@mutmutco/cli 2.10.1 → 2.12.0

package/dist/index.cjs

@@ -3392,9 +3392,9 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises = require("node:fs/promises");
+var import_promises2 = require("node:fs/promises");
 var import_node_fs5 = require("node:fs");
-var import_node_crypto = require("node:crypto");
+var import_node_crypto2 = require("node:crypto");
 
 // src/rules-sync.ts
 function normalizeEol(s) {
@@ -3468,6 +3468,25 @@ async function runSessionStart(parallel, sequential, io) {
   for (const lines of buffered) flush(lines, io);
   for (const step of sequential) flush(await runBufferedStep(step), io);
 }
+function buildSessionStartPlan(verbs) {
+  return {
+    parallel: [
+      { name: "rules sync", run: verbs.rulesSync },
+      { name: "saga show", run: verbs.sagaShow },
+      { name: "saga health", run: verbs.sagaHealth }
+    ],
+    sequential: [{ name: "doctor", run: verbs.doctor }]
+  };
+}
+function spawnDetachedSelf(args, deps) {
+  try {
+    deps.spawn(deps.execPath, [deps.scriptPath, ...args], { detached: true, stdio: "ignore", windowsHide: true }).unref();
+  } catch {
+  }
+}
+function northstarPointer() {
+  return "North Stars: run `mmi-cli northstar relevant` to load plans relevant to your task (`northstar list` for all).";
+}
 
 // src/saga-capture.ts
 function parseHookInput(stdin) {
@@ -3480,10 +3499,10 @@ function parseHookInput(stdin) {
 }
 
 // src/index.ts
-var import_node_child_process5 = require("node:child_process");
-var import_node_util5 = require("node:util");
-var import_node_path5 = require("node:path");
-var import_node_os = require("node:os");
+var import_node_child_process6 = require("node:child_process");
+var import_node_util6 = require("node:util");
+var import_node_path6 = require("node:path");
+var import_node_os2 = require("node:os");
 
 // src/saga-head-maintainer.ts
 var import_node_child_process2 = require("node:child_process");
@@ -3495,7 +3514,7 @@ var HEAD_PROMPT_ACTION_LIMIT = 50;
 var HEAD_PROMPT_DECISION_LIMIT = 80;
 function resolveEngine(platform, custom) {
   if (custom) return { cmd: custom, args: [], shell: true };
-  return { cmd: "claude", args: ["-p"], shell: platform === "win32" };
+  return { cmd: "claude", args: ["-p", "--no-session-persistence"], shell: platform === "win32" };
 }
 function headTsPath(key) {
   const safe = (s) => s.replace(/[^A-Za-z0-9._-]/g, "_");
@@ -3608,6 +3627,12 @@ async function runHeadEngine(prompt, timeoutMs = HEAD_ENGINE_TIMEOUT_MS) {
   });
 }
 
+// src/gh-create.ts
+var import_promises = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_node_path3 = require("node:path");
+var import_node_crypto = require("node:crypto");
+
 // src/board-priority.ts
 var BOARD_PRIORITY_NAMES = ["Urgent", "High", "Medium", "Low"];
 var CLI_PRIORITIES = ["urgent", "high", "medium", "low"];
@@ -3646,6 +3671,11 @@ function recoverPriorityFromEvents(events) {
 
 // src/gh-create.ts
 var ISSUE_TYPES = ["bug", "feature", "task"];
+var GH_MUTATION_TIMEOUT_MS = 12e4;
+function timeoutKillNote(err, timeoutMs) {
+  if (typeof err !== "object" || err === null || !err.killed) return void 0;
+  return `killed at the ${timeoutMs}ms timeout \u2014 the write may have completed server-side; verify before retrying`;
+}
 function normalizePriority(priority) {
   const p = priority.trim().toLowerCase();
   if (!CLI_PRIORITIES.includes(p)) {
@@ -3673,6 +3703,24 @@ function buildIssueArgs({ type, title, body, priority, repo, labels }) {
   for (const label of labels ?? []) args.push("--label", label);
   return args;
 }
+async function bodyArgsViaFile(args, deps = {}) {
+  const i = args.indexOf("--body");
+  if (i === -1 || i + 1 >= args.length) return { args, cleanup: async () => {
+  } };
+  const write = deps.write ?? import_promises.writeFile;
+  const remove = deps.remove ?? import_promises.unlink;
+  const file = (0, import_node_path3.join)(deps.dir ?? (0, import_node_os.tmpdir)(), `mmi-gh-body-${process.pid}-${(0, import_node_crypto.randomBytes)(4).toString("hex")}.md`);
+  await write(file, args[i + 1], "utf8");
+  return {
+    args: [...args.slice(0, i), "--body-file", file, ...args.slice(i + 2)],
+    cleanup: async () => {
+      try {
+        await remove(file);
+      } catch {
+      }
+    }
+  };
+}
 function buildAddToProjectArgs(projectId, contentId) {
   if (!projectId) throw new Error("addToProject: projectId is required");
   if (!contentId) throw new Error("addToProject: contentId is required");
@@ -3811,6 +3859,32 @@ function resumeCue() {
   return '> STATUS/RESUME CUE \u2014 For any status, resume, or "where do I stand" report: read THIS saga HEAD first (`mmi-cli saga show`), then reconcile its NEXT / LAST 5 / DECISIONS against the live board + git/gh before reporting. Do not rebuild the picture from board/issues/memory while skipping the HEAD. PRECEDENCE: the HEAD is prior-session belief and MAY BE SUPERSEDED \u2014 the current live user/master instruction WINS over any conflicting HEAD anchor, NEXT, or checklist; follow the live instruction and treat the stale HEAD item as superseded.';
 }
 
+// src/fetch-retry.ts
+async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
+  const attempts = opts.attempts ?? 3;
+  const baseDelayMs = opts.baseDelayMs ?? 250;
+  const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
+  const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  let lastErr;
+  for (let i = 0; i < attempts; i++) {
+    const isLast = i === attempts - 1;
+    const attemptInit = opts.timeoutMs ? { ...init, signal: AbortSignal.timeout(opts.timeoutMs) } : init;
+    try {
+      const res = await fetchImpl(url, attemptInit);
+      if (!isLast && retryOn(res)) {
+        await sleep(baseDelayMs * 2 ** i);
+        continue;
+      }
+      return res;
+    } catch (e) {
+      lastErr = e;
+      if (isLast) throw e;
+      await sleep(baseDelayMs * 2 ** i);
+    }
+  }
+  throw lastErr;
+}
+
 // src/saga-note.ts
 var AGENT_SURFACE_TOKENS = ["claude", "codex", "cursor", "gemini"];
 var ROUTE_LEVEL_403 = "saga API route-level 403 from GitHubAuthorizer cache/policy";
@@ -4025,32 +4099,153 @@ ${buildReportBody(body, sourceRepo)}`;
 }
 
 // src/board.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_util4 = require("node:util");
+
+// src/github-client.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_util3 = require("node:util");
+var rawExecFileP = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
+var execFileP = (file, args, options = {}) => rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: 1e4, killSignal: "SIGTERM", ...options });
+var cachedGhCliToken;
+async function githubToken() {
+  if (process.env.GH_TOKEN) return process.env.GH_TOKEN;
+  if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
+  cachedGhCliToken ??= execFileP("gh", ["auth", "token"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
+  return cachedGhCliToken;
+}
+var GitHubApiError = class extends Error {
+  status;
+  stderr;
+  graphqlErrors;
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = "GitHubApiError";
+    this.status = opts.status ?? 0;
+    this.stderr = message;
+    this.graphqlErrors = opts.graphqlErrors;
+  }
+};
+var DEFAULT_TIMEOUT_MS = 2e4;
+function joinUrl(base, path2) {
+  if (path2.startsWith("http://") || path2.startsWith("https://")) return path2;
+  return `${base.replace(/\/+$/, "")}/${path2.replace(/^\/+/, "")}`;
+}
+function withPerPage(url) {
+  if (/[?&]per_page=/.test(url)) return url;
+  return url.includes("?") ? `${url}&per_page=100` : `${url}?per_page=100`;
+}
+function nextLink(linkHeader) {
+  if (!linkHeader) return void 0;
+  for (const part of linkHeader.split(",")) {
+    const match = part.match(/<([^>]+)>\s*;\s*rel="next"/);
+    if (match) return match[1];
+  }
+  return void 0;
+}
+async function errorFromResponse(res) {
+  let detail = "";
+  try {
+    const text = await res.text();
+    try {
+      const parsed = JSON.parse(text);
+      detail = parsed.message ?? text;
+    } catch {
+      detail = text;
+    }
+  } catch {
+    detail = "";
+  }
+  const suffix = detail ? `: ${detail.trim()}` : "";
+  return new GitHubApiError(`HTTP ${res.status}${suffix} (${res.url})`, { status: res.status });
+}
+function createGitHubClient(options = {}) {
+  const baseUrl = options.baseUrl ?? process.env.GITHUB_API_URL ?? "https://api.github.com";
+  const token = options.token ?? githubToken;
+  const defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  async function request(method, url, init = {}) {
+    const t = await token();
+    const headers = {
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "mmi-cli",
+      ...t ? { Authorization: `Bearer ${t}` } : {},
+      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {},
+      ...init.headers
+    };
+    const res = await fetchImpl(url, {
+      method,
+      headers,
+      body: init.body !== void 0 ? JSON.stringify(init.body) : void 0,
+      signal: AbortSignal.timeout(init.timeoutMs ?? defaultTimeoutMs)
+    });
+    if (!res.ok) throw await errorFromResponse(res);
+    return res;
+  }
+  async function parseJson(res) {
+    if (res.status === 204) return void 0;
+    const text = await res.text();
+    if (!text) return void 0;
+    return JSON.parse(text);
+  }
+  return {
+    async rest(method, path2, init) {
+      const res = await request(method, joinUrl(baseUrl, path2), init);
+      return parseJson(res);
+    },
+    async restPaginate(path2, init) {
+      const items = [];
+      let url = withPerPage(joinUrl(baseUrl, path2));
+      while (url) {
+        const res = await request("GET", url, init);
+        const page = await parseJson(res);
+        if (Array.isArray(page)) items.push(...page);
+        url = nextLink(res.headers.get("link"));
+      }
+      return items;
+    },
+    async graphql(query, variables, init) {
+      const res = await request("POST", joinUrl(baseUrl, "graphql"), {
+        ...init,
+        body: { query, ...variables ? { variables } : {} }
+      });
+      const parsed = await parseJson(res);
+      if (parsed?.errors?.length) {
+        const message = parsed.errors.map((e) => e.message ?? e.type ?? "unknown GraphQL error").join("; ");
+        throw new GitHubApiError(`GraphQL: ${message}`, { status: 200, graphqlErrors: parsed.errors });
+      }
+      if (!parsed || parsed.data === void 0 || parsed.data === null) {
+        throw new GitHubApiError("GraphQL response did not include data", { status: 200 });
+      }
+      return parsed.data;
+    }
+  };
+}
+var cachedDefaultClient;
+function defaultGitHubClient() {
+  cachedDefaultClient ??= createGitHubClient();
+  return cachedDefaultClient;
+}
 
 // ../infra/board-vocab.mjs
 var BOARD_STATUSES = ["Todo", "In Progress", "In Review", "Done"];
 
