@mutmutco/claude-plugin 4.6.42 → 4.6.44

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.6.42",
+  "version": "4.6.44",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -25273,6 +25273,31 @@ function missingPlaceholders(rendered) {
   for (const m of rendered.matchAll(PLACEHOLDER_RE)) out.add(m[1]);
   return [...out];
 }
+function seedMatchesReleaseTrack(seed, releaseTrack) {
+  if (!seed.releaseTracks?.length) return true;
+  return releaseTrack != null && seed.releaseTracks.includes(releaseTrack);
+}
+var TRAIN_ONLY_BEGIN = "mmi-train-only:start";
+var TRAIN_ONLY_END = "mmi-train-only:end";
+function renderSelfSeedForTrack(content, releaseTrack) {
+  if (releaseTrack !== "single") return content;
+  const lines2 = content.split(/(?<=\n)/);
+  const out = [];
+  let skipping = false;
+  for (const line of lines2) {
+    if (!skipping && line.includes(TRAIN_ONLY_BEGIN)) {
+      skipping = true;
+      continue;
+    }
+    if (skipping) {
+      if (line.includes(TRAIN_ONLY_END)) skipping = false;
+      continue;
+    }
+    out.push(line);
+  }
+  if (skipping) throw new Error(`unterminated ${TRAIN_ONLY_BEGIN} region`);
+  return out.join("");
+}
 function isPropagatableSeed(seed) {
   return seed.ownership === "org" && seed.source === "self" || seed.managedBlock != null;
 }
@@ -26639,6 +26664,7 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranc
   out.CLASS ??= cls;
   out.PROJECT_OWNER ??= parsed.owner;
   const track = releaseTrack ?? resolveBootstrapReleaseTrack(cls);
+  out.RELEASE_TRACK ??= track;
   const runtime = out.GATE_RUNTIME === "python" ? "python" : "node";
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime, requiredCheckBranches, requiredChecks))) {
     out[key] ??= value;
@@ -26998,7 +27024,10 @@ function renderBootstrapAncillaryPlan(labels, environments, exceptions = []) {
   ].join("\n");
 }
 function resolveSeedContent(seed, vars, readFile11) {
-  if (seed.source === "self") return readFile11(seed.target);
+  if (seed.source === "self") {
+    const own = readFile11(seed.target);
+    return own == null ? null : renderSelfSeedForTrack(own, vars.RELEASE_TRACK);
+  }
   if (seed.source.startsWith("seed:")) {
     const tmpl = readFile11(`skills/bootstrap/seeds/${seed.source.slice("seed:".length)}`);
     return tmpl == null ? null : renderSeed(tmpl, vars);
@@ -28527,10 +28556,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.42",
-    tag: "v4.6.42",
-    commit: "cb451037f47d",
-    npm: "@mutmutco/cli@4.6.42"
+    version: "4.6.44",
+    tag: "v4.6.44",
+    commit: "2ce6b7e5afc3",
+    npm: "@mutmutco/cli@4.6.44"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28547,14 +28576,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.42"
+          v3Target: "v4.6.44"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.42 and redeploy the Hub Lambda from tag v4.6.42 (cb451037f47d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.42 (@mutmutco/cli@4.6.42, tag commit cb451037f47d \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.44 and redeploy the Hub Lambda from tag v4.6.44 (2ce6b7e5afc3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.44 (@mutmutco/cli@4.6.44, tag commit 2ce6b7e5afc3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -31670,17 +31699,17 @@ function isBundleOnlySuiteMember(repo, suite) {
   if (!suite) return false;
   return repo.split("/")[1]?.toLowerCase() !== suite.toLowerCase();
 }
+var MM_GOES_LIVE = "MM-Work and its modules merge to development and it goes live; there is no release, rc or candidate stage.";
 function suiteMemberRefusal(repo, meta, lane, solo = false, cut) {
   const suite = meta?.suite;
   if (!suite) return null;
   if (!isBundleOnlySuiteMember(repo, suite)) {
     if (solo || cut?.token === SUITE_LEAD_TOKEN && cut.repo.toLowerCase() === repo.toLowerCase()) return null;
-    const route = lane === "hotfix" ? "hotfix the affected member from its own checkout, then run mmi-cli devops suite release --owner-go" : `run mmi-cli devops suite ${lane} --owner-go`;
-    return `${repo} is the ${suite} suite lead; a plain ${lane} would cut it without its members: ${route}. A lead-only ${lane} needs --suite-solo --owner-go.`;
+    return `${repo} is the ${suite} suite lead; ${MM_GOES_LIVE} There is no ${lane} to run: land the change through a normal PR to development and state what landed.`;
   }
   if (authorisedSuiteCut(repo, meta, cut)) return null;
   if (lane !== "rcand" && solo) return null;
-  return `${repo} is part of the ${suite} suite; the cut comes from the suite lead ${suiteLeadRepo(repo, suite)}. A suite member never asks for, proposes or prompts an rc, release or hotfix: the suite orchestrator is the only voice that brings a cut to Jervaise, so state what landed and stop. --owner-go and --suite-solo are never self-authorized; only a backward-compatible solo backend release/hotfix with actual owner approval may pass --suite-solo --owner-go.`;
+  return `${repo} is part of the ${suite} suite; ${MM_GOES_LIVE} A suite member never asks for, proposes or prompts an rc, release or hotfix: there is none, so state what landed and stop.`;
 }
 
