@mutmutco/claude-plugin 4.6.12 → 4.6.13

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.6.12",
+  "version": "4.6.13",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -1674,6 +1674,7 @@ __export(board_write_exports, {
   BoardAttachError: () => BoardAttachError,
   addIssueToProjectViaHub: () => addIssueToProjectViaHub,
   boardAttachHttpError: () => boardAttachHttpError,
+  createBoardIssueViaHub: () => createBoardIssueViaHub,
   writeHubBoardField: () => writeHubBoardField
 });
 async function writeHubBoardField(request) {
@@ -1715,6 +1716,18 @@ function boardAttachHttpError(status, detail) {
   const code = status === 401 ? "hub_session_missing" : status === 403 ? "forbidden" : status === 429 ? "rate_limited" : status >= 500 ? "hub_unavailable" : "refused";
   return new BoardAttachError(code, status, detail);
 }
+async function createBoardIssueViaHub(request) {
+  const config = await loadConfig();
+  const res = await fetch(`${config.sagaApiUrl?.replace(/\/$/, "")}/board/issues`, {
+    method: "POST",
+    headers: await hubHeaders({ "content-type": "application/json" }),
+    body: JSON.stringify(request),
+    signal: AbortSignal.timeout(25e3)
+  });
+  const body = await res.json().catch(() => null);
+  if (!res.ok || !body?.number || !body.url) throw new Error(`board issue create HTTP ${res.status}: ${body?.error ?? "unconfirmed result"}`);
+  return { number: body.number, url: body.url, projectItemId: body.projectItemId, onBoard: Boolean(body.onBoard) };
+}
 var BOARD_ATTACH_HINTS, BoardAttachError;
 var init_board_write = __esm({
   "src/board-write.ts"() {
@@ -1723,7 +1736,7 @@ var init_board_write = __esm({
     BOARD_ATTACH_HINTS = {
       // #8965: honest, not a promise — attach did NOT run. App automation never has a Hub session by design.
       hub_session_missing: "No Hub session (an App installation token cannot open one). Hub adds new issues in registered repos to their board automatically when they are opened; check membership with `mmi-cli oracle board show <n> --repo <owner/repo>`. A human login or MMI_HUB_TOKEN (Actions /auth/session-ci) is needed only to attach older or transferred issues.",
-      forbidden: "the Hub denied this login: attach needs org-owner or repo-admin authority on <owner/repo>",
+      forbidden: "the Hub denied this login: attach needs org-owner, repo-admin or verified repository write authority on <owner/repo>",
       hub_unavailable: "the Hub or GitHub failed transiently; the add is idempotent, so rerun `mmi-cli oracle board attach <issue>`",
       rate_limited: "GitHub quota is exhausted; rerun `mmi-cli oracle board attach <issue>` after the reset",
       refused: "the Hub refused this attach; check the board registration for <owner/repo>"
@@ -27010,6 +27023,24 @@ async function reconcileOrgNoAgentFilesRuleset(plan, client, org = ORG_LOGIN) {
   };
 }
 
+// src/registry-repositories.ts
+function qualifyRegistryRepo(raw) {
+  return raw.includes("/") ? raw : `mutmutco/${raw}`;
+}
+function registryRepoKey(repo) {
+  return repo.toLowerCase();
+}
+function repoProjectClaim(project2, repoKey) {
+  if (!project2) return 0;
+  const slug = typeof project2.slug === "string" ? project2.slug.toLowerCase() : void 0;
+  if (slug !== void 0 && slug === repoKey.split("/")[1]) return 3;
+  if (project2.projectType !== "hub-service") return 2;
+  return 1;
+}
+function preferPrimaryRepoProject(current, candidate, repoKey) {
+  return repoProjectClaim(candidate, repoKey) > repoProjectClaim(current, repoKey) ? candidate : current;
+}
+
 // src/safe-json.ts
 function safeJson(text, fallback) {
   try {
@@ -27291,17 +27322,23 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess, sanctioned
 }
 function loadAccessTargets(projectsJson) {
   const projects = safeJson(projectsJson, {}).projects ?? [];
-  const seen = /* @__PURE__ */ new Set();
-  const targets = [];
