@mutmutco/cli 3.100.0 → 3.102.0

package/dist/main.cjs

@@ -7536,6 +7536,39 @@ function missingPlaceholders(rendered) {
   for (const m of rendered.matchAll(PLACEHOLDER_RE)) out.add(m[1]);
   return [...out];
 }
+async function resolveHubSeedSource(execGit, defaultBranch = "development") {
+  let status;
+  try {
+    status = (await execGit(["status", "--porcelain"])).trim();
+  } catch (e) {
+    return { ok: false, reason: `could not read git status of this checkout (${e.message}) \u2014 refusing to treat an unknown working tree as the fleet's desired state` };
+  }
+  if (status) {
+    return {
+      ok: false,
+      reason: `this checkout has uncommitted changes \u2014 refusing to read seeds from a working tree that has not been reviewed or merged:
+${status}`
+    };
+  }
+  let head;
+  let remoteSha;
+  try {
+    head = (await execGit(["rev-parse", "HEAD"])).trim();
+    remoteSha = (await execGit(["ls-remote", "origin", `refs/heads/${defaultBranch}`])).trim().split(/\s+/)[0] ?? "";
+  } catch (e) {
+    return { ok: false, reason: `could not resolve this checkout's HEAD against origin/${defaultBranch} (${e.message}) \u2014 refusing to read seeds without a known upstream revision` };
+  }
+  if (!remoteSha) {
+    return { ok: false, reason: `\`git ls-remote origin refs/heads/${defaultBranch}\` returned nothing \u2014 refusing to read seeds without a known upstream revision` };
+  }
+  if (head !== remoteSha) {
+    return {
+      ok: false,
+      reason: `this checkout (${head}) is not origin/${defaultBranch} (${remoteSha}) \u2014 fast-forward to origin/${defaultBranch} first; a stale or ahead checkout must not seed the fleet`
+    };
+  }
+  return { ok: true, sha: head };
+}
 var GITIGNORE_MANAGED_BEGIN = "# >>> mmi-managed >>>";
 var GITIGNORE_MANAGED_END = "# <<< mmi-managed <<<";
 var MANAGED_GITIGNORE_LINES = [
@@ -12168,6 +12201,16 @@ async function auditRepoCi(repo, deps) {
       });
     }
   }
+  if (repoClass === "deployable") {
+    const exemptReason = meta?.ciExemptReason?.trim();
+    const declaredExempt = statusChecks.size === 0 && !!exemptReason;
+    checks.push({
+      ok: statusChecks.size > 0 || declaredExempt,
+      label: declaredExempt ? "deployable repo declared CI-exempt, not required to gate (#4265)" : "deployable repo requires at least one status check (#4260)",
+      detail: declaredExempt ? `declared-exempt: ${exemptReason}` : statusChecks.size === 0 ? "zero required contexts on an active branch ruleset \u2014 any PR, including an automation seed PR, merges on an empty gate" : void 0,
+      remediation: declaredExempt || statusChecks.size > 0 ? void 0 : `Determine this repo's correct gate context from its own PR-triggered workflow, set it via mmi-cli org project set ${repo} --var requiredChecks=[...], then mmi-cli ci reconcile --repo ${repo} --apply, or, if this repo genuinely has no CI surface, declare it via mmi-cli org project set ${repo} --var ciExemptReason="<why>" (#4265)`
+    });
+  }
   if (deployableGated || repoClass === "hub") {
     const gate = await readDefaultBranchGate(repo, deps.client, baseBranch, Date.now(), gateWorkflowFiles(prWorkflowPaths));
     checks.push({
@@ -13865,6 +13908,12 @@ async function postSchedulesMode(slug, mode, deps) {
 async function postSchedulesRun(id, deps) {
   return postJson("/schedules/run", { id }, deps, "POST", { noRetry: true });
 }
+async function postSchedulesPark(id, reason, deps) {
+  return postJson("/schedules/park", { id, reason }, deps);
+}
+async function postSchedulesUnpark(id, deps) {
+  return postJson("/schedules/unpark", { id }, deps);
+}
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
@@ -20923,7 +20972,7 @@ function authorizeBodyHasMismatch(body) {
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "gate", "seedCanary"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -21218,6 +21267,11 @@ function parseRequiredChecksVar(raw) {
   }
   return parsed.map((c) => c.trim());
 }
+function parseCiExemptReasonVar(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
+  return trimmed;
+}
 function parseGateVar(raw) {
   let parsed;
   try {
@@ -21270,6 +21324,7 @@ var SETTABLE_VAR_KEYS = [
   "portRange",
   "ci",
   "requiredChecks",
+  "ciExemptReason",
   "gate",
   "secrets",
   "seedCanary"
@@ -21296,6 +21351,7 @@ var SETTABLE_VAR_HINTS = {
   portRange: "JSON {start,end} or [start,end]",
   ci: "none \u2014 declare intentional no-ci",
   requiredChecks: 'JSON array, e.g. ["gate"] or [] for no-ci',
+  ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,workdir,cacheDepPath,pyVersion}"