 // src/tenant-control-parse.ts
@@ -42162,6 +42191,31 @@ function compactRouteManifest(manifest, onlyHouse) {
     }
   };
 }
+function filterCompactRouteManifest(output, match) {
+  return { ...output, routes: output.routes.filter((route) => match.test(route.path)) };
+}
+function pruneManifestTree(node, match) {
+  const subcommands = node.subcommands.map((child2) => pruneManifestTree(child2, match)).filter((child2) => child2 !== void 0);
+  if (match.test(node.name) || match.test(node.path) || subcommands.length > 0) {
+    return { ...node, subcommands };
+  }
+  return void 0;
+}
+function filterTreeAndIndex(tree, index, match) {
+  return {
+    tree: pruneManifestTree(tree, match) ?? { ...tree, subcommands: [] },
+    index: index.filter((leaf) => match.test(leaf.name) || match.test(leaf.path))
+  };
+}
+function filterCommandManifest(manifest, match) {
+  const full = filterTreeAndIndex(manifest.tree, manifest.index, match);
+  const primary = filterTreeAndIndex(manifest.primary_tree, manifest.primary_index, match);
+  return { ...manifest, tree: full.tree, index: full.index, primary_tree: primary.tree, primary_index: primary.index };
+}
+function filterPrimaryCommandManifest(manifest, match) {
+  const filtered = filterTreeAndIndex(manifest.tree, manifest.index, match);
+  return { ...manifest, tree: filtered.tree, index: filtered.index };
+}
 var DOOR_DECLARATIONS = [
   { door: "board", question: "What is on my board \u2014 and what is next?", path: "board read", source: "the live GitHub Project v2 board, read through the Hub board API" },
   { door: "registry", question: "What repos and projects exist, with what META?", path: "org project list", source: "the Hub org registry (DDB)" },
@@ -51008,7 +51062,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: `expected: ${requiredProductRulesetRef} (apply as an active repo ruleset after bootstrap)`
     });
   }
-  if (repoClass === "deployable") {
+  if (repoClass === "deployable" && effectiveTrack !== "single") {
     const trainScript = "scripts/next-version.mjs";
     checks.push({ ok: await contentExists2(deps, repo, baseBranch, trainScript), label: `train tooling script exists: ${trainScript}` });
   }
@@ -51734,7 +51788,9 @@ function registerBootstrapCommands(program3) {
     for (const repo of targets) {
       const cls = classOf(repo);
       const meta = metaOf(repo);
-      const seeds = byteComparableSeeds(manifest, cls);
+      const track = resolveReleaseTrack(metaWithDeclaredClass(meta, cls), void 0, repo);
+      const seeds = byteComparableSeeds(manifest, cls).filter((s) => seedMatchesReleaseTrack(s, track));
+      const trackHubContents = new Map([...hubContents].map(([t, c]) => [t, c == null ? c : renderSelfSeedForTrack(c, track)]));
       seedsPerRepo = Math.max(seedsPerRepo, seeds.length);
       const baseBranch = cls === "content" ? "main" : "development";
       const reads = [];
@@ -51749,9 +51805,8 @@ function registerBootstrapCommands(program3) {
         }
         reads.push({ target: seed.target, content });
       }
-      findings.push(...auditRepoSeedDrift(repo, seeds, hubContents, reads));
+      findings.push(...auditRepoSeedDrift(repo, seeds, trackHubContents, reads));
       findings.push(...declaredRenderWaivers(manifest, repo));
-      const track = resolveReleaseTrack(metaWithDeclaredClass(meta, cls), void 0, repo);
       const github = await readBootstrapGitHubFacts(repo, track, controlClient);
       const deployFacts = await fetchDeployFactsBySlug((repo.split("/").pop() ?? repo).toLowerCase(), registryClientDeps(await loadConfig()));
       const controlRows = planBootstrapControlPlane({
@@ -52176,6 +52231,7 @@ function registerBootstrapCommands(program3) {
       if (!seed.classes.includes(o.class)) continue;
       if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
       if (!seedMatchesProjectType(seed, applyProjectType)) continue;
+      if (!seedMatchesReleaseTrack(seed, vars.RELEASE_TRACK)) continue;
       const waiver = seed.waivers?.[slug];
       if (waiver) {
         actions.push({ action: "skip", target: seed.target, ownership: seed.ownership, reason: `waived: ${waiver}` });
@@ -52670,7 +52726,12 @@ LIVE apply to ${repo}:
     const readSeedFile2 = (path2) => (0, import_node_fs40.existsSync)(path2) ? (0, import_node_fs40.readFileSync)(path2, "utf8") : null;
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const { projects, classOf, inClassRepos, canarySlug, sourcePilot } = await propagationScope(seed.classes, `target '${seed.target}'`);
-    const repos = inClassRepos.map((repo) => {
+    const trackOf = (repo) => resolveReleaseTrack(
+      projects.find((p) => (p.repos ?? []).some((r) => r.toLowerCase() === repo.toLowerCase())),
+      void 0,
+      repo
+    );
+    const repos = inClassRepos.filter((repo) => seedMatchesReleaseTrack(seed, trackOf(repo))).map((repo) => {
       const slug = repo.split("/").pop().toLowerCase();
       const waiver = seed.waivers?.[slug];
       return { repo, slug, waiver };
@@ -52718,7 +52779,7 @@ LIVE apply to ${repo}:
         }
         desired = resolved.content;
       } else {
-        desired = hubContent;
+        desired = renderSelfSeedForTrack(hubContent, trackOf(r.repo));
       }
       desiredByRepo.set(r.repo, desired);
       const drift = compareSeedBytes(desired, content);
@@ -59669,7 +59730,7 @@ function branchRulesReadHint(path2) {
   const match = new RegExp(`^repos/(${NAME})/(${NAME})/(?:rules/branches/[^/?#]+|branches/[^/?#]+/protection(?:/|$)|rulesets(?:/|$))`).exec(path2.split("?")[0]);
   if (!match) return "";
   const slug = `${match[1]}/${match[2]}`;
-  return ` No raw rules, rulesets or branch-protection read is on the App allowlist, so retrying path or query variants cannot work \u2014 inspect a PR's required status contexts with \`MMI_ACTOR=app mmi-cli devops pr checks-required <pr> --repo ${slug} --json\`, or verify repository ruleset and branch-protection health with \`mmi-cli devops bootstrap verify --repo ${slug} --json\` and \`mmi-cli devops ci audit --repo ${slug} --json\`.`;
