@mutmutco/cli 3.125.0 → 3.127.0

package/dist/main.cjs

@@ -523,7 +523,7 @@ var require_graceful_fs = __commonJS({
     function patch(fs3) {
       polyfills(fs3);
       fs3.gracefulify = patch;
-      fs3.createReadStream = createReadStream;
+      fs3.createReadStream = createReadStream2;
       fs3.createWriteStream = createWriteStream;
       var fs$readFile = fs3.readFile;
       fs3.readFile = readFile9;
@@ -733,7 +733,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream(path2, options) {
+      function createReadStream2(path2, options) {
         return new fs3.ReadStream(path2, options);
       }
       function createWriteStream(path2, options) {
@@ -1239,11 +1239,11 @@ var require_mtime_precision = __commonJS({
     function probe(file, fs2, callback) {
       const cachedPrecision = fs2[cacheSymbol];
       if (cachedPrecision) {
-        return fs2.stat(file, (err, stat3) => {
+        return fs2.stat(file, (err, stat4) => {
           if (err) {
             return callback(err);
           }
-          callback(null, stat3.mtime, cachedPrecision);
+          callback(null, stat4.mtime, cachedPrecision);
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
@@ -1251,13 +1251,13 @@ var require_mtime_precision = __commonJS({
         if (err) {
           return callback(err);
         }
-        fs2.stat(file, (err2, stat3) => {
+        fs2.stat(file, (err2, stat4) => {
           if (err2) {
             return callback(err2);
           }
-          const precision = stat3.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
+          const precision = stat4.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
           Object.defineProperty(fs2, cacheSymbol, { value: precision });
-          callback(null, stat3.mtime, precision);
+          callback(null, stat4.mtime, precision);
         });
       });
     }
@@ -1311,14 +1311,14 @@ var require_lockfile = __commonJS({
         if (options.stale <= 0) {
           return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
         }
-        options.fs.stat(lockfilePath, (err2, stat3) => {
+        options.fs.stat(lockfilePath, (err2, stat4) => {
           if (err2) {
             if (err2.code === "ENOENT") {
               return acquireLock2(file, { ...options, stale: 0 }, callback);
             }
             return callback(err2);
           }
-          if (!isLockStale(stat3, options)) {
+          if (!isLockStale(stat4, options)) {
             return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
           }
           removeLock(file, options, (err3) => {
@@ -1330,8 +1330,8 @@ var require_lockfile = __commonJS({
         });
       });
     }
-    function isLockStale(stat3, options) {
-      return stat3.mtime.getTime() < Date.now() - options.stale;
+    function isLockStale(stat4, options) {
+      return stat4.mtime.getTime() < Date.now() - options.stale;
     }
     function removeLock(file, options, callback) {
       options.fs.rmdir(getLockFile(file, options), (err) => {
@@ -1349,7 +1349,7 @@ var require_lockfile = __commonJS({
       lock2.updateDelay = lock2.updateDelay || options.update;
       lock2.updateTimeout = setTimeout(() => {
         lock2.updateTimeout = null;
-        options.fs.stat(lock2.lockfilePath, (err, stat3) => {
+        options.fs.stat(lock2.lockfilePath, (err, stat4) => {
           const isOverThreshold = lock2.lastUpdate + options.stale < Date.now();
           if (err) {
             if (err.code === "ENOENT" || isOverThreshold) {
@@ -1358,7 +1358,7 @@ var require_lockfile = __commonJS({
             lock2.updateDelay = 1e3;
             return updateLock(file, options);
           }
-          const isMtimeOurs = lock2.mtime.getTime() === stat3.mtime.getTime();
+          const isMtimeOurs = lock2.mtime.getTime() === stat4.mtime.getTime();
           if (!isMtimeOurs) {
             return setLockAsCompromised(
               file,
@@ -1483,11 +1483,11 @@ var require_lockfile = __commonJS({
         if (err) {
           return callback(err);
         }
-        options.fs.stat(getLockFile(file2, options), (err2, stat3) => {
+        options.fs.stat(getLockFile(file2, options), (err2, stat4) => {
           if (err2) {
             return err2.code === "ENOENT" ? callback(null, false) : callback(err2);
           }
-          return callback(null, !isLockStale(stat3, options));
+          return callback(null, !isLockStale(stat4, options));
         });
       });
     }
@@ -1533,12 +1533,12 @@ var require_adapter = __commonJS({
       return newFs;
     }
     function toPromise(method) {
-      return (...args) => new Promise((resolve5, reject) => {
+      return (...args) => new Promise((resolve6, reject) => {
         args.push((err, result) => {
           if (err) {
             reject(err);
           } else {
-            resolve5(result);
+            resolve6(result);
           }
         });
         method(...args);