+  const byRepo = /* @__PURE__ */ new Map();
   for (const project2 of projects) {
     for (const repo of project2.repos ?? []) {
-      if (seen.has(repo)) continue;
-      seen.add(repo);
-      const cls = project2.class === "content" || project2.deployModel === "content" ? "content" : "deployable";
-      const releaseTrack = cls === "content" ? "trunk" : resolveReleaseTrack(project2, void 0, repo);
-      targets.push({ repo, class: cls, releaseTrack });
+      const key = repo.toLowerCase();
+      const existing = byRepo.get(key);
+      byRepo.set(key, {
+        repo: existing?.repo ?? repo,
+        project: preferPrimaryRepoProject(existing?.project, project2, key)
+      });
     }
   }
+  const targets = [];
+  for (const { repo, project: project2 } of byRepo.values()) {
+    const cls = project2.class === "content" || project2.deployModel === "content" ? "content" : "deployable";
+    const releaseTrack = cls === "content" ? "trunk" : resolveReleaseTrack(project2, void 0, repo);
+    targets.push({ repo, class: cls, releaseTrack });
+  }
   return targets;
 }
 function resolveOrgAuditTargets(registryProjects) {
@@ -27665,10 +27702,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.12",
-    tag: "v4.6.12",
-    commit: "9d7baf6ad8c7",
-    npm: "@mutmutco/cli@4.6.12"
+    version: "4.6.13",
+    tag: "v4.6.13",
+    commit: "70ee5f41b61b",
+    npm: "@mutmutco/cli@4.6.13"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27685,14 +27722,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.12"
+          v3Target: "v4.6.13"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.12 and redeploy the Hub Lambda from tag v4.6.12 (9d7baf6ad8c7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.12 (@mutmutco/cli@4.6.12, tag commit 9d7baf6ad8c7 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.13 and redeploy the Hub Lambda from tag v4.6.13 (70ee5f41b61b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.13 (@mutmutco/cli@4.6.13, tag commit 70ee5f41b61b \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -27923,7 +27960,10 @@ function buildOrgVersionsReport(projects, probes, generatedAt) {
         name: String(project2.name ?? project2.slug ?? "?")
       });
     }
-    for (const repo of repos2) projectByRepo.set(repo.trim().toLowerCase(), projectByRepo.get(repo.trim().toLowerCase()) ?? project2);
+    for (const repo of repos2) {
+      const key = repo.trim().toLowerCase();
+      projectByRepo.set(key, preferPrimaryRepoProject(projectByRepo.get(key), project2, key));
+    }
   }
   const repos = orgVersionRepos(projects).map((repo) => {
     const project2 = projectByRepo.get(repo.toLowerCase());
@@ -28942,7 +28982,7 @@ function buildFleetTrackInventory(projects, releaseProbes, pluginProbes, generat
     }
     for (const repo of repos2) {
       const key = repo.trim().toLowerCase();
-      projectByRepo.set(key, projectByRepo.get(key) ?? project2);
+      projectByRepo.set(key, preferPrimaryRepoProject(projectByRepo.get(key), project2, key));
     }
   }
   const repos = orgVersionRepos(projects).map((repo) => {
@@ -29030,15 +29070,16 @@ function defaultFleetTrackInventoryDeps(consistent = false) {
 async function readFleetTrackInventory(deps = defaultFleetTrackInventoryDeps()) {
   const projects = await deps.projects();
   const repos = orgVersionRepos(projects);
-  const branchByRepo = /* @__PURE__ */ new Map();
+  const projectByRepo = /* @__PURE__ */ new Map();
   for (const project2 of projects) {
     for (const repo of (project2.repos ?? []).filter(validRepo2)) {
       const key = repo.trim().toLowerCase();
-      if (!branchByRepo.has(key)) {
-        branchByRepo.set(key, typeof project2.branch === "string" ? project2.branch : void 0);
-      }
+      projectByRepo.set(key, preferPrimaryRepoProject(projectByRepo.get(key), project2, key));
     }
   }
+  const branchByRepo = new Map(