+  return ` No raw rules, rulesets or branch-protection read is on the App allowlist, so retrying path or query variants cannot work \u2014 inspect a PR's required status contexts with \`MMI_ACTOR=app mmi-cli devops pr checks-required <pr> --repo ${slug} --json\`, or verify repository ruleset and branch-protection health with \`mmi-cli devops bootstrap verify --repo ${slug} --json\` and \`mmi-cli devops ci audit --repo ${slug} --json\`. Stepping around it with a raw \`gh api repos/${slug}/rulesets/<id> > file\` is not a substitute \u2014 when that read fails it leaves an EMPTY file, and a later require/JSON.parse throws 'Unexpected end of JSON input' that looks like corrupt data while the real refusal is only on stderr; check the exit code and file size, or ask a human token holder for the raw ruleset body.`;
 }
 function commitsReadHint(path2) {
   const clean4 = path2.split("?")[0];
@@ -73693,11 +73754,24 @@ function registerDeveloperCommands(program3) {
       console.log("mmi-cli devops org rules gitignore: up to date");
     }
   });
-  program3.command("commands").description("print the grouped agentic-coding map; JSON defaults to bounded routes").option("--all", "human: include operational depth; JSON: emit the exhaustive schema-2 manifest").option("--json", "machine-readable progressive discovery").option("--primary", "with --json, emit the compatibility schema-2 primary tree and index").addOption(new Option("--house <house>", "with --json, limit routes to one house").choices([...HOUSE_ROOTS, "core"])).action((o) => {
+  program3.command("commands").description("print the grouped agentic-coding map; JSON defaults to bounded routes").option("--all", "human: include operational depth; JSON: emit the exhaustive schema-2 manifest").option("--json", "machine-readable progressive discovery; the compact default emits an OBJECT {schema_version, scope:'routes', routes[{path,house,summary,detail}], houses, doors, next{full:'mmi-cli commands --all --json'}} \u2014 never a top-level `commands` array; --all --json emits the exhaustive schema-2 manifest {scope:'all', tree, index, houses, doors, flat_alias_cut, primary_tree, primary_index, error_codes}").option("--primary", "with --json, emit the compatibility schema-2 primary tree and index").addOption(new Option("--house <house>", "with --json, limit routes to one house").choices([...HOUSE_ROOTS, "core"])).addOption(new Option("--match <regex>", "with --json, keep only routes/commands whose path or name matches this regular expression (case-insensitive)")).action((o) => {
     if (o.house && !o.json) {
       fail("commands: --house requires --json", { code: ERROR_CODES.ERR_CONFLICTING_FLAGS, offending_flag: "--house" });
       return;
     }
+    if (o.match && !o.json) {
+      fail("commands: --match requires --json", { code: ERROR_CODES.ERR_CONFLICTING_FLAGS, offending_flag: "--match" });
+      return;
+    }
+    let match;
+    if (o.match) {
+      try {
+        match = new RegExp(o.match, "i");
+      } catch {
+        fail(`commands: --match '${o.match}' is not a valid regular expression`, { code: ERROR_CODES.ERR_INVALID_INPUT, offending_flag: "--match" });
+        return;
+      }
+    }
     const conflicting = [o.all ? "--all" : "", o.primary ? "--primary" : "", o.house ? "--house" : ""].filter(Boolean);
     if (o.json && conflicting.length > 1) {
       fail(`commands: ${conflicting.join(" and ")} are mutually exclusive`, { code: ERROR_CODES.ERR_CONFLICTING_FLAGS, offending_flag: conflicting.join(",") });
@@ -73705,7 +73779,7 @@ function registerDeveloperCommands(program3) {
     }
     const manifest = buildCommandManifest(program3);
     if (o.json) {
-      const output = o.all ? manifest : o.primary ? primaryCommandManifest(manifest) : compactRouteManifest(manifest, o.house);
+      const output = o.all ? match ? filterCommandManifest(manifest, match) : manifest : o.primary ? match ? filterPrimaryCommandManifest(primaryCommandManifest(manifest), match) : primaryCommandManifest(manifest) : match ? filterCompactRouteManifest(compactRouteManifest(manifest, o.house), match) : compactRouteManifest(manifest, o.house);
       consoleIo.log(JSON.stringify(output, null, 2));
       return;
     }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.42",
+  "version": "4.6.44",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.6.42",
+  "version": "4.6.44",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -1,6 +1,7 @@
 name: gate
 # Org-standard green-before-merge gate for product repos (#1333). Runs on PRs, train-branch pushes,
-# and v* tags so /release and /hotfix can discover required contexts on the tagged SHA.
+# and v* tags so /release and /hotfix can discover required contexts on the tagged SHA (repos with a
+# release train only; MM-Work and its modules have none — they merge to development and it goes live).
 #
 # Runner (#9248, owner 29 Oct 2026): included GitHub-hosted capacity is FIRST CHOICE for CI — this gate
 # runs on `ubuntu-latest`, which costs included Enterprise minutes, not spend. Self-hosted lanes
@@ -196,7 +197,7 @@ jobs:
       - run: {{GATE_INSTALL_CMD}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}{{GATE_JEV_FETCH_YAML}}{{GATE_CHECK_POLICY_STEP_YAML}}
       # #3178: the check runs under the org wall-clock budget — a hung suite dies at the ceiling instead
-      # of squatting a runner lane for GitHub's 6h default. ci-audit + the release train enforce this step.
+      # of squatting a runner lane for GitHub's 6h default. ci-audit (and, on repos that have one, the release train) enforce this step.
       # #9293: PRs fail fast, merge_group and tags run everything. pytest reads PYTEST_ADDOPTS natively; a
       # Node check script opts in with MMI_FAIL_FAST (`vitest run ${MMI_FAIL_FAST:+--bail=1}`, or
       # `--fail-fast` on the org node runner). #9295: on PRs the Jev plan step exports JEV_PYTEST_ARGS