@@ -4999,8 +4999,8 @@ function useColor() {
 var program = new Command();
 
 // src/index.ts
-var import_promises11 = require("node:fs/promises");
-var import_node_fs47 = require("node:fs");
+var import_promises12 = require("node:fs/promises");
+var import_node_fs48 = require("node:fs");
 var import_node_child_process20 = require("node:child_process");
 
 // src/cli-shared.ts
@@ -5112,19 +5112,19 @@ function hardExit(code) {
 }
 var STDIO_FLUSH_TIMEOUT_MS = 2e3;
 function flushStream(stream) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     try {
-      stream.write("", () => resolve5());
+      stream.write("", () => resolve6());
     } catch {
-      resolve5();
+      resolve6();
     }
   });
 }
 async function flushStdio(timeoutMs = STDIO_FLUSH_TIMEOUT_MS) {
   await Promise.race([
     Promise.all([flushStream(process.stdout), flushStream(process.stderr)]),
-    new Promise((resolve5) => {
-      setTimeout(resolve5, timeoutMs).unref?.();
+    new Promise((resolve6) => {
+      setTimeout(resolve6, timeoutMs).unref?.();
     })
   ]);
 }
@@ -5132,7 +5132,7 @@ async function cleanExit(code) {
   process.exitCode = code;
   await closeHttpPool();
   await flushStdio();
-  await new Promise((resolve5) => setImmediate(resolve5));
+  await new Promise((resolve6) => setImmediate(resolve6));
   return void 0;
 }
 var CLI_EXIT_WATCHDOG_MS = (() => {
@@ -5519,7 +5519,7 @@ async function fetchWithRetry(fetchImpl, url, init, opts = {}) {
   const attempts = opts.attempts ?? 3;
   const baseDelayMs = opts.baseDelayMs ?? 250;
   const retryOn = opts.retryOn ?? ((res) => res.status >= 500);
-  const sleep3 = opts.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = opts.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastErr;
   for (let i = 0; i < attempts; i++) {
     const isLast = i === attempts - 1;
@@ -5646,10 +5646,10 @@ var import_node_fs4 = require("node:fs");
 var injectedStdin;
 function stdinHasPipedInput(statFd = () => (0, import_node_fs4.fstatSync)(0), getIsTTY = () => process.stdin.isTTY) {
   try {
-    const stat3 = statFd();
-    if (stat3.isFIFO() || stat3.isFile()) return true;
-    if (stat3.isCharacterDevice()) return false;
-    if (stat3.isSocket()) return false;
+    const stat4 = statFd();
+    if (stat4.isFIFO() || stat4.isFile()) return true;
+    if (stat4.isCharacterDevice()) return false;
+    if (stat4.isSocket()) return false;
     if (getIsTTY() === true) return false;
     return true;
   } catch {
@@ -5680,8 +5680,8 @@ async function readStdin(opts = {}) {
   })().catch(() => {
   });
   let timer;
-  const timeout = new Promise((resolve5) => {
-    timer = setTimeout(resolve5, timeoutMs);
+  const timeout = new Promise((resolve6) => {
+    timer = setTimeout(resolve6, timeoutMs);
   });
   try {
     await Promise.race([drain, timeout]);
@@ -5735,12 +5735,12 @@ function killProcessTree(pid) {
 function execFileHard(file, args, options) {
   const { timeout, step, ...rest } = options;
   const started = Date.now();
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child2 = (0, import_node_child_process3.execFile)(file, args, { encoding: "utf8", windowsHide: true, ...rest, timeout: 0 }, (error, stdout, stderr) => {
       clearTimeout(timer);
       if (expired) return;
       if (error) reject(error);
-      else resolve5({ stdout: String(stdout), stderr: String(stderr) });
+      else resolve6({ stdout: String(stdout), stderr: String(stderr) });
     });
     let expired = false;
     const timer = setTimeout(() => {
@@ -6234,9 +6234,9 @@ function trackedPathStatus(c, realPath, repoAnchor) {
     return null;
   }
 }
-function rootScratchDirSnapshot(root, readdir2, stat3) {
+function rootScratchDirSnapshot(root, readdir2, stat4) {
   try {
-    const rootStat = stat3(root);
+    const rootStat = stat4(root);
     let mtimeMs = rootStat.mtimeMs;
     let bytes = 0;
     const stack = [root];
@@ -6250,7 +6250,7 @@ function rootScratchDirSnapshot(root, readdir2, stat3) {
           return null;
         } catch {
         }
-        const st = stat3(child2);
+        const st = stat4(child2);
         mtimeMs = Math.max(mtimeMs, st.mtimeMs);
         if (ent.isDirectory()) stack.push(child2);
         else if (ent.isFile()) bytes += st.size;
@@ -6263,7 +6263,7 @@ function rootScratchDirSnapshot(root, readdir2, stat3) {
 }
 function collectScratchSnapshot(repoRoot2, deps = {}) {
   const readdir2 = deps.readdir ?? import_node_fs6.readdirSync;
-  const stat3 = deps.stat ?? import_node_fs6.statSync;
+  const stat4 = deps.stat ?? import_node_fs6.statSync;
   const plansRoot = (0, import_node_path4.join)(repoRoot2, "plans");
   const rootScratchFiles = [];
   try {
@@ -6276,10 +6276,10 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
       const full = (0, import_node_path4.join)(repoRoot2, ent.name);
       try {
         if (isDir) {
-          const snap = rootScratchDirSnapshot(full, readdir2, stat3);