 };
 function settableVarHelp() {
@@ -21393,6 +21449,8 @@ function buildProjectSetPatch(input) {
       patch[key] = raw;
     } else if (key === "requiredChecks") {
       patch[key] = parseRequiredChecksVar(raw);
+    } else if (key === "ciExemptReason") {
+      patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
       patch[key] = parseGateVar(raw);
     } else {
@@ -22730,6 +22788,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
   const liveByName = new Map(liveGithub.map((e) => [e.name, e]));
   const registryById = new Map(registryGithub.map((r) => [r.id, r]));
   const drifts = [];
+  const parked = [];
   for (const e of liveGithub) {
     if (!registryById.has(e.name)) {
       drifts.push({
@@ -22742,6 +22801,10 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
     }
   }
   for (const r of registryGithub) {
+    if (r.parkedReason) {
+      parked.push({ id: r.id, executor: r.executor, repo: r.repo, reason: r.parkedReason });
+      continue;
+    }
     const live = liveByName.get(r.id);
     if (live) {
       if (cadenceStale(r.cadence, live.cadence)) {
@@ -22763,7 +22826,7 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
           name: r.id,
           executor: r.executor || "github-actions",
           detail: "workflow file present but DISABLED in GitHub Actions \u2014 the dispatcher cannot run it",
-          remedy: `\`gh workflow enable\` it in ${r.repo} to re-arm (or, if it was retired on purpose, re-run schedules register so the replace prunes the SCHEDULE# row) \u2014 never prune a lane parked on purpose`
+          remedy: `\`gh workflow enable\` it in ${r.repo} to re-arm, or if this is a deliberate hold run \`mmi-cli org schedules park ${r.id} --reason <ref>\` (#4257) so it stops reading as drift \u2014 never prune a lane parked on purpose`
         });
       }
       continue;
@@ -22778,7 +22841,10 @@ function reconcileGithubActions(liveGithub, registry2, readRepos, activeWorkflow
       });
     }
   }
-  return drifts.sort((a, b) => a.class.localeCompare(b.class) || a.name.localeCompare(b.name));
+  return {
+    drifts: drifts.sort((a, b) => a.class.localeCompare(b.class) || a.name.localeCompare(b.name)),
+    parked: parked.sort((a, b) => a.id.localeCompare(b.id))
+  };
 }
 function suppressSelfManagedDrifts(drifts, selfManagedRepos) {
   return drifts.filter((d) => {
@@ -22789,6 +22855,9 @@ function suppressSelfManagedDrifts(drifts, selfManagedRepos) {
 function renderDrift(d) {
   return `${d.class}: ${d.name} (${d.executor}) \u2014 ${d.detail}; remedy: ${d.remedy}`;
 }
+function renderParked(p) {
+  return `parked (${p.reason}): ${p.id}`;
+}
 function strayCronDrift(name) {
   return {
     class: "stray-cron",
@@ -22824,12 +22893,17 @@ function unlauncheredLlmDrifts(entries) {
 }
 var HARBOUR_ARM_GRACE_MS = 30 * 60 * 1e3;
 function registeredButUnarmedDrifts(registry2, liveEntries, opts) {
-  if (!opts.schedulerRead) return [];
+  if (!opts.schedulerRead) return { drifts: [], parked: [] };
   const now = opts.now ?? Date.now();
   const armed = new Set(liveEntries.map((e) => e.scheduleId).filter((id) => Boolean(id)));
   const drifts = [];
+  const parked = [];
   for (const row of registry2) {
     if (row.executor === "github-actions") continue;
+    if (row.parkedReason) {
+      parked.push({ id: row.id, executor: row.executor, repo: row.repo, reason: row.parkedReason });
+      continue;
+    }
     if (armed.has(row.id)) continue;
     const stamped = row.updatedAt ? Date.parse(row.updatedAt) : NaN;
     if (Number.isFinite(stamped) && now - stamped < HARBOUR_ARM_GRACE_MS) continue;
@@ -22841,25 +22915,36 @@ function registeredButUnarmedDrifts(registry2, liveEntries, opts) {
       remedy: "check the fleet-clock reconciler tick; re-run `mmi-cli org schedules register` for the repo and verify with `mmi-cli org schedules`"
     });
   }
-  return drifts.sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    drifts: drifts.sort((a, b) => a.name.localeCompare(b.name)),
+    parked: parked.sort((a, b) => a.id.localeCompare(b.id))
+  };
 }
 function assembleReconciliation(githubEntries2, readRepos, registry2, activeWorkflowNames = /* @__PURE__ */ new Set(), harbour = {}, disabledWorkflowNames = /* @__PURE__ */ new Set()) {
   if (registry2 === null) {
     return {
       reconciliation: [],
       driftLines: [],
+      parked: [],
+      parkedLines: [],
       incomplete: ["registry: could not read GET /schedules/list \u2014 reconciliation skipped (Hub API unreachable or not authenticated)"]
     };
   }