package/skills/bootstrap/seeds/manifest.json

@@ -1,12 +1,12 @@
 {
-  "_comment": "Bootstrap seed manifest (#201) — the machine-readable contract of what /bootstrap and `mmi-cli devops bootstrap --apply` (#202) stamp into a target repo. Consumed by the CLI (loadBootstrapSeeds). ownership: 'org' = org-delivered, OVERWRITTEN on upgrade (the org owns it); 'repo' = created ONCE on a fresh bootstrap, never clobbered on upgrade (the repo owns its content). source: 'self' = copy MMI-Hub's own current file verbatim; 'seed:<file>' = render the named template in this dir with {{PLACEHOLDERS}}; 'managed-block' = merge the legacy org-managed .gitignore block in place. managedBlock declares a separately sourced, exact-marker-bounded Hub-owned region inside a repo-owned containing file; apply/propagate reconcile only that region and refuse malformed markers. NOTE: this manifest seeds org-managed PRODUCT assets only — it never seeds AGENTS.md / CLAUDE.md / .claude/settings.json (personal agent guides) or a legacy repo-local control-plane marker. classes: which repo classes receive this seed.",
+  "_comment": "Bootstrap seed manifest (#201) — the machine-readable contract of what /bootstrap and `mmi-cli devops bootstrap --apply` (#202) stamp into a target repo. Consumed by the CLI (loadBootstrapSeeds). ownership: 'org' = org-delivered, OVERWRITTEN on upgrade (the org owns it); 'repo' = created ONCE on a fresh bootstrap, never clobbered on upgrade (the repo owns its content). source: 'self' = copy MMI-Hub's own current file verbatim; 'seed:<file>' = render the named template in this dir with {{PLACEHOLDERS}}; 'managed-block' = merge the legacy org-managed .gitignore block in place. managedBlock declares a separately sourced, exact-marker-bounded Hub-owned region inside a repo-owned containing file; apply/propagate reconcile only that region and refuse malformed markers. NOTE: this manifest seeds org-managed PRODUCT assets only — it never seeds AGENTS.md / CLAUDE.md / .claude/settings.json (personal agent guides) or a legacy repo-local control-plane marker. classes: which repo classes receive this seed. releaseTracks (#10076): when set, only repos on those registry release tracks receive it; a 'self' seed's '# mmi-train-only:start' ... ':end' line regions are dropped for single-track repos.",
   "placeholders": ["OWNER", "REPO", "REPO_SLUG", "REPO_NAME", "CLASS", "GATE_CMD", "GATE_PUSH_BRANCHES_YAML", "GATE_FULL_RUN_BRANCH", "GATE_RULESET_BRANCH_REFS_JSON", "GATE_RULESET_CONTEXTS_JSON", "PROJECT_OWNER", "PROJECT_NUMBER", "PROJECT_ID", "STATUS_FIELD_ID", "STATUS_TODO", "STATUS_IN_PROGRESS", "STATUS_IN_REVIEW", "STATUS_DONE", "STACK", "REGION"],
   "seeds": [
     { "target": ".github/ISSUE_TEMPLATE/bug.yml", "source": "self", "ownership": "org", "classes": ["deployable", "content"] },
     { "target": ".github/ISSUE_TEMPLATE/feature.yml", "source": "self", "ownership": "org", "classes": ["deployable", "content"] },
     { "target": ".github/ISSUE_TEMPLATE/task.yml", "source": "self", "ownership": "org", "classes": ["deployable", "content"] },
     { "target": ".github/ISSUE_TEMPLATE/config.yml", "source": "self", "ownership": "repo", "classes": ["deployable", "content"] },
-    { "target": "scripts/next-version.mjs", "source": "self", "ownership": "org", "classes": ["deployable"] },
+    { "target": "scripts/next-version.mjs", "source": "self", "ownership": "org", "classes": ["deployable"], "releaseTracks": ["full", "direct", "trunk"] },
     { "target": ".github/workflows/gate.yml", "source": "seed:gate.template.yml", "ownership": "repo", "classes": ["deployable"], "waivers": { "mmi-katip": "gates through py-gate and web-gate (in-job path filters, #3836) and its registry requiredChecks name exactly those two; a generic Node gate.yml here is red noise on every PR and would be re-created by every apply (#6333)." } },
     { "target": ".github/workflows/agent-pr.yml", "source": "self", "ownership": "org", "classes": ["deployable"], "waivers": { "jerv-jervcode": "pins this workflow's EXACT step shapes in its own scripts/workflow-boundary-core.mjs — a literal repositories: Jerv-JervCode token scope, and whole-step equality for the surface and verdict legs. #4040 widened the org seed to the same hardened boundary (pull_request_target off the trusted base, an immutable BASE..HEAD compare with a file-count equality wall, a per-repo App token scope, and a certified-head merge), so the two now agree on substance. They cannot agree on bytes: a seed serving 16 repos resolves its token scope and its required contexts at run time, which exact-step equality rejects by construction. The waiver is permanent by design, not a deferral — lifting it would mean weakening the strictest repo to match a fleet file." } },
     { "target": ".github/rulesets/mmi-product-required-checks.json", "source": "seed:mmi-product-required-checks.template.json", "ownership": "org", "classes": ["deployable"] },

package/skills/bootstrap/seeds/readme-mmi-developer-environment.block.md

@@ -4,5 +4,5 @@
 Use the [canonical MMI developer-environment guide](https://github.com/mutmutco/MMI-Hub/blob/main/docs/Architecture/agentic-dev-environment.md) for shared setup and daily agent work.
 