+          const snap = rootScratchDirSnapshot(full, readdir2, stat4);
           if (snap) rootScratchFiles.push({ path: full, dir: repoRoot2, name: ent.name, mtimeMs: snap.mtimeMs, bytes: snap.bytes, kind: "dir" });
         } else {
-          const st = stat3(full);
+          const st = stat4(full);
           rootScratchFiles.push({ path: full, dir: repoRoot2, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file" });
         }
       } catch {
@@ -6293,7 +6293,7 @@ function collectScratchSnapshot(repoRoot2, deps = {}) {
       if (!ent.isFile() || !ent.name.endsWith(".md")) continue;
       const full = (0, import_node_path4.join)(plansRoot, ent.name);
       try {
-        const st = stat3(full);
+        const st = stat4(full);
         planMdFiles.push({ path: full, dir: plansRoot, name: ent.name, mtimeMs: st.mtimeMs, bytes: st.size, kind: "file" });
       } catch {
       }
@@ -7405,7 +7405,7 @@ async function runWithSweepWatchdog(run, timeoutMs, onTimeout) {
     clearTimeout(timer);
   }
 }
-var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function removeWorktreeWithRecovery(wtPath, deps) {
   const maxAttempts = deps.maxAttempts ?? 3;
   const backoff = deps.backoffMs ?? [250, 1e3];
@@ -10075,7 +10075,7 @@ var import_node_path15 = require("node:path");
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
 var import_node_path14 = require("node:path");
-var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var sleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 var IMMEDIATE_RETRY_BUDGET = 3;
 var FileLockBusyError = class extends Error {
   lockPath;
@@ -10488,7 +10488,7 @@ function commandLadderHint() {
 }
 
 // src/index.ts
-var import_node_path44 = require("node:path");
+var import_node_path45 = require("node:path");
 
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
@@ -12338,6 +12338,12 @@ function extractControlOutputFromLog(log) {
   const slice = end < 0 ? lines.slice(start + 1) : lines.slice(start + 1, end);
   return slice.map(logLinePayload).join("\n").trim();
 }
+function clampTaskOutput(output, maxChars = 16384) {
+  if (output.length <= maxChars) return output;
+  const kept = output.slice(output.length - maxChars);
+  return `[task output truncated by mmi-cli \u2014 last ${maxChars} of ${output.length} chars]
+${kept}`;
+}
 function parseStatusSnippet(stdout) {
   const t = stdout.toLowerCase();
   const m = t.match(/service[:=]\s*(running|stopped|missing|up|down|absent)/);
@@ -13628,6 +13634,9 @@ async function postSchedulesUnpark(id, deps) {
 async function tenantControl(payload, deps) {
   return postJson("/tenant-control", payload, deps, "POST", { noRetry: true });
 }
+async function tenantArtifactUpload(payload, deps) {
+  return postJson("/tenant-control", { ...payload, action: "artifact-upload" }, deps, "POST", { noRetry: true });
+}
 async function tenantReconcile(payload, deps) {
   return postJson("/tenant-reconcile", payload, deps, "POST", { noRetry: true });
 }
@@ -13930,7 +13939,7 @@ function upstreamFaultMessage(verb, stderr) {
 }
 async function ghCreate(args, deps = {}) {
   const exec = deps.exec ?? execFileP2;
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   const swapped = await bodyArgsViaFile(args);
   try {
     for (let attempt = 1; attempt <= GH_CREATE_UPSTREAM_RETRIES; attempt++) {
@@ -15136,8 +15145,8 @@ var PRE_SPAWN_DRAIN_TIMEOUT_MS = 2e3;
 async function drainHttpPoolBeforeSpawn() {
   const drained = await Promise.race([
     closeHttpPool().then(() => true),
-    new Promise((resolve5) => {
-      setTimeout(() => resolve5(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
+    new Promise((resolve6) => {
+      setTimeout(() => resolve6(false), PRE_SPAWN_DRAIN_TIMEOUT_MS).unref?.();
     })
   ]);
   if (!drained) destroyHttpPool();
@@ -15840,10 +15849,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "3.125.0",
-    tag: "v3.125.0",
-    commit: "2ffc8e9b6dc8",
-    npm: "@mutmutco/cli@3.125.0"
+    version: "3.127.0",
+    tag: "v3.127.0",
+    commit: "2f170f4e63d4",
+    npm: "@mutmutco/cli@3.127.0"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15860,14 +15869,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v3.125.0"
+          v3Target: "v3.127.0"
         }
       ],
       rollbackTrigger: "Any red inside the post-cut soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a v3 client refused while the compat window must still admit it (SUPPORTED_MINOR_WINDOW=2, MIN_CLIENT_VERSION 0.0.0 \u2014 D6a), or npm consumer install/doctor failure on the v4 dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 3.125.0 and redeploy the Hub Lambda from tag v3.125.0 (2ffc8e9b6dc8); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v3.125.0 (@mutmutco/cli@3.125.0, tag commit 2ffc8e9b6dc8 \u2014 the preserved latest-v3 distribution, D6b)"
+        mechanism: "npm dist-tag latest -> 3.127.0 and redeploy the Hub Lambda from tag v3.127.0 (2f170f4e63d4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v3.127.0 (@mutmutco/cli@3.127.0, tag commit 2f170f4e63d4 \u2014 the preserved latest-v3 distribution, D6b)"