   const live = githubEntries2.filter((e) => e.executor === "github-actions");
-  const drifts = [
-    ...reconcileGithubActions(live, registry2, readRepos, activeWorkflowNames, disabledWorkflowNames),
-    ...registeredButUnarmedDrifts(registry2, harbour.awsEntries ?? [], {
-      schedulerRead: Boolean(harbour.schedulerRead),
-      now: harbour.now
-    })
-  ];
-  return { reconciliation: drifts, driftLines: drifts.map(renderDrift), incomplete: [] };
+  const githubResult = reconcileGithubActions(live, registry2, readRepos, activeWorkflowNames, disabledWorkflowNames);
+  const harbourResult = registeredButUnarmedDrifts(registry2, harbour.awsEntries ?? [], {
+    schedulerRead: Boolean(harbour.schedulerRead),
+    now: harbour.now
+  });
+  const drifts = [...githubResult.drifts, ...harbourResult.drifts];
+  const parked = [...githubResult.parked, ...harbourResult.parked].sort((a, b) => a.id.localeCompare(b.id));
+  return {
+    reconciliation: drifts,
+    driftLines: drifts.map(renderDrift),
+    parked,
+    parkedLines: parked.map(renderParked),
+    incomplete: []
+  };
 }
 
 // src/schedules-commands.ts
@@ -23023,7 +23108,9 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
     entries: sortEntries([...gh.entries, ...aws.entries, ...DECLARED_ENTRIES]),
     incomplete: [...gh.incomplete, ...aws.incomplete, ...recon.incomplete],
     drift: driftLines,
-    reconciliation
+    reconciliation,
+    parked: recon.parked,
+    parkedLines: recon.parkedLines
   };
 }
 async function defaultProjectsRead() {
@@ -23036,10 +23123,13 @@ function warnIncomplete2(incomplete) {
 function reportDrift(drift) {
   for (const d of drift) console.error(`org schedules: DRIFT \u2014 ${d}`);
 }
+function reportParked(parked) {
+  for (const p of parked) console.log(`org schedules: ${p}`);
+}
 function registerSchedulesCommands(program3) {
   const schedules = program3.command("schedules").description("the org schedules notebook \u2014 every armed cron, timer, and scheduled LLM lane, resolved live (jerv side lives in jerv-cli schedules)").option("--json", "machine-readable output (consumed by jerv-cli schedules --all)").option("--doc <path>", "optional snapshot only \u2014 splice inventory between schedules:inventory markers; live `org schedules` / --json remains SSOT (Hub#4120)").action(async (o) => {
     try {
-      const { entries, incomplete, drift, reconciliation } = await fetchNotebook();
+      const { entries, incomplete, drift, reconciliation, parked, parkedLines } = await fetchNotebook();
       if (o.doc) {
         if (incomplete.length) {
           warnIncomplete2(incomplete);
@@ -23055,9 +23145,10 @@ function registerSchedulesCommands(program3) {
       }
       if (o.json) {
         const now = /* @__PURE__ */ new Date();
-        console.log(JSON.stringify({ org: entries.map((e) => withTickState(e, now)), incomplete, drift, reconciliation }, null, 2));
+        console.log(JSON.stringify({ org: entries.map((e) => withTickState(e, now)), incomplete, drift, reconciliation, parked }, null, 2));
       } else {
         console.log(formatSchedulesTable(entries));
+        reportParked(parkedLines);
         reportDrift(drift);
         warnIncomplete2(incomplete);
       }
@@ -23078,6 +23169,30 @@ function registerSchedulesCommands(program3) {
       await failGraceful(e.message);
     }
   });
+  schedules.command("park <schedule-id>").description("record a deliberate hold on a SCHEDULE# row \u2014 the reconciler skips it and `org schedules` renders `parked (<reason>)` instead of DRIFT (#4257)").requiredOption("--reason <ref>", "why the lane is held, e.g. an issue ref (#1774)").action(async (scheduleId, o) => {
+    try {
+      const res = await postSchedulesPark(scheduleId, o.reason, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        await failGraceful(`schedules park: HTTP ${res.status} \u2014 ${JSON.stringify(res.body ?? res.error ?? "failed")}`);
+        return;
+      }
+      console.log(JSON.stringify(res.body, null, 2));
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
+  schedules.command("unpark <schedule-id>").description("clear a deliberate hold on a SCHEDULE# row \u2014 reconciliation resumes normally (#4257)").action(async (scheduleId) => {
+    try {
+      const res = await postSchedulesUnpark(scheduleId, registryClientDeps(await loadConfig()));
+      if (!res.ok) {
+        await failGraceful(`schedules unpark: HTTP ${res.status} \u2014 ${JSON.stringify(res.body ?? res.error ?? "failed")}`);
+        return;
+      }
+      console.log(JSON.stringify(res.body, null, 2));
+    } catch (e) {
