@mutmutco/cli 3.100.0 → 3.101.0

package/dist/main.cjs

@@ -12168,6 +12168,16 @@ async function auditRepoCi(repo, deps) {
       });
     }
   }
+  if (repoClass === "deployable") {
+    const exemptReason = meta?.ciExemptReason?.trim();
+    const declaredExempt = statusChecks.size === 0 && !!exemptReason;
+    checks.push({
+      ok: statusChecks.size > 0 || declaredExempt,
+      label: declaredExempt ? "deployable repo declared CI-exempt, not required to gate (#4265)" : "deployable repo requires at least one status check (#4260)",
+      detail: declaredExempt ? `declared-exempt: ${exemptReason}` : statusChecks.size === 0 ? "zero required contexts on an active branch ruleset \u2014 any PR, including an automation seed PR, merges on an empty gate" : void 0,
+      remediation: declaredExempt || statusChecks.size > 0 ? void 0 : `Determine this repo's correct gate context from its own PR-triggered workflow, set it via mmi-cli org project set ${repo} --var requiredChecks=[...], then mmi-cli ci reconcile --repo ${repo} --apply, or, if this repo genuinely has no CI surface, declare it via mmi-cli org project set ${repo} --var ciExemptReason="<why>" (#4265)`
+    });
+  }
   if (deployableGated || repoClass === "hub") {
     const gate = await readDefaultBranchGate(repo, deps.client, baseBranch, Date.now(), gateWorkflowFiles(prWorkflowPaths));
     checks.push({
@@ -13865,6 +13875,12 @@ async function postSchedulesMode(slug, mode, deps) {
 async function postSchedulesRun(id, deps) {
   return postJson("/schedules/run", { id }, deps, "POST", { noRetry: true });
 }
+async function postSchedulesPark(id, reason, deps) {
+  return postJson("/schedules/park", { id, reason }, deps);
+}
+async function postSchedulesUnpark(id, deps) {
+  return postJson("/schedules/unpark", { id }, deps);
+}
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
@@ -20923,7 +20939,7 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "gate", "seedCanary"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -21218,6 +21234,11 @@ function parseRequiredChecksVar(raw) {
   }
   return parsed.map((c) => c.trim());
 }
+function parseCiExemptReasonVar(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
+  return trimmed;
+}
 function parseGateVar(raw) {
   let parsed;
   try {
@@ -21270,6 +21291,7 @@ var SETTABLE_VAR_KEYS = [
   "portRange",
   "ci",
   "requiredChecks",
+  "ciExemptReason",
   "gate",
   "secrets",
   "seedCanary"
@@ -21296,6 +21318,7 @@ var SETTABLE_VAR_HINTS = {
   portRange: "JSON {start,end} or [start,end]",
   ci: "none \u2014 declare intentional no-ci",
   requiredChecks: 'JSON array, e.g. ["gate"] or [] for no-ci',
+  ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,workdir,cacheDepPath,pyVersion}"
 };
 function settableVarHelp() {
@@ -21393,6 +21416,8 @@ function buildProjectSetPatch(input) {
       patch[key] = raw;
     } else if (key === "requiredChecks") {
       patch[key] = parseRequiredChecksVar(raw);
+    } else if (key === "ciExemptReason") {
+      patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
       patch[key] = parseGateVar(raw);
     } else {
@@ -22730,6 +22755,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
   const liveByName = new Map(liveGithub.map((e) => [e.name, e]));
   const registryById = new Map(registryGithub.map((r) => [r.id, r]));
   const drifts = [];
+  const parked = [];
   for (const e of liveGithub) {
     if (!registryById.has(e.name)) {
       drifts.push({
@@ -22742,6 +22768,10 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
     }
   }
   for (const r of registryGithub) {
+    if (r.parkedReason) {
+      parked.push({ id: r.id, executor: r.executor, repo: r.repo, reason: r.parkedReason });
+      continue;
+    }
     const live = liveByName.get(r.id);
     if (live) {
       if (cadenceStale(r.cadence, live.cadence)) {
@@ -22763,7 +22793,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
           name: r.id,
           executor: r.executor || "github-actions",
           detail: "workflow file present but DISABLED in GitHub Actions \u2014 the dispatcher cannot run it",
-          remedy: `\`gh workflow enable\` it in ${r.repo} to re-arm (or, if it was retired on purpose, re-run schedules register so the replace prunes the SCHEDULE# row) \u2014 never prune a lane parked on purpose`
+          remedy: `\`gh workflow enable\` it in ${r.repo} to re-arm, or if this is a deliberate hold run \`mmi-cli org schedules park ${r.id} --reason <ref>\` (#4257) so it stops reading as drift \u2014 never prune a lane parked on purpose`
         });
       }
       continue;
@@ -22778,7 +22808,10 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
       });
     }
   }
-  return drifts.sort((a, b) => a.class.localeCompare(b.class) || a.name.localeCompare(b.name));