       }
     },
     {
@@ -18274,7 +18283,7 @@ async function runMergeTreePreflight(deps, ours, theirs) {
 async function predictMergeConflicts(deps, ours, theirs) {
   return runMergeTreePreflight(deps, ours, theirs);
 }
-async function mergeWithToleratedResolution(deps, sourceRef, label, resolve5, extraTolerated = []) {
+async function mergeWithToleratedResolution(deps, sourceRef, label, resolve6, extraTolerated = []) {
   try {
     await deps.run("git", ["merge", sourceRef, "--no-edit"]);
     return;
@@ -18288,7 +18297,7 @@ async function mergeWithToleratedResolution(deps, sourceRef, label, resolve5, ex
       unmerged.length === 0 ? `${label} merge failed without conflicted paths \u2014 merge aborted; inspect the repo state and rerun` : `${label} merge conflicts on untolerated path(s): ${blocking.join(", ")} \u2014 merge aborted (the train is misaligned; reconcile the branches via an approved alignment PR, then rerun)`
     );
   }
-  await deps.run("git", ["checkout", `--${resolve5}`, "--", ...unmerged]);
+  await deps.run("git", ["checkout", `--${resolve6}`, "--", ...unmerged]);
   await deps.run("git", ["add", "--", ...unmerged]);
   await deps.run("git", ["commit", "--no-edit"]);
 }
@@ -18499,7 +18508,7 @@ var CORRELATE_SKEW_SLACK_MS = 1e4;
 var CORRELATE_PAGE_LIMIT = 50;
 var RUN_CONFIRM_ATTEMPTS = 3;
 var RUN_CONFIRM_DELAY_MS = 1e3;
-var defaultSleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultSleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 function resolveSleep(deps) {
   return deps.sleep ?? defaultSleep2;
 }
@@ -20420,14 +20429,14 @@ async function runTenantReconcile(deps, options) {
   };
 }
 function tenantControlWatches(action) {
-  return action === "status" || action === "retire" || action === "verify-secrets" || action === "verify-broker" || action === "logs";
+  return action === "status" || action === "retire" || action === "verify-secrets" || action === "verify-broker" || action === "logs" || action === "run-task";
 }
 async function runTenantControl(deps, options) {
   const { repo, stage, action } = options;
   const watch = options.watch ?? tenantControlWatches(action);
   const base = { command: "tenant-control", repo, stage, action };
   const since = (deps.now ?? Date.now)();
-  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines });
+  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, task: options.task, artifact: options.artifact });
   if (!d.ok) {
     const transport = d.category === "transport-failed";
     return {
@@ -20438,7 +20447,7 @@ async function runTenantControl(deps, options) {
       note: transport ? `runtime tenant control ${action} dispatch failed (transport) \u2014 safe to retry` : `runtime tenant control ${action} rejected: ${d.error ?? "request rejected by the Hub"}`
     };
   }
-  const correlated = await correlateControlRun(deps, since, [stage, action]);
+  const correlated = await correlateControlRun(deps, since, [stage, action, ...action === "run-task" && options.task ? [options.task] : []]);
   if (correlated.read === "failed") {
     return {
       ...base,
@@ -20474,6 +20483,13 @@ async function runTenantControl(deps, options) {
       result.brokerRaw = output;
     }
   }
+  if (watch && runId != null && action === "run-task" && (conclusion === "success" || conclusion === "failure")) {
+    const fetched = await fetchControlRunLog(deps, runId);
+    if (fetched.ok) {
+      const output = extractControlOutputFromLog(fetched.log);
+      if (output) result.taskOutput = clampTaskOutput(output);
+    }
+  }
   result.note = conclusion === "success" ? `tenant-control ${action} run succeeded` : conclusion === "failure" ? `tenant-control ${action} run failed \u2014 inspect the run` : runId == null ? `dispatched tenant-control.yml (${action}) \u2014 run not correlated; check the Actions tab` : `dispatched tenant-control.yml (${action}) \u2014 not watched`;
   return result;
 }
@@ -20485,6 +20501,10 @@ function renderTenantControl(r) {
   if (r.secrets?.length) {
     for (const s of r.secrets) lines.push(`  ${s.key}: ${s.status}`);
   }
+  if (r.taskOutput) {
+    lines.push("  task output:");
+    for (const l of r.taskOutput.split("\n")) lines.push(`    ${l}`);
+  }
   lines.push(`  ${r.note}`);
   return lines.join("\n");
 }
@@ -21417,7 +21437,7 @@ async function mergeAutoWithTransientRetry(prNumber, repo, deps) {
   if (first.mergeStatus !== "failed") return first;
   const ready = await deps.probeMergeReady(prNumber, repo).catch(() => ({ open: false, mergeable: false, checksPassing: false }));
   if (!ready.open || !ready.mergeable || !ready.checksPassing) return first;
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   await sleep3(PR_LAND_MERGE_RETRY_DELAY_MS);
   const retried = await deps.mergeAuto(prNumber, repo);
   if (retried.mergeStatus !== "failed") return retried;