+      await failGraceful(e.message);
+    }
+  });
   schedules.command("mode <mode>").description("fleet schedules doctrine for a repo: 'managed' (default \u2014 Hub registry + drift enforcement) or 'self-managed' (opt out; the repo owns its crons). Project-admin self-serve (#3228).").option("--repo <name>", "bare repo name (defaults to the origin remote basename)").action(async (mode, o) => {
     try {
       if (mode !== "managed" && mode !== "self-managed") {
@@ -23861,6 +23976,16 @@ var import_node_crypto6 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
+function declaredRenderWaivers(manifest, repo) {
+  const slug = repo.includes("/") ? repo.slice(repo.indexOf("/") + 1).toLowerCase() : repo.toLowerCase();
+  const findings = [];
+  for (const seed of manifest.seeds) {
+    if (seed.ownership !== "org" || seed.source === "self") continue;
+    const why = seed.waivers?.[slug];
+    if (why) findings.push({ repo, target: seed.target, state: "waived", detail: `hand-authored, not rendered \u2014 waived: ${why}` });
+  }
+  return findings;
+}
 function compareSeedBytes(hubContent, repoContent) {
   if (repoContent === null) return "absent";
   const normalize = (s) => s.replace(/\r\n/g, "\n");
@@ -23938,18 +24063,21 @@ function assignWaves(repos, canarySlug) {
   rest.forEach((r, i) => waves.set(r.repo, i < wave1Count ? 1 : 2));
   return waves;
 }
-function statusFor(read) {
+function statusFor(read, currentSha) {
   if (!read) return { status: "pending", record: {} };
   if (read.drift === "match") return { status: "match", record: { mergeSha: read.pr?.mergeSha } };
   const pr2 = read.pr;
   if (!pr2) return { status: "pending", record: {} };
   if (pr2.state === "closed") return { status: "closed-unmerged", record: { prNumber: pr2.number, prUrl: pr2.url } };
+  if (pr2.state === "merged" && pr2.sourceSha && pr2.sourceSha !== currentSha) {
+    return { status: "pending", record: {} };
+  }
   if (pr2.checks === "red") return { status: "red", record: { prNumber: pr2.number, prUrl: pr2.url } };
   return { status: "open-pending", record: { prNumber: pr2.number, prUrl: pr2.url, mergeSha: pr2.mergeSha } };
 }
 var HALTING_STATUSES = /* @__PURE__ */ new Set(["red", "closed-unmerged"]);
 function planPropagationTick(input) {
-  const { target, repos, canarySlug, reads, isWorkflowSeed, functionGateSatisfied } = input;
+  const { target, repos, canarySlug, reads, isWorkflowSeed, functionGateSatisfied, currentSha } = input;
   const readByRepo = new Map(reads.map((r) => [r.repo, r]));
   const records = [];
   const opened = [];
@@ -23983,7 +24111,7 @@ function planPropagationTick(input) {
     let waveAllMatch = true;
     let waveHasRed = false;
     for (const r of waveRepos) {
-      const { status, record } = statusFor(readByRepo.get(r.repo));
+      const { status, record } = statusFor(readByRepo.get(r.repo), currentSha);
       const shouldOpen = status === "pending";
       if (shouldOpen) opened.push(r.repo);
       records.push({
@@ -24725,6 +24853,7 @@ async function reconcileOrgNoAgentFilesRuleset(plan, client, org = ORG_LOGIN) {
 }
 
 // src/bootstrap-commands.ts
+var execGitForSeedSource = async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
 function registerBootstrapCommands(program3) {
   const bootstrap = program3.command("bootstrap").description("plan repo bootstrap operations; mutations require master-admin approval").option("--repo <owner/repo>", "target repo").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).option("--json", "machine-readable output").action((o) => {
     if (!o.repo) return fail("bootstrap: required option --repo <owner/repo> not specified");
@@ -24804,6 +24933,8 @@ function registerBootstrapCommands(program3) {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs31.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    const seedSource = await resolveHubSeedSource(execGitForSeedSource);
+    if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
     const manifest = loadBootstrapSeeds((0, import_node_fs31.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
@@ -24846,12 +24977,14 @@ function registerBootstrapCommands(program3) {
         reads.push({ target: seed.target, content });
       }
       findings.push(...auditRepoSeedDrift(repo, seeds, hubContents, reads));
+      findings.push(...declaredRenderWaivers(manifest, repo));
     }
     if (o.json) {
       console.log(JSON.stringify({
         // #3842: `ok` reflects real findings; waivers ride the payload so a consumer can see every
         // standing exception without them counting as drift.