 // src/board.ts
-var rawExecFileP = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
-var BOARD_GH_TIMEOUT_MS = 2e4;
+var rawExecFileP2 = (0, import_node_util4.promisify)(import_node_child_process4.execFile);
 var BOARD_GIT_TIMEOUT_MS = 1e4;
 var WRITE_PROBE_CONCURRENCY = 8;
-var execFileP = (file, args, options = {}) => (
+var execFileP2 = (file, args, options = {}) => (
   // encoding 'utf8' guarantees string output at runtime; the cast pins the type (promisify's
   // overloads widen to string|Buffer when options is spread in).
-  rawExecFileP(file, args, { encoding: "utf8", windowsHide: true, timeout: BOARD_GIT_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
+  rawExecFileP2(file, args, { encoding: "utf8", windowsHide: true, timeout: BOARD_GIT_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
 );
 var ACTIVE_STATUSES = /* @__PURE__ */ new Set(["Todo", "In Progress", "In Review"]);
 var STATUS_ORDER = new Map(BOARD_STATUSES.map((s, i) => [s, i]));
 var TYPE_LABELS = ["bug", "feature", "task"];
-var defaultGh = async (args) => {
-  const { stdout, stderr } = await execFileP("gh", args, { timeout: BOARD_GH_TIMEOUT_MS, maxBuffer: 10 * 1024 * 1024 });
-  return { stdout: String(stdout), stderr: String(stderr) };
-};
 var defaultGit = async (args) => {
   try {
-    const { stdout } = await execFileP("git", args, { timeout: BOARD_GIT_TIMEOUT_MS });
+    const { stdout } = await execFileP2("git", args, { timeout: BOARD_GIT_TIMEOUT_MS });
     return stdout.trim();
   } catch {
     return "";
@@ -4104,36 +4299,52 @@ query($owner: String!, $number: Int!, $after: String) {
     }
   }
 }`;
-var ISSUE_PROJECT_ITEM_QUERY = `
-query($repoOwner: String!, $repoName: String!, $number: Int!) {
-  repository(owner: $repoOwner, name: $repoName) {
-    issue(number: $number) {
-      id
-      number
-      title
-      url
-      state
-      repository { nameWithOwner }
-      labels(first: 10) { nodes { name } }
-      assignees(first: 10) { nodes { login } }
-      projectItems(first: 20) {
-        nodes {
-          id
-          project { id title }
-          fieldValues(first: 8) {
-            nodes {
-              ... on ProjectV2ItemFieldSingleSelectValue {
-                name
-                optionId
-                field { ... on ProjectV2SingleSelectField { id name } }
+var SINGLE_ITEM_CONTENT_FRAGMENT = `
+        id
+        number
+        title
+        url
+        state
+        repository { nameWithOwner }
+        labels(first: 10) { nodes { name } }
+        assignees(first: 10) { nodes { login } }
+        projectItems(first: 20) {
+          nodes {
+            id
+            project { id title }
+            fieldValues(first: 8) {
+              nodes {
+                ... on ProjectV2ItemFieldSingleSelectValue {
+                  name
+                  optionId
+                  field { ... on ProjectV2SingleSelectField { id name } }
+                }
               }
             }
           }
-        }
+        }`;
+var ISSUE_PROJECT_ITEM_QUERY = `
+query($repoOwner: String!, $repoName: String!, $number: Int!) {
+  viewer { login }
+  repository(owner: $repoOwner, name: $repoName) {
+    issueOrPullRequest(number: $number) {
+      __typename
+      ... on Issue {${SINGLE_ITEM_CONTENT_FRAGMENT}
+      }
+      ... on PullRequest {${SINGLE_ITEM_CONTENT_FRAGMENT}
       }
     }
   }
 }`;
+var UPDATE_ITEM_FIELD_MUTATION = `
+mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
+  updateProjectV2ItemFieldValue(input: { projectId: $projectId, itemId: $itemId, fieldId: $fieldId, value: { singleSelectOptionId: $optionId } }) {
+    projectV2Item { id }
+  }
+}`;
+async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
+  await client.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
+}
 function resolveBoardConfig(cfg) {
   const missing = [];
   if (!cfg.projectOwner) missing.push("projectOwner");
@@ -4256,7 +4467,7 @@ function renderBoardReport(report) {
   return lines.join("\n");
 }
 async function collectBoardItems(cfg, options, deps) {
-  const gh = deps.gh ?? defaultGh;
+  const client = deps.client ?? defaultGitHubClient();
   const git = deps.git ?? defaultGit;
   const currentRepo = options.repo ?? repoFromGitRemote(await git(["remote", "get-url", "origin"])) ?? "";
   if (!currentRepo) throw new Error("could not resolve current GitHub repo; pass --repo owner/repo");
@@ -4269,7 +4480,7 @@ async function collectBoardItems(cfg, options, deps) {
   let partial = false;
   do {
     try {
-      const page = await fetchProjectPage(gh, cfg, after);
+      const page = await fetchProjectPage(client, cfg, after);
       viewer ||= page.viewer.login;
       const project2 = page.organization?.projectV2;
       if (!project2) throw new Error(`project ${cfg.projectOwner}#${cfg.projectNumber} not found`);
@@ -4287,19 +4498,15 @@ async function collectBoardItems(cfg, options, deps) {
   } while (after);
   return { items: nodesToItems(nodes, warnings, cfg), viewer, repo: currentRepo, projectId, projectTitle, warnings, partial };
 }
-async function repoCanPush(repo, gh) {
+async function repoCanPush(repo, client) {
   try {
-    const { stdout } = await gh(["api", `repos/${repo}`, "--jq", ".permissions.push"]);
-    const value = stdout.trim();
-    if (value === "true") return true;
-    if (value === "false") return false;
-    const parsed = JSON.parse(value);
-    return typeof parsed.permissions?.push === "boolean" ? parsed.permissions.push : void 0;
+    const parsed = await client.rest("GET", `repos/${repo}`);
+    return typeof parsed?.permissions?.push === "boolean" ? parsed.permissions.push : void 0;
   } catch {
     return void 0;
   }
 }
-async function resolveWritableReposForClaimables(items, gh, allowPartial) {
+async function resolveWritableReposForClaimables(items, client, allowPartial) {
   const candidateRepos = [...new Set(items.filter((item) => item.status === "Todo" && item.assignees.length === 0).map((item) => item.repository))];
   const repos = /* @__PURE__ */ new Set();
   const warnings = [];
@@ -4308,7 +4515,7 @@ async function resolveWritableReposForClaimables(items, gh, allowPartial) {
   const worker = async () => {
     while (next < candidateRepos.length) {
       const repo = candidateRepos[next++];
-      const canPush = await repoCanPush(repo, gh);
+      const canPush = await repoCanPush(repo, client);
       if (canPush === true) {
         repos.add(repo.toLowerCase());
         continue;
@@ -4326,9 +4533,9 @@ async function resolveWritableReposForClaimables(items, gh, allowPartial) {
 }
 async function readBoard(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const gh = deps.gh ?? defaultGh;
+  const client = deps.client ?? defaultGitHubClient();
   const collected = await collectBoardItems(cfg, options, deps);
-  const writable = await resolveWritableReposForClaimables(collected.items, gh, options.allowPartial ?? false);
+  const writable = await resolveWritableReposForClaimables(collected.items, client, options.allowPartial ?? false);
   collected.warnings.push(...writable.warnings);
   collected.partial = collected.partial || writable.partial;
   const groups = partitionBoardItems(collected.items, collected.viewer, collected.repo, writable.repos);
@@ -4341,7 +4548,7 @@ async function readBoard(options, deps = {}) {
     partial: collected.partial
   };
   if (options.includeBundleDetails) {
-    await attachBundleDetails(report, gh, options.allowPartial ?? false);
+    await attachBundleDetails(report, client, options.allowPartial ?? false);
   }
   return report;
 }
@@ -4352,67 +4559,50 @@ function findBoardItem(items, selector) {
   if (!found) throw new Error(`${selector.repo}#${selector.number} is not on this project board`);
   return found;
 }
+async function resolveCurrentRepo(options, deps) {
+  const git = deps.git ?? defaultGit;
+  const currentRepo = options.repo ?? repoFromGitRemote(await git(["remote", "get-url", "origin"])) ?? "";
+  if (!currentRepo) throw new Error("could not resolve current GitHub repo; pass --repo owner/repo");
+  return currentRepo;
+}
 async function moveBoardItem(options, deps = {}) {
   if (!BOARD_STATUSES.includes(options.status)) {
     throw new Error(`unknown status '${options.status}'; expected one of ${BOARD_STATUSES.join(", ")}`);
   }
   const cfg = resolveBoardConfig(options.config);
-  const gh = deps.gh ?? defaultGh;
-  const collected = await collectBoardItems(cfg, options, deps);
-  const selector = parseIssueSelector(options.selector, collected.repo);
-  const item = findBoardItem(collected.items, selector);
+  const client = deps.client ?? defaultGitHubClient();
+  const currentRepo = await resolveCurrentRepo(options, deps);
+  const selector = parseIssueSelector(options.selector, currentRepo);
+  const lookup = await fetchIssueProjectItem(client, cfg, selector);
+  const item = lookup.item;
+  if (!item) throw new Error(`${selector.repo}#${selector.number} is not on this project board`);
   if (item.contentType !== "Issue") throw new Error(`${item.ref} is not an issue`);
   const optionId = cfg.statusOptions[options.status];
   try {
-    await gh([
-      "project",
-      "item-edit",
-      "--id",
-      item.itemId,
-      "--project-id",
-      cfg.projectId,
-      "--field-id",
-      cfg.statusFieldId,
-      "--single-select-option-id",
-      optionId
-    ]);
+    await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.statusFieldId, optionId);
   } catch (e) {
     const warning = `partial move: ${item.ref} status was not changed to ${options.status} (${ghError(e)})`;
     if (!options.allowPartial) throw new Error(warning);
-    return { item, viewer: collected.viewer, repo: collected.repo, status: item.status, partial: true, warning };
+    return { item, viewer: lookup.viewer, repo: currentRepo, status: item.status, partial: true, warning };
   }
   return {
     item: { ...item, status: options.status, statusOptionId: optionId },
-    viewer: collected.viewer,
-    repo: collected.repo,
+    viewer: lookup.viewer,
+    repo: currentRepo,
     status: options.status,
     partial: false
   };
 }
 async function showBoardItem(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const gh = deps.gh ?? defaultGh;
-  const collected = await collectBoardItems(cfg, options, deps);
-  const selector = parseIssueSelector(options.selector, collected.repo);
-  let item;
-  try {
-    item = findBoardItem(collected.items, selector);
-  } catch (e) {
-    const fallback = await fetchIssueProjectItem(gh, cfg, selector);
-    if (!fallback) throw e;
-    item = fallback;
-  }
+  const client = deps.client ?? defaultGitHubClient();
+  const currentRepo = await resolveCurrentRepo(options, deps);
+  const selector = parseIssueSelector(options.selector, currentRepo);
+  const { item } = await fetchIssueProjectItem(client, cfg, selector);
+  if (!item) throw new Error(`${selector.repo}#${selector.number} is not on this project board`);
   if (item.contentType === "Issue") {
     try {
-      const { stdout } = await gh(["issue", "view", String(item.number), "--repo", item.repository, "--json", "body,comments"]);
-      const detail = JSON.parse(stdout);
-      item.details = {
-        body: detail.body ?? "",
-        comments: (detail.comments ?? []).map((comment) => ({
-          author: comment.author?.login ?? "",
-          body: comment.body ?? ""
-        }))
-      };
+      item.details = await fetchIssueDetails(client, item.repository, item.number);
     } catch (e) {
       if (!options.allowPartial) throw new Error(`detail read failed: ${item.ref}: ${ghError(e)}`);
     }
@@ -4421,17 +4611,17 @@ async function showBoardItem(options, deps = {}) {
 }
 async function claimBoardIssue(options, deps = {}) {
   const cfg = resolveBoardConfig(options.config);
-  const gh = deps.gh ?? defaultGh;
+  const client = deps.client ?? defaultGitHubClient();
   const collected = await collectBoardItems(cfg, { repo: options.repo, allowPartial: options.allowPartial }, deps);
   const selector = parseIssueSelector(options.selector, collected.repo);
   try {
     findBoardItem(collected.items, selector);
   } catch (e) {
-    const fallback = await fetchIssueProjectItem(gh, cfg, selector);
+    const fallback = (await fetchIssueProjectItem(client, cfg, selector)).item;
     if (!fallback) throw e;
     collected.items.push(fallback);
   }
-  const writable = await resolveWritableReposForClaimables(collected.items, gh, options.allowPartial ?? false);
+  const writable = await resolveWritableReposForClaimables(collected.items, client, options.allowPartial ?? false);
   collected.warnings.push(...writable.warnings);
   collected.partial = collected.partial || writable.partial;
   const report = {
@@ -4448,7 +4638,7 @@ async function claimBoardIssue(options, deps = {}) {
   }
   let item = findClaimableItem(report, selector);
   if (item.contentType !== "Issue") throw new Error(`${item.ref} is not an issue`);
-  const fresh = await fetchIssueProjectItem(gh, cfg, { repo: item.repository, number: item.number });
+  const fresh = (await fetchIssueProjectItem(client, cfg, { repo: item.repository, number: item.number })).item;
   if (!fresh) throw new Error(`${item.ref} is not on this project board`);
   if (fresh.status !== "Todo") throw new Error(`${item.ref} is not claimable: Status is ${fresh.status}`);
   if (fresh.assignees.length) throw new Error(`${item.ref} is already assigned to @${fresh.assignees.join(", @")}`);
@@ -4456,23 +4646,12 @@ async function claimBoardIssue(options, deps = {}) {
   const assignee = options.assignee ?? "@me";
   const assignedLogin = assignee === "@me" ? report.viewer : assignee.replace(/^@/, "");
   try {
-    await gh(["issue", "edit", String(item.number), "--repo", item.repository, "--add-assignee", assignee]);
+    await client.rest("POST", `repos/${item.repository}/issues/${item.number}/assignees`, { body: { assignees: [assignedLogin] } });
   } catch (e) {
     throw new Error(`claim failed before board status changed: ${ghError(e)}`);
   }
   try {
-    await gh([
-      "project",
-      "item-edit",
-      "--id",
-      item.itemId,
-      "--project-id",
-      cfg.projectId,
-      "--field-id",
-      cfg.statusFieldId,
-      "--single-select-option-id",
-      cfg.statusOptions["In Progress"]
-    ]);
+    await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.statusFieldId, cfg.statusOptions["In Progress"]);
   } catch (e) {
     const warning = `partial claim: ${item.ref} was assigned to @${assignedLogin}, but Status was not moved to In Progress (${ghError(e)})`;
     if (!options.allowPartial) throw new Error(warning);
@@ -4491,22 +4670,11 @@ async function claimBoardIssue(options, deps = {}) {
     partial: false
   };
 }
-async function setBoardItemPriority(gh, cfg, itemId, priority) {
+async function setBoardItemPriority(client, cfg, itemId, priority) {
   if (!isPriorityFieldConfigured(cfg)) return void 0;
   const optionId = resolvePriorityOptionId(cfg, priority);
   if (!optionId || !cfg.priorityFieldId || !cfg.projectId) return void 0;
-  await gh([
-    "project",
-    "item-edit",
-    "--id",
-    itemId,
-    "--project-id",
-    cfg.projectId,
-    "--field-id",
-    cfg.priorityFieldId,
-    "--single-select-option-id",
-    optionId
-  ]);
+  await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
 async function backfillBoardPriorities(options, deps = {}) {
@@ -4514,7 +4682,7 @@ async function backfillBoardPriorities(options, deps = {}) {
   if (!isPriorityFieldConfigured(cfg)) {
     throw new Error("priority field is not configured in Hub registry META (priorityFieldId + priorityOptions)");
   }
-  const gh = deps.gh ?? defaultGh;
+  const client = deps.client ?? defaultGitHubClient();
   const collected = await collectBoardItems(cfg, { repo: options.repo }, deps);
   const issues = collected.items.filter((item) => item.contentType === "Issue");
   const concurrency = Math.max(1, options.concurrency ?? 8);
@@ -4525,7 +4693,7 @@ async function backfillBoardPriorities(options, deps = {}) {
       return;
     }
     try {
-      const priority = await recoverIssuePriority(gh, item);
+      const priority = await recoverIssuePriority(client, item);
       if (!priority) {
         result.skipped += 1;
         return;
@@ -4537,18 +4705,7 @@ async function backfillBoardPriorities(options, deps = {}) {
       }
       const optionId = cfg.priorityOptions?.[priority];
       if (!optionId) throw new Error(`no option id for ${priority}`);
-      await gh([
-        "project",
-        "item-edit",
-        "--id",
-        item.itemId,
-        "--project-id",
-        cfg.projectId,
-        "--field-id",
-        cfg.priorityFieldId,
-        "--single-select-option-id",
-        optionId
-      ]);
+      await updateItemSingleSelect(client, cfg.projectId, item.itemId, cfg.priorityFieldId, optionId);
       result.set += 1;
       result.details.push(`${item.ref} \u2192 ${priority}`);
     } catch (e) {
@@ -4561,88 +4718,65 @@ async function backfillBoardPriorities(options, deps = {}) {
   }
   return result;
 }
-async function recoverIssuePriority(gh, item) {
+async function recoverIssuePriority(client, item) {
   for (const label of item.labels) {
     const fromLabel = labelToFieldPriority(label);
     if (fromLabel) return fromLabel;
   }
-  const { stdout } = await gh(["api", `repos/${item.repository}/issues/${item.number}/events`, "--paginate"]);
-  return recoverPriorityFromEvents(parsePaginatedEvents(stdout));
+  const events = await client.restPaginate(
+    `repos/${item.repository}/issues/${item.number}/events`
+  );
+  return recoverPriorityFromEvents(events);
 }
-function parsePaginatedEvents(stdout) {
-  const trimmed = stdout.trim();
-  if (!trimmed) return [];
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (Array.isArray(parsed)) return parsed;
-  } catch {
-  }
-  return trimmed.split(/\r?\n/).filter(Boolean).flatMap((line) => {
-    try {
-      const parsed = JSON.parse(line);
-      return Array.isArray(parsed) ? parsed : [];
-    } catch {
-      return [];
-    }
+async function fetchProjectPage(client, cfg, after) {
+  return client.graphql(PROJECT_ITEMS_QUERY, {
+    owner: cfg.projectOwner,
+    number: cfg.projectNumber,
+    ...after ? { after } : {}
   });
 }
-async function fetchProjectPage(gh, cfg, after) {
-  const args = [
-    "api",
-    "graphql",
-    "-f",
-    `query=${PROJECT_ITEMS_QUERY}`,
-    "-f",
-    `owner=${cfg.projectOwner}`,
-    "-F",
-    `number=${cfg.projectNumber}`
-  ];
-  if (after) args.push("-f", `after=${after}`);
-  const { stdout } = await gh(args);
-  const parsed = JSON.parse(stdout);
-  if (!parsed.data) throw new Error("gh GraphQL response did not include data");
-  return parsed.data;
+function isGraphQLNotFound(e) {
+  const errors = e.graphqlErrors;
+  return Boolean(e instanceof GitHubApiError && errors?.length && errors.every((entry) => entry.type === "NOT_FOUND"));
 }
-async function fetchIssueProjectItem(gh, cfg, selector) {
+async function fetchIssueProjectItem(client, cfg, selector) {
   const [repoOwner, repoName] = selector.repo.split("/");
-  if (!repoOwner || !repoName) return void 0;
-  const { stdout } = await gh([
-    "api",
-    "graphql",
-    "-f",
-    `query=${ISSUE_PROJECT_ITEM_QUERY}`,
-    "-f",
-    `repoOwner=${repoOwner}`,
-    "-f",
-    `repoName=${repoName}`,
-    "-F",
-    `number=${selector.number}`
-  ]);
-  const parsed = JSON.parse(stdout);
-  const issue2 = parsed.data?.repository?.issue;
-  if (!issue2) {
-    const pageNodes = parsed.data?.organization?.projectV2?.items.nodes ?? [];
-    return nodesToItems(pageNodes, [], cfg).find(
-      (item) => item.repository.toLowerCase() === selector.repo.toLowerCase() && item.number === selector.number
-    );
+  if (!repoOwner || !repoName) return { viewer: "" };
+  let data;
+  try {
+    data = await client.graphql(ISSUE_PROJECT_ITEM_QUERY, {
+      repoOwner,
+      repoName,
+      number: selector.number
+    });
+  } catch (e) {
+    if (isGraphQLNotFound(e)) return { viewer: "" };
+    throw e;
   }
-  const projectItem = (issue2.projectItems?.nodes ?? []).find((item) => item.project?.id === cfg.projectId);
-  if (!projectItem) return void 0;
-  return nodeToItem({
-    id: projectItem.id,
-    fieldValues: projectItem.fieldValues,
-    content: {
-      __typename: "Issue",
-      id: issue2.id,
-      number: issue2.number,
-      title: issue2.title,
-      url: issue2.url,
-      state: issue2.state,
-      repository: issue2.repository,
-      labels: issue2.labels,
-      assignees: issue2.assignees
-    }
-  }, cfg);
+  const viewer = data.viewer?.login ?? "";
+  const content = data.repository?.issueOrPullRequest;
+  if (!content) return { viewer };
+  const projectItem = (content.projectItems?.nodes ?? []).find((item) => item.project?.id === cfg.projectId);
+  if (!projectItem) return { viewer };
+  const { projectItems: _projectItems, ...contentFields } = content;
+  return {
+    viewer,
+    item: nodeToItem({
+      id: projectItem.id,
+      fieldValues: projectItem.fieldValues,
+      content: contentFields
+    }, cfg)
+  };
+}
+async function fetchIssueDetails(client, repo, number) {
+  const issue2 = await client.rest("GET", `repos/${repo}/issues/${number}`);
+  const comments = await client.restPaginate(
+    `repos/${repo}/issues/${number}/comments`
+  );
+  return {
+    body: issue2?.body ?? "",
+    comments: comments.map((comment) => ({ author: comment.user?.login ?? "", body: comment.body ?? "" }))
+  };
 }
 function nodesToItems(nodes, warnings, cfg) {
   const items = [];
@@ -4701,20 +4835,12 @@ function nodeToItem(node, cfg) {
 function isSupportedContent(content) {
   return Boolean(content && (content.__typename === "Issue" || content.__typename === "PullRequest"));
 }
-async function attachBundleDetails(report, gh, allowPartial) {
+async function attachBundleDetails(report, client, allowPartial) {
   const candidates = detailCandidates(report);
   if (candidates.length <= 1) return;
   for (const item of candidates) {
     try {
-      const { stdout } = await gh(["issue", "view", String(item.number), "--repo", item.repository, "--json", "body,comments"]);
-      const detail = JSON.parse(stdout);
-      item.details = {
-        body: detail.body ?? "",
-        comments: (detail.comments ?? []).map((comment) => ({
-          author: comment.author?.login ?? "",
-          body: comment.body ?? ""
-        }))
-      };
+      item.details = await fetchIssueDetails(client, item.repository, item.number);
     } catch (e) {
       const warning = `partial detail read: ${item.ref}: ${ghError(e)}`;
       if (!allowPartial) throw new Error(warning);
@@ -5347,14 +5473,14 @@ function buildInstalledPluginVersionCheck(input) {
 }
 