@@ -21428,7 +21448,7 @@ var AUTO_MERGE_CONFIRM_DELAY_MS = 3e3;
 async function confirmAutoMergeEnqueued(deps, options) {
   const retries = options?.retries ?? AUTO_MERGE_CONFIRM_RETRIES;
   const delayMs = options?.delayMs ?? AUTO_MERGE_CONFIRM_DELAY_MS;
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   for (let attempt = 0; attempt < retries; attempt++) {
     if (await deps.readMerged().catch(() => false)) return "merged";
     const stuck = await deps.readAutoMergeRequest().then((s) => s.trim()).catch(() => "");
@@ -21445,7 +21465,7 @@ async function confirmAutoMergeEnqueued(deps, options) {
 async function readGhPrStateWithRetry(fetchState, options) {
   const retries = options?.retries ?? PR_LAND_STATE_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_LAND_STATE_READ_DELAY_MS;
-  const sleep3 = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastError = "empty state";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -21552,7 +21572,7 @@ function healthPollIntervalMs() {
   return HEALTH_POLL_INTERVAL_MS;
 }
 function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     let settled = false;
     const finish = (fn) => {
       if (settled) return;
@@ -21562,7 +21582,7 @@ function waitForProcessStability(child2, graceMs = earlyExitGraceMs()) {
       child2.removeAllListeners("exit");
       fn();
     };
-    const timer = setTimeout(() => finish(resolve5), graceMs);
+    const timer = setTimeout(() => finish(resolve6), graceMs);
     child2.on("error", (err) => finish(() => reject(new Error(`stage process failed to start: ${err.message}`))));
     child2.on("exit", (code, signal) => {
       const detail = code != null ? `code ${code}` : signal ? `signal ${signal}` : "unknown reason";
@@ -21772,10 +21792,10 @@ function pickStagePort(range, isFree) {
   throw new Error(`no free stage port in range ${start}-${end} \u2014 every port is in use`);
 }
 function isPortFree(port) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const srv = (0, import_node_net.createServer)();
-    srv.once("error", () => resolve5(false));
-    srv.once("listening", () => srv.close(() => resolve5(true)));
+    srv.once("error", () => resolve6(false));
+    srv.once("listening", () => srv.close(() => resolve6(true)));
     srv.listen(port, "127.0.0.1");
   });
 }
@@ -21986,7 +22006,7 @@ async function killTree(pid) {
     } catch {
     }
   }
-  await new Promise((resolve5) => setTimeout(resolve5, 500));
+  await new Promise((resolve6) => setTimeout(resolve6, 500));
   try {
     process.kill(-pid, "SIGKILL");
   } catch {
@@ -22007,7 +22027,7 @@ async function waitForHealth(url, timeoutMs, anyStatus = false) {
     } catch (e) {
       last = e.message;
     }
-    await new Promise((resolve5) => setTimeout(resolve5, healthPollIntervalMs()));
+    await new Promise((resolve6) => setTimeout(resolve6, healthPollIntervalMs()));
   }
   throw new Error(`stage health check timed out for ${url}${last ? ` (${last})` : ""}`);
 }
@@ -23542,7 +23562,7 @@ async function setBoardItemPriority(client, cfg, itemId, priority) {
   await updateItemSingleSelect(client, cfg.projectId, itemId, cfg.priorityFieldId, optionId);
   return cliPriorityToFieldName(priority);
 }
-var defaultRetrySleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var defaultRetrySleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function resolveProjectItemIdWithRetry(client, cfg, selector, opts = {}) {
   const attempts = Math.max(1, opts.attempts ?? 5);
   const delayMs = opts.delayMs ?? 300;
@@ -24653,7 +24673,7 @@ function buildOption(opt) {
   if (opt.hidden) out.discovery = "all-only";
   return out;
 }
-function buildCommand(cmd, path2) {
+function buildCommand(cmd, flatPath) {
   const metadata = commandMetadata(cmd) ?? {
     category: "core",
     discovery: "primary",
@@ -24661,29 +24681,31 @@ function buildCommand(cmd, path2) {
     module_owner: "unclassified",
     consumer: "unclassified"
   };
-  const house = houseForPath(path2);
+  const house = houseForPath(flatPath);
   if (!house) {
     throw new Error(
-      `command-manifest: command '${path2}' has no house assignment \u2014 add it to cli/src/house-map.ts (the six-house taxonomy; every top-level command maps to exactly one house).`
+      `command-manifest: command '${flatPath}' has no house assignment \u2014 add it to cli/src/house-map.ts (the six-house taxonomy; every top-level command maps to exactly one house).`
     );
   }
   const aliases = cmd.aliases();
+  const canonical = canonicalPathFor(flatPath) ?? flatPath;
   const out = {
     name: cmd.name(),
-    path: path2,
+    path: canonical,
+    flat_path: flatPath,
     ...aliases.length ? { aliases: [...aliases] } : {},
     house,
-    canonical: canonicalPathFor(path2) ?? path2,
+    canonical,
     arguments: cmd.registeredArguments.map(buildArgument),
     // A hand-parsed command registers no Commander options, so its declared set is merged in (#3682).
