@mutmutco/claude-plugin 4.6.34 → 4.6.36

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.6.34",
+  "version": "4.6.36",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -15366,13 +15366,6 @@ async function fetchHubBoardSnapshot(request, deps) {
 // src/board-read.ts
 init_github_quota();
 
-// src/claim-marker-client.ts
-init_github_client();
-init_github_quota();
-
-// src/pr-checks-rest.ts
-init_cli_shared();
-
 // ../shared/github-quota-scope.ts
 var import_node_crypto4 = require("node:crypto");
 function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
@@ -15497,6 +15490,7 @@ var APP_WRITE_COMMANDS = /* @__PURE__ */ new Map([
   ["run cancel", { metadata: "read", actions: "write" }],
   // #9587: one named run rerun (all or failed jobs) — same actions:write profile, nothing broader.
   ["run rerun", { metadata: "read", actions: "write" }],
+  ["run dispatch", { metadata: "read", actions: "write" }],
   // #9780: repository Actions variables — get/list mint only Variables:read; create/update/delete
   // Variables:write. Repository scope only; no secret store, no rename, no workflow dispatch.
   // #9790: the token key is `actions_variables` (as ci-reconcile.yml mints); `variables` was refused 422.
@@ -15736,6 +15730,13 @@ async function activateAppActor(commandPath4, env, mint, note = (line) => proces
   return "app";
 }
 