 // src/stage-runner.ts
-var import_node_child_process4 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
+var import_node_path4 = require("node:path");
 var import_node_net = require("node:net");
-var import_node_util4 = require("node:util");
-var execFileP2 = (0, import_node_util4.promisify)(import_node_child_process4.execFile);
+var import_node_util5 = require("node:util");
+var execFileP3 = (0, import_node_util5.promisify)(import_node_child_process5.execFile);
 function stageStatePath(cwd = process.cwd()) {
-  return (0, import_node_path3.join)(cwd, "tmp", "stage", "state.json");
+  return (0, import_node_path4.join)(cwd, "tmp", "stage", "state.json");
 }
 function validateStageConfig(config = {}, action) {
   const problems = [];
@@ -5387,7 +5513,7 @@ function isPortFree(port) {
   });
 }
 async function shell(command, cwd, timeoutMs) {
-  await execFileP2(command, [], {
+  await execFileP3(command, [], {
     cwd,
     shell: true,
     timeout: timeoutMs,
@@ -5406,7 +5532,7 @@ function readState(path2) {
 async function killTree(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return;
   if (process.platform === "win32") {
-    await execFileP2("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }).catch(() => void 0);
+    await execFileP3("taskkill", ["/PID", String(pid), "/T", "/F"], { windowsHide: true }).catch(() => void 0);
     return;
   }
   try {
@@ -5469,7 +5595,7 @@ async function startStage(config = {}, opts = {}) {
   }
   const sub = (s) => s != null && stagePort != null ? s.replace(/\$\{?STAGE_PORT\}?/g, String(stagePort)) : s;
   const up = sub(config.up.trim());
-  const child = (0, import_node_child_process4.spawn)(up, {
+  const child = (0, import_node_child_process5.spawn)(up, {
     cwd,
     shell: true,
     detached: true,
@@ -5759,22 +5885,29 @@ function safeJson(text, fallback) {
     return fallback;
   }
 }
-async function ghJson(deps, args, fallback) {
+async function restJson(deps, path2, fallback) {
+  try {
+    return await deps.client.rest("GET", path2) ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+async function restPagedJson(deps, path2, fallback) {
   try {
-    return safeJson((await deps.gh(args)).stdout, fallback);
+    return await deps.client.restPaginate(path2);
   } catch {
     return fallback;
   }
 }
 async function resolveOwners(deps) {
-  const members = await ghJson(deps, ["api", `orgs/${OWNER}/members?role=admin`, "--paginate"], []);
+  const members = await restPagedJson(deps, `orgs/${OWNER}/members?role=admin`, []);
   return members.map((m) => m.login);
 }
 function collaboratorRole(c) {
   return c.role_name ?? (c.permissions?.admin ? "admin" : c.permissions?.maintain ? "maintain" : "write");
 }
 async function auditRepoCollaborators(repo, owners, deps) {
-  const collabs = await ghJson(deps, ["api", `repos/${repo}/collaborators?affiliation=direct`, "--paginate"], []);
+  const collabs = await restPagedJson(deps, `repos/${repo}/collaborators?affiliation=direct`, []);
   const findings = [];
   for (const c of collabs) {
     if (owners.has(c.login)) continue;
@@ -5795,7 +5928,7 @@ async function auditRepoCollaborators(repo, owners, deps) {
 async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set()) {
   let restrictions = null;
   try {
-    restrictions = safeJson((await deps.gh(["api", `repos/${repo}/branches/${branch}/protection/restrictions`])).stdout, null);
+    restrictions = await deps.client.rest("GET", `repos/${repo}/branches/${branch}/protection/restrictions`) ?? null;
   } catch {
     restrictions = null;
   }
@@ -5879,7 +6012,7 @@ async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /*
   return { repo, class: repoClass, ok: !findings.some((f) => f.severity === "high"), findings };
 }
 async function auditOrgBasePermission(deps) {
-  const org = await ghJson(deps, ["api", `orgs/${OWNER}`], {});
+  const org = await restJson(deps, `orgs/${OWNER}`, {});
   const perm = org.default_repository_permission;
   if (perm && perm !== "read" && perm !== "none") {
     return [{
@@ -6022,9 +6155,16 @@ function safeJson2(text, fallback) {
     return fallback;
   }
 }
-async function ghJson2(deps, args, fallback) {
+async function restJson2(deps, path2, fallback) {
+  try {
+    return await deps.client.rest("GET", path2) ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+async function restPagedJson2(deps, path2, fallback) {
   try {
-    return safeJson2((await deps.gh(args)).stdout, fallback);
+    return await deps.client.restPaginate(path2);
   } catch {
     return fallback;
   }
@@ -6032,7 +6172,7 @@ async function ghJson2(deps, args, fallback) {
 async function contentExists(deps, repo, branch, path2) {
   try {
     const encodedPath = path2.split("/").map(encodeURIComponent).join("/");
-    await deps.gh(["api", `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`]);
+    await deps.client.rest("GET", `repos/${repo}/contents/${encodedPath}?ref=${encodeURIComponent(branch)}`);
     return true;
   } catch {
     return false;
@@ -6040,7 +6180,7 @@ async function contentExists(deps, repo, branch, path2) {
 }
 async function getProtection(deps, repo, branch) {
   try {
-    return safeJson2((await deps.gh(["api", `repos/${repo}/branches/${branch}/protection`])).stdout, {});
+    return await deps.client.rest("GET", `repos/${repo}/branches/${branch}/protection`) ?? {};
   } catch {
     return null;
   }
@@ -6068,7 +6208,7 @@ async function rulesetDetails(deps, repo, list) {
       details.push(ruleset);
       continue;
     }
-    details.push(await ghJson2(deps, ["api", `repos/${repo}/rulesets/${ruleset.id}`], ruleset));
+    details.push(await restJson2(deps, `repos/${repo}/rulesets/${ruleset.id}`, ruleset));
   }
   return details;
 }
@@ -6081,11 +6221,11 @@ async function verifyBootstrap(repo, repoClass, deps) {
   const branchesWanted = expectedBranches(repoClass);
   const baseBranch = repoClass === "content" ? "main" : "development";
   const checks = [];
-  const repoInfo = await ghJson2(deps, ["api", `repos/${repo}`], {});
+  const repoInfo = await restJson2(deps, `repos/${repo}`, {});
   checks.push({ ok: Boolean(repoInfo.default_branch), label: "repo exists" });
   checks.push({ ok: repoInfo.default_branch === baseBranch, label: `default branch is ${baseBranch}`, detail: repoInfo.default_branch || "missing" });
   checks.push({ ok: repoInfo.has_wiki === true, label: "wiki enabled", detail: repoInfo.has_wiki === true ? void 0 : "has_wiki is false or unavailable" });
-  const branchList = await ghJson2(deps, ["api", `repos/${repo}/branches`, "--paginate"], []);
+  const branchList = await restPagedJson2(deps, `repos/${repo}/branches`, []);
   const branchNames = new Set(branchList.map((b) => b.name));
   for (const branch of branchesWanted) {
     checks.push({ ok: branchNames.has(branch), label: `branch exists: ${branch}` });
@@ -6118,14 +6258,14 @@ async function verifyBootstrap(repo, repoClass, deps) {
     checks.push({ ok: await contentExists(deps, repo, baseBranch, trainScript), label: `train tooling script exists: ${trainScript}` });
   }
   checks.push({ ok: await contentExists(deps, repo, baseBranch, ".cursor/environment.json"), label: "Cursor environment committed" });
-  const labels = await ghJson2(deps, ["label", "list", "--repo", repo, "--limit", "200", "--json", "name"], []);
+  const labels = await restPagedJson2(deps, `repos/${repo}/labels`, []);
   const labelNames = new Set(labels.map((l) => l.name));
   for (const label of requiredLabels) {
     checks.push({ ok: labelNames.has(label), label: `label exists: ${label}` });
   }
   const strays = strayDefaultLabels.filter((l) => labelNames.has(l));
   checks.push({ ok: strays.length === 0, label: "no stray GitHub-default labels", detail: presentDetail(strays) });
-  const actions = await ghJson2(deps, ["api", `repos/${repo}/actions/permissions`], {});
+  const actions = await restJson2(deps, `repos/${repo}/actions/permissions`, {});
   checks.push({ ok: actions.enabled === true, label: "GitHub Actions enabled" });
   const config = deps.projectMeta ?? null;
   checks.push({
@@ -6133,12 +6273,18 @@ async function verifyBootstrap(repo, repoClass, deps) {
     label: "registry project board META exists"
   });
   if (config?.projectOwner && config.projectNumber != null) {
-    const project2 = await ghJson2(
-      deps,
-      ["project", "field-list", String(config.projectNumber), "--owner", config.projectOwner, "--format", "json"],
-      {}
-    );
-    const fields = project2.fields || [];
+    const fieldsQuery = `query($login: String!, $number: Int!) { organization(login: $login) { projectV2(number: $number) { fields(first: 50) { nodes { ... on ProjectV2FieldCommon { id name } ... on ProjectV2SingleSelectField { id name options { id name } } } } } } }`;
+    const fields = await (async () => {
+      try {
+        const data = await deps.client.graphql(fieldsQuery, {
+          login: config.projectOwner,
+          number: config.projectNumber
+        });
+        return (data.organization?.projectV2?.fields?.nodes ?? []).filter((f) => Boolean(f?.id && f?.name));
+      } catch {
+        return [];
+      }
+    })();
     const statusField = fields.find((field) => field.name === "Status");
     const labelField = fields.find((field) => field.name === "Labels");
     checks.push({
@@ -6195,12 +6341,17 @@ async function verifyBootstrap(repo, repoClass, deps) {
       }
     }
     const workflowQuery = "query($login: String!, $number: Int!) { organization(login: $login) { projectV2(number: $number) { workflows(first: 30) { nodes { name enabled } } } } }";
-    const workflowResponse = await ghJson2(
-      deps,
-      ["api", "graphql", "-f", `query=${workflowQuery}`, "-f", `login=${config.projectOwner}`, "-F", `number=${config.projectNumber}`],
-      {}
-    );
-    const workflows = workflowResponse.data?.organization?.projectV2?.workflows?.nodes || [];
+    const workflowResponse = await (async () => {
+      try {
+        return await deps.client.graphql(workflowQuery, {
+          login: config.projectOwner,
+          number: config.projectNumber
+        });
+      } catch {
+        return {};
+      }
+    })();
+    const workflows = workflowResponse.organization?.projectV2?.workflows?.nodes || [];
     for (const workflowName of requiredProjectWorkflows) {
       checks.push({
         ok: workflows.some((workflow) => workflow.name === workflowName && workflow.enabled === true),
@@ -6212,11 +6363,7 @@ async function verifyBootstrap(repo, repoClass, deps) {
   if (fanout != null) checks.push({ ok: fanout, label: `fanout target registered on ${baseBranch}` });
   const projectRegistry = localRegistryCheck(deps, "projects.json", (json) => Array.isArray(json?.projects) && json.projects.some((p) => (p.repos || []).includes(repo)));
   if (projectRegistry != null) checks.push({ ok: projectRegistry, label: "cloud-agent project registry includes repo" });
-  const rulesetList = await ghJson2(
-    deps,
-    ["api", `repos/${repo}/rulesets?includes_parents=true`],
-    []
-  );
+  const rulesetList = await restJson2(deps, `repos/${repo}/rulesets?includes_parents=true`, []);
   const rulesets = await rulesetDetails(deps, repo, rulesetList);
   const activeOrgRulesets = rulesets.filter(
     (r) => r.source_type === "Organization" && r.target === "branch" && r.enforcement === "active"
@@ -6402,17 +6549,22 @@ var ORG_CONFIG_PATH = "/org/config";
 var PROJECTS_ENVELOPE_KEY = "projects";
 