     options: [...cmd.options.map(buildOption), ...readDeclaredOptions(cmd)],
     subcommands: cmd.commands.map(
-      (child2) => buildCommand(child2, path2 ? `${path2} ${child2.name()}` : child2.name())
+      (child2) => buildCommand(child2, flatPath ? `${flatPath} ${child2.name()}` : child2.name())
     ),
     ...metadata
   };
   if (cmd._allowUnknownOption) out.parses_own_argv = true;
-  if (path2 && house !== "core") out.flat_removed = true;
+  if (flatPath && house !== "core") out.flat_removed = true;
   const description = cmd.description();
   if (description) out.description = description;
   const examples = readExamples(cmd);
@@ -24712,7 +24734,7 @@ function collectLeaves(node, acc) {
 function buildHouses(tree) {
   const collect = (node, parentHouse, root, out) => {
     if (node.house === root && parentHouse !== root) {
-      const entry = { path: node.path, canonical: node.canonical };
+      const entry = { path: node.flat_path, canonical: node.canonical };
       if (node.description) entry.description = node.description;
       out.push(entry);
     }
@@ -25875,6 +25897,57 @@ function renderVerifyBroker(input) {
   };
 }
 
+// src/tenant-artifact.ts
+var import_node_crypto4 = require("node:crypto");
+var import_node_fs28 = require("node:fs");
+var import_promises5 = require("node:fs/promises");
+var import_node_path26 = require("node:path");
+var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var MAX_BYTES = 5 * 1024 * 1024 * 1024;
+async function sha256File(path2) {
+  const hash = (0, import_node_crypto4.createHash)("sha256");
+  for await (const chunk of (0, import_node_fs28.createReadStream)(path2)) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function putTenantArtifact(repo, stage, inputPath, deps) {
+  if (!["dev", "rc", "main"].includes(stage)) throw new Error("tenant artifact put: <stage> must be dev, rc, or main");
+  const path2 = (0, import_node_path26.resolve)(inputPath);
+  const info = await (0, import_promises5.stat)(path2);
+  if (!info.isFile()) throw new Error("tenant artifact put: input path must be a file");
+  if (!Number.isSafeInteger(info.size) || info.size < 1 || info.size > MAX_BYTES) throw new Error(`tenant artifact put: file must be 1..${MAX_BYTES} bytes`);
+  const sha256 = await sha256File(path2);
+  const prepared = await tenantArtifactUpload({ repo, stage, size: info.size, sha256 }, deps);
+  if (!prepared.ok) {
+    const detail = prepared.body?.error ?? prepared.error ?? `HTTP ${prepared.status}`;
+    throw new Error(`tenant artifact put: ${detail}`);
+  }
+  const body = prepared.body;
+  if (!ARTIFACT_ID_RE.test(body.artifactId ?? "") || typeof body.uploadUrl !== "string" || !body.uploadUrl.startsWith("https://")) throw new Error("tenant artifact put: Hub returned an invalid upload grant");
+  if (!body.headers || typeof body.headers !== "object" || Array.isArray(body.headers)) throw new Error("tenant artifact put: Hub returned invalid signed headers");
+  const headers = Object.fromEntries(Object.entries(body.headers).map(([key, value]) => {
+    if (typeof value !== "string" || /[\r\n]/.test(key + value)) throw new Error("tenant artifact put: Hub returned an unsafe signed header");
+    return [key, value];
+  }));
+  headers["content-length"] = String(info.size);
+  const stream = (0, import_node_fs28.createReadStream)(path2);
+  let uploaded;
+  try {
+    uploaded = await fetch(body.uploadUrl, {
+      method: "PUT",
+      headers,
+      body: stream,
+      duplex: "half",
+      signal: AbortSignal.timeout(60 * 60 * 1e3)
+    });
+  } catch (error) {
+    stream.destroy();
+    throw error;
+  }
+  if (!uploaded.ok) throw new Error(`tenant artifact put: object upload failed (HTTP ${uploaded.status})`);
+  if (body.size !== info.size || body.sha256 !== sha256 || typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt))) throw new Error("tenant artifact put: Hub returned inconsistent artifact metadata");
+  return { artifactId: body.artifactId, repo, stage, size: info.size, sha256, expiresAt: body.expiresAt };
+}
+
 // src/hotfix-coverage.ts
 var import_node_child_process12 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
@@ -26058,7 +26131,7 @@ function clean3(out) {
   return out.trim();
 }
 function sleeper(deps) {
-  return deps.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  return deps.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
 }
 function normalizeHotfixVersion(input) {