         ok: findings.every((f) => f.state === "waived"),
+        sourceSha: seedSource.sha,
         scope: o.repo ? "single-repo" : "fleet",
         reposAudited: targets.length,
         seedsPerRepo,
@@ -24886,6 +25019,8 @@ function registerBootstrapCommands(program3) {
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs31.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    const seedSource = await resolveHubSeedSource(execGitForSeedSource);
+    if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
     const manifest = loadBootstrapSeeds((0, import_node_fs31.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
@@ -25062,9 +25197,9 @@ function registerBootstrapCommands(program3) {
           "--body",
           onlyTarget ? `Auto-opened by \`mmi-cli bootstrap apply ${repo} --only ${onlyTarget} --execute\` (#3818).
 
-\`${onlyTarget}\` is an org-owned seed declared in MMI-Hub's \`skills/bootstrap/seeds/manifest.json\`; this PR brings this repo's copy to the Hub's. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
+\`${onlyTarget}\` is an org-owned seed declared in MMI-Hub's \`skills/bootstrap/seeds/manifest.json\` at MMI-Hub@${seedSource.sha}; this PR brings this repo's copy to the Hub's. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
 
-\`${baseBranch}\` is protected (${seedPlan.reason}), so delivery goes via this branch + PR \u2014 a direct contents PUT 409s on a protected base.` : `Auto-opened by \`mmi-cli bootstrap apply --execute ${repo}\` (#2286): \`${baseBranch}\` is protected (${seedPlan.reason}), so the org-managed seed files are delivered via this branch + PR \u2014 a direct contents PUT 409s on a protected base ("N of N required status checks are expected").`
+\`${baseBranch}\` is protected (${seedPlan.reason}), so delivery goes via this branch + PR \u2014 a direct contents PUT 409s on a protected base.` : `Auto-opened by \`mmi-cli bootstrap apply --execute ${repo}\` (#2286): \`${baseBranch}\` is protected (${seedPlan.reason}), so the org-managed seed files are delivered via this branch + PR \u2014 a direct contents PUT 409s on a protected base ("N of N required status checks are expected"). Seeds are from MMI-Hub@${seedSource.sha}.`
         ]);
         seedPrUrl = created.url;
       }
@@ -25160,7 +25295,7 @@ function registerBootstrapCommands(program3) {
         applied.push(`ddb register ${registerPayload.slug} (failed: ${why})`);
       }
     }
-    if (o.json) console.log(JSON.stringify({ repo, class: o.class, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedPrUrl, actions, applied, ddbWrites }, null, 2));
+    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedPrUrl, actions, applied, ddbWrites }, null, 2));
     else {
       console.log(renderSeedPlan(actions));
       if (o.execute) console.log(`
@@ -25172,6 +25307,8 @@ LIVE apply to ${repo}:
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs31.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    const seedSource = await resolveHubSeedSource(execGitForSeedSource);
+    if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
     const manifest = loadBootstrapSeeds((0, import_node_fs31.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
     if (!o.target) {
@@ -25210,9 +25347,28 @@ LIVE apply to ${repo}:
     }
     const bySlugMeta = new Map(projects.flatMap((p) => (p.repos ?? []).map((r) => [(r.includes("/") ? r : `mutmutco/${r}`).toLowerCase(), p])));
     const classOf = (repo) => bySlugMeta.get(repo.toLowerCase())?.class ?? "deployable";
-    const canaryProject = projects.find((p) => p.seedCanary === true);
-    const canarySlug = canaryProject ? (canaryProject.repos ?? [])[0]?.split("/").pop()?.toLowerCase() ?? null : null;
-    const repos = rosterRepos2.map((repo) => {
+    const inClassRepos = rosterRepos2.filter((repo) => seed.classes.includes(classOf(repo)));
+    const classPriority = [.../* @__PURE__ */ new Set(["deployable", ...seed.classes])].filter((c) => seed.classes.includes(c));
+    let canaryProject = null;
+    for (const cls of classPriority) {
+      const inClass = projects.filter((p) => p.seedCanary === true && (p.class ?? "deployable") === cls);
+      if (inClass.length === 0) continue;
+      if (inClass.length > 1) {
+        const slugs = inClass.map((p) => (p.repos ?? [])[0]?.split("/").pop() ?? "?").join(", ");
+        return fail(
+          `bootstrap propagate: target '${seed.target}' (classes [${seed.classes.join(", ")}]) matches ${inClass.length} seedCanary:true repos in class '${cls}' (${slugs}) \u2014 exactly one seedCanary:true repo per class is required`
+        );
+      }
+      canaryProject = inClass[0];
+      break;
+    }
+    if (!canaryProject) {
+      return fail(