 Daily loop: `mmi-cli oracle issue create` → `mmi-cli oracle board claim <n>` (stamps the mmi-claim lease) → `mmi-cli devops pr create` → `mmi-cli devops pr land <pr>`.
-Any org member with repository write (developer) or repository admin (project admin) can run it, with no vault access; release trains stay org-owner only.
+Any org member with repository write (developer) or repository admin (project admin) can run it, with no vault access; Hub release trains (repos that have one) stay org-owner only; MM-Work and its modules have none — merge and go live.
 <!-- mmi-developer-environment:end -->

package/skills/bootstrap/seeds/runbook-unaffected.json

@@ -1,14 +1,14 @@
 {
   ".github/workflows/agent-pr.yml": {
-    "blob": "e85a80c65b26531a330917fb4b5d8f563a0f0d0c",
-    "reason": "sole-write-path guard reads retry transient GitHub API 5xx/429/transport failures up to 3 attempts, then fail closed with the same messages (#9911); permissions, refs, guarded paths and operator responsibilities unchanged"
+    "blob": "228f2f3289b187e47c91d88c8582c7d856708a3b",
+    "reason": "train-only markers around the release-align replay, its comment and the scripts/next-version.mjs org-owned entry, stripped for single-track repos (#10076, #10085); the #7717 note says it applies only on repos with a release train (#10071); guarded paths for train repos, permissions and operator responsibilities unchanged"
   },
   "scripts/next-version.mjs": {
-    "blob": "2c1985b59edc779695479559074e7654c1574a11",
-    "reason": "comment-only note that rc/release modes are unused in dev-only MM suite repos (#8282), no runtime or operator behaviour change"
+    "blob": "7faba0bb3ee48074702da48d149657820d74de1a",
+    "reason": "comment-only header: the train applies only to repos with a release lane; MM-Work and its modules merge to development and it goes live with no release, rc or candidate stage (#10071); no runtime or operator behaviour change"
   },
   "README.md": {
-    "blob": "768c5e35cdb48849c77bce6b334658adefe6a5d8",
-    "reason": "the developer-environment seed block now states the concrete mmi-cli loop (issue create, board claim, PR create, PR land) and who may run it — the README propagation is intended (#9987); no runbook step changes"
+    "blob": "46f5e07288931eee1c26362219b9d4271a5ed49e",
+    "reason": "the developer-environment seed block now says Hub release trains (repos that have one) stay org-owner only and MM-Work and its modules have none — merge and go live (#10071); no runbook step changes"
   }
 }

package/skills/hotfix/SKILL.md

@@ -15,7 +15,7 @@ Pushing to `main` and production needs Jervaise's yes unless a standing authoriz
 