   const m = /^v?(\d+\.\d+\.\d+)$/.exec(input.trim());
@@ -26972,10 +27045,10 @@ async function announceRelease(deps, args) {
 }
 
 // src/repo-index.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var import_node_child_process13 = require("node:child_process");
-var import_node_fs28 = require("node:fs");
-var import_node_path26 = require("node:path");
+var import_node_fs29 = require("node:fs");
+var import_node_path27 = require("node:path");
 var REPO_INDEX_SCHEMA = 1;
 var HARD_DENY = [
   /(^|\/)\.env(\.|$)/i,
@@ -27100,11 +27173,11 @@ function loadReadmeHints(cwd, candidatePaths) {
   }
   for (const rel of readmes) {
     if (isHardDeniedPath(rel)) continue;
-    const abs = (0, import_node_path26.join)(cwd, ...rel.split("/"));
-    if (!(0, import_node_fs28.existsSync)(abs)) continue;
+    const abs = (0, import_node_path27.join)(cwd, ...rel.split("/"));
+    if (!(0, import_node_fs29.existsSync)(abs)) continue;
     let text;
     try {
-      text = (0, import_node_fs28.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs29.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
@@ -27117,7 +27190,7 @@ function loadReadmeHints(cwd, candidatePaths) {
   return hints;
 }
 function toPosix(p) {
-  return p.split(import_node_path26.sep).join("/");
+  return p.split(import_node_path27.sep).join("/");
 }
 function listCandidatePaths(cwd, exec = import_node_child_process13.execFileSync) {
   try {
@@ -27139,16 +27212,16 @@ function rebuildRepoIndex(cwd, repoSlug2) {
   for (const rel of candidates) {
     if (ignored.has(rel)) continue;
     if (isHardDeniedPath(rel)) continue;
-    const abs = (0, import_node_path26.join)(cwd, ...rel.split("/"));
-    if (!(0, import_node_fs28.existsSync)(abs)) continue;
+    const abs = (0, import_node_path27.join)(cwd, ...rel.split("/"));
+    if (!(0, import_node_fs29.existsSync)(abs)) continue;
     let text;
     try {
-      text = (0, import_node_fs28.readFileSync)(abs, "utf8");
+      text = (0, import_node_fs29.readFileSync)(abs, "utf8");
     } catch {
       continue;
     }
     if (text.length > 15e5) continue;
-    const hash = (0, import_node_crypto4.createHash)("sha256").update(text).digest("hex").slice(0, 16);
+    const hash = (0, import_node_crypto5.createHash)("sha256").update(text).digest("hex").slice(0, 16);
     const symbols = extractSymbols(text);
     const docBlurb = extractModuleBlurb(text);
     const top = rel.includes("/") ? rel.split("/")[0] : "";
@@ -27168,16 +27241,16 @@ function rebuildRepoIndex(cwd, repoSlug2) {
     entries
   };
   const store = repoIndexStorePath(cwd);
-  (0, import_node_fs28.mkdirSync)((0, import_node_path26.dirname)(store), { recursive: true });
-  (0, import_node_fs28.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
+  (0, import_node_fs29.mkdirSync)((0, import_node_path27.dirname)(store), { recursive: true });
+  (0, import_node_fs29.writeFileSync)(store, `${JSON.stringify(projection, null, 2)}
 `, "utf8");
   return projection;
 }
 function loadRepoIndex(cwd) {
   const store = repoIndexStorePath(cwd);
-  if (!(0, import_node_fs28.existsSync)(store)) return null;
+  if (!(0, import_node_fs29.existsSync)(store)) return null;
   try {
-    const raw = JSON.parse((0, import_node_fs28.readFileSync)(store, "utf8"));
+    const raw = JSON.parse((0, import_node_fs29.readFileSync)(store, "utf8"));
     if (raw?.schema !== REPO_INDEX_SCHEMA || !Array.isArray(raw.entries)) return null;
     return raw;
   } catch {
@@ -27249,7 +27322,7 @@ function inferRepoSlug(cwd, exec = import_node_child_process13.execFileSync) {
     if (m?.[1]) return m[1].toLowerCase();
   } catch {
   }
-  return ((0, import_node_path26.basename)(cwd) || "local").toLowerCase();
+  return ((0, import_node_path27.basename)(cwd) || "local").toLowerCase();
 }
 
 // src/repo-index-cloud-client.ts
@@ -27389,9 +27462,9 @@ async function gcRepoIndexCloud(deps) {
 }
 
 // src/repo-index-sync.ts
-var import_node_fs29 = require("node:fs");
+var import_node_fs30 = require("node:fs");
 var import_node_os12 = require("node:os");
-var import_node_path27 = require("node:path");
+var import_node_path28 = require("node:path");
 var import_node_child_process14 = require("node:child_process");
 var MAX_EMBED_BACKFILL_ROUNDS = 40;
 function normalizeRepo(raw) {
@@ -27435,7 +27508,7 @@ async function syncEstateRepoIndex(opts) {
   const failed = [];
   const skipped = [];
   for (const repo of repos) {
-    const dir = (0, import_node_fs29.mkdtempSync)((0, import_node_path27.join)((0, import_node_os12.tmpdir)(), "mmi-repo-index-"));