+  return {
+    drifts: drifts.sort((a, b) => a.class.localeCompare(b.class) || a.name.localeCompare(b.name)),
+    parked: parked.sort((a, b) => a.id.localeCompare(b.id))
+  };
 }
 function suppressSelfManagedDrifts(drifts, selfManagedRepos) {
   return drifts.filter((d) => {
@@ -22789,6 +22822,9 @@ function suppressSelfManagedDrifts(drifts, selfManagedRepos) {
 function renderDrift(d) {
   return `${d.class}: ${d.name} (${d.executor}) \u2014 ${d.detail}; remedy: ${d.remedy}`;
 }
+function renderParked(p) {
+  return `parked (${p.reason}): ${p.id}`;
+}
 function strayCronDrift(name) {
   return {
     class: "stray-cron",
@@ -22824,12 +22860,17 @@ function unlauncheredLlmDrifts(entries) {
 }
 var HARBOUR_ARM_GRACE_MS = 30 * 60 * 1e3;
 function registeredButUnarmedDrifts(registry2, liveEntries, opts) {
-  if (!opts.schedulerRead) return [];
+  if (!opts.schedulerRead) return { drifts: [], parked: [] };
   const now = opts.now ?? Date.now();
   const armed = new Set(liveEntries.map((e) => e.scheduleId).filter((id) => Boolean(id)));
   const drifts = [];
+  const parked = [];
   for (const row of registry2) {
     if (row.executor === "github-actions") continue;
+    if (row.parkedReason) {
+      parked.push({ id: row.id, executor: row.executor, repo: row.repo, reason: row.parkedReason });
+      continue;
+    }
     if (armed.has(row.id)) continue;
     const stamped = row.updatedAt ? Date.parse(row.updatedAt) : NaN;
     if (Number.isFinite(stamped) && now - stamped < HARBOUR_ARM_GRACE_MS) continue;
@@ -22841,25 +22882,36 @@ function registeredButUnarmedDrifts(registry2, liveEntries, opts) {
       remedy: "check the fleet-clock reconciler tick; re-run `mmi-cli org schedules register` for the repo and verify with `mmi-cli org schedules`"
     });
   }
-  return drifts.sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    drifts: drifts.sort((a, b) => a.name.localeCompare(b.name)),
+    parked: parked.sort((a, b) => a.id.localeCompare(b.id))
+  };
 }
 function assembleReconciliation(githubEntries2, readRepos, registry2, activeWorkflowNames = /* @__PURE__ */ new Set(), harbour = {}, disabledWorkflowNames = /* @__PURE__ */ new Set()) {
   if (registry2 === null) {
     return {
       reconciliation: [],
       driftLines: [],
+      parked: [],
+      parkedLines: [],
       incomplete: ["registry: could not read GET /schedules/list \u2014 reconciliation skipped (Hub API unreachable or not authenticated)"]
     };
   }
   const live = githubEntries2.filter((e) => e.executor === "github-actions");
-  const drifts = [
-    ...reconcileGithubActions(live, registry2, readRepos, activeWorkflowNames, disabledWorkflowNames),
-    ...registeredButUnarmedDrifts(registry2, harbour.awsEntries ?? [], {
-      schedulerRead: Boolean(harbour.schedulerRead),
-      now: harbour.now
-    })
-  ];
-  return { reconciliation: drifts, driftLines: drifts.map(renderDrift), incomplete: [] };
+  const githubResult = reconcileGithubActions(live, registry2, readRepos, activeWorkflowNames, disabledWorkflowNames);
+  const harbourResult = registeredButUnarmedDrifts(registry2, harbour.awsEntries ?? [], {
+    schedulerRead: Boolean(harbour.schedulerRead),
+    now: harbour.now
+  });
+  const drifts = [...githubResult.drifts, ...harbourResult.drifts];
+  const parked = [...githubResult.parked, ...harbourResult.parked].sort((a, b) => a.id.localeCompare(b.id));
+  return {
+    reconciliation: drifts,
+    driftLines: drifts.map(renderDrift),
+    parked,
+    parkedLines: parked.map(renderParked),
+    incomplete: []
+  };
 }
 
 // src/schedules-commands.ts
@@ -23023,7 +23075,9 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
     entries: sortEntries([...gh.entries, ...aws.entries, ...DECLARED_ENTRIES]),
     incomplete: [...gh.incomplete, ...aws.incomplete, ...recon.incomplete],
     drift: driftLines,
-    reconciliation
+    reconciliation,
+    parked: recon.parked,
+    parkedLines: recon.parkedLines
   };
 }
 async function defaultProjectsRead() {
@@ -23036,10 +23090,13 @@ function warnIncomplete2(incomplete) {
 function reportDrift(drift) {
   for (const d of drift) console.error(`org schedules: DRIFT \u2014 ${d}`);
 }
+function reportParked(parked) {
+  for (const p of parked) console.log(`org schedules: ${p}`);
+}
 function registerSchedulesCommands(program3) {
   const schedules = program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "optional snapshot only \u2014 splice inventory between schedules:inventory markers; live `org schedules` / --json remains SSOT (Hub#4120)").action(async (o) => {
     try {
-      const { entries, incomplete, drift, reconciliation } = await fetchNotebook();
+      const { entries, incomplete, drift, reconciliation, parked, parkedLines } = await fetchNotebook();