 // src/registry-client.ts
-var DEFAULT_TIMEOUT_MS = 8e3;
+var DEFAULT_TIMEOUT_MS2 = 8e3;
+var RETRY_ATTEMPTS = 3;
+function retriedFetch(deps, url, init) {
+  return fetchWithRetry(deps.fetch ?? fetch, url, init, {
+    attempts: RETRY_ATTEMPTS,
+    timeoutMs: deps.timeoutMs ?? DEFAULT_TIMEOUT_MS2
+  });
+}
 async function fetchTrainAuthority(repo, deps) {
   if (!deps.baseUrl) return { ok: false, error: "Hub API URL not configured" };
   const token = await deps.token();
   if (!token) return { ok: false, error: "no GitHub token (gh auth login)" };
-  const doFetch = deps.fetch ?? fetch;
   try {
-    const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}/train-authority?repo=${encodeURIComponent(repo)}`, {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/train-authority?repo=${encodeURIComponent(repo)}`, {
       method: "GET",
-      headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      headers: { Authorization: `Bearer ${token}` }
     });
     if (!res.ok) return { ok: false, error: `train-authority HTTP ${res.status}` };
     const body = await res.json();
@@ -6426,12 +6578,10 @@ async function fetchProjectsList(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
   if (!token) return null;
-  const doFetch = deps.fetch ?? fetch;
   try {
-    const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}${PROJECTS_LIST_PATH}`, {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}${PROJECTS_LIST_PATH}`, {
       method: "GET",
-      headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      headers: { Authorization: `Bearer ${token}` }
     });
     if (!res.ok) return null;
     const body = await res.json();
@@ -6450,12 +6600,10 @@ async function fetchProjectBySlugChecked(slug, deps) {
   if (!slug) return { ok: false, error: "no slug" };
   const token = await deps.token();
   if (!token) return { ok: false, error: "no GitHub token (run `gh auth login`)" };
-  const doFetch = deps.fetch ?? fetch;
   try {
-    const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(slug)}`, {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(slug)}`, {
       method: "GET",
-      headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      headers: { Authorization: `Bearer ${token}` }
     });
     if (res.status === 404) return { ok: true, project: null };
     if (!res.ok) return { ok: false, error: `HTTP ${res.status}` };
@@ -6472,12 +6620,10 @@ async function fetchDeployStatusBySlug(slug, deps) {
   if (!deps.baseUrl || !slug) return null;
   const token = await deps.token();
   if (!token) return null;
-  const doFetch = deps.fetch ?? fetch;
   try {
-    const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(slug)}/deploy-status`, {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/projects/${encodeURIComponent(slug)}/deploy-status`, {
       method: "GET",
-      headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      headers: { Authorization: `Bearer ${token}` }
     });
     if (!res.ok) return null;
     const body = await res.json();
@@ -6491,12 +6637,10 @@ async function fetchOrgConfig(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
   if (!token) return null;
-  const doFetch = deps.fetch ?? fetch;
   try {
-    const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}${ORG_CONFIG_PATH}`, {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}${ORG_CONFIG_PATH}`, {
       method: "GET",
-      headers: { Authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      headers: { Authorization: `Bearer ${token}` }
     });
     if (!res.ok) return null;
     return await res.json();
@@ -6508,13 +6652,11 @@ async function postJson(pathSuffix, payload, deps, method = "POST") {
   if (!deps.baseUrl) return { ok: false, status: 0, body: null, error: "no Hub API URL (set MMI_HUB_URL or use a current MMI CLI/plugin build)" };
   const token = await deps.token();
   if (!token) return { ok: false, status: 0, body: null, error: "no GitHub token (run `gh auth login`)" };
-  const doFetch = deps.fetch ?? fetch;
   try {
-    const res = await doFetch(`${deps.baseUrl.replace(/\/$/, "")}${pathSuffix}`, {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}${pathSuffix}`, {
       method,
       headers: { Authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: JSON.stringify(payload),
-      signal: AbortSignal.timeout(deps.timeoutMs ?? DEFAULT_TIMEOUT_MS)
+      body: JSON.stringify(payload)
     });
     let body = null;
     try {
@@ -6532,6 +6674,9 @@ async function registerProject(payload, deps) {
 async function upsertProject(slug, patch, deps) {
   return postJson(`/projects/${encodeURIComponent(slug)}`, patch, deps);
 }
+async function attestAppGaps(slug, repo, deps) {
+  return postJson(`/projects/${encodeURIComponent(slug)}/attest-app`, { repo }, deps);
+}
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps);
 }
@@ -6570,7 +6715,24 @@ function stageRequiredSecrets(stage2, meta) {
 function stageKey(stage2, key) {
   return key.includes("/") ? key : `${stage2}/${key}`;
 }
+function hasRuntimeSecretContract(contract) {
+  return Boolean(contract) && !Array.isArray(contract);
+}
+function appAttestationOf(meta) {
+  const a = meta?.appAttested;
+  if (!a || typeof a !== "object" || Array.isArray(a)) return null;
+  const { at, by } = a;
+  return typeof at === "string" && at.length > 0 && typeof by === "string" && by.length > 0 ? { at, by } : null;
+}
+function attestedLine(att) {
+  return `App-owned readiness attested by @${att.by} on ${att.at.slice(0, 10)} \u2014 the static checklist is cleared (the doctor reads no product repo files); re-run \`mmi-cli project attest\` after app-owned structural changes.`;
+}
+var CONTRACT_UNDECLARED_LINE = "No runtime secrets declared \u2014 declare requiredRuntimeSecrets (a per-stage name map) in the registry META, or attest the app needs none with an explicit empty stage map ({ dev: [], rc: [], main: [] }).";
 function appGapsFor(meta, model, slug, projectType) {
+  const attested = appAttestationOf(meta);
+  const isTenantWeb = !(projectType === "content" || model === "content") && projectType !== "desktop-game" && !(projectType === "non-deployable" || model === "none") && model !== "hub-serverless" && model !== "serverless";
+  const contractUndeclared = isTenantWeb && Boolean(meta) && !hasRuntimeSecretContract(meta?.requiredRuntimeSecrets);
+  if (attested) return contractUndeclared ? [attestedLine(attested), CONTRACT_UNDECLARED_LINE] : [attestedLine(attested)];
   if (projectType === "content" || model === "content") return ["Content/KB repo: keep app-owned work to docs/content changes; release train does not apply."];
   if (projectType === "desktop-game") {
     return [
@@ -6602,6 +6764,9 @@ function appGapsFor(meta, model, slug, projectType) {
     "Make app config fail clearly for missing required env in prod/rc instead of relying on hidden defaults.",
     "Keep app-owned README.md and architecture.md aligned with v2 central deploy/secrets reality."
   ];
+  if (contractUndeclared) {
+    gaps.unshift(CONTRACT_UNDECLARED_LINE);
+  }
   if (slug === "mmi-katip") {
     gaps.push("Katip-specific app plan: declare Google Workspace service-account requirements, use the service account numeric OAuth2 client ID for DWD, remove prod-hidden impersonation defaults, and make non-critical Google Workspace failures degrade instead of crash-looping.");
   }
@@ -6680,7 +6845,29 @@ async function runV2Heal(repoOrSlug, opts, deps) {
 async function buildV2Doctor(repoOrSlug, deps) {
   const slug = slugOfRepo(repoOrSlug);
   const repo = repoFrom(repoOrSlug, slug);
-  const meta = await deps.getProject(slug);
+  const read = await deps.getProject(slug);
+  if (!read.ok) {
+    const degradedSecrets = {
+      dev: { required: [], present: [], missing: [] },
+      rc: { required: [], present: [], missing: [] },
+      main: { required: [], present: [], missing: [] }
+    };
+    const degradedStage = {
+      dev: { ok: false, required: false },
+      rc: { ok: false, required: false },
+      main: { ok: false, required: false }
+    };
+    return {
+      ok: false,
+      repo,
+      slug,
+      registryError: read.error,
+      hubOwned: { meta: { ok: false, missing: [] }, deployCoords: degradedStage, deployState: degradedStage, secrets: degradedSecrets },
+      autoHealAvailable: [],
+      appOwnedGaps: [`Hub registry read failed (${read.error}) \u2014 diagnosis degraded; nothing is known about META, coords, or gaps. Likely transient (cold start, network, or auth blip): retry \`mmi-cli project doctor\` shortly.`]
+    };
+  }
+  const meta = read.project;
   const projectType = resolveProjectType(meta, repo);
   const model = resolveDeployModel(meta, repo);
   const autoHeal = buildV2HealPatch(repo, meta);
@@ -6741,7 +6928,8 @@ async function buildV2Doctor(repoOrSlug, deps) {
     hubOwned: { meta: { ok: metaMissing.length === 0, missing: metaMissing }, deployCoords, deployState, secrets: secrets2 },
     secretsError,
     autoHealAvailable: Object.keys(autoHeal.patch),
-    appOwnedGaps: autoHeal.appOwnedGaps
+    appOwnedGaps: autoHeal.appOwnedGaps,
+    appAttested: appAttestationOf(meta) ?? void 0
   };
 }
 function renderReadinessIssueBody(existingBody, report, opts = {}) {
@@ -6785,6 +6973,30 @@ ${section}`.trim();
 // src/project-set.ts
 var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "edgeDomains", "requiredGcpApis", "publishRequired"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
+var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
+function parseRuntimeSecretsVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('project set: requiredRuntimeSecrets must be JSON, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}');
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("project set: requiredRuntimeSecrets must be a stage map (a flat array is not box-loadable)");
+  }
+  const map = parsed;
+  const out = {};
+  for (const [stage2, names] of Object.entries(map)) {
+    if (!RUNTIME_SECRET_STAGES.includes(stage2)) {
+      throw new Error(`project set: requiredRuntimeSecrets stage "${stage2}" \u2014 expected only ${RUNTIME_SECRET_STAGES.join("/")}`);
+    }
+    if (!Array.isArray(names) || names.some((n) => typeof n !== "string" || !n.trim())) {
+      throw new Error(`project set: requiredRuntimeSecrets.${stage2} must be an array of non-empty secret names`);
+    }
+    out[stage2] = names;
+  }
+  return out;
+}
 function buildProjectSetPatch(input) {
   const patch = {};
   if (input.class) {
@@ -6814,6 +7026,8 @@ function buildProjectSetPatch(input) {
         const n = Number(raw);
         if (!Number.isFinite(n)) throw new Error("project set: projectNumber must be numeric");
         patch[key] = n;
+      } else if (key === "requiredRuntimeSecrets") {
+        patch[key] = parseRuntimeSecretsVar(raw);
       } else {
         patch[key] = raw;
       }
@@ -6834,6 +7048,10 @@ function buildProjectSetPatch(input) {
   }
   return patch;
 }
+function repoFromRemoteUrl(remoteUrl) {
+  const m = remoteUrl.trim().match(/^(?:[a-z][a-z0-9+.-]*:\/\/)?(?:[^@\s/]+@)?github\.com[:/]([^/\s:]+)\/([^/\s]+?)(?:\.git)?\/?$/i);
+  return m ? `${m[1]}/${m[2]}` : void 0;
+}
 function requireProjectTarget(commandName, explicitTarget, currentRepo) {
   const target = explicitTarget?.trim() || currentRepo?.trim();
   if (!target) {
@@ -6869,10 +7087,91 @@ function parseKbTree(stdout, prefix) {
 }
 