+        `bootstrap propagate: target '${seed.target}' needs classes [${seed.classes.join(", ")}] but no registry repo with seedCanary:true carries a matching class \u2014 set seedCanary:true on an in-class repo (mmi-cli org project set <slug> --var seedCanary=true)`
+      );
+    }
+    const canarySlug = (canaryProject.repos ?? [])[0]?.split("/").pop()?.toLowerCase() ?? null;
+    const repos = inClassRepos.map((repo) => {
       const slug = repo.split("/").pop().toLowerCase();
       const waiver = seed.waivers?.[slug];
       return { repo, slug, waiver };
@@ -25236,13 +25392,14 @@ LIVE apply to ${repo}:
       let pr2;
       try {
         const branch = `${branchPrefix}-${r.slug}`;
-        const listed = await gh(["pr", "list", "--repo", r.repo, "--head", branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit", "--limit", "1"]);
+        const listed = await gh(["pr", "list", "--repo", r.repo, "--head", branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,statusCheckRollup,mergeCommit,body", "--limit", "1"]);
         const arr = JSON.parse(listed.stdout || "[]");
         const p = arr[0];
         if (p) {
           const rollup = p.statusCheckRollup ?? [];
           const checks = rollup.length === 0 ? "none" : rollup.some((c) => c.conclusion === "FAILURE" || c.state === "FAILURE") ? "red" : rollup.every((c) => c.conclusion === "SUCCESS" || c.state === "SUCCESS") ? "success" : "pending";
-          pr2 = { number: p.number, url: p.url, state: p.state === "MERGED" ? "merged" : p.state === "CLOSED" ? "closed" : "open", checks, mergeSha: p.mergeCommit?.oid };
+          const sourceSha = p.body?.match(/Propagates MMI-Hub@([0-9a-fA-F]{7,40})/)?.[1];
+          pr2 = { number: p.number, url: p.url, state: p.state === "MERGED" ? "merged" : p.state === "CLOSED" ? "closed" : "open", checks, mergeSha: p.mergeCommit?.oid, sourceSha };
         }
       } catch {
         pr2 = void 0;
@@ -25264,10 +25421,10 @@ LIVE apply to ${repo}:
         }
       }
     }
-    const plan = planPropagationTick({ target: seed.target, repos, canarySlug, reads, isWorkflowSeed, functionGateSatisfied });
+    const plan = planPropagationTick({ target: seed.target, repos, canarySlug, reads, isWorkflowSeed, functionGateSatisfied, currentSha: seedSource.sha });
     if (o.execute) {
       if (plan.refusedNoCanary) return fail("bootstrap propagate --execute: no canary declared for this target \u2014 refusing to write (set seedCanary:true on exactly one registry repo)");
-      const headSha = (await gh(["api", "repos/mutmutco/MMI-Hub/commits/development", "--jq", ".sha"])).stdout.trim();
+      const headSha = seedSource.sha;
       for (const rec of plan.records) {
         if (rec.action !== "open-pr") continue;
         const repoEntry = repos.find((r) => r.repo === rec.repo);
@@ -25332,8 +25489,9 @@ Rollback: \`mmi-cli bootstrap rollback ${rec.repo} --target ${seed.target} --exe
         rec.prUrl = prUrl;
       }
     }
-    if (o.json) console.log(JSON.stringify(plan, null, 2));
-    else console.log(renderPropagationReport(plan));
+    if (o.json) console.log(JSON.stringify({ ...plan, sourceSha: seedSource.sha }, null, 2));
+    else console.log(`${renderPropagationReport(plan)}
+  source: MMI-Hub@${seedSource.sha}`);
     if (plan.halted) process.exitCode = 1;
   });
   bootstrap.command("rollback <repo>").description("#4240: open a per-repo revert PR of the recorded seed-propagate merge \u2014 never a fleet-wide overwrite; dry-run unless --execute").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).option("--target <path>", "the manifest target to roll back (an ownership:org + source:self seed, e.g. .github/workflows/agent-pr.yml)").option("--record <path>", "read propagation candidates from a persisted `bootstrap propagate --json` report instead of the live seed-propagate PR history").option("--execute", "LIVE revert via gh (master-gated) \u2014 opens/reuses the seed-rollback PR; dry-run prints the plan only").option("--json", "machine-readable output").action(async (repo) => {
@@ -25353,6 +25511,8 @@ Rollback: \`mmi-cli bootstrap rollback ${rec.repo} --target ${seed.target} --exe
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs31.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    const seedSource = await resolveHubSeedSource(execGitForSeedSource);
+    if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
     const manifest = loadBootstrapSeeds((0, import_node_fs31.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
     if (!o.target) {
@@ -25408,7 +25568,7 @@ Rollback: \`mmi-cli bootstrap rollback ${rec.repo} --target ${seed.target} --exe
     }
     const plan = planRollback(repo, seed.target, slug, candidates);
     if (!plan.resolution.found) {
-      if (o.json) console.log(JSON.stringify(plan, null, 2));