       if (o.doc) {
         if (incomplete.length) {
           warnIncomplete2(incomplete);
@@ -23055,9 +23112,10 @@ function registerSchedulesCommands(program3) {
       }
       if (o.json) {
         const now = /* @__PURE__ */ new Date();
-        console.log(JSON.stringify({ org: entries.map((e) => withTickState(e, now)), incomplete, drift, reconciliation }, null, 2));
+        console.log(JSON.stringify({ org: entries.map((e) => withTickState(e, now)), incomplete, drift, reconciliation, parked }, null, 2));
       } else {
         console.log(formatSchedulesTable(entries));
+        reportParked(parkedLines);
         reportDrift(drift);
         warnIncomplete2(incomplete);
       }
@@ -23078,6 +23136,30 @@ function registerSchedulesCommands(program3) {
       await failGraceful(e.message);
     }
   });
+  schedules.command("park <schedule-id>").description("record a deliberate hold on a SCHEDULE# row \u2014 the reconciler skips it and `org schedules` renders `parked (<reason>)` instead of DRIFT (#4257)").requiredOption("--reason <ref>", "why the lane is held, e.g. an issue ref (#1774)").action(async (scheduleId, o) => {
+    try {
+      const res = await postSchedulesPark(scheduleId, o.reason, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        await failGraceful(`schedules park: HTTP ${res.status} \u2014 ${JSON.stringify(res.body ?? res.error ?? "failed")}`);
+        return;
+      }
+      console.log(JSON.stringify(res.body, null, 2));
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
+  schedules.command("unpark <schedule-id>").description("clear a deliberate hold on a SCHEDULE# row \u2014 reconciliation resumes normally (#4257)").action(async (scheduleId) => {
+    try {
+      const res = await postSchedulesUnpark(scheduleId, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        await failGraceful(`schedules unpark: HTTP ${res.status} \u2014 ${JSON.stringify(res.body ?? res.error ?? "failed")}`);
+        return;
+      }
+      console.log(JSON.stringify(res.body, null, 2));
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
   schedules.command("mode <mode>").description("fleet schedules doctrine for a repo: 'managed' (default \u2014 Hub registry + drift enforcement) or 'self-managed' (opt out; the repo owns its crons). Project-admin self-serve (#3228).").option("--repo <name>", "bare repo name (defaults to the origin remote basename)").action(async (mode, o) => {
     try {
       if (mode !== "managed" && mode !== "self-managed") {
@@ -25210,9 +25292,28 @@ LIVE apply to ${repo}:
     }
     const bySlugMeta = new Map(projects.flatMap((p) => (p.repos ?? []).map((r) => [(r.includes("/") ? r : `mutmutco/${r}`).toLowerCase(), p])));
     const classOf = (repo) => bySlugMeta.get(repo.toLowerCase())?.class ?? "deployable";
-    const canaryProject = projects.find((p) => p.seedCanary === true);
-    const canarySlug = canaryProject ? (canaryProject.repos ?? [])[0]?.split("/").pop()?.toLowerCase() ?? null : null;
-    const repos = rosterRepos2.map((repo) => {
+    const inClassRepos = rosterRepos2.filter((repo) => seed.classes.includes(classOf(repo)));
+    const classPriority = [.../* @__PURE__ */ new Set(["deployable", ...seed.classes])].filter((c) => seed.classes.includes(c));
+    let canaryProject = null;
+    for (const cls of classPriority) {
+      const inClass = projects.filter((p) => p.seedCanary === true && (p.class ?? "deployable") === cls);
+      if (inClass.length === 0) continue;
+      if (inClass.length > 1) {
+        const slugs = inClass.map((p) => (p.repos ?? [])[0]?.split("/").pop() ?? "?").join(", ");
+        return fail(
+          `bootstrap propagate: target '${seed.target}' (classes [${seed.classes.join(", ")}]) matches ${inClass.length} seedCanary:true repos in class '${cls}' (${slugs}) \u2014 exactly one seedCanary:true repo per class is required`
+        );
+      }
+      canaryProject = inClass[0];
+      break;
+    }
+    if (!canaryProject) {
+      return fail(
+        `bootstrap propagate: target '${seed.target}' needs classes [${seed.classes.join(", ")}] but no registry repo with seedCanary:true carries a matching class \u2014 set seedCanary:true on an in-class repo (mmi-cli org project set <slug> --var seedCanary=true)`
+      );
+    }
+    const canarySlug = (canaryProject.repos ?? [])[0]?.split("/").pop()?.toLowerCase() ?? null;
+    const repos = inClassRepos.map((repo) => {
       const slug = repo.split("/").pop().toLowerCase();
       const waiver = seed.waivers?.[slug];
       return { repo, slug, waiver };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.100.0",
+  "version": "3.101.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",