 // src/plan.ts
-var import_node_path4 = require("node:path");
+var import_node_path5 = require("node:path");
+
+// src/frontmatter.ts
+function splitFrontmatter(content) {
+  const match = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(content);
+  if (!match) return { entries: [], body: content };
+  return { entries: match[1].split(/\r?\n/).filter((line) => line.trim()), body: content.slice(match[0].length) };
+}
+function entryKeyValue(line) {
+  const i = line.indexOf(":");
+  if (i < 0) return null;
+  return { key: line.slice(0, i).trim().toLowerCase(), value: line.slice(i + 1).trim() };
+}
+function frontmatterValue(content, key) {
+  const want = key.trim().toLowerCase();
+  for (const line of splitFrontmatter(content).entries) {
+    const kv = entryKeyValue(line);
+    if (kv && kv.key === want) return kv.value || void 0;
+  }
+  return void 0;
+}
+function frontmatterList(content, key) {
+  const raw = frontmatterValue(content, key);
+  if (!raw) return [];
+  return raw.replace(/^\[/, "").replace(/\]$/, "").split(",").map((s) => s.trim()).filter(Boolean);
+}
+function extractPlanMeta(content) {
+  const meta = {};
+  const status = frontmatterValue(content, "status");
+  if (status) meta.status = status;
+  const tags = frontmatterList(content, "topic-tags");
+  if (tags.length) meta.topicTags = tags;
+  const title = frontmatterValue(content, "title");
+  if (title) meta.title = title;
+  const supersedes = frontmatterValue(content, "supersedes");
+  if (supersedes) meta.supersedes = supersedes;
+  return meta;
+}
+
+// src/plan-relevance.ts
+var STOP = /* @__PURE__ */ new Set(["the", "and", "for", "with", "plan", "issue", "fix", "feat", "add", "wip", "src", "tsx", "mjs"]);
+function tokenize(s) {
+  return (s ?? "").replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((t) => t.length >= 3 && !STOP.has(t));
+}
+var SUPPRESSED = /* @__PURE__ */ new Set(["superseded", "graduated"]);
+function signalTokens(s) {
+  const all = [
+    ...tokenize(s.branch),
+    ...tokenize(s.issueTitle),
+    ...(s.issueLabels ?? []).flatMap(tokenize),
+    ...(s.changedFiles ?? []).flatMap(tokenize)
+  ];
+  return new Set(all);
+}
+function rankPlansByRelevance(plans, signals, opts = {}) {
+  const wanted = signalTokens(signals);
+  const eligible = opts.includeAll ? plans : plans.filter((p) => !p.status || !SUPPRESSED.has(p.status.toLowerCase()));
+  const ranked = eligible.map((plan2) => {
+    const tagTokens = new Set((plan2.topicTags ?? []).flatMap(tokenize));
+    const titleTokens = new Set(tokenize(plan2.title));
+    const slugTokens = new Set(tokenize(plan2.slug));
+    const matched = /* @__PURE__ */ new Set();
+    let score = 0;
+    for (const t of wanted) {
+      if (tagTokens.has(t)) {
+        score += 3;
+        matched.add(t);
+      } else if (titleTokens.has(t)) {
+        score += 2;
+        matched.add(t);
+      } else if (slugTokens.has(t)) {
+        score += 1;
+        matched.add(t);
+      }
+    }
+    return { plan: plan2, score, matched: [...matched] };
+  });
+  ranked.sort((a, b) => b.score - a.score || (b.plan.updatedAt ?? "").localeCompare(a.plan.updatedAt ?? ""));
+  return ranked;
+}
+
+// src/plan.ts
 var PLANS_DIR = "plans";
-var META_FILE = (0, import_node_path4.join)(PLANS_DIR, ".plan-meta.json");
-var planPath = (slug) => (0, import_node_path4.join)(PLANS_DIR, `${slug}.md`);
+var META_FILE = (0, import_node_path5.join)(PLANS_DIR, ".plan-meta.json");
+var planPath = (slug) => (0, import_node_path5.join)(PLANS_DIR, `${slug}.md`);
 var metaKey = (project2, slug) => `${project2}/${slug}`;
 function parseMeta(raw) {
   if (!raw) return {};
@@ -6901,12 +7200,7 @@ function formatPlanList(plans) {
   return plans.map((p) => `${p.slug}  \xB7  ${p.updatedAt ?? "-"}  \xB7  ${p.project}`).join("\n");
 }
 var TIMEOUT_MS = 8e3;
-var GRADUATION_KEYS = /* @__PURE__ */ new Set(["northstar-graduation", "privacy", "merged-pr"]);
-function splitFrontmatter(content) {
-  const match = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(content);
-  if (!match) return { entries: [], body: content };
-  return { entries: match[1].split(/\r?\n/).filter((line) => line.trim()), body: content.slice(match[0].length) };
-}
+var GRADUATION_KEYS = /* @__PURE__ */ new Set(["northstar-graduation", "privacy", "merged-pr", "status"]);
 function markPlanGraduated(content, opts) {
   const { entries, body } = splitFrontmatter(normalizeEol(content));
   const preserved = entries.filter((line) => {
@@ -6916,6 +7210,7 @@ function markPlanGraduated(content, opts) {
   const next = [
     ...preserved,
     "northstar-graduation: built-and-merged",
+    "status: graduated",
     "privacy: org",
     `merged-pr: ${opts.mergedPr}`
   ];
@@ -6935,6 +7230,8 @@ async function planPush(deps, slug, opts = {}) {
   const meta = parseMeta(deps.readMetaRaw());
   const entry = meta[metaKey(project2, slug)];
   const body = { project: project2, slug, content };
+  const frontmatterMeta = extractPlanMeta(content);
+  if (Object.keys(frontmatterMeta).length) body.meta = frontmatterMeta;
   if (opts.force) body.force = true;
   else if (entry?.etag) body.baseEtag = entry.etag;
   const res = await deps.fetch(`${deps.apiUrl}/plan/put`, {
@@ -6988,35 +7285,59 @@ async function planPull(deps, slug, opts = {}) {
   deps.log(`pulled ${slug} \u2192 ${planPath(slug)}`);
   return true;
 }
+async function fetchPlanList(deps, project2) {
+  const qs = project2 ? `?${new URLSearchParams({ project: project2 }).toString()}` : "";
+  const res = await deps.fetch(`${deps.apiUrl}/plan/list${qs}`, {
+    method: "GET",
+    headers: await deps.headers(),
+    signal: AbortSignal.timeout(TIMEOUT_MS)
+  });
+  if (!res.ok) throw new Error(`HTTP ${res.status}`);
+  const { plans } = await res.json();
+  return plans ?? [];
+}
 async function planList(deps, opts = {}) {
   const project2 = opts.project ?? (opts.quiet ? await deps.project() : void 0);
-  const qs = project2 ? `?${new URLSearchParams({ project: project2 }).toString()}` : "";
-  let res;
+  let plans;
   try {
-    res = await deps.fetch(`${deps.apiUrl}/plan/list${qs}`, {
-      method: "GET",
-      headers: await deps.headers(),
-      signal: AbortSignal.timeout(TIMEOUT_MS)
-    });
+    plans = await fetchPlanList(deps, project2);
   } catch (e) {
     if (!opts.quiet) deps.err(`plan list: ${e.message}`);
     return;
   }
-  if (!res.ok) {
-    if (!opts.quiet) deps.err(`plan list failed: HTTP ${res.status}`);
-    return;
-  }
-  const { plans } = await res.json();
-  if (opts.json) {
-    deps.log(JSON.stringify(plans));
-    return;
-  }
+  if (opts.json) return deps.log(JSON.stringify(plans));
   if (!plans.length) {
     if (!opts.quiet) deps.log("no plans");
     return;
   }
   deps.log(formatPlanList(plans));
 }
+function formatRelevant(ranked) {
+  return ranked.map((r) => {
+    const why = r.matched.length ? `matches ${r.matched.join(", ")}` : "recent";
+    return `${r.plan.slug}  \xB7  ${why}  \xB7  mmi-cli northstar pull ${r.plan.slug}`;
+  }).join("\n");
+}
+async function relevantPlans(deps, signals, opts = {}) {
+  const project2 = opts.project ?? await deps.project();
+  let plans;
+  try {
+    const scoped = await fetchPlanList(deps, project2);
+    const unprojected = project2 === "-" ? [] : await fetchPlanList(deps, "-").catch(() => []);
+    const seen = new Set(scoped.map((p) => `${p.project}/${p.slug}`));
+    plans = [...scoped, ...unprojected.filter((p) => !seen.has(`${p.project}/${p.slug}`))];
+  } catch (e) {
+    deps.err(`northstar relevant: ${e.message}`);
+    return;
+  }
+  if (!plans.length) return deps.log("no North Stars for this repo yet");
+  const ranked = rankPlansByRelevance(plans, signals, { includeAll: opts.includeAll });
+  const top = (opts.includeAll ? ranked : ranked.filter((r) => r.score > 0)).slice(0, opts.limit ?? 5);
+  if (!top.length) {
+    return deps.log(`no task-relevant North Stars among ${plans.length} for this repo \u2014 \`mmi-cli northstar relevant --all\` lists recent ones`);
+  }
+  deps.log(formatRelevant(top));
+}
 async function planDelete(deps, slug, opts = {}) {
   const project2 = opts.project ?? await deps.project();
   const res = await deps.fetch(`${deps.apiUrl}/plan/delete`, {
@@ -7113,12 +7434,14 @@ function formatVaultPointer(p) {
 }
 var TIMEOUT_MS2 = 8e3;
 var repoOf = (slug) => `${OWNER2}/${slug}`;
+async function vaultSlug(deps, opts) {
+  return (opts.repo ? opts.repo.split("/").pop() : await deps.slug()).toLowerCase();
+}
 async function targetRepo(deps, opts) {
-  return opts.repo ?? repoOf(await deps.slug());
+  return opts.repo ?? repoOf(await vaultSlug(deps, opts));
 }
 async function secretsWhere(deps, opts) {
-  const slug = opts.repo ? opts.repo.split("/").pop().toLowerCase() : await deps.slug();
-  deps.log(formatVaultPointer(vaultPointer(slug)));
+  deps.log(formatVaultPointer(vaultPointer(await vaultSlug(deps, opts))));
 }
 async function readErr(res) {
   try {
@@ -7300,7 +7623,7 @@ async function secretsSet(deps, key, opts) {
     );
     return;
   }
-  deps.log(`set ${key} (${classifyTier(await deps.slug(), key)} tier)`);
+  deps.log(`set ${key} (${classifyTier(await vaultSlug(deps, opts), key)} tier)`);
 }
 async function secretsEdit(deps, key, opts) {
   return secretsSet(deps, key, opts);
@@ -7352,8 +7675,8 @@ async function secretsRevoke(deps, repo, login, key, _opts) {
   }
   deps.log(`revoked @${login}'s access to ${key} in ${repo}`);
 }
-async function secretsUse(deps, key, _opts) {
-  const slug = await deps.slug();
+async function secretsUse(deps, key, opts) {
+  const slug = await vaultSlug(deps, opts);
   const tier = classifyTier(slug, key);
   const path2 = secretParamName(slug, key);
   deps.log(
@@ -7438,30 +7761,23 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/index.ts
-var rawExecFileP2 = (0, import_node_util5.promisify)(import_node_child_process5.execFile);
+var rawExecFileP3 = (0, import_node_util6.promisify)(import_node_child_process6.execFile);
 var DEFAULT_EXEC_TIMEOUT_MS = 1e4;
-var execFileP3 = (file, args, options = {}) => (
+var execFileP4 = (file, args, options = {}) => (
   // encoding 'utf8' guarantees string stdout/stderr at runtime; the cast pins the type because
   // promisify(execFile)'s overloads widen to string|Buffer when options is spread in.
-  rawExecFileP2(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
+  rawExecFileP3(file, args, { encoding: "utf8", windowsHide: true, timeout: DEFAULT_EXEC_TIMEOUT_MS, killSignal: "SIGTERM", ...options })
 );
 var GIT_TIMEOUT_MS = DEFAULT_EXEC_TIMEOUT_MS;
 var GC_GH_TIMEOUT_MS = 2e4;
-var cachedGhCliToken;
-async function githubToken() {
-  if (process.env.GH_TOKEN) return process.env.GH_TOKEN;
-  if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
-  cachedGhCliToken ??= execFileP3("gh", ["auth", "token"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
-  return cachedGhCliToken;
-}
 var cachedGithubLogin;
 async function githubLogin() {
-  cachedGithubLogin ??= execFileP3("gh", ["api", "user", "--jq", ".login"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
+  cachedGithubLogin ??= execFileP4("gh", ["api", "user", "--jq", ".login"]).then(({ stdout }) => stdout.trim() || void 0).catch(() => void 0);
   return cachedGithubLogin;
 }
 async function awsCallerArn() {
   try {
-    const { stdout } = await execFileP3(
+    const { stdout } = await execFileP4(
       "aws",
       ["sts", "get-caller-identity", "--query", "Arn", "--output", "text"],
       { timeout: GIT_TIMEOUT_MS }
@@ -7478,7 +7794,7 @@ async function sagaHeaders(extra = {}) {
 async function loadConfig() {
   let file = {};
   try {
-    file = JSON.parse(await (0, import_promises.readFile)(".mmi/config.json", "utf8"));
+    file = JSON.parse(await (0, import_promises2.readFile)(".mmi/config.json", "utf8"));
   } catch {
     file = {};
   }
@@ -7486,12 +7802,16 @@ async function loadConfig() {
   return file;
 }
 var discoveredConfig = null;
+function registryDegradeError(error) {
+  return new Error(`Hub registry read failed (${error}) \u2014 board coords could not be discovered; likely transient (cold start, network, or auth blip) \u2014 retry shortly`);
+}
 async function loadConfigOrDiscover() {
   if (discoveredConfig) return discoveredConfig;
   const floor = await loadConfig();
   if (!floor.sagaApiUrl) return stripMutableBoardConfig(floor);
-  const meta = await fetchProjectBySlug(await repoSlug(), registryClientDeps(floor));
-  discoveredConfig = meta ? boardConfigFromProject(meta, floor) : stripMutableBoardConfig(floor);
+  const read = await fetchProjectBySlugChecked(await repoSlug(), registryClientDeps(floor));
+  if (!read.ok) throw registryDegradeError(read.error);
+  discoveredConfig = read.project ? boardConfigFromProject(read.project, floor) : stripMutableBoardConfig(floor);
   return discoveredConfig;
 }
 async function loadConfigForRepo(targetRepo2) {
@@ -7499,9 +7819,10 @@ async function loadConfigForRepo(targetRepo2) {
   const cwdRepo = await resolveRepo();
   if (cwdRepo && targetRepo2.toLowerCase() === cwdRepo.toLowerCase()) return loadConfigOrDiscover();
   const floor = await loadConfig();
-  const meta = await fetchProjectBySlug(slugOf(targetRepo2), registryClientDeps(floor));
-  if (!meta) return stripMutableBoardConfig(floor);
-  return boardConfigFromProject(meta, floor);
+  const read = await fetchProjectBySlugChecked(slugOf(targetRepo2), registryClientDeps(floor));
+  if (!read.ok) throw registryDegradeError(read.error);
+  if (!read.project) return stripMutableBoardConfig(floor);
+  return boardConfigFromProject(read.project, floor);
 }
 function repoFromSelector(selector) {
   const trimmed = selector.trim();
@@ -7521,7 +7842,7 @@ var DEFAULT_RULES_SOURCE = "https://raw.githubusercontent.com/mutmutco/MMI-Hub/d
 var SESSION_FILE = ".mmi/.session";
 var gitOut = async (args) => {
   try {
-    return (await execFileP3("git", [...args])).stdout.trim();
+    return (await execFileP4("git", [...args])).stdout.trim();
   } catch {
     return "";
   }
@@ -7538,7 +7859,7 @@ function sessionDeps() {
     },
     writePersisted: (id) => persistSession(id),
     now: () => /* @__PURE__ */ new Date(),
-    rand: () => (0, import_node_crypto.randomBytes)(4).toString("hex")
+    rand: () => (0, import_node_crypto2.randomBytes)(4).toString("hex")
   };
 }
 var resolveSessionId = () => resolveSession(sessionDeps());
@@ -7561,16 +7882,11 @@ async function postCapture(capture, quiet = false) {
       if (!quiet) console.error("mmi-cli saga: Hub API URL not configured");
       return;
     }
-    const res = await fetch(`${cfg.sagaApiUrl}/saga/capture`, {
+    const res = await fetchWithRetry(fetch, `${cfg.sagaApiUrl}/saga/capture`, {
       method: "POST",
       headers: await sagaHeaders({ "content-type": "application/json" }),
-      body: JSON.stringify({ ...capture, ...await sagaKey(cfg) }),
-      // Capture latency is high + variable (server-side HEAD render); 8s dropped larger notes. Match the
-      // head-write timeout (20s) so a continuity note isn't lost to a slow/cold backend. No client retry:
-      // the capture isn't guaranteed idempotent, so a retry after a server-side-completed write could
-      // duplicate the note. Backend capture-latency root cause tracked in #255.
-      signal: AbortSignal.timeout(2e4)
-    });
+      body: JSON.stringify({ ...capture, ...await sagaKey(cfg) })
+    }, { attempts: 2, timeoutMs: 2e4, retryOn: () => false });
     let message = "";
     if (!res.ok) {
       try {
@@ -7593,18 +7909,18 @@ async function readStdin() {
 async function ghPrs(limit) {
   const args = (state) => ["pr", "list", "--state", state, "--limit", String(limit), "--json", "number,headRefName,state"];
   const [open, closed] = await Promise.all([
-    execFileP3("gh", args("open"), { timeout: GC_GH_TIMEOUT_MS }),
-    execFileP3("gh", args("closed"), { timeout: GC_GH_TIMEOUT_MS })
+    execFileP4("gh", args("open"), { timeout: GC_GH_TIMEOUT_MS }),
+    execFileP4("gh", args("closed"), { timeout: GC_GH_TIMEOUT_MS })
   ]);
   return [...JSON.parse(open.stdout || "[]"), ...JSON.parse(closed.stdout || "[]")];
 }
 async function worktreeBranches() {
-  const { stdout } = await execFileP3("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
+  const { stdout } = await execFileP4("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
   const parsed = parseWorktreePorcelain(stdout);
   return await Promise.all(parsed.map(async (w) => {
     let dirty = true;
     try {