+// src/claim-marker-client.ts
+init_github_client();
+init_github_quota();
+
+// src/pr-checks-rest.ts
+init_cli_shared();
+
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
   if (input.registryCi === "none") {
@@ -17173,9 +17174,11 @@ async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
 // src/claim-marker-client.ts
 var claimWriteTokenProvider;
 var claimWriteTokenOnce;
+var notedPersonalClaimWrite = false;
 function setClaimWriteTokenProvider(provider) {
   claimWriteTokenProvider = provider;
   claimWriteTokenOnce = void 0;
+  notedPersonalClaimWrite = false;
 }
 async function selectClaimWriteClient(client, appClient) {
   if (appClient) return appClient;
@@ -17186,15 +17189,26 @@ async function selectClaimWriteClient(client, appClient) {
     token = await claimWriteTokenOnce;
   } catch (e) {
     claimWriteTokenOnce = void 0;
+    if (e instanceof AppActorError && e.code === "vault-denied" && process.env.MMI_ACTOR?.trim() !== "app") return personalClaimWrite(client);
     const detail = e instanceof Error ? e.message : String(e);
     throw new Error(`${detail} \u2014 refusing personal-token fallback for claim write (#9511)`);
   }
   if (!token) {
     claimWriteTokenOnce = void 0;
-    throw new Error("app actor: claim write token unavailable \u2014 refusing personal-token fallback for claim write (#9511)");
+    if (process.env.MMI_ACTOR?.trim() === "app") {
+      throw new Error("app actor: claim write token unavailable \u2014 refusing personal-token fallback for claim write (#9511)");
+    }
+    return personalClaimWrite(client);
   }
   return createGitHubClient({ token: async () => token });
 }
+function personalClaimWrite(client) {
+  if (!notedPersonalClaimWrite) {
+    notedPersonalClaimWrite = true;
+    process.stderr.write("note: no App route on this host (no MMI-Hub vault access) \u2014 claim writes go as your own GitHub login\n");
+  }
+  return client;
+}
 async function selectLivenessClient(client, appClient) {
   if (appClient) return appClient;
   let token;
@@ -22744,6 +22758,7 @@ mutation($projectId: ID!, $itemId: ID!) {
     item { id }
   }
 }`;
+var BOARD_WRITE_REFUSAL_TYPES = /* @__PURE__ */ new Set(["INSUFFICIENT_SCOPES", "FORBIDDEN", "NOT_FOUND"]);
 async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
   if (process.env.MMI_ACTOR?.trim() === "app") {
     const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
@@ -22770,10 +22785,14 @@ async function updateItemSingleSelect(client, projectId, itemId, fieldId, option
     return { credential: "user" };
   } catch (error) {
     const errors = error.graphqlErrors;
-    if (errors?.length && errors.every((entry) => entry.type === "INSUFFICIENT_SCOPES")) {
+    if (errors?.length && errors.every((entry) => entry.type !== void 0 && BOARD_WRITE_REFUSAL_TYPES.has(entry.type))) {
       const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
-      await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
-      return { credential: "app_installation" };
+      try {
+        await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
+        return { credential: "app_installation" };
+      } catch {
+        throw error;
+      }
     }
     if (isGitHubRateLimitError(error)) {
       const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
@@ -28366,10 +28385,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.34",
-    tag: "v4.6.34",
-    commit: "a094b40adf8d",
-    npm: "@mutmutco/cli@4.6.34"
+    version: "4.6.36",
+    tag: "v4.6.36",
+    commit: "d1c15e58d6e5",
+    npm: "@mutmutco/cli@4.6.36"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28386,14 +28405,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.34"
+          v3Target: "v4.6.36"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.34 and redeploy the Hub Lambda from tag v4.6.34 (a094b40adf8d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.34 (@mutmutco/cli@4.6.34, tag commit a094b40adf8d \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.36 and redeploy the Hub Lambda from tag v4.6.36 (d1c15e58d6e5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.36 (@mutmutco/cli@4.6.36, tag commit d1c15e58d6e5 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -30698,6 +30717,8 @@ var CORRELATE_ATTEMPTS = 5;
 var CORRELATE_DELAY_MS = 1500;
 var CORRELATE_SKEW_SLACK_MS = 1e4;
 var CORRELATE_PAGE_LIMIT = 50;
+var GET_PUBLISH_CORRELATE_ATTEMPTS = 12;
+var GET_PUBLISH_CORRELATE_DELAY_MS = 2500;
 var RUN_CONFIRM_ATTEMPTS = 3;
 var RUN_CONFIRM_DELAY_MS = 1e3;
 var defaultSleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
@@ -30744,11 +30765,13 @@ async function correlateRun(deps, args) {
   const sleep2 = resolveSleep(deps);
   const threshold = args.since - CORRELATE_SKEW_SLACK_MS;
   const repo = args.mode === "workflow" ? args.repo ?? HUB_REPO2 : HUB_REPO2;
+  const attempts = args.mode === "dispatch" ? args.attempts ?? CORRELATE_ATTEMPTS : CORRELATE_ATTEMPTS;
+  const delayMs = args.mode === "dispatch" ? args.delayMs ?? CORRELATE_DELAY_MS : CORRELATE_DELAY_MS;
   let lastError;
   let parsedAnyResponse = false;
   let truncatedWindow = false;
-  for (let attempt = 0; attempt < CORRELATE_ATTEMPTS; attempt++) {
-    if (attempt > 0) await sleep2(CORRELATE_DELAY_MS);
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    if (attempt > 0) await sleep2(delayMs);
     const listArgs = [
       "run",
       "list",
@@ -30791,7 +30814,7 @@ async function correlateRun(deps, args) {
   if (!parsedAnyResponse) {
     return {
       read: "failed",
-      error: `\`gh run list --workflow ${args.workflow} --repo ${repo}\` failed on all ${CORRELATE_ATTEMPTS} attempts${lastError ? ` (${describeReadError(lastError)})` : ""}`
+      error: `\`gh run list --workflow ${args.workflow} --repo ${repo}\` failed on all ${attempts} attempts${lastError ? ` (${describeReadError(lastError)})` : ""}`
     };
   }
   if (truncatedWindow) {
@@ -30806,7 +30829,7 @@ function correlateTenantRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-deploy.yml", since, mode: "dispatch", titleIncludes });
 }
 function correlateGetPublishRun(deps, since, product, mode) {
-  return correlateRun(deps, { workflow: "get-publish.yml", since, mode: "dispatch", titleIncludes: [product, ...mode ? [mode] : []], ...mode ? { requireTitleMatch: true } : {} });
+  return correlateRun(deps, { workflow: "get-publish.yml", since, mode: "dispatch", titleIncludes: [product, ...mode ? [mode] : []], ...mode ? { requireTitleMatch: true } : {}, attempts: GET_PUBLISH_CORRELATE_ATTEMPTS, delayMs: GET_PUBLISH_CORRELATE_DELAY_MS });