+    [...projectByRepo].map(([key, project2]) => [key, typeof project2.branch === "string" ? project2.branch : void 0])
+  );
   const [releaseProbes, pluginProbes, onboardingProbes] = await Promise.all([
     mapBounded2(repos, 6, (repo) => readOrgVersionProbe(deps.query, repo)),
     mapBounded2(repos, 6, (repo) => readFleetPluginProbe(deps.query, repo, branchByRepo.get(repo.toLowerCase()))),
@@ -39110,14 +39151,6 @@ function renderPinDiffs(tick) {
   return tick.diffs.map((d) => [`${d.repo}:`, ...d.files.flatMap((f) => f.changes.map((c) => `  ${f.path}:${c.line} ${c.action} ${c.from === "development" ? "@development" : c.from.slice(0, 12)} -> ${c.to.slice(0, 12)}`))].join("\n")).join("\n");
 }
 
-// src/registry-repositories.ts
-function qualifyRegistryRepo(raw) {
-  return raw.includes("/") ? raw : `mutmutco/${raw}`;
-}
-function registryRepoKey(repo) {
-  return repo.toLowerCase();
-}
-
 // src/ci-audit.ts
 var import_yaml2 = __toESM(require_dist(), 1);
 var HUB_REPO5 = "mutmutco/MMI-Hub";
@@ -39426,6 +39459,11 @@ function rulesetStatusChecks(rulesets) {
 function sortedUnique(values) {
   return [...new Set(values)].sort((a, b) => a.localeCompare(b));
 }
+function isGitHub404(e) {
+  const err = e;
+  if (err?.status === 404) return true;
+  return /\b404\b|\bnot found\b/i.test(String(err?.message ?? ""));
+}
 async function restJson2(deps, path2, fallback) {
   try {
     return await deps.client.rest("GET", path2) ?? fallback;
@@ -39795,7 +39833,23 @@ async function auditRepoCi(repo, callerDeps) {
   const registryRequiredChecks = meta?.requiredChecks;
   const explicitNoCi = registryCi === "none" || registryRequiredChecks === null || Array.isArray(registryRequiredChecks) && registryRequiredChecks.length === 0;
   const deployableGated = repoClass === "deployable" && !explicitNoCi;
-  const info = await restJson2(deps, `repos/${repo}`, {});
+  let info;
+  try {
+    info = await deps.client.rest("GET", `repos/${repo}`) ?? {};
+  } catch (e) {
+    if (isGitHub404(e)) {
+      return {
+        repo,
+        class: repoClass,
+        mergePolicy: "wait-for-checks",
+        ok: false,
+        checks: [],
+        explicitNoCi,
+        excludedReason: "GitHub repository returned 404 (not found)"
+      };
+    }
+    info = {};
+  }
   if (info.archived === true) {
     return {
       repo,
@@ -41876,8 +41930,9 @@ async function runPrLandOnce(prNumber, options, deps) {
     if (!verdict.ok) {
       return { ...base, error: `train authority unavailable: ${verdict.error}` };
     }
-    base.train = { role: verdict.authority.role, train: verdict.authority.train };
-    if (!verdict.authority.train) {
+    base.train = { role: verdict.authority.role, train: verdict.authority.train, ...verdict.authority.developmentMerge !== void 0 ? { developmentMerge: verdict.authority.developmentMerge } : {} };
+    const canMerge = verdict.authority.train || resolved.base === "development" && verdict.authority.developmentMerge === true;
+    if (!canMerge) {
       return {
         ...base,
         error: `@${verdict.authority.login ?? "caller"} is ${verdict.authority.role} \u2014 train not authorized on ${repo}; cannot land PR`
@@ -48676,7 +48731,11 @@ async function propagationScope(classes, what) {
   } catch (e) {
     return fail(e.message);
   }
-  const bySlugMeta = new Map(projects.flatMap((p) => (p.repos ?? []).map((r) => [(r.includes("/") ? r : `mutmutco/${r}`).toLowerCase(), p])));
+  const bySlugMeta = /* @__PURE__ */ new Map();
+  for (const p of projects) for (const r of p.repos ?? []) {
+    const key = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
+    bySlugMeta.set(key, preferPrimaryRepoProject(bySlugMeta.get(key), p, key));
+  }
   const classOf = (repo) => bySlugMeta.get(repo.toLowerCase())?.class ?? "deployable";
   const seedClasses = classes ?? [...new Set(rosterRepos.map(classOf))];
   const inClassRepos = rosterRepos.filter((repo) => seedClasses.includes(classOf(repo)));