-      const { stdout: status } = await execFileP3("git", ["-C", w.path, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
+      const { stdout: status } = await execFileP4("git", ["-C", w.path, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS });
       dirty = status.trim().length > 0;
     } catch {
       dirty = true;
@@ -7616,7 +7932,7 @@ async function gcPlan(remote, limit) {
   const [branches, current, stale, prs, worktrees] = await Promise.all([
     gitOut(["branch", "--format=%(refname:short)"]),
     gitOut(["rev-parse", "--abbrev-ref", "HEAD"]),
-    execFileP3("git", ["remote", "prune", remote, "--dry-run"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseRemotePruneDryRun(`${r.stdout}${r.stderr}`)).catch(() => []),
+    execFileP4("git", ["remote", "prune", remote, "--dry-run"], { timeout: GIT_TIMEOUT_MS }).then((r) => parseRemotePruneDryRun(`${r.stdout}${r.stderr}`)).catch(() => []),
     ghPrs(limit),
     worktreeBranches()
   ]);
@@ -7644,8 +7960,8 @@ async function applyGcPlan(plan2, remote) {
   const result = { removedBranches: [], removedTrackingRefs: [], failed: [], pruned: false };
   for (const branch of plan2.branches) {
     try {
-      if (branch.worktreePath) await execFileP3("git", ["worktree", "remove", "--force", branch.worktreePath], { timeout: GIT_TIMEOUT_MS });
-      await execFileP3("git", ["branch", "-D", branch.branch], { timeout: GIT_TIMEOUT_MS });
+      if (branch.worktreePath) await execFileP4("git", ["worktree", "remove", "--force", branch.worktreePath], { timeout: GIT_TIMEOUT_MS });
+      await execFileP4("git", ["branch", "-D", branch.branch], { timeout: GIT_TIMEOUT_MS });
       result.removedBranches.push(branch.branch);
     } catch (e) {
       result.failed.push(`${branch.branch}: ${e.message.split("\n")[0]}`);
@@ -7653,7 +7969,7 @@ async function applyGcPlan(plan2, remote) {
   }
   for (const ref of plan2.trackingRefs) {
     try {
-      await execFileP3("git", ["update-ref", "-d", `refs/remotes/${remote}/${ref.branch}`], { timeout: GIT_TIMEOUT_MS });
+      await execFileP4("git", ["update-ref", "-d", `refs/remotes/${remote}/${ref.branch}`], { timeout: GIT_TIMEOUT_MS });
       result.removedTrackingRefs.push(ref.branch);
     } catch (e) {
       result.failed.push(`${remote}/${ref.branch}: ${e.message.split("\n")[0]}`);
@@ -7661,7 +7977,7 @@ async function applyGcPlan(plan2, remote) {
   }
   if (plan2.branches.some((b) => b.worktreePath)) {
     try {
-      await execFileP3("git", ["worktree", "prune"], { timeout: GIT_TIMEOUT_MS });
+      await execFileP4("git", ["worktree", "prune"], { timeout: GIT_TIMEOUT_MS });
       result.pruned = true;
     } catch (e) {
       result.failed.push(`worktree prune: ${e.message.split("\n")[0]}`);
@@ -7671,11 +7987,11 @@ async function applyGcPlan(plan2, remote) {
 }
 function resolveVersion() {
   try {
-    const manifest = (0, import_node_path5.join)(__dirname, "..", "..", ".claude-plugin", "plugin.json");
+    const manifest = (0, import_node_path6.join)(__dirname, "..", "..", ".claude-plugin", "plugin.json");
     return JSON.parse((0, import_node_fs5.readFileSync)(manifest, "utf8")).version || "0.0.0";
   } catch {
     try {
-      const pkg = (0, import_node_path5.join)(__dirname, "..", "package.json");
+      const pkg = (0, import_node_path6.join)(__dirname, "..", "package.json");
       return JSON.parse((0, import_node_fs5.readFileSync)(pkg, "utf8")).version || "0.0.0";
     } catch {
       return "0.0.0";
@@ -7684,14 +8000,14 @@ function resolveVersion() {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path5.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path6.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
 }
 async function fetchReleasedVersion() {
   try {
-    const { stdout } = await execFileP3("gh", pluginManifestVersionArgs(), { timeout: 5e3 });
+    const { stdout } = await execFileP4("gh", pluginManifestVersionArgs(), { timeout: 5e3 });
     return parseManifestVersion(stdout);
   } catch {
     return void 0;
@@ -7705,9 +8021,9 @@ async function applyVersionAutoUpdate(report, log) {
   const target = report.releasedVersion ?? "latest";
   if (action === "plugin-pull") {
     try {
-      const root = (await execFileP3("git", ["-C", process.env.CLAUDE_PLUGIN_ROOT, "rev-parse", "--show-toplevel"], { timeout: PLUGIN_PULL_TIMEOUT_MS })).stdout.trim();
+      const root = (await execFileP4("git", ["-C", process.env.CLAUDE_PLUGIN_ROOT, "rev-parse", "--show-toplevel"], { timeout: PLUGIN_PULL_TIMEOUT_MS })).stdout.trim();
       log(`  \u21BB refreshing MMI plugin ${report.currentVersion} \u2192 ${target} (effective next session)\u2026`);
-      await execFileP3("git", ["-C", root, "pull", "--ff-only"], { timeout: PLUGIN_PULL_TIMEOUT_MS });
+      await execFileP4("git", ["-C", root, "pull", "--ff-only"], { timeout: PLUGIN_PULL_TIMEOUT_MS });
       return { ...report, ok: true };
     } catch {
       return report;
@@ -7734,7 +8050,7 @@ async function requireFreshTrainCli(commandName) {
 var consoleIo = { log: (m) => console.log(m), err: (m) => console.error(m) };
 var CLAUDE_PLUGIN_TIMEOUT_MS = 12e4;
 function runHostBin(bin, args, opts) {
-  return isWin ? execFileP3("cmd.exe", ["/c", bin, ...args], opts) : execFileP3(bin, args, opts);
+  return isWin ? execFileP4("cmd.exe", ["/c", bin, ...args], opts) : execFileP4(bin, args, opts);
 }
 async function runClaudePlugin(args) {
   try {
@@ -7781,11 +8097,11 @@ async function runRulesSync(opts, io = consoleIo) {
   for (const entry of fetched) {
     if ("error" in entry) continue;
     const { file, source } = entry;
-    const current = (0, import_node_fs5.existsSync)(file) ? await (0, import_promises.readFile)(file, "utf8") : null;
+    const current = (0, import_node_fs5.existsSync)(file) ? await (0, import_promises2.readFile)(file, "utf8") : null;
     if (needsUpdate(source, current)) {
       const slash = file.lastIndexOf("/");
       if (slash > 0) (0, import_node_fs5.mkdirSync)(file.slice(0, slash), { recursive: true });
-      await (0, import_promises.writeFile)(file, normalizeEol(source), "utf8");
+      await (0, import_promises2.writeFile)(file, normalizeEol(source), "utf8");
       changed++;
       if (!opts.quiet) io.log(`mmi-cli rules: updated ${file}`);
     }
@@ -7805,14 +8121,14 @@ async function runDocsSync(opts, io = consoleIo) {
     isDirty: async (f) => await gitOut(["status", "--porcelain", "--", f]) !== "",
     originContent: async (f) => {
       try {
-        return (await execFileP3("git", ["show", `origin/${def}:${f}`], { maxBuffer: 10 * 1024 * 1024 })).stdout;
+        return (await execFileP4("git", ["show", `origin/${def}:${f}`], { maxBuffer: 10 * 1024 * 1024 })).stdout;
       } catch {
         return null;
       }
     },
-    localContent: async (f) => (0, import_node_fs5.existsSync)(f) ? await (0, import_promises.readFile)(f, "utf8") : null,
+    localContent: async (f) => (0, import_node_fs5.existsSync)(f) ? await (0, import_promises2.readFile)(f, "utf8") : null,
     writeDoc: async (f, c) => {
-      await (0, import_promises.writeFile)(f, c, "utf8");
+      await (0, import_promises2.writeFile)(f, c, "utf8");
     }
   });
   for (const f of result.updated) io.log(`mmi-cli docs: updated ${f} (from origin/${def})`);
@@ -7824,7 +8140,7 @@ docs.command("sync").option("--quiet", "stay silent unless something changed or
 var saga = program2.command("saga").description("per-session continuity");
 async function runNote(summary, o) {
   const [sha, key] = await Promise.all([gitOut(["rev-parse", "--short", "HEAD"]), sagaKey(await loadConfig())]);
-  const capture = buildNoteCapture(summary, o, (0, import_node_crypto.randomUUID)(), { sha: sha || void 0, branch: key.branch });
+  const capture = buildNoteCapture(summary, o, (0, import_node_crypto2.randomUUID)(), { sha: sha || void 0, branch: key.branch });
   await postCapture(capture);
 }
 saga.command("note <summary>").description("record a one-line structured note into your saga (the per-turn capture)").option("--next <text>", 'set "where I left off" (NEXT)').option("--decision <text>", "append a verbatim decision").option("--queue-add <text>", "add a worklist item").option("--queue-done <n>", "mark worklist item N done").option("--verified", "mark this claim as checked against source (state: verified, else asserted)").option("--diagnostic", "isolate a probe write (state: diagnostic, source: probe) \u2014 never resume/LAST 5").option("--supersedes <key>", "retire prior decisions matching an evidence key (pr:N | file:path)").option("--anchor <intent>", "set the sprint North-Star (write-protected; needs --anchor-force to change)").option("--anchor-force", "overwrite an existing anchor").action((summary, o) => runNote(summary, o));
@@ -7838,21 +8154,24 @@ async function runSagaShow(opts, io = consoleIo) {
   try {
     const key = await sagaKey(cfg);
     const qs = opts.latestAnywhere ? "scope=anywhere" : new URLSearchParams({ project: key.project, branch: key.branch }).toString();
-    const res = await fetch(`${cfg.sagaApiUrl}/saga/head?${qs}`, { headers: await sagaHeaders(), signal: AbortSignal.timeout(8e3) });
+    const res = await fetchWithRetry(fetch, `${cfg.sagaApiUrl}/saga/head?${qs}`, { headers: await sagaHeaders() }, { attempts: 2, timeoutMs: 3e3 });
     if (res.ok) {
       io.log(resumeCue());
       return io.log(await res.text());
     }
     if (!opts.quiet) io.log(`saga show failed: HTTP ${res.status}`);
   } catch (e) {
-    if (!opts.quiet) io.err(`saga show: ${e.message}`);
+    if (!opts.quiet) {
+      const reason = e.name === "TimeoutError" ? "backend unreachable (timed out after 2 attempts)" : e.message;
+      io.err(`saga show: ${reason} \u2014 continuing without saga; diagnose with \`mmi-cli saga health --json\``);
+    }
   }
 }
 saga.command("show").option("--quiet", "no-op silently when unconfigured/unreachable (SessionStart hook)").option("--latest-anywhere", "resume the newest saga across all repos (default: current repo)").description("print your resume block \u2014 current repo HEAD + project memory (where you left off)").action((opts) => runSagaShow(opts));
 saga.command("capture").option("--quiet", "capture silently (for the Stop hook)").description("per-turn deterministic capture (Stop hook): turn boundary + current sha").action(async (opts) => {
   const hook = parseHookInput(await readStdin());
   if (hook.session_id) persistSession(hook.session_id);
-  await postCapture({ event: "stop", id: (0, import_node_crypto.randomUUID)(), source: "hook", sha: await gitOut(["rev-parse", "--short", "HEAD"]), surface: agentSurface() }, opts.quiet ?? false);
+  await postCapture({ event: "stop", id: (0, import_node_crypto2.randomUUID)(), source: "hook", sha: await gitOut(["rev-parse", "--short", "HEAD"]), surface: agentSurface() }, opts.quiet ?? false);
 });
 saga.command("session").option("--quiet", "silent (for the SessionStart hook)").description("persist the harness session id for this repo (SessionStart hook)").action(async () => {
   const hook = parseHookInput(await readStdin());
@@ -7865,7 +8184,7 @@ saga.command("head-update").option("--run", "detached worker: fetch state, run t
     if (!headGateDue(tsPath)) return;
     markHeadRun(tsPath);
     try {
-      (0, import_node_child_process5.spawn)(process.execPath, [process.argv[1], "saga", "head-update", "--run"], {
+      (0, import_node_child_process6.spawn)(process.execPath, [process.argv[1], "saga", "head-update", "--run"], {
         detached: true,
         stdio: "ignore",
         windowsHide: true
@@ -7904,7 +8223,7 @@ saga.command("key").option("--json", "machine-readable output").description("pri
 });
 async function probeBackend(url) {
   try {
-    const res = await fetch(`${url}/saga/head`, { headers: await sagaHeaders(), signal: AbortSignal.timeout(8e3) });
+    const res = await fetchWithRetry(fetch, `${url}/saga/head`, { headers: await sagaHeaders() }, { attempts: 3, timeoutMs: 4e3 });
     let message = "";
     try {
       const body = await res.clone().json();
@@ -7982,7 +8301,7 @@ var kb = program2.command("kb").description("org knowledgebase (read-only)");
 kb.command("get <path>").description("print a KB document by path").action(async (path2) => {
   const src = resolveKbSource((await loadConfig()).kbSource);
   try {
-    const { stdout } = await execFileP3("gh", buildKbGetArgs(src, path2), { timeout: 1e4 });
+    const { stdout } = await execFileP4("gh", buildKbGetArgs(src, path2), { timeout: 1e4 });
     process.stdout.write(stdout);
   } catch (e) {
     const err = e;
@@ -7992,7 +8311,7 @@ kb.command("get <path>").description("print a KB document by path").action(async
 kb.command("list [prefix]").description("list KB document paths (optionally under a prefix)").action(async (prefix) => {
   const src = resolveKbSource((await loadConfig()).kbSource);
   try {
-    const { stdout } = await execFileP3("gh", buildKbTreeArgs(src), { timeout: 1e4 });
+    const { stdout } = await execFileP4("gh", buildKbTreeArgs(src), { timeout: 1e4 });
     const paths = parseKbTree(stdout, prefix);
     if (!paths.length) return fail(`kb list: no documents${prefix ? ` under ${prefix}` : ""}`);
     console.log(paths.join("\n"));
@@ -8002,22 +8321,29 @@ kb.command("list [prefix]").description("list KB document paths (optionally unde
   }
 });
 async function ghCreate(args) {
+  const swapped = await bodyArgsViaFile(args);
   try {
-    const { stdout } = await execFileP3("gh", args);
+    const { stdout } = await execFileP4("gh", swapped.args, { timeout: GH_MUTATION_TIMEOUT_MS });
     return parseCreatedUrl(stdout);
   } catch (e) {
+    await swapped.cleanup();
     const err = e;
-    fail(`gh ${args[0]} create failed: ${(err.stderr || err.message || String(e)).trim()}`);
+    const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
+    fail(`gh ${args[0]} create failed: ${(err.stderr || err.message || String(e)).trim()}${note ? ` (${note})` : ""}`);
+  } finally {
+    await swapped.cleanup();
   }
 }
-async function ghJson3(args, timeout = 1e4) {
-  const { stdout } = await execFileP3("gh", args, { timeout });
+async function ghJson(args, timeout = 1e4) {
+  const { stdout } = await execFileP4("gh", args, { timeout });
   return JSON.parse(stdout);
 }
 async function resolveRepo(repo) {
   if (repo) return repo;
+  const fromOrigin = repoFromRemoteUrl(await gitOut(["remote", "get-url", "origin"]));
+  if (fromOrigin) return fromOrigin;
   try {
-    const { stdout } = await execFileP3("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], { timeout: 5e3 });
+    const { stdout } = await execFileP4("gh", ["repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], { timeout: 5e3 });
     return stdout.trim() || void 0;
   } catch {
     return void 0;
@@ -8025,7 +8351,13 @@ async function resolveRepo(repo) {
 }
 async function attachToProject(issueNumber, repo, priority) {
   const targetRepo2 = await resolveRepo(repo);
-  const cfg = await loadConfigForRepo(targetRepo2);
+  let cfg;
+  try {
+    cfg = await loadConfigForRepo(targetRepo2);
+  } catch (e) {
+    console.error(`issue create: board attach skipped \u2014 ${e.message}`);
+    return void 0;
+  }
   if (!cfg.projectId) {
     console.error(`issue create: board attach skipped \u2014 no Hub registry board META for ${targetRepo2 ?? "current repo"}; run \`mmi-cli project get ${targetRepo2 ?? "<owner/repo>"}\` and backfill board coords`);
     return void 0;
@@ -8033,19 +8365,14 @@ async function attachToProject(issueNumber, repo, priority) {
   try {
     const viewArgs = ["issue", "view", String(issueNumber), "--json", "id", "--jq", ".id"];
     if (targetRepo2) viewArgs.push("--repo", targetRepo2);
-    const { stdout: idOut } = await execFileP3("gh", viewArgs, { timeout: 1e4 });
+    const { stdout: idOut } = await execFileP4("gh", viewArgs, { timeout: 1e4 });
     const contentId = idOut.trim();
     if (!contentId) throw new Error("could not resolve issue node id");
-    const { stdout } = await execFileP3("gh", buildAddToProjectArgs(cfg.projectId, contentId), { timeout: 1e4 });
+    const { stdout } = await execFileP4("gh", buildAddToProjectArgs(cfg.projectId, contentId), { timeout: GH_MUTATION_TIMEOUT_MS });
     const projectItemId = parseAddedItemId(stdout);
     if (projectItemId && priority) {
       try {
-        await setBoardItemPriority(
-          async (args) => execFileP3("gh", args, { timeout: 1e4 }),
-          cfg,
-          projectItemId,
-          priority