 }
 function correlateControlRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes, titleFieldsFrom: 2, ...titleIncludes?.length ? { requireTitleMatch: true } : {} });
@@ -31937,7 +31960,7 @@ async function fetchServedChannelVersion(url, fetchImpl = fetch) {
     return { ok: false, error: e instanceof Error ? e.message : String(e) };
   }
 }
-async function findPriorGreenDispatch(deps, repo, workflow, sha, titleTokens) {
+async function findPriorGreenDispatch(deps, repo, workflow, sha, titleTokens, opts = {}) {
   if (!/^[0-9a-f]{40}$/i.test(sha)) return void 0;
   try {
     const rows = JSON.parse(await deps.run("gh", [
@@ -31956,12 +31979,18 @@ async function findPriorGreenDispatch(deps, repo, workflow, sha, titleTokens) {
       "--json",
       "databaseId,url,status,conclusion,displayTitle,headSha"
     ]));
-    const hit = rows.find((r) => typeof r.databaseId === "number" && r.headSha?.toLowerCase() === sha.toLowerCase() && r.status === "completed" && r.conclusion === "success" && titleTokens.every((t) => (r.displayTitle ?? "").split(/[^\w.-]+/).includes(t)));
-    return hit ? { runId: hit.databaseId, ...hit.url ? { runUrl: hit.url } : {} } : void 0;
+    const titleMatch = (r) => titleTokens.every((t) => (r.displayTitle ?? "").split(/[^\w.-]+/).includes(t));
+    const atSha = (r) => r.headSha?.toLowerCase() === sha.toLowerCase();
+    const hit = rows.find((r) => typeof r.databaseId === "number" && atSha(r) && r.status === "completed" && r.conclusion === "success" && titleMatch(r));
+    if (hit) return { runId: hit.databaseId, ...hit.url ? { runUrl: hit.url } : {} };
+    if (!opts.includeActive) return void 0;
+    const active = rows.find((r) => typeof r.databaseId === "number" && atSha(r) && PRIOR_DISPATCH_ACTIVE_STATUSES.has(r.status ?? "") && titleMatch(r));
+    return active ? { runId: active.databaseId, ...active.url ? { runUrl: active.url } : {}, active: true } : void 0;
   } catch {
     return void 0;
   }
 }
+var PRIOR_DISPATCH_ACTIVE_STATUSES = /* @__PURE__ */ new Set(["in_progress", "queued", "waiting", "requested", "pending"]);
 function planeFailureRow(workflow, evidence) {
   return { workflow, runUrlNote: evidence, conclusion: "failure" };
 }
@@ -32040,10 +32069,13 @@ async function appendMmiGetRedeploy(deps, input, dispatch) {
 async function appendServedChannelStage(deps, input, dispatch) {
   if (!isHubControlRepo(input.repo)) return dispatch;
   const remedy = `${getPublishDispatchCommand(input.repo)} -f mode=stage`;
-  const prior = await findPriorGreenDispatch(deps, input.repo, "get-publish.yml", input.releaseSha, [HUB_SERVED_PRODUCT, "stage"]);
+  const prior = await findPriorGreenDispatch(deps, input.repo, "get-publish.yml", input.releaseSha, [HUB_SERVED_PRODUCT, "stage"], { includeActive: true });
   let row;
-  if (prior) {
+  if (prior && !prior.active) {
     row = { workflow: "get-publish.yml", runId: prior.runId, ...prior.runUrl ? { runUrl: prior.runUrl } : {}, conclusion: "success" };
+  } else if (prior?.active) {
+    row = { workflow: "get-publish.yml", runId: prior.runId, ...prior.runUrl ? { runUrl: prior.runUrl } : {}, conclusion: "pending" };
+    if (input.watch) row.conclusion = await watchTenantRun(deps, prior.runId, input.repo);
   } else {
     const since = (deps.now ?? Date.now)();
     try {
@@ -32058,7 +32090,7 @@ async function appendServedChannelStage(deps, input, dispatch) {
       };
     }
     const correlated = await correlateGetPublishRun(deps, since, HUB_SERVED_PRODUCT, "stage");
-    if (correlated.read !== "found") {
+    if (correlated.read === "failed") {
       return {
         ...dispatch,
         note: `${dispatch.note}; get-publish stage dispatched but its run could not be READ \u2014 check Actions; recover with \`${remedy}\``,
@@ -32066,6 +32098,14 @@ async function appendServedChannelStage(deps, input, dispatch) {
         workflowRuns: [...dispatch.workflowRuns ?? [], planeFailureRow("get-publish.yml", "stage dispatched, but its run could not be read")]
       };
     }
+    if (correlated.read === "absent") {
+      const dispatchedAt = new Date(since).toISOString();
+      return {
+        ...dispatch,
+        note: `${dispatch.note}; get-publish stage dispatched at ${dispatchedAt} but its run is not listed yet \u2014 recorded PENDING; \`devops release --resume\` re-correlates it by title and time`,
+        workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "get-publish.yml", runUrlNote: `stage dispatched ${dispatchedAt}; run not listed within the correlation window`, conclusion: "pending", dispatchedAt, titleTokens: [HUB_SERVED_PRODUCT, "stage"] }]
+      };
+    }
     row = { workflow: "get-publish.yml", runId: correlated.runId, ...correlated.runUrl ? { runUrl: correlated.runUrl } : {}, conclusion: "pending" };
     if (input.watch) row.conclusion = await watchTenantRun(deps, correlated.runId, input.repo);
   }
@@ -32090,12 +32130,15 @@ async function appendServedChannelPublish(deps, input, dispatch, redeployed) {
   if (input.publishStatus !== "success") {
     return withNote(`served channel NOT moved (publish did not succeed) \u2014 after the publish is green, run \`${remedy}\``);
   }
-  const prior = input.releaseSha ? await findPriorGreenDispatch(deps, input.repo, "get-publish.yml", input.releaseSha, [HUB_SERVED_PRODUCT, "pointer"]) : void 0;
+  const prior = input.releaseSha ? await findPriorGreenDispatch(deps, input.repo, "get-publish.yml", input.releaseSha, [HUB_SERVED_PRODUCT, "pointer"], { includeActive: true }) : void 0;
   let runRow;
   let runStatus;
-  if (prior) {
+  if (prior && !prior.active) {
     runRow = { workflow: "get-publish.yml", runId: prior.runId, ...prior.runUrl ? { runUrl: prior.runUrl } : {} };
     runStatus = "success";
+  } else if (prior?.active) {
+    runRow = { workflow: "get-publish.yml", runId: prior.runId, ...prior.runUrl ? { runUrl: prior.runUrl } : {} };
+    runStatus = input.watch ? await watchTenantRun(deps, prior.runId, input.repo) : "pending";
   } else {
     const version = input.tag?.replace(/^v/, "") ?? (deps.readLauncherVersion ?? readLocalLauncherVersion)();
     if (!version) return withNote("the local launcher version could not be read \u2014 nothing was compared, so the move is unverified");
@@ -32107,9 +32150,17 @@ async function appendServedChannelPublish(deps, input, dispatch, redeployed) {