 ## Lane
 
-MM-Work suite seats: read [suite.md](suite.md). Lane from META:
+MM-Work and its modules have no hotfix: a fix merges to development and it goes live ([suite.md](suite.md)). Every other repo, lane from META:
 
 ```bash
 mmi-cli oracle org project get {owner}/{repo} --json

package/skills/hotfix/suite.md

@@ -1,2 +1 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
-
+MM-Work and its modules (MM-Account, MM-Chat, MM-Inspo, MM-Moments, MM-PM, MM-Strategy, MMI-Junior, MMI-Katip, MMI-Pulse, MMI-Scout, MM-Talent) merge to development and it goes live. No release, rc or candidate stage (owner ruling 2026-11-05): `development` is their only branch, and a merged change is live once its deploy is green. There is no suite rcand, suite release or suite hotfix for them and no `--suite-solo` path: never run `/release`, `/rcand` or `/hotfix` in these repos (the CLI refuses), and never tell the owner a landed change waits on a release. An urgent fix is a normal PR to development. A suite member never asks for, proposes or prompts an rc, release or hotfix — there is none; state what landed and stop.

package/skills/org-guide/references/design.md

@@ -164,8 +164,11 @@ Craft essentials every agent applies (owner, 2026-10-25, #8839):
   it serves `<pack-dir>` on `127.0.0.1`, measures each named board per width and theme, runs
   `impeccable detect --json` over the board files and writes `check.json`. `--boards` takes one
   comma-separated list (an unquoted shell glob passes only its first match); the server serves only
-  files directly inside `<pack-dir>`; and the run always exits 2 because rhythm and alignment stay
-  unmeasured, so it is not a full kit pass on its own. Boards that load `/kit/kit.css` and
+  files directly inside `<pack-dir>`; BRP rhythm and sibling alignment are measured against the kit
+  space scale read live from the page's `:root` `--space-*` / `--mm-space-*` tokens (kit 4px fallback
+  steps when a board defines none), so off-scale padding/gap/sibling-margin values and 1–3px sibling
+  edge near-misses are named in `check.json` `detail.rhythm` / `detail.align` and fail the run
+  (exit 0 clean, 2 with faults — no standing caveat). Boards that load `/kit/kit.css` and
   `/kit/kit.js` are canvas boards: use `review.mjs <folder> --no-open`, which serves the kit beside
   each board on `127.0.0.1` and runs live-DOM `impeccable detect` per board.
   `artifacts/review/kit-assets.mjs`, `review.mjs`'s kit and board serving, and

package/skills/org-guide/references/work-and-releases.md

@@ -27,8 +27,8 @@ mmi-cli devops pr land <pr-number>
 
 Board writes (attach, claim stamp, status move) gate on org owner, repo admin or repository write, so
 these roles pass. Where the GitHub App route is absent the writes go as the person's own GitHub login
-(one note says so); an agent host with the App route writes as the App. MMI-Hub's own merges and all
-release trains stay org-owner only.
+(one note says so); an agent host with the App route writes as the App. MMI-Hub's own merges and the Hub
+release trains (repos that have one) stay org-owner only; MM-Work and its modules have none: merge and go live.
 
 Start with `mmi-cli onboard` and the [board skill](../../board/SKILL.md).
 Reading or discussing the board is read-only until the developer authorizes work.
@@ -169,8 +169,9 @@ development. A trunk repository follows its single branch and declared workflow
   No box stage.
 - Trunk track: one main branch, without an rc/development promotion train. Follow the repository's
   declared publishing workflow rather than manufacturing train branches.
-- Single track (MM-Work and its modules): one environment. Every merge to development auto-deploys
-  the `main` stage; there is no rc, dev stage or release train, and release, rcand and hotfix refuse.
+- MM-Work and its modules (registry `releaseTrack: single`) are not on any of these trains: MM-Work and
+  its modules merge to development and it goes live. No release, rc or candidate stage; `development`
+  is their only branch, and release, rcand and hotfix refuse. The Hub's own release train never applies to them.
 - Urgent already-merged fixes: use [hotfix](../../hotfix/SKILL.md), which carries selected development
   fixes directly to main on either track.
 