-        );
+        await setBoardItemPriority(defaultGitHubClient(), cfg, projectItemId, priority);
       } catch (e) {
         const err = e;
         process.stderr.write(`warning: issue #${issueNumber} board Priority not set: ${(err.stderr || err.message || String(e)).trim()}
@@ -8064,7 +8391,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body];
     if (o.repo) args.push("--repo", o.repo);
-    (0, import_node_child_process5.spawn)(process.execPath, [process.argv[1], ...args], {
+    (0, import_node_child_process6.spawn)(process.execPath, [process.argv[1], ...args], {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -8120,7 +8447,7 @@ function openInEditor(path2) {
     return;
   }
   try {
-    (0, import_node_child_process5.spawn)(editor, [path2], { stdio: "inherit" });
+    (0, import_node_child_process6.spawn)(editor, [path2], { stdio: "inherit" });
   } catch {
     console.log(`open ${path2} manually`);
   }
@@ -8133,6 +8460,26 @@ async function withPlan(quiet, run, io = consoleIo) {
   }
   await run(makePlanDeps(cfg, io));
 }
+async function gatherRelevanceSignals() {
+  const branch = await gitOut(["rev-parse", "--abbrev-ref", "HEAD"]).catch(() => "") || void 0;
+  const changed = (await gitOut(["diff", "--name-only", "HEAD"]).catch(() => "")).split("\n").map((s) => s.trim()).filter(Boolean);
+  const signals = { branch, changedFiles: changed.length ? changed : void 0 };
+  const issueNum = branch?.match(/\b(\d{2,})\b/)?.[1];
+  if (issueNum) {
+    try {
+      const { stdout } = await execFileP4(
+        "gh",
+        ["issue", "view", issueNum, "--json", "title,labels", "--jq", "{title:.title,labels:[.labels[].name]}"],
+        { timeout: 1e4 }
+      );
+      const j = JSON.parse(stdout);
+      if (j.title) signals.issueTitle = j.title;
+      if (j.labels?.length) signals.issueLabels = j.labels;
+    } catch {
+    }
+  }
+  return signals;
+}
 function registerNorthStarCommands(cmd) {
   cmd.command("push <slug>").description("push a local North Star plan (plans/<slug>.md) to the server").option("--project <name>", "override the project key").option("--force", "overwrite the remote even if it changed since your last sync").action((slug, o) => withPlan(false, async (d) => {
     const ok = await planPush(d, slug, o);
@@ -8143,6 +8490,10 @@ function registerNorthStarCommands(cmd) {
     if (!ok) process.exitCode = 1;
   }));
   cmd.command("list").description("list your North Star plans (cross-device)").option("--project <name>", "filter by project").option("--json", "machine-readable output").option("--quiet", "silent when unconfigured/empty/unreachable (SessionStart hook)").action((o) => withPlan(o.quiet ?? false, (d) => planList(d, o)));
+  cmd.command("relevant").description("list North Stars relevant to your current task (branch + claimed issue + changed files)").option("--project <name>", "override the project key").option("--all", "include superseded/graduated and recent non-matching plans").option("--limit <n>", "max results (default 5)").action((o) => withPlan(false, async (d) => {
+    const signals = await gatherRelevanceSignals();
+    await relevantPlans(d, signals, { project: o.project, includeAll: o.all, limit: o.limit ? Number(o.limit) : void 0 });
+  }));
   cmd.command("open <slug>").description("pull if needed, then open plans/<slug>.md in $EDITOR").option("--project <name>", "override the project key").action(
     (slug, o) => withPlan(false, async (d) => {
       const ok = await planPull(d, slug, { project: o.project });
@@ -8178,7 +8529,9 @@ function makeSecretsDeps(cfg) {
     apiUrl: cfg.sagaApiUrl,
     fetch: (url, init = {}) => fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(1e4) }),
     headers: (extra) => sagaHeaders(extra),
-    slug: async () => (await sagaKey(cfg)).project,
+    // Vault paths are lowercase kebab (AGENTS.md naming); sagaKey carries the repo name's original
+    // casing, which leaked mixed-case into `secrets where` output (#681).
+    slug: async () => (await sagaKey(cfg)).project.toLowerCase(),
     readSecretValue: () => readSecretStdin(),
     log: (m) => console.log(m),
     err: (m) => console.error(m)
@@ -8251,7 +8604,8 @@ tenant.command("control <owner/repo> <stage> <action>").description("run bounded
 async function v2ReadinessDeps(cfg) {
   const reg = registryClientDeps(cfg);
   return {
-    getProject: (slug) => fetchProjectBySlug(slug, reg),
+    // Checked read (#727/#733): the doctor distinguishes a FAILED read (degraded report) from a 404.
+    getProject: (slug) => fetchProjectBySlugChecked(slug, reg),
     hasDeployCoords: async (slug, stage2) => {
       const status = await fetchDeployStatusBySlug(slug, reg);
       return Boolean(status?.stages[stage2]);
@@ -8264,11 +8618,10 @@ async function v2ReadinessDeps(cfg) {
       const apiUrl = cfg.sagaApiUrl;
       if (!apiUrl) throw new Error("Hub API URL not configured \u2014 cannot verify secret names (set sagaApiUrl)");
       const qs = new URLSearchParams({ repo: targetRepo2 }).toString();
-      const res = await fetch(`${apiUrl.replace(/\/$/, "")}/secrets/list?${qs}`, {
+      const res = await fetchWithRetry(fetch, `${apiUrl.replace(/\/$/, "")}/secrets/list?${qs}`, {
         method: "GET",
-        headers: await sagaHeaders(),
-        signal: AbortSignal.timeout(8e3)
-      });
+        headers: await sagaHeaders()
+      }, { attempts: 2, timeoutMs: 5e3 });
       if (!res.ok) throw new Error(`secrets list failed for ${targetRepo2}: HTTP ${res.status}`);
       const body = await res.json();
       return (body.secrets ?? []).map((s) => s.key).filter(Boolean);
@@ -8278,22 +8631,32 @@ async function v2ReadinessDeps(cfg) {
 async function updateV2ReadinessIssue(repo, report, healed) {
   const title = "v2 readiness: central deploy + secrets alignment";
   const freshBody = renderReadinessIssueBody("", report, { healed });
-  const list = await execFileP3("gh", ["issue", "list", "--repo", repo, "--state", "open", "--search", "v2 readiness in:title", "--json", "number,title", "--limit", "20"], { timeout: 2e4 });
+  const list = await execFileP4("gh", ["issue", "list", "--repo", repo, "--state", "open", "--search", "v2 readiness in:title", "--json", "number,title", "--limit", "20"], { timeout: 2e4 });
   const issues = JSON.parse(list.stdout || "[]");
   const existing = issues.find((i) => i.title.toLowerCase().includes("v2 readiness"));
   if (!existing) {
-    const created = await execFileP3("gh", ["issue", "create", "--repo", repo, "--title", title, "--body", freshBody, "--label", "feature"], { timeout: 2e4 });
-    const url = created.stdout.trim();
-    const number = Number(url.match(/\/issues\/(\d+)$/)?.[1] ?? 0);
-    return { number, url, action: "created" };
+    const create = await bodyArgsViaFile(["issue", "create", "--repo", repo, "--title", title, "--body", freshBody, "--label", "feature"]);
+    try {
+      const created = await execFileP4("gh", create.args, { timeout: GH_MUTATION_TIMEOUT_MS });
+      const url = created.stdout.trim();
+      const number = Number(url.match(/\/issues\/(\d+)$/)?.[1] ?? 0);
+      return { number, url, action: "created" };
+    } finally {
+      await create.cleanup();
+    }
   }
-  const view = await execFileP3("gh", ["issue", "view", String(existing.number), "--repo", repo, "--json", "body,url", "--jq", "{body:.body,url:.url}"], { timeout: 2e4 });
+  const view = await execFileP4("gh", ["issue", "view", String(existing.number), "--repo", repo, "--json", "body,url", "--jq", "{body:.body,url:.url}"], { timeout: 2e4 });
   const current = JSON.parse(view.stdout || "{}");
   const nextBody = renderReadinessIssueBody(current.body ?? "", report, { healed });
-  await execFileP3("gh", ["issue", "edit", String(existing.number), "--repo", repo, "--body", nextBody], { timeout: 2e4 });
+  const edit = await bodyArgsViaFile(["issue", "edit", String(existing.number), "--repo", repo, "--body", nextBody]);
+  try {
+    await execFileP4("gh", edit.args, { timeout: GH_MUTATION_TIMEOUT_MS });
+  } finally {
+    await edit.cleanup();
+  }
   return { number: existing.number, url: current.url ?? `https://github.com/${repo}/issues/${existing.number}`, action: "updated" };
 }
-var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); set is master-only");
+var project = program2.command("project").description("the DDB org registry \u2014 list/get projects (any member); attest is project-admin; set is master-only");
 async function projectTarget(commandName, explicitTarget) {
   return requireProjectTarget(commandName, explicitTarget, explicitTarget ? void 0 : await resolveRepo());
 }
@@ -8330,7 +8693,7 @@ project.command("resolve <owner/repo>").description("deploy coords for a stage \
   }
   fail(msg);
 });
-project.command("doctor [owner/repo]").description("diagnose Hub v2 readiness for a repo without reading product repo files; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--json", "machine-readable output").action(async (repo, _o) => {
+project.command("doctor [owner/repo]").description("diagnose Hub v2 readiness for a repo without reading product repo files \u2014 appOwnedGaps are advisory templates; clear them with `project attest`; defaults to the current repo").option("--v2", "compatibility flag; v2 readiness is the default").option("--json", "machine-readable output").action(async (repo, _o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -8380,7 +8743,19 @@ project.command("readiness [owner/repo]").description("update the repo v2 readin
   const issue2 = await updateV2ReadinessIssue(target, report, []);
   console.log(JSON.stringify({ ok: true, repo: target, issue: issue2, ready: report.ok }));
 });
-project.command("set [owner/repo]").description("MASTER-ONLY: upsert a project META (idempotent merge; defaults to the current repo; no clobber of unspecified fields)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--var <KEY=VALUE...>", "META field to set (repeatable): name, division, projectId, branch, wikiRepo, vaultPath, kbPointer").option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+project.command("attest [owner/repo]").description("attest this repo's app-owned v2 readiness work is done (project-admin of the repo or master) \u2014 clears doctor's static appOwnedGaps; re-running overwrites; defaults to the current repo").option("--json", "machine-readable output").action(async (repoOrSlug) => {
+  const cfg = await loadConfig();
+  let target;
+  try {
+    target = await projectTarget("project attest", repoOrSlug);
+  } catch (e) {
+    return fail(e.message);
+  }
+  const repo = target.includes("/") ? target : `mutmutco/${slugOf(target)}`;
+  const res = await attestAppGaps(slugOf(target), repo, registryClientDeps(cfg));
+  reportWrite("project attest", res);
+});
+project.command("set [owner/repo]").description("MASTER-ONLY: upsert a project META (idempotent merge; defaults to the current repo; no clobber of unspecified fields)").option("--class <class>", "deployable | content").option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (v2 capability shape)`).option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path; none means no Hub deploy registration)`).option("--var <KEY=VALUE...>", 'META field to set (repeatable): name, division, projectId, branch, wikiRepo, vaultPath, kbPointer, requiredRuntimeSecrets (JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]})').option("--unset <KEY...>", "META field to remove (repeatable): oauth, requiredRuntimeSecrets, edgeDomains, requiredGcpApis, publishRequired").option("--clear-web-profile", "remove web-only registry fields (oauth, edgeDomains) for non-web/content projects").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -8484,7 +8859,7 @@ issue.command("create").description("create an issue (type \u2192 label) and pri
   let priority;
   let body;
   try {
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises2.readFile, readStdin });
     priority = normalizePriority(o.priority);
     args = buildIssueArgs({ type: o.type, title: o.title, body, priority, repo: o.repo, labels: o.label });
   } catch (e) {
@@ -8494,7 +8869,7 @@ issue.command("create").description("create an issue (type \u2192 label) and pri
     const la = ["label", "create", label, "--color", "ededed"];
     if (o.repo) la.push("--repo", o.repo);
     try {
-      await execFileP3("gh", la, { timeout: 1e4 });
+      await execFileP4("gh", la, { timeout: GH_MUTATION_TIMEOUT_MS });
     } catch {
     }
   }
@@ -8509,7 +8884,7 @@ issue.command("discover-related").description("find related issues for an existi
   const repo = await resolveRepo(o.repo);
   if (!repo) return fail("issue discover-related: could not resolve repo");
   try {
-    const issues = await ghJson3([
+    const issues = await ghJson([
       "issue",
       "list",
       "--repo",
@@ -8524,7 +8899,7 @@ issue.command("discover-related").description("find related issues for an existi
     const candidates = findRelatedIssues({ number, title: o.title, body: o.body }, issues);
     if (o.json) return console.log(JSON.stringify({ number, repo, candidates }, null, 2));
     if (!candidates.length) return;
-    const viewed = await ghJson3([
+    const viewed = await ghJson([
       "issue",
       "view",
       String(number),
@@ -8534,18 +8909,18 @@ issue.command("discover-related").description("find related issues for an existi
       "comments"
     ]);
     if (viewed.comments.some((comment) => comment.body.includes(relatedMarker(number)))) return;
-    await execFileP3("gh", ["issue", "comment", String(number), "--repo", repo, "--body", buildRelatedComment(number, candidates)], { timeout: 1e4 });
+    await execFileP4("gh", ["issue", "comment", String(number), "--repo", repo, "--body", buildRelatedComment(number, candidates)], { timeout: GH_MUTATION_TIMEOUT_MS });
   } catch {
   }
 });
-program2.command("report").description("file a friction report on the Hub board (GitHub auth, dedups open reports) and print {number,url} JSON").requiredOption("--title <title>", "one-line friction summary").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").option("--type <type>", "bug | feature | task (sets the matching label)", "task").option("--priority <priority>", "urgent | high | medium | low (board Priority field when configured)", "medium").option("--repo <owner/repo>", `target repo (defaults to the org Hub: ${HUB_REPO})`).option("--force", "file a new issue even when an open report looks like a duplicate").action(async (o) => {
+program2.command("report").description("file a friction report on the Hub board (GitHub auth, dedups open reports) and print {number,url} JSON").requiredOption("--title <title>", "one-line friction summary").option("--body <body>", "report body (markdown)").option("--body-file <path|->", "read report body from a UTF-8 file, or from stdin with -").option("--type <type>", "bug | feature | task (sets the matching label)", "task").option("--priority <priority>", "urgent | high | medium | low (board Priority field when configured)", "medium").option("--repo <owner/repo>", `target repo (defaults to the org Hub: ${HUB_REPO})`).option("--force", "file a new issue even when an open report looks like a duplicate").option("--json", "machine-readable output (already the default \u2014 report always prints JSON; #682)").action(async (o) => {
   let body;
   let priority;
   let args;
   const targetRepo2 = o.repo ?? HUB_REPO;
   const sourceRepo = await resolveRepo(void 0);
   try {
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises2.readFile, readStdin });
     priority = normalizePriority(o.priority);
     args = buildIssueArgs({
       type: o.type,
@@ -8561,7 +8936,7 @@ program2.command("report").description("file a friction report on the Hub board
   if (!o.force) {
     let openReports = [];
     try {
-      openReports = await ghJson3([
+      openReports = await ghJson([
         "issue",
         "list",
         "--repo",
@@ -8580,7 +8955,7 @@ program2.command("report").description("file a friction report on the Hub board
     const dup = findDuplicateReport({ title: o.title, body }, openReports);
     if (dup) {
       try {
-        await execFileP3("gh", ["issue", "comment", String(dup.number), "--repo", targetRepo2, "--body", buildDupComment(dup.number, body, sourceRepo)], { timeout: 1e4 });
+        await execFileP4("gh", ["issue", "comment", String(dup.number), "--repo", targetRepo2, "--body", buildDupComment(dup.number, body, sourceRepo)], { timeout: GH_MUTATION_TIMEOUT_MS });