       return withNote(`get-publish dispatch FAILED: ${msg}. The release itself landed, but the SERVED CHANNEL IS UNCHANGED \u2014 recover with \`${pointerRemedy}\``, "failure", planeFailureRow("get-publish.yml", `dispatch refused: ${msg}`));
     }
     const correlated = await correlateGetPublishRun(deps, since, HUB_SERVED_PRODUCT, "pointer");
-    if (correlated.read !== "found") {
+    if (correlated.read === "failed") {
       return withNote(`get-publish dispatched but its run could not be READ: ${correlated.error ?? "no matching run appeared"}. Check the Actions tab; if it never ran, recover with \`${pointerRemedy}\``, "failure", planeFailureRow("get-publish.yml", `dispatched, but its run could not be read`));
     }
+    if (correlated.read === "absent") {
+      const dispatchedAt = new Date(since).toISOString();
+      return {
+        ...dispatch,
+        note: `${dispatch.note}; get-publish pointer dispatched at ${dispatchedAt} but its run is not listed yet \u2014 recorded PENDING; \`devops release --resume\` re-correlates it by title and time`,
+        workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "get-publish.yml", runUrlNote: `pointer dispatched ${dispatchedAt}; run not listed within the correlation window`, conclusion: "pending", dispatchedAt, titleTokens: [HUB_SERVED_PRODUCT, "pointer"] }]
+      };
+    }
     const { runId, runUrl } = correlated;
     runRow = { workflow: "get-publish.yml", ...runId ? { runId } : {}, ...runUrl ? { runUrl } : {} };
     if (!input.watch) {
@@ -32121,7 +32172,7 @@ async function appendServedChannelPublish(deps, input, dispatch, redeployed) {
     }
     runStatus = await watchTenantRun(deps, runId, input.repo);
   }
-  if (runStatus !== "success") {
+  if (runStatus === "failure") {
     return {
       ...dispatch,
       note: `${dispatch.note}; get-publish.yml ${runStatus} \u2014 the SERVED CHANNEL IS UNCHANGED; recover with \`${pointerRemedy}\``,
@@ -32129,6 +32180,13 @@ async function appendServedChannelPublish(deps, input, dispatch, redeployed) {
       deployStatus: "failure"
     };
   }
+  if (runStatus === "pending") {
+    return {
+      ...dispatch,
+      note: `${dispatch.note}; get-publish.yml pointer run is still unverified (pending) \u2014 the served channel move is not yet proven; \`devops release --resume\` re-reads it`,
+      workflowRuns: [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: "pending" }]
+    };
+  }
   const expected = input.tag ? input.tag.replace(/^v/, "") : (deps.readLauncherVersion ?? readLocalLauncherVersion)();
   const runs2 = [...dispatch.workflowRuns ?? [], { ...runRow, conclusion: "success" }];
   if (!channelUrl) {
@@ -32269,6 +32327,14 @@ async function appendInstallHomePublish(deps, input, dispatch) {
       deployStatus: "failure"
     };
   }
+  if (correlated.read === "absent") {
+    const dispatchedAt = new Date(since).toISOString();
+    return {
+      ...dispatch,
+      note: note(`installer home publish for ${product} dispatched at ${dispatchedAt} but its run is not listed yet \u2014 recorded PENDING; \`devops release --resume\` re-correlates it by title and time`),
+      workflowRuns: [...dispatch.workflowRuns ?? [], { workflow: "get-publish.yml", runUrlNote: `installer home (${product}) dispatched ${dispatchedAt}; run not listed within the correlation window`, conclusion: "pending", dispatchedAt, titleTokens: [product] }]
+    };
+  }
   const row = { workflow: "get-publish.yml", ...correlated.runId ? { runId: correlated.runId } : {}, ...correlated.runUrl ? { runUrl: correlated.runUrl } : {} };
   if (!input.watch) {
     return {
@@ -32278,7 +32344,7 @@ async function appendInstallHomePublish(deps, input, dispatch) {
     };
   }
   const status = await watchTenantRun(deps, correlated.runId, HUB_REPO2);
-  if (status !== "success") {
+  if (status === "failure") {
     return {
       ...dispatch,
       note: note(`get-publish.yml (product=${product}) ${status} \u2014 the INSTALLER HOME IS UNCHANGED; recover with \`${remedy}\``),
@@ -32286,6 +32352,13 @@ async function appendInstallHomePublish(deps, input, dispatch) {
       deployStatus: "failure"
     };
   }
+  if (status === "pending") {
+    return {
+      ...dispatch,
+      note: note(`get-publish.yml (product=${product}) run is still unverified (pending) \u2014 the installer home is not yet proven published; \`devops release --resume\` re-reads it`),
+      workflowRuns: [...dispatch.workflowRuns ?? [], { ...row, conclusion: "pending" }]
+    };
+  }
   return {
     ...dispatch,
     note: note(`installer home published for ${product} (get-publish.yml green)`),
@@ -32324,8 +32397,10 @@ async function appendServedChannelLegs(deps, input, dispatch) {
     ]);
     return mergeServedLegs(dispatch, home2, proof2);
   }
-  const stageGreen = (prepared.workflowRuns ?? []).filter((r) => r.workflow === "get-publish.yml").every((r) => r.conclusion === "success");
-  const channel = stageGreen || !isHubControlRepo(input.repo) || publishStatus !== "success" ? await appendServedChannelPublish(deps, { repo: input.repo, publishStatus, watch: input.watch, releaseSha: input.releaseSha, tag: input.tag }, dispatch, Promise.resolve(prepared)) : { ...dispatch, note: `${dispatch.note}; served channel NOT moved (stage not green) \u2014 recover with \`${getPublishDispatchCommand(input.repo)} -f mode=stage\`, then \`${getPublishDispatchCommand(input.repo)} -f mode=pointer -f version=${input.tag.replace(/^v/, "")}\`` };
+  const stageRows = (prepared.workflowRuns ?? []).filter((r) => r.workflow === "get-publish.yml");
+  const stageGreen = stageRows.every((r) => r.conclusion === "success");
+  const stagePending = !stageGreen && stageRows.every((r) => r.conclusion !== "failure");
+  const channel = stageGreen || !isHubControlRepo(input.repo) || publishStatus !== "success" ? await appendServedChannelPublish(deps, { repo: input.repo, publishStatus, watch: input.watch, releaseSha: input.releaseSha, tag: input.tag }, dispatch, Promise.resolve(prepared)) : { ...dispatch, note: `${dispatch.note}; served channel NOT moved (stage ${stagePending ? "still pending \u2014 `devops release --resume` re-correlates the stage run and moves the pointer" : "not green"}) \u2014 recover with \`${getPublishDispatchCommand(input.repo)} -f mode=stage\`, then \`${getPublishDispatchCommand(input.repo)} -f mode=pointer -f version=${input.tag.replace(/^v/, "")}\`` };
   const out = mergeServedLegs(dispatch, {
     ...dispatch,
     note: dispatch.note + prepared.note,
@@ -44822,6 +44897,56 @@ function registerRunRerun(run, writeToken, projects) {
   });
 }
 