@@ -199,7 +200,7 @@ refresh tags with `git fetch origin --tags --force` (or `git fetch origin '+refs
 never chain a plain tag fetch with `&&` ahead of a read-only `git log <tag>..origin/<branch>` range (#9517).
 A Hub summary never mentions a Jerv-side project; the train
 refuses such a line.
-Every new MM-Work suite Release, solo and hotfix included, requires `--announce-summary-file` and `--announce-summary-file-tr` in the bilingual update-notes template of the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md#update-notes) (`Fixed`/`Düzeldi`, then `New`/`Yeni`, with `<Area>: <sentence>.` lines; a Fixed line states what works now, never the problem). A suite release requires `--member-summary-file owner/repo=path` and `--member-summary-file-tr owner/repo=path` for every member it releases. A suite cut's `--owner-go` records the owner's explicit go for that one cut, never an agent's own decision: a held train or stale MM-Work cut goes to the suite orchestrator with the exact owner-gated commands. On its own an agent runs only `suite rcand --dry-run` and `suite hotfix <member> --dry-run`; it never runs `suite release` or `suite abandon`, which have no dry-run. Details: the release skill.
+MM-Work and its modules never cut a release, so they write no release summary: MM-Work and its modules merge to development and it goes live. No release, rc or candidate stage, no suite cut and no `--suite-solo` path (owner ruling 2026-11-05). Details: the release skill's suite.md.
 
 Announcement delivery uses the developer's GitHub-authenticated Hub session. The Hub checks project
 authority, resolves the registered channel, and reads the MMI Future Slack key inside its vault boundary.

package/skills/rcand/SKILL.md

@@ -13,7 +13,7 @@ Merge `development → rc`, tag `vX.Y.0-rc.N`, push the tag, wait for required c
 
 ## Lane
 
-MM-Work suite lead or member: read [suite.md](suite.md) first. Name the lane from META:
+MM-Work and its modules have no rcand: they merge to development and it goes live ([suite.md](suite.md)). Every other repo: Name the lane from META:
 
 ```bash
 mmi-cli oracle org project get {owner}/{repo} --json

package/skills/rcand/suite.md

@@ -1,4 +1 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
-
-Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.
-
+MM-Work and its modules (MM-Account, MM-Chat, MM-Inspo, MM-Moments, MM-PM, MM-Strategy, MMI-Junior, MMI-Katip, MMI-Pulse, MMI-Scout, MM-Talent) merge to development and it goes live. No release, rc or candidate stage (owner ruling 2026-11-05): `development` is their only branch, and a merged change is live once its deploy is green. There is no suite rcand, suite release or suite hotfix for them and no `--suite-solo` path: never run `/release`, `/rcand` or `/hotfix` in these repos (the CLI refuses), and never tell the owner a landed change waits on a release. An urgent fix is a normal PR to development. A suite member never asks for, proposes or prompts an rc, release or hotfix — there is none; state what landed and stop.

package/skills/release/SKILL.md

@@ -11,7 +11,7 @@ Bare `minor|major|patch` (default `patch`), never a flag. A production release n
 
 ## Lane
 
-Read `mmi-cli oracle org project get {owner}/{repo} --json` and name the lane ([verification.md](verification.md) Lane rules); unreadable META → stop. On `releaseTrack: single` (MM-Work and its modules) or `trunk` there is no release lane. On single track a merge to development auto-deploys the `main` stage, and release, rcand and hotfix refuse. A merged single-track change is live once that deploy is green. A trunk repo follows its own declared publishing workflow. Never tell the owner a landed change waits on a release. [suite.md](suite.md) for suite cuts; [vercel.md](vercel.md) for Vercel.
+Read `mmi-cli oracle org project get {owner}/{repo} --json` and name the lane ([verification.md](verification.md) Lane rules); unreadable META → stop. MM-Work and its modules merge to development and it goes live. No release, rc or candidate stage: release, rcand and hotfix refuse there, and a merged change is live once its deploy is green ([suite.md](suite.md)). A `trunk` repo has no release lane either and follows its own declared publishing workflow. Never tell the owner a landed change waits on a release. [vercel.md](vercel.md) for Vercel.
 