       } catch (e) {
         const err = e;
         return fail(`report: duplicate of #${dup.number} (${dup.url}) but the +1 comment failed: ${(err.stderr || err.message || String(e)).trim()}`);
@@ -8589,7 +8964,7 @@ program2.command("report").description("file a friction report on the Hub board
     }
   }
   try {
-    await execFileP3("gh", ["label", "create", REPORT_LABEL, "--color", "ededed", "--repo", targetRepo2], { timeout: 1e4 });
+    await execFileP4("gh", ["label", "create", REPORT_LABEL, "--color", "ededed", "--repo", targetRepo2], { timeout: GH_MUTATION_TIMEOUT_MS });
   } catch {
   }
   const created = await ghCreate(args);
@@ -8597,14 +8972,20 @@ program2.command("report").description("file a friction report on the Hub board
   console.log(JSON.stringify({ ...created, deduped: false, label: REPORT_LABEL, priority, projectItemId }));
 });
 var pr = program2.command("pr").description("pull requests \u2014 reliable create with structured output");
-pr.command("create").description("create a PR and print {number,url} JSON").requiredOption("--title <title>", "PR title").requiredOption("--body <body>", "PR body (markdown)").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
-  const created = await ghCreate(buildPrArgs({ title: o.title, body: o.body, base: o.base, head: o.head, repo: o.repo }));
+pr.command("create").description("create a PR and print {number,url} JSON").requiredOption("--title <title>", "PR title").option("--body <body>", "PR body (markdown)").option("--body-file <path|->", "read PR body from a UTF-8 file, or from stdin with -").option("--base <branch>", "base branch (defaults to the repo default)").option("--head <branch>", "head branch (defaults to the current branch)").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (o) => {
+  let body;
+  try {
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises2.readFile, readStdin });
+  } catch (e) {
+    return fail(`pr create: ${e.message}`);
+  }
+  const created = await ghCreate(buildPrArgs({ title: o.title, body, base: o.base, head: o.head, repo: o.repo }));
   console.log(JSON.stringify(created));
 });
 async function remoteBranchExists(branch) {
   if (!branch) return void 0;
   try {
-    const { stdout } = await execFileP3("git", ["ls-remote", "--heads", "origin", branch], { timeout: GIT_TIMEOUT_MS });
+    const { stdout } = await execFileP4("git", ["ls-remote", "--heads", "origin", branch], { timeout: GIT_TIMEOUT_MS });
     return stdout.trim().length > 0;
   } catch {
     return void 0;
@@ -8613,20 +8994,22 @@ async function remoteBranchExists(branch) {
 pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree \u2014 no leftover local branch").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
-  const headRef = (await execFileP3("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName", "--jq", ".headRefName"], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
-  const startingPath = (await execFileP3("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
+  const headRef = (await execFileP4("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName", "--jq", ".headRefName"], { timeout: GC_GH_TIMEOUT_MS })).stdout.trim();
+  const startingPath = (await execFileP4("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
   const beforeWorktrees = parseWorktreePorcelain(
-    (await execFileP3("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
+    (await execFileP4("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
   );
   const remoteBefore = repoArgs.length ? void 0 : await remoteBranchExists(headRef);
   let remoteDeleteAttempted = false;
   let remoteNotAttemptedReason = repoArgs.length ? "repo-option" : void 0;
-  await execFileP3("gh", ["pr", "merge", number, ...repoArgs, method, "--delete-branch"], { timeout: GC_GH_TIMEOUT_MS }).catch((e) => {
+  await execFileP4("gh", ["pr", "merge", number, ...repoArgs, method, "--delete-branch"], { timeout: GH_MUTATION_TIMEOUT_MS }).catch((e) => {
     const message = String(e.message || "");
     if (/already been merged/i.test(message)) {
       remoteNotAttemptedReason = "pr-already-merged";
       return;
     }
+    const note = timeoutKillNote(e, GH_MUTATION_TIMEOUT_MS);
+    if (note) throw new Error(`gh pr merge ${number}: ${note}`);
     if (!/used by worktree|cannot delete branch/i.test(message)) throw e;
   });
   if (!remoteNotAttemptedReason) remoteDeleteAttempted = true;
@@ -8644,7 +9027,7 @@ pr.command("merge <number>").description("merge a PR (squash by default) and cle
   } : await cleanupPrMergeLocalBranch(headRef, {
     beforeWorktrees,
     startingPath,
-    execGit: async (args) => (await execFileP3("git", args, { timeout: GIT_TIMEOUT_MS })).stdout
+    execGit: async (args) => (await execFileP4("git", args, { timeout: GIT_TIMEOUT_MS })).stdout
   });
   console.log(JSON.stringify({
     merged: number,
@@ -8767,9 +9150,9 @@ function stageKeepAlive() {
   return setTimeout(() => void 0, 5 * 60 * 1e3);
 }
 program2.command("port-range <repo>").description("assign (idempotently) + print the repo's local stage port block via the atomic ORG#config.portCursor allocator (committed-file fallback)").option("--json", "machine-readable output").action(async (repo, o) => {
-  const path2 = (0, import_node_path5.join)(process.cwd(), "infra", "port-ranges.json");
+  const path2 = (0, import_node_path6.join)(process.cwd(), "infra", "port-ranges.json");
   const allocate = async (seed) => {
-    const { stdout } = await execFileP3("node", [(0, import_node_path5.join)(process.cwd(), "infra", "port-ddb.mjs"), String(seed)], { timeout: 15e3 });
+    const { stdout } = await execFileP4("node", [(0, import_node_path6.join)(process.cwd(), "infra", "port-ddb.mjs"), String(seed)], { timeout: 15e3 });
     const parsed = JSON.parse(stdout);
     if (!Array.isArray(parsed.range) || parsed.range.length !== 2) throw new Error("port-ddb: no range in output");
     return parsed.range;
@@ -8875,8 +9258,8 @@ for (const commandName of ["rcand", "release", "hotfix"]) {
       if (commandName === "hotfix") return fail("hotfix: CLI apply is reserved; use the /hotfix skill PR path after explicit master-admin approval");
       try {
         const result = await runTrainApply(commandName, {
-          run: async (file, args) => (await execFileP3(file, args, { timeout: file === "gh" ? 3e4 : GIT_TIMEOUT_MS })).stdout,
-          runSelf: async (args) => (await execFileP3(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
+          run: async (file, args) => (await execFileP4(file, args, { timeout: file === "gh" ? 3e4 : GIT_TIMEOUT_MS })).stdout,
+          runSelf: async (args) => (await execFileP4(process.execPath, [process.argv[1], ...args], { timeout: 3e4 })).stdout,
           trainAuthority: async (repo) => {
             const verdict = await fetchTrainAuthority(repo, registryClientDeps(await loadConfig()));
             return verdict.ok ? { ok: true, role: verdict.authority.role, train: verdict.authority.train } : verdict;
@@ -8907,7 +9290,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
   const slug = (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
   const meta = await fetchProjectBySlug(slug, { baseUrl: cfg.sagaApiUrl, token: githubToken });
   const report = await verifyBootstrap(repo, o.class, {
-    gh: async (args) => execFileP3("gh", args, { timeout: 2e4 }),
+    client: defaultGitHubClient(),
     projectMeta: meta,
     readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs5.existsSync)(path2) ? (0, import_node_fs5.readFileSync)(path2, "utf8") : null,
     // requiredGcpApis is stored as an array by a JSON write, but `project set --var KEY=VALUE` stores a raw
@@ -8920,7 +9303,7 @@ bootstrap.command("verify <repo>").description("audit whether an existing repo i
     })(),
     listEnabledGcpApis: async (gcpProject) => {
       try {
-        const { stdout } = await execFileP3(
+        const { stdout } = await execFileP4(
           "gcloud",
           ["services", "list", "--enabled", "--project", gcpProject, "--format", "value(config.name)"],
           { timeout: 3e4 }
@@ -8954,7 +9337,7 @@ bootstrap.command("apply <repo>").description("idempotent seed apply from skills
   const manifest = loadBootstrapSeeds((0, import_node_fs5.readFileSync)(manifestPath, "utf8"));
   const baseBranch = o.class === "content" ? "main" : "development";
   const slug = parsedRepo.slug;
-  const gh = async (args) => execFileP3("gh", args, { timeout: 2e4 });
+  const gh = async (args) => execFileP4("gh", args, { timeout: 2e4 });
   const readFile2 = (p) => (0, import_node_fs5.existsSync)(p) ? (0, import_node_fs5.readFileSync)(p, "utf8") : null;
   const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
   const vars = {};
@@ -9071,7 +9454,7 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
 });
 access.command("audit").description("audit collaborator roles + train-branch push allowlists vs the locked state; read-only, emits gh remediation, never applies").option("--json", "machine-readable output").option("--repo <owner/repo>", "audit a single repo instead of the whole org").option("--class <class>", "repo class for --repo (deployable | content)", "deployable").action(async () => {
   const o = { json: rawFlag("--json"), repo: rawValue("--repo", ""), class: rawValue("--class", "deployable") };
-  const deps = { gh: async (args) => execFileP3("gh", args, { timeout: 2e4 }) };
+  const deps = { client: defaultGitHubClient() };
   let targets;
   const cfg = await loadConfig();
   const registryProjects = await fetchProjectsList(registryClientDeps(cfg));
@@ -9097,7 +9480,7 @@ access.command("audit").description("audit collaborator roles + train-branch pus
 var isWin = process.platform === "win32";
 var installedPluginsPath = (surface = detectSurface(process.env)) => {
   const homeDir = surface === "codex" ? ".codex" : ".claude";
-  return (0, import_node_path5.join)((0, import_node_os.homedir)(), homeDir, "plugins", "installed_plugins.json");
+  return (0, import_node_path6.join)((0, import_node_os2.homedir)(), homeDir, "plugins", "installed_plugins.json");
 };
 function readInstalledPlugins() {
   try {
@@ -9108,7 +9491,7 @@ function readInstalledPlugins() {
 }
 function readClaudeSettings() {
   try {
-    return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path5.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
+    return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path6.join)(process.cwd(), ".claude", "settings.json"), "utf8"));
   } catch {
     return null;
   }
@@ -9154,14 +9537,14 @@ function backupAndWriteInstalledPlugins(records, pluginId) {
 }
 function mmiPluginCacheRootSnapshots() {
   const roots = [
-    { surface: "claude", root: (0, import_node_path5.join)((0, import_node_os.homedir)(), ".claude", "plugins", "cache", "mmi", "mmi") },
-    { surface: "codex", root: (0, import_node_path5.join)((0, import_node_os.homedir)(), ".codex", "plugins", "cache", "mmi", "mmi") }
+    { surface: "claude", root: (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".claude", "plugins", "cache", "mmi", "mmi") },
+    { surface: "codex", root: (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".codex", "plugins", "cache", "mmi", "mmi") }
   ];
   return roots.flatMap(({ surface, root }) => {
     try {
       const entries = (0, import_node_fs5.readdirSync)(root, { withFileTypes: true }).map((entry) => ({
         name: entry.name,
-        path: (0, import_node_path5.join)(root, entry.name),
+        path: (0, import_node_path6.join)(root, entry.name),
         isDirectory: entry.isDirectory()
       }));
       return [{ surface, root, entries }];
@@ -9184,7 +9567,7 @@ function quarantinePluginCacheDirs(plan2) {
     try {
       if (!(0, import_node_fs5.existsSync)(move.from)) continue;
       const target = uniqueQuarantineTarget(move.to);
-      (0, import_node_fs5.mkdirSync)((0, import_node_path5.dirname)(target), { recursive: true });
+      (0, import_node_fs5.mkdirSync)((0, import_node_path6.dirname)(target), { recursive: true });
       (0, import_node_fs5.renameSync)(move.from, target);
       moved += 1;
     } catch {
@@ -9192,7 +9575,7 @@ function quarantinePluginCacheDirs(plan2) {
   }
   return moved;
 }
-var gitignorePath = () => (0, import_node_path5.join)(process.cwd(), ".gitignore");
+var gitignorePath = () => (0, import_node_path6.join)(process.cwd(), ".gitignore");
 function readGitignore() {
   try {
     return (0, import_node_fs5.readFileSync)(gitignorePath(), "utf8");
@@ -9219,17 +9602,17 @@ async function runDoctor(opts, io = consoleIo) {
   const CLONE_FIX = 'run: git config --global url."https://github.com/".insteadOf "git@github.com:"';
   const [login, pathProbe, releasedVersion, cfg, callerArn, cloneProbe] = await Promise.all([
     githubLogin(),
-    execFileP3(isWin ? "where" : "which", ["mmi-cli"]).then(() => true).catch(() => false),
+    execFileP4(isWin ? "where" : "which", ["mmi-cli"]).then(() => true).catch(() => false),
     fetchReleasedVersion(),
     loadConfig(),
     awsCallerArn(),
-    execFileP3("git", ["config", "--global", "--get-all", REWRITE_KEY]).then(({ stdout }) => stdout.split("\n").some((l) => l.trim() === "git@github.com:")).catch(() => false)
+    execFileP4("git", ["config", "--global", "--get-all", REWRITE_KEY]).then(({ stdout }) => stdout.split("\n").some((l) => l.trim() === "git@github.com:")).catch(() => false)
     // unset → repair below
   ]);
   let ghInstalled = true;
   if (!login) {
     try {
-      await execFileP3("gh", ["--version"]);
+      await execFileP4("gh", ["--version"]);
     } catch {
       ghInstalled = false;
     }
@@ -9256,7 +9639,7 @@ async function runDoctor(opts, io = consoleIo) {
   let cloneOk = cloneProbe;
   if (!cloneOk && !opts.banner && !opts.json) {
     try {
-      await execFileP3("git", ["config", "--global", "--add", REWRITE_KEY, "git@github.com:"]);
+      await execFileP4("git", ["config", "--global", "--add", REWRITE_KEY, "git@github.com:"]);
       cloneOk = true;
       io.err("  \u21BB repaired: git insteadOf git@github.com \u2192 https (plugin clone over HTTPS)");
     } catch {
@@ -9355,24 +9738,22 @@ async function runDoctor(opts, io = consoleIo) {
 ${gaps.length} item(s) need attention.` : "\nAll set \u2014 you are ready.");
 }
 program2.command("doctor").description("check onboarding gates (GitHub auth, mmi-cli on PATH, Hub API default, plugin git clone, plugin install record, .gitignore managed block, plugin config drift, installed plugin version) and print fixes").option("--banner", "one-line resume summary; silent when all gates pass").option("--guide", "print the MMI Agentic Onboarding guide URL").option("--json", "machine-readable output").action((opts) => runDoctor(opts));
-program2.command("session-start").description("run the SessionStart verbs (rules/docs sync, saga session+show, plan list, saga health, doctor) in one process").action(async () => {
+program2.command("session-start").description("run the SessionStart verbs (rules sync, saga session+show, saga health, doctor) in one process; docs sync runs detached").action(async () => {
   try {
     const hook = parseHookInput(await readStdin());
     if (hook.session_id) persistSession(hook.session_id);
   } catch (e) {
     console.error(`[mmi-hook] saga session failed: ${e.message}`);
   }
-  const parallel = [
-    { name: "rules sync", run: (io) => runRulesSync({ quiet: true }, io) },
-    { name: "docs sync", run: (io) => runDocsSync({ quiet: true }, io) },
-    { name: "saga show", run: (io) => runSagaShow({ quiet: true }, io) },
-    { name: "plan list", run: (io) => withPlan(true, (d) => planList(d, { quiet: true }), io) },
-    { name: "saga health", run: (io) => runSagaHealth({ banner: true, quiet: true }, io) }
-  ];
-  const sequential = [
-    { name: "doctor", run: (io) => runDoctor({ banner: true }, io) }
-  ];
+  spawnDetachedSelf(["docs", "sync", "--quiet"], { spawn: import_node_child_process6.spawn, execPath: process.execPath, scriptPath: process.argv[1] });
+  const { parallel, sequential } = buildSessionStartPlan({
+    rulesSync: (io) => runRulesSync({ quiet: true }, io),
+    sagaShow: (io) => runSagaShow({ quiet: true }, io),
+    sagaHealth: (io) => runSagaHealth({ banner: true, quiet: true }, io),
+    doctor: (io) => runDoctor({ banner: true }, io)
+  });
   await runSessionStart(parallel, sequential, consoleIo);
+  consoleIo.log(northstarPointer());
 });
 function fail(msg) {
   console.error(`mmi-cli ${msg}`);