+// src/run-dispatch.ts
+init_cli_shared();
+async function dispatchWorkflow(repo, workflow, ref, inputs, deps) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) throw new Error("run dispatch: invalid repository");
+  if (!/^[A-Za-z0-9_.-]+\.ya?ml$/.test(workflow)) throw new Error("run dispatch: workflow must be a YAML filename");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$/.test(ref) || ref.includes("..") || ref.includes("//") || ref.endsWith("/")) throw new Error("run dispatch: invalid ref");
+  if (inputs.length > 10) throw new Error("run dispatch: at most 10 inputs");
+  const fields = ["-f", `ref=${ref}`];
+  const names = /* @__PURE__ */ new Set();
+  for (const input of inputs) {
+    const match = /^([A-Za-z_][A-Za-z0-9_]{0,63})=([^\r\n]{0,2048})$/.exec(input);
+    if (!match || names.has(match[1])) throw new Error("run dispatch: invalid or duplicate input");
+    names.add(match[1]);
+    fields.push("-f", `inputs[${match[1]}]=${match[2]}`);
+  }
+  const projects = await deps.projects();
+  if (!projects) throw new Error("run dispatch: registry unavailable; no dispatch attempted");
+  if (!projects.some((p) => (p.repos ?? []).some((r) => typeof r === "string" && registryRepoKey(qualifyRegistryRepo(r)) === registryRepoKey(repo)))) {
+    throw new Error("run dispatch: repository is not registered; no dispatch attempted");
+  }
+  let status;
+  try {
+    status = await deps.post(`repos/${repo}/actions/workflows/${workflow}/dispatches`, fields);
+  } catch {
+    throw new Error("run dispatch: outcome unknown; inspect GitHub before any retry");
+  }
+  if (status !== 204) throw new Error("run dispatch: outcome unknown; inspect GitHub before any retry");
+  return { ok: true, repo, workflow, ref, credential: "app_installation", status: "dispatch-requested", httpStatus: status };
+}
+function appDispatchPost(writeToken, exec3 = execFileP) {
+  return async (path2, fields) => {
+    const token = await writeToken();
+    const { stdout } = await exec3("gh", ["api", "--include", "--method", "POST", path2, ...fields], {
+      timeout: 2e4,
+      env: { ...process.env, GH_TOKEN: token, MMI_GH_POOL: "app" }
+    });
+    return Number(/^HTTP\/[\d.]+ (\d{3})/.exec(stdout)?.[1] ?? 0);
+  };
+}
+function registerRunDispatch(run, writeToken, projects) {
+  run.command("dispatch <workflow>").description("request one workflow dispatch using the org App; an ambiguous result is never retried").requiredOption("--repo <owner/repo>", "registered repository").requiredOption("--ref <ref>", "workflow ref").option("--input <name=value>", "workflow input (repeatable)", (v, values) => [...values, v], []).option("--json", "machine-readable receipt").action(async (workflow, options) => {
+    try {
+      const receipt = await dispatchWorkflow(options.repo, workflow, options.ref, options.input, { projects, post: appDispatchPost(writeToken) });
+      console.log(options.json ? JSON.stringify(receipt) : `run dispatch: requested ${receipt.repo}/${receipt.workflow} at ${receipt.ref}`);
+    } catch (error) {
+      return fail(error.message);
+    }
+  });
+}
+
 // src/devops-vars.ts
 var import_node_crypto13 = require("node:crypto");
 init_github_client();
@@ -46042,6 +46167,15 @@ async function attachOnIntegrationRefusal(detail, cfg, contentNodeId, attach = a
     return { warning: `board attach refused: the gh login is an App installation token without Projects access (${detail}) and the Hub App leg failed (${e.message}). If the Hub reports the same refusal, ${PROJECTS_PERMISSION_HINT}` };
   }
 }
+var ATTACH_AUTHORITY_REFUSAL = /FORBIDDEN|NOT_FOUND|Resource not accessible|missing required scopes|insufficient (?:permissions?|scope)|Could not resolve to a node|does not have (?:access|permission)/i;
+async function attachOnAuthorityRefusal(detail, cfg, contentNodeId, attach = attachViaHubApp) {
+  if (!ATTACH_AUTHORITY_REFUSAL.test(detail)) return void 0;
+  try {
+    return { projectItemId: await attach(cfg, contentNodeId) };
+  } catch (e) {
+    return { warning: `${detail}; the Hub attach also refused (${e.message}) \u2014 attach needs org-owner, repo-admin or repository write authority on the board's repository` };
+  }
+}
 async function issueNodeIdForAttach(repo, number, ghView, client) {
   try {
     return (await ghView()).trim();
@@ -46300,7 +46434,7 @@ function refuseNotClaimable(e, json) {
   process.exitCode = 1;
   return true;
 }
-var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array, and there is no top-level `items` list:\n  {project, viewer, repo, primary, secondary, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET, not the report:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\nAdd --flat with --json for one array across both scopes: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nNever sniff the envelope \u2014 `j.items ?? j.rows ?? j`, `Object.values(j)` or any generic \"find the list\"\nwrapper throws `items is not iterable` before any row is read (#9956). For a number|status|claim|title\nprojection across non-Done rows, read --json --flat --out .jerv/tmp/board.json and filter that array locally:\n  mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n\nA zero-byte or empty .jerv/tmp/*.json means the read FAILED \u2014 `Unexpected end of JSON input` is\nthe symptom of shell-redirected empty stdout, not malformed JSON \u2014 re-run with --out (which writes\nthe file only on success) and check the exit code before parsing.\n\nChanging an existing item's Status is a move, never a hand-written `gh api graphql`\n`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status\nfield-id lookup:\n  mmi-cli oracle board move <status> <ref>\n";
+var BOARD_READ_HELP = "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--direct skips the Hub snapshot and uses the existing direct GitHub GraphQL read immediately.\n--allow-partial applies to the paginated path and detail reads.\n\nWhen using Windows PowerShell 5.1, avoid shell redirects: PowerShell 5.1's `> file.json` is Out-File,\nwhich writes UTF-16LE with a BOM, and Node reading it as 'utf8' then fails JSON.parse at position 1\n(#5802). Use --out instead \u2014 the CLI writes the file itself as UTF-8:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n\nThe --json report is an OBJECT \u2014 never an array:\n  {project, viewer, repo, primary, secondary, items, warnings, partial[, source, builtAt, eventCursor, ...]}\n`primary` is this repo and `secondary` the other repos in scope; each is a bucket object\n  {userOwned, claimable, taken, unownedInFlight}\nand each bucket is an array of items. Filter the BUCKET for ownership context:\n  mmi-cli oracle board read --json --out .jerv/tmp/board.json\n  node -e \"const b=require('./.jerv/tmp/board.json');console.log(b.primary.claimable.length)\"\n\n`items` (#9974) is that same flat row array, already on the full report: {ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}\n  node -e \"const b=require('./.jerv/tmp/board.json');for(const i of b.items)console.log(i.number,i.status,i.title)\"\nIt is built from the same flattener as --flat, so `const rows = j.items || j` is now safe on either form.\n\nAdd --flat with --json for that array as the WHOLE output (no project/viewer/warnings envelope):\n(#9595: claim is the parsed mmi-claim evidence object, null when unclaimed; openPullRequests lists the OPEN\n PRs whose closing-issue body links name the item. On the FULL JSON object that list lives at\n `report.pullRequests` \u2014 there is no top-level `openPullRequests`, and #9596 hand-written projections\n that assume one crash on `.filter`.)