+      if (o.json) console.log(JSON.stringify({ ...plan, sourceSha: seedSource.sha }, null, 2));
       else console.log(renderRollbackReport(plan));
       return fail(`bootstrap rollback: ${plan.resolution.reason}`);
     }
@@ -25463,8 +25623,9 @@ Rollback: \`mmi-cli bootstrap rollback ${rec.repo} --target ${seed.target} --exe
       }
       plan.prUrl = prUrl;
     }
-    if (o.json) console.log(JSON.stringify(plan, null, 2));
-    else console.log(renderRollbackReport(plan));
+    if (o.json) console.log(JSON.stringify({ ...plan, sourceSha: seedSource.sha }, null, 2));
+    else console.log(`${renderRollbackReport(plan)}
+  manifest verified against: MMI-Hub@${seedSource.sha}`);
   });
 }
 
@@ -29481,6 +29642,25 @@ function findNegatedClosings(text, closingNumbers) {
     return forIssue.length > 0 && forIssue.every((m) => m.negated);
   });
 }
+var CROSS_REPO_TOKEN_RE = /\b([\w.-]+\/[\w.-]+)#(\d+)\b/g;
+function findCrossRepoAmbiguousClosings(text, closingNumbers, repo) {
+  if (!closingNumbers.length) return [];
+  const closing = new Set(closingNumbers);
+  const flagged = /* @__PURE__ */ new Set();
+  const repoLower = repo.toLowerCase();
+  for (const match of text.matchAll(CROSS_REPO_TOKEN_RE)) {
+    const n = Number(match[2]);
+    if (!closing.has(n)) continue;
+    if ((match[1] ?? "").toLowerCase() === repoLower) continue;
+    flagged.add(n);
+  }
+  return [...flagged];
+}
+function crossRepoAmbiguousRefusalMessage(ambiguous, repo, context = "pr merge") {
+  const named = ambiguous.map((n) => `${repo}#${n}`).join(", ");
+  const first = `#${ambiguous[0] ?? "N"}`;
+  return `${context}: REFUSED \u2014 GitHub will close ${named} on merge (a bare \`#N\` after a closing keyword always means the repo the PR lives in), but this body also mentions ${first} qualified against a DIFFERENT repo elsewhere \u2014 check whether that closing keyword was meant to carry an explicit owner/repo#N qualifier instead. Reword the closing reference with the full owner/repo#N form, or re-run with --force to merge anyway and let ${named} close.`;
+}
 function commitMessagesText(commits) {
   if (!Array.isArray(commits)) return "";
   return commits.map((commit) => {
@@ -29489,7 +29669,7 @@ function commitMessagesText(commits) {
 ${typeof messageBody === "string" ? messageBody : ""}`;
   }).join("\n");
 }
-function parseClosingGuardInput(raw) {
+function parseClosingGuardInput(raw, repo) {
   if (!raw || typeof raw !== "object") return void 0;
   const { title, body, state, closingIssuesReferences, commits } = raw;
   if (typeof state !== "string" || !Array.isArray(closingIssuesReferences)) return void 0;
@@ -29502,7 +29682,7 @@ function parseClosingGuardInput(raw) {
   const commitClosing = [...new Set(findClosingMentions(commitMessagesText(commits)).map((m) => m.issue))];
   const text = `${typeof title === "string" ? title : ""}
 ${typeof body === "string" ? body : ""}`;
-  return { state, text, closing, commitClosing };
+  return { state, text, closing, commitClosing, repo };
 }
 function negatedClosingRefusalMessage(negated, context = "pr merge") {
   const named = negated.map((n) => `#${n}`).join(", ");
@@ -29531,12 +29711,24 @@ function evaluateClosingGuard(input, opts) {
   }
   if (input.closing.length === 0) return { blocked: false };
   const negated = findNegatedClosings(input.text, input.closing);
-  if (!negated.length) return { blocked: false };
-  if (!opts.force) return { blocked: true, message: negatedClosingRefusalMessage(negated, opts.context) };
-  return {
-    blocked: false,
-    message: `${opts.context}: --force past the negated-closing guard \u2014 GitHub will still close ${negated.map((n) => `#${n}`).join(", ")} on merge although the PR body says it does not.`
-  };
+  if (negated.length) {
+    if (!opts.force) return { blocked: true, message: negatedClosingRefusalMessage(negated, opts.context) };
+    return {
+      blocked: false,
+      message: `${opts.context}: --force past the negated-closing guard \u2014 GitHub will still close ${negated.map((n) => `#${n}`).join(", ")} on merge although the PR body says it does not.`
+    };
+  }
+  if (input.repo) {
+    const ambiguous = findCrossRepoAmbiguousClosings(input.text, input.closing, input.repo);
+    if (ambiguous.length) {
+      if (!opts.force) return { blocked: true, message: crossRepoAmbiguousRefusalMessage(ambiguous, input.repo, opts.context) };
+      return {
+        blocked: false,
+        message: `${opts.context}: --force past the cross-repo-ambiguous closing guard \u2014 GitHub will still close ${ambiguous.map((n) => `${input.repo}#${n}`).join(", ")} on merge.`
+      };
+    }
+  }
+  return { blocked: false };
 }
 
 // src/session-report.ts
@@ -34455,12 +34647,13 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
   if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
