import_node_fs43 = require("node:fs");
-var import_node_crypto19 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -54092,7 +53952,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto19.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto18.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -59656,7 +59516,7 @@ function releaseFollowUpLegs(result, projectInfoSync) {
     legs.push(...runs2.map((run) => ({
       leg: run.workflow,
       status: followUpLegStatus(run.conclusion),
-      ...run.conclusion === "failure" ? { error: run.workflow === "jerv-gateway" ? result.dispatch : `${run.workflow} reported failure` } : {}
+      ...run.conclusion === "failure" ? { error: run.workflow === "jerv-gateway" ? result.dispatch : run.runUrlNote ?? `${run.workflow} reported failure` } : {}
     })));
   } else if (result.deployStatus && result.deployStatus !== "success") {
     legs.push({
@@ -63793,9 +63653,9 @@ function formatExplainCommand(cmd, rootName) {
   return lines2.join("\n").trimEnd();
 }
 function formatExplainGroup(cmd, rootName) {
-  const canonical2 = (node) => node.path;
+  const canonical = (node) => node.path;
   const lines2 = [
-    `${rootName} ${canonical2(cmd)}${cmd.description ? ` \u2014 ${cmd.description}` : ""}`,
+    `${rootName} ${canonical(cmd)}${cmd.description ? ` \u2014 ${cmd.description}` : ""}`,
     `Category: ${cmd.category} \xB7 Discovery: ${cmd.discovery}`,
     ""
   ];
@@ -63806,7 +63666,7 @@ function formatExplainGroup(cmd, rootName) {
       const name = arg.variadic ? `${arg.name}...` : arg.name;
       return arg.required ? `<${name}>` : `[${name}]`;
     }).join(" ");
-    lines2.push(`  ${canonical2(child2)}${args ? ` ${args}` : ""}${child2.description ? ` \u2014 ${child2.description}` : ""}`);
+    lines2.push(`  ${canonical(child2)}${args ? ` ${args}` : ""}${child2.description ? ` \u2014 ${child2.description}` : ""}`);
   }
   return lines2.join("\n");
 }
@@ -66565,14 +66425,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto20 = require("node:crypto");
+var import_node_crypto19 = require("node:crypto");
 var import_node_fs58 = require("node:fs");
 var import_promises11 = require("node:fs/promises");
 var import_node_path53 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES2 = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto20.createHash)("sha256");
+  const hash = (0, import_node_crypto19.createHash)("sha256");
   for await (const chunk of (0, import_node_fs58.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -67164,13 +67024,13 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process22 = require("node:child_process");
-var import_node_crypto22 = require("node:crypto");
+var import_node_crypto21 = require("node:crypto");
 var import_node_fs61 = require("node:fs");
 var import_node_os26 = require("node:os");
 var import_node_path56 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto21 = require("node:crypto");
+var import_node_crypto20 = require("node:crypto");
 var import_node_fs60 = require("node:fs");
 var import_node_path55 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
@@ -67183,7 +67043,7 @@ function repoPath(root, declaredPath, label) {
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto21.createHash)("sha256");
+  const hash = (0, import_node_crypto20.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs60.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs60.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -67214,7 +67074,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha2562 = (bytes) => `sha256:${(0, import_node_crypto22.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha2562 = (bytes) => `sha256:${(0, import_node_crypto21.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha2562(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha2562(rebuiltBytes) : ABSENT;
@@ -68549,8 +68409,8 @@ function resolveParseHint() {
     const candidates = unknownCommandCandidates(parent, allCommandPaths());
     const tail = unknownCommandTail(process.argv.slice(2), lastUnknownCommand);
     const path3 = lastUnknownCommand ? suggestCommandPath(lastUnknownCommand, candidates, tail) : void 0;
-    const canonical2 = path3 ? canonicalPathFor(path3) ?? path3 : void 0;
-    if (canonical2) return `(did you mean \`mmi-cli ${canonical2}\`? ${DISCOVERY_HINT})`;
+    const canonical = path3 ? canonicalPathFor(path3) ?? path3 : void 0;
+    if (canonical) return `(did you mean \`mmi-cli ${canonical}\`? ${DISCOVERY_HINT})`;
     return parent ? `(${DISCOVERY_HINT})` : STALE_HINT;
   }
   if (lastParseErrorKind !== "bad-arguments") return STALE_HINT;
@@ -68569,10 +68429,10 @@ function positionalCommandEntries(house) {
     if (commandMetadata(node)?.category !== "internal") {
       const args = node.registeredArguments ?? [];
       const path2 = commandPath3(node);
-      const canonical2 = path2 ? canonicalPathFor(path2) ?? path2 : "";
-      if (args[0] && canonical2 && (house === void 0 || houseForPath(canonical2) === house)) {
+      const canonical = path2 ? canonicalPathFor(path2) ?? path2 : "";
+      if (args[0] && canonical && (house === void 0 || houseForPath(canonical) === house)) {
         acc.push({
-          path: canonical2,
+          path: canonical,
           names: [node.name(), ...node.aliases()],
           argName: args[0].name(),
           ownFlags: commandOwnLongFlags(node)
@@ -68587,8 +68447,8 @@ function positionalCommandEntries(house) {
 function excessArgumentCorrection(extra, argv) {
   const invoked = resolveCommandFromArgv(program2, [...argv]);
   if (!invoked || extra.length !== 1) return void 0;
-  const canonical2 = canonicalPathFor(commandPath3(invoked)) ?? commandPath3(invoked);
-  const entries = positionalCommandEntries(houseForPath(canonical2)).filter((e) => e.path !== canonical2);
+  const canonical = canonicalPathFor(commandPath3(invoked)) ?? commandPath3(invoked);
+  const entries = positionalCommandEntries(houseForPath(canonical)).filter((e) => e.path !== canonical);
   const sibling = siblingTakingPositional(invoked.name(), entries);
   return sibling ? correctedPositionalCommand(sibling, extra[0], argv) : void 0;
 }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.230",
+  "version": "4.5.232",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.5.230",
+  "version": "4.5.232",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",