\n\nNever sniff the envelope \u2014 read `report.items` (or `primary`/`secondary`) by name. `j.items ?? j.rows ?? j`,\n`Object.values(j)` and any generic \"find the list\" wrapper are still guesses: before `items` existed they\nthrew `items is not iterable` before any row was read (#9956), and `j.rows` has never been a key. For a\nnumber|status|claim|title projection across non-Done rows, read --json --flat --out .jerv/tmp/board.json\nand filter that array locally (identical rows to `report.items`):\n  mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json\n\nA cached snapshot read renders `source: cache \xB7 built <timestamp> \xB7 fresh|stale` (#9584) and carries\n`builtAt` under --json, so a same-turn re-read of the same builtAt buys nothing new.\n\nUnder --json, parse stdout ONLY and check the exit code first. A failure still prints a\nhuman-readable reason on stderr, so never pipe 2>&1 into a JSON parser (#9151) \u2014 the merged\ntext is not JSON and hides the real board failure.\n\nA zero-byte or empty .jerv/tmp/*.json means the read FAILED \u2014 `Unexpected end of JSON input` is\nthe symptom of shell-redirected empty stdout, not malformed JSON \u2014 re-run with --out (which writes\nthe file only on success) and check the exit code before parsing.\n\nChanging an existing item's Status is a move, never a hand-written `gh api graphql`\n`updateProjectV2ItemFieldValue` mutation with copied `PVT_`/`PVTI_` node ids and a manual Status\nfield-id lookup:\n  mmi-cli oracle board move <status> <ref>\n";
 function flattenBoardReport(report) {
   const closingByRef = /* @__PURE__ */ new Map();
   for (const pull of report.pullRequests ?? []) {
@@ -46322,6 +46456,9 @@ function flattenBoardReport(report) {
     openPullRequests: closingByRef.get(ref) ?? []
   }))));
 }
+function withBoardItems(report) {
+  return { ...report, items: flattenBoardReport(report) };
+}
 function registerBoardCommands(program3) {
   function withDiscoverMissDetail(message2) {
     const miss = lastBoardDiscoverMiss();
@@ -46346,7 +46483,7 @@ function registerBoardCommands(program3) {
         snapshotOnly: o.snapshotOnly,
         ...o.minCursor !== void 0 ? { minCursor: Number(o.minCursor) } : {}
       }, o.direct ? {} : { snapshot: registryClientDeps(config) });
-      const output = o.json ? JSON.stringify(o.flat ? flattenBoardReport(report) : report) : renderBoardReport(report);
+      const output = o.json ? JSON.stringify(o.flat ? flattenBoardReport(report) : withBoardItems(report)) : renderBoardReport(report);
       if (!o.out) console.log(output);
       else console.log(`Wrote board read to ${o.out} (UTF-8, ${writeUtf8Receipt(o.out, output)} bytes)`);
     } catch (e) {
@@ -63066,9 +63203,11 @@ function renderResidueSweepLines(report) {
     const more = report.unrecorded.length > 5 ? `, \u2026 ${report.unrecorded.length - 5} more` : "";
     lines2.push(`pr merge: ${report.unrecorded.length} unregistered folder(s) with content under the worktree root${where} were left untouched (not recorded by a merge): ${listed.map((u) => u.path).join(", ")}${more}`);
     for (const u of listed) lines2.push(`pr merge:   left untouched ${u.path} \u2014 ${provenanceText(u)}`);
+    lines2.push(`pr merge:   recovery: ${RESIDUE_RECOVERY_MOVE}`);
   }
   return lines2;
 }
+var RESIDUE_RECOVERY_MOVE = `run \`git worktree list --porcelain\` in the primary checkout and confirm the path is absent and its provenance above shows no live lane (not registered; admin dir gone or .git pointer missing); nothing can record it for this sweep (only \`pr merge\` records its own merged worktree in <git-common-dir>/${RESIDUE_LEDGER_FILE}), so removing a non-empty unrecorded folder stays a human decision \u2014 hand the confirmed path to a human; this sweep never deletes it`;
 function provenanceText(u) {
   const pointer = u.gitdir ? `.git \u2192 ${u.gitdir}${u.gitdirPresent ? "" : " (admin dir gone)"}` : ".git pointer missing";
   const registration = `worktrees/${u.registrationId} ${u.registrationPresent ? "registered" : "not registered"}`;
@@ -63226,6 +63365,24 @@ async function attachToProject(issueNumber, repo, priority) {
       }
       return boardAttachRateLimitedReceipt(resetEpochSeconds);
     }
+    const authority = contentId ? await attachOnAuthorityRefusal(detail, cfg, contentId) : void 0;
+    if (authority && "projectItemId" in authority) {
+      if (priority) {
+        try {
+          await setBoardItemPriority(defaultGitHubClient(), cfg, authority.projectItemId, priority);
+        } catch (pe) {
+          const perr = pe;
+          process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(perr.stderr || perr.message || String(pe)).trim()}
+`);
+        }
+      }
+      return { projectItemId: authority.projectItemId, onBoard: true, credential: "app_installation" };
+    }
+    if (authority) {
+      process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${authority.warning}
+`);
+      return { onBoard: false };
+    }
     process.stderr.write(`warning: issue #${issueNumber} created but NOT added to the project board: ${detail}
 `);
     return { onBoard: false };
@@ -73836,7 +73993,16 @@ setGhWriteTokenProvider(() => {
     throw e;
   });
 });
-setClaimWriteTokenProvider(() => mintFilingWriteToken(appActorDeps()).then((t) => t.token));
+var claimWriteToken;
+setClaimWriteTokenProvider(() => {
+  if (process.env.MMI_ACTOR?.trim() === "app") {
+    return mintFilingWriteToken(appActorDeps()).then((t) => t.token);
+  }
+  return claimWriteToken ??= mintFilingWriteToken(appActorDeps()).then((t) => t.token, (e) => {
+    if (e instanceof AppActorError && e.code === "vault-denied") return void 0;
+    throw e;
+  });
+});
 setStatusWriteTokenProvider(() => mintStatusWriteToken(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
@@ -73848,6 +74014,7 @@ registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand
     "ci cancel-orphans",
     "run cancel",
     "run rerun",
+    "run dispatch",
     // #9779/#9780: the vars verbs and archive-status validate --repo/name/value before the first
     // dispatch, so their scoped App mint waits for the action handler like the run writes above.
     "vars get",
@@ -74727,13 +74894,18 @@ ci.command("hosted-usage").description("read-only hosted tick and lane-demand al
 });
 registerCiChecksWait(ci);
 registerCancelOrphans(ci, async () => (await mintCommandWriteToken(appActorDeps(), "ci cancel-orphans")).token);
-var runRoot = program2.command("run").description("bounded workflow-run writes \u2014 `run cancel <id>` and `run rerun <id> [--failed]`, both on the org App actions:write profile");
+var runRoot = program2.command("run").description("bounded workflow-run writes on the org App actions:write profile");
 registerRunCancel(runRoot, async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run cancel")).token);
 registerRunRerun(
   runRoot,
   async () => activeAppToken() ?? (await mintCommandWriteToken(appActorDeps(), "run rerun")).token,
   async () => fetchProjectsList(registryClientDeps(await loadConfig()))
 );
+registerRunDispatch(
+  runRoot,
+  async () => (await mintCommandWriteToken(appActorDeps(), "run dispatch")).token,
+  async () => fetchProjectsList(registryClientDeps(await loadConfig()))
+);
 var varsAppClient = (commandPath4) => async () => (
   // The concrete client always provides restWithStatus (optional on the interface only so hand-built
   // test stubs of GitHubClient keep compiling).