   if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
 });
-pr.command("land <number>").description("agent merge path (#1440): train probe ? checks-wait ? merge --auto ? poll enqueued ? development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--preserve-worktree", "after merge, keep the local PR worktree/stage/branch for an active batch (#1888)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword refusal (#3718)").action(async (number, o) => {
+pr.command("land <number>").description("agent merge path (#1440): train probe ? checks-wait ? merge --auto ? poll enqueued ? development PRs only").option("--json", "machine-readable output").option("--repo <owner/repo>", "target repo (defaults to the PR repo)").option("--no-require-train", "skip train-authority preflight (not recommended for autonomous agents)").option("--preserve-worktree", "after merge, keep the local PR worktree/stage/branch for an active batch (#1888)").option("--force", "acknowledge and land past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal").action(async (number, o) => {
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const startingPath = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
   assertPrMergeHousekeepingClean(startingPath || process.cwd(), "pr land", { force: o.force });
   const landClosingGuardRaw = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "title,body,state,closingIssuesReferences,commits"], { timeout: GC_GH_TIMEOUT_MS2 }).then((r) => JSON.parse(r.stdout)).catch(() => void 0);
-  const landClosingGuardVerdict = evaluateClosingGuard(parseClosingGuardInput(landClosingGuardRaw), { force: o.force, context: "pr land" });
+  const landRepoForGuard = await resolveRepo(o.repo).catch(() => void 0) ?? o.repo;
+  const landClosingGuardVerdict = evaluateClosingGuard(parseClosingGuardInput(landClosingGuardRaw, landRepoForGuard), { force: o.force, context: "pr land" });
   if (landClosingGuardVerdict.blocked) {
     console.error(landClosingGuardVerdict.message);
     process.exitCode = 1;
@@ -34571,14 +34764,14 @@ pr.command("land <number>").description("agent merge path (#1440): train probe ?
   }
   if (result.status === "failed" || result.cleanupError) process.exitCode = 1;
 });
-jsonParity(pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree ? no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge ? merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword refusal (#3718)")).action(async (number, o) => {
+jsonParity(pr.command("merge <number>").description("merge a PR (squash by default) and clean up its branch + worktree ? no leftover local branch; on no-ci repos run pr ci-policy / checks-wait first (#1432)").option("--squash", "squash merge (default)").option("--merge", "create a merge commit").option("--rebase", "rebase merge").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--auto", "enable auto-merge ? merge once the base-branch policy is satisfied (use for policy-gated repos)").option("--wait", `wait for checks to reach a terminal passing verdict before merging (default budget ${PR_CHECKS_TIMEOUT_MS / 6e4}m)`).option("--preserve-worktree", "keep the local PR worktree/stage/branch for an active multi-issue batch (#1888)").option("--force", "acknowledge and merge past a remaining prunable/severe scratch housekeeping block (advisory kept plans/ never blocks, #3012) or a negated-closing-keyword (#3718) or ambiguous-cross-repo-closing (#4279) refusal")).action(async (number, o) => {
   const method = o.rebase ? "--rebase" : o.merge ? "--merge" : "--squash";
   const repoArgs = o.repo ? ["--repo", o.repo] : [];
   const repoForPostCleanup = await resolveRepo(o.repo) ?? o.repo;
   const [headRef, baseRef, headRefOid] = (await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "headRefName,baseRefName,headRefOid", "--jq", '.headRefName + " " + .baseRefName + " " + (.headRefOid // "")'], { timeout: GC_GH_TIMEOUT_MS2 })).stdout.trim().split(/\s+/);
   const headIsProtected = isProtectedBranch(headRef);
   const closingGuardRaw = await execFileP2("gh", ["pr", "view", number, ...repoArgs, "--json", "title,body,state,closingIssuesReferences,commits"], { timeout: GC_GH_TIMEOUT_MS2 }).then((r) => JSON.parse(r.stdout)).catch(() => void 0);
-  const closingGuardVerdict = evaluateClosingGuard(parseClosingGuardInput(closingGuardRaw), { force: o.force, context: "pr merge" });
+  const closingGuardVerdict = evaluateClosingGuard(parseClosingGuardInput(closingGuardRaw, repoForPostCleanup), { force: o.force, context: "pr merge" });
   if (closingGuardVerdict.blocked) {
     console.error(closingGuardVerdict.message);
     process.exitCode = 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.100.0",
+  "version": "3.102.0",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",