@@ -48889,13 +48948,12 @@ function registerBootstrapCommands(program3) {
         return failGraceful("bootstrap drift: the registry roster is unreadable or empty \u2014 refusing to report a fleet verdict from a scope this command could not establish (#3808)");
       }
       targets = collectRegistryRepos(projects);
-      const byRepo = /* @__PURE__ */ new Map();
       const metaByRepo = /* @__PURE__ */ new Map();
       for (const p of projects) for (const r of p.repos ?? []) {
         const key = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
-        byRepo.set(key, p.class ?? "deployable");
-        metaByRepo.set(key, p);
+        metaByRepo.set(key, preferPrimaryRepoProject(metaByRepo.get(key), p, key));
       }
+      const byRepo = new Map([...metaByRepo].map(([key, p]) => [key, p.class ?? "deployable"]));
       classOf = (repo) => byRepo.get(repo.toLowerCase()) ?? "deployable";
       metaOf = (repo) => metaByRepo.get(repo.toLowerCase()) ?? null;
     }
@@ -55094,6 +55152,9 @@ async function openSuitePinPr(deps, input) {
   }
 }
 
+// src/command-register-collaboration.ts
+init_board_write();
+
 // src/pr-title-check.ts
 var CONVENTIONAL_PR_TITLE = /^(feat|fix|docs|chore|refactor|perf|test|build|ci|revert|style)(\([^)]+\))?!?: .+/;
 var EXEMPT_PR_TITLE = /^Merge pull request /;
@@ -59500,8 +59561,25 @@ function registerCollaborationCommands(program3) {
       }
       if (refusal && !surfaceWaived()) return fail(refusal.message, refusal.payload);
     }
-    await ensureLabelsExist(extraLabels, targetRepo2);
-    const created = await ghCreate(args);
+    let created;
+    try {
+      await ensureLabelsExist(extraLabels, targetRepo2);
+      created = await ghCreate(args);
+    } catch (error) {
+      if (o.parent !== void 0 || !/Could not resolve to a Repository|HTTP 404|Not Found/i.test(error.message)) throw error;
+      const filed = await createBoardIssueViaHub({ repo: targetRepo2, title, body, type: issueType, priority, labels: extraLabels });
+      const nextStep = filed.onBoard ? void 0 : `mmi-cli oracle board attach ${targetRepo2}#${filed.number}`;
+      console.log(JSON.stringify({
+        status: filed.onBoard ? "created" : "partial",
+        ...filed,
+        label: issueType,
+        priority,
+        credential: "app",
+        ...nextStep ? { boardAttach: "failed", nextStep, nextSteps: [nextStep] } : {},
+        ...surfaceInferred ? { surface_inferred: true, surface: surfaceInferred.label, surface_reason: surfaceInferred.reason } : {}
+      }));
+      return;
+    }
     if (isGhCreateRateLimited(created)) {
       console.log(JSON.stringify(created));
       process.exitCode = 1;

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.12",
+  "version": "4.6.13",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.6.12",
+  "version": "4.6.13",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/org-guide/references/work-and-releases.md

@@ -4,6 +4,10 @@ GitHub repository admins hold project-admin authority on their own projects with
 registry enrollment. Registry-listed admins with repository write access remain supported.
 Use `mmi-cli oracle org access role <owner/repo> --json` to verify authority for release,
 candidate, hotfix, and runtime operations. Organization membership role alone is not this check.
+Verified repository writers (GitHub write, maintain or admin) may land PRs targeting `development`
+on non-Hub repositories. `/train-authority` reports this separately as `developmentMerge`;
+it does not grant release, candidate, hotfix or runtime train authority. MMI-Hub development
+merges remain master-only.
 The Hub distribution train remains organization-master-only. It runs in the `hub-release` workflow on
 our self-hosted runners, dispatched by an org owner, never on a workstation (#9137).
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is