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.34",
+  "version": "4.6.36",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.6.34",
+  "version": "4.6.36",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -20,12 +20,16 @@ One call; `--flat` gives one array of rows to iterate. A routine read already ex
 items, so no status post-filter is needed. The detailed form (`--json` without `--flat`) carries `viewer`,
 `repo` and the project title; use its `primary` for this repo and `secondary` for other repos on the
 Project. Without `--flat`, `board read --json` returns an object
-`{project, viewer, repo, primary, secondary, warnings, partial}` whose `primary` and `secondary` are bucket
-objects `{userOwned, claimable, taken, unownedInFlight}` of item arrays (no top-level `items` array), so filter
-a bucket (e.g. `report.primary.claimable`) or pass `--json --flat`, never `(j.items||j).filter`. Never sniff
-for the list (`j.items ?? j.rows ?? j`, `Object.values`, any generic "find the list" wrapper): it throws
-`items is not iterable` before any row is read. For a number|status|claim|title projection across non-Done
-rows, run `mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json` and filter that array locally.
+`{project, viewer, repo, primary, secondary, items, warnings, partial}` whose `primary` and `secondary` are bucket
+objects `{userOwned, claimable, taken, unownedInFlight}` of item arrays, and whose top-level `items` (#9974) is
+the flat row array — the same rows `--flat` prints — so a number|status|title projection can iterate
+`report.items` without a second read. Filter a bucket (`report.primary.claimable`) when ownership context
+matters, or `report.items` / `--json --flat` for a projection. Never sniff
+for the list (`j.items ?? j.rows ?? j`, `Object.values`, any generic "find the list" wrapper): `j.rows` is not a
+key, and on an older report it threw
+`items is not iterable` before any row was read. For a number|status|claim|title projection across non-Done
+rows, read `report.items` or run `mmi-cli oracle board read --json --flat --out .jerv/tmp/board.json` and filter
+that array locally.
 `--flat` rows are `{ref,number,title,status,assignees,labels,bucket,claim,openPullRequests}` (`claim` is the
 parsed mmi-claim evidence object, null when unclaimed; `openPullRequests` lists the OPEN PRs whose
 closing-issue body links name the item — on the full JSON object that list lives at `report.pullRequests`,