 ## Preflight
 

package/skills/release/suite.md

@@ -1,9 +1,5 @@
-MM-Work and most of its modules are `releaseTrack: single` ([work-and-releases.md](../org-guide/references/work-and-releases.md)). A merge to development auto-deploys their `main` stage, so a landed change is live once that deploy is green. Never tell the owner such a change waits on a release. Read each repo's `releaseTrack` with `mmi-cli oracle org project get <owner/repo> --json` before naming any cut. A suite cut also cuts the MM-Work lead's rcand, which refuses while MM-Work is single track.
+MM-Work and its modules (MM-Account, MM-Chat, MM-Inspo, MM-Moments, MM-PM, MM-Strategy, MMI-Junior, MMI-Katip, MMI-Pulse, MMI-Scout, MM-Talent) merge to development and it goes live. No release, rc or candidate stage (owner ruling 2026-11-05): `development` is their only branch, and a merged change is live once its deploy is green. There is no suite rcand, suite release or suite hotfix for them and no `--suite-solo` path: never run `/release`, `/rcand` or `/hotfix` in these repos (the CLI refuses), and never tell the owner a landed change waits on a release. An urgent fix is a normal PR to development. A suite member never asks for, proposes or prompts an rc, release or hotfix — there is none; state what landed and stop.
 
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
+The Hub's own release train (MMI-Hub, Jerv-Hub, Jerv-JervCode and other non-MM repos with a release lane) is unchanged and never applies to MM-Work or its modules.
 
 Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.
-
-Every new mm-work suite Release (including solo and hotfix releases) requires both `--announce-summary-file <path>` (English) and `--announce-summary-file-tr <path>` (Turkish, "sen" form) in the update-notes template. The canonical wording lives in the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md#update-notes); this repo links it and never copies it. Each file has the section word `Fixed` / `Düzeldi` (what works now, never the problem: "Drive: Scans of large drives now finish without timing out."; a line without now / again / no longer, or artık / yeniden / tekrar / yine, is refused) and/or `New` / `Yeni` (what you can now do) on its own line, Fixed first, each only when it has lines. Under them go 1–8 lines of `<Area>: <sentence>.`, each at most 120 characters, with no issue numbers, versions or commit prefixes. Off-template or missing files refuse before tagging. Do not write the head (app · date · time) or the thanks line: MM-Work renders both from the Release date and credits. Suite release also requires a valid `--member-summary-file <owner/repo=path>` and `--member-summary-file-tr <owner/repo=path>` for every member being released, before promoting any member. Carried, held and already-released members need none, and existing Releases can resume without new files.
-The `/user-releases` feed serves template notes as `updateNotes: {en?, tr?: {fixed[], new[]}}`. Older title-and-notes bodies keep `plainWords` and get `updateNotes: null`.
-

package/skills/release/verification.md

@@ -8,7 +8,7 @@ Do not use a `--jq` formatter, raw `gh` reads (`gh run list`, `gh run list --com
 
 ## Release summary file
 
-Required for MMI-Hub and any product whose META carries `releaseChannel`; an mm-work suite repo needs one for its GitHub Release, following the update-notes template in [suite.md](suite.md). Run `mkdir -p .jerv/tmp` and write 3–6 lines to a file made by `mktemp .jerv/tmp/release-summary.XXXXXX` (scratch lives under `.jerv/tmp` in every repo; a repo-root `tmp/` may not exist and a host guards root writes).
+Required for MMI-Hub and any product whose META carries `releaseChannel`. MM-Work and its modules never cut a release, so they never write one ([suite.md](suite.md)). Run `mkdir -p .jerv/tmp` and write 3–6 lines to a file made by `mktemp .jerv/tmp/release-summary.XXXXXX` (scratch lives under `.jerv/tmp` in every repo; a repo-root `tmp/` may not exist and a host guards root writes).
 
 - MMI-Hub: neutral Hub-subsystem terms, never a product or brand name or a Jerv-side project (the train refuses one). Build every line from `git log --stat --format='%h %s%n%b' origin/main..origin/development`; a line you cannot point to there stays out, and every cited `#N` must appear there.
 - Product: in `releaseLanguage` (default `en`), plain words on what changed and why it matters; no prefixes, issue/PR numbers, file names or jargon.