package/skills/board/reference.md

@@ -21,9 +21,12 @@ rows to iterate. A routine read already excludes Done and closed items, so no st
 One call. The detailed form (`--json` without `--flat`) carries `viewer`, `repo` and the project title — do not spend extra calls on
 `gh api user` or `gh repo view`. Use `primary` for this repo and `secondary` for other repos on the same
 Project. Without `--flat`, `board read --json` returns an object
-`{project, viewer, repo, primary, secondary, warnings, partial}` whose `primary` and `secondary` are bucket
-objects `{userOwned, claimable, taken, unownedInFlight}` of item arrays (no top-level `items` array), so filter
-a bucket (e.g. `report.primary.claimable`) or pass `--json --flat`, never `(j.items||j).filter`. Partial reads
+`{project, viewer, repo, primary, secondary, items, warnings, partial}` whose `primary` and `secondary` are bucket
+objects `{userOwned, claimable, taken, unownedInFlight}` of item arrays, and whose top-level `items` (#9974) holds
+the flat rows — exactly what `--flat` prints — so iterate `report.items` instead of spending a second read.
+Filter a bucket (`report.primary.claimable`) when ownership context matters. Never sniff for the list
+(`j.items ?? j.rows ?? j` is only coincidentally safe now, `Object.values` is not): `j.rows` is not a key.
+Partial reads
 exit nonzero; pass `--allow-partial` only when the dev accepts an incomplete board.
 
 Partition, as the CLI computes it:

package/skills/bootstrap/seeds/readme-mmi-developer-environment.block.md

@@ -2,4 +2,7 @@
 ## MMI developer environment
 
 Use the [canonical MMI developer-environment guide](https://github.com/mutmutco/MMI-Hub/blob/main/docs/Architecture/agentic-dev-environment.md) for shared setup and daily agent work.
+
+Daily loop: `mmi-cli oracle issue create` → `mmi-cli oracle board claim <n>` (stamps the mmi-claim lease) → `mmi-cli devops pr create` → `mmi-cli devops pr land <pr>`.
+Any org member with repository write (developer) or repository admin (project admin) can run it, with no vault access; release trains stay org-owner only.
 <!-- mmi-developer-environment:end -->

package/skills/bootstrap/seeds/runbook-unaffected.json

@@ -6,5 +6,9 @@
   "scripts/next-version.mjs": {
     "blob": "2c1985b59edc779695479559074e7654c1574a11",
     "reason": "comment-only note that rc/release modes are unused in dev-only MM suite repos (#8282), no runtime or operator behaviour change"
+  },
+  "README.md": {
+    "blob": "768c5e35cdb48849c77bce6b334658adefe6a5d8",
+    "reason": "the developer-environment seed block now states the concrete mmi-cli loop (issue create, board claim, PR create, PR land) and who may run it — the README propagation is intended (#9987); no runbook step changes"
   }
 }

package/skills/org-guide/references/work-and-releases.md

@@ -13,6 +13,23 @@ our self-hosted runners, dispatched by an org owner, never on a workstation (#91
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is
 not a denial: wait for the reset time it names, then retry.
 
+## Developer and project-admin access
+
+A developer is an org member with GitHub write on a product repository. A project admin is that
+repository's admin. Both run the full loop with mmi-cli and need no MMI-Hub vault access:
+
+```sh
+mmi-cli oracle issue create --title "<title>" --body-file <path>   # files and attaches the board card
+mmi-cli oracle board claim <n>                                     # stamps the mmi-claim lease
+mmi-cli devops pr create --title "<title>" --base development
+mmi-cli devops pr land <pr-number>
+```
+
+Board writes (attach, claim stamp, status move) gate on org owner, repo admin or repository write, so
+these roles pass. Where the GitHub App route is absent the writes go as the person's own GitHub login
+(one note says so); an agent host with the App route writes as the App. MMI-Hub's own merges and all
+release trains stay org-owner only.
+
 Start with `mmi-cli onboard` and the [board skill](../../board/SKILL.md).
 Reading or discussing the board is read-only until the developer authorizes work.
 Claim approved work with `mmi-cli oracle board claim <issue>`, then prepare an isolated task