+    const dir = (0, import_node_fs30.mkdtempSync)((0, import_node_path28.join)((0, import_node_os12.tmpdir)(), "mmi-repo-index-"));
     try {
       shallowClone(repo, dir, opts.githubToken);
       const built = rebuildRepoIndex(dir, repo);
@@ -27485,7 +27558,7 @@ async function syncEstateRepoIndex(opts) {
       failed.push({ repo, error: e.message });
     } finally {
       try {
-        (0, import_node_fs29.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs30.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -27494,7 +27567,7 @@ async function syncEstateRepoIndex(opts) {
 }
 
 // src/repo-index-health.ts
-var import_node_fs30 = require("node:fs");
+var import_node_fs31 = require("node:fs");
 
 // testdata/repo-index-golden-queries.json
 var repo_index_golden_queries_default = {
@@ -27536,7 +27609,7 @@ function assertGoldenSuite(raw, source) {
 function loadGoldenSuite(path2) {
   let text;
   try {
-    text = (0, import_node_fs30.readFileSync)(path2, "utf8");
+    text = (0, import_node_fs31.readFileSync)(path2, "utf8");
   } catch (e) {
     throw new Error(`golden suite unreadable at ${path2}: ${e.message}`);
   }
@@ -27690,8 +27763,8 @@ async function runRepoIndexHealth(opts) {
 
 // src/spawn-policy-core.ts
 var import_node_child_process15 = require("node:child_process");
-var import_node_fs31 = require("node:fs");
-var import_node_path28 = require("node:path");
+var import_node_fs32 = require("node:fs");
+var import_node_path29 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
 var CALL_SOURCE = String.raw`(^|[^.\w$])(${SPAWNERS.join("|")})\s*\(`;
 var SOURCE_EXT = /\.(ts|mts|cts|js|mjs|cjs)$/;
@@ -27777,7 +27850,7 @@ function runSpawnPolicy(root) {
   for (const file of files) {
     let raw;
     try {
-      raw = (0, import_node_fs31.readFileSync)((0, import_node_path28.join)(root, file), "utf8");
+      raw = (0, import_node_fs32.readFileSync)((0, import_node_path29.join)(root, file), "utf8");
     } catch {
       continue;
     }
@@ -27795,8 +27868,8 @@ function runSpawnPolicy(root) {
 
 // src/test-policy-core.ts
 var import_node_child_process16 = require("node:child_process");
-var import_node_fs32 = require("node:fs");
-var import_node_path29 = require("node:path");
+var import_node_fs33 = require("node:fs");
+var import_node_path30 = require("node:path");
 var POLICY_FILE = "test-policy.json";
 var TEST_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
 var PY_TEST_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
@@ -27849,7 +27922,7 @@ function isTestPath(path2) {
   return TEST_RE.test(path2) || PY_TEST_RE.test(path2);
 }
 function loadPolicy(root, readFile9 = readFileOrNull2) {
-  const raw = readFile9((0, import_node_path29.join)(root, POLICY_FILE));
+  const raw = readFile9((0, import_node_path30.join)(root, POLICY_FILE));
   if (raw == null) return { mandatory: [], declared: false };
   try {
     return { ...JSON.parse(raw), declared: true };
@@ -27859,7 +27932,7 @@ function loadPolicy(root, readFile9 = readFileOrNull2) {
 }
 function readFileOrNull2(path2) {
   try {
-    return (0, import_node_fs32.readFileSync)(path2, "utf8");
+    return (0, import_node_fs33.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -27886,12 +27959,12 @@ function classify(changed, policy, present = () => false) {
   const removedProtected = [...removed].filter((p) => protectedBy.has(p)).map((p) => ({ path: p, why: protectedBy.get(p) ?? "" }));
   return { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected };
 }
-function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
-  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path29.join)(root, p)));
+function unresolvedProtectedEntries(policy, root, exists = (path2) => (0, import_node_fs33.existsSync)(path2)) {
+  return (policy.protected ?? []).map((p) => p.path).filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
-function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs32.existsSync)(path2)) {
+function unresolvedSatisfiers(policy, root, exists = (path2) => (0, import_node_fs33.existsSync)(path2)) {
   const declared = (policy.mandatory ?? []).flatMap((m) => m.satisfiedBy ?? []);
-  return [...new Set(declared)].filter((p) => !exists((0, import_node_path29.join)(root, p)));
+  return [...new Set(declared)].filter((p) => !exists((0, import_node_path30.join)(root, p)));
 }
 function evaluate(changed, policy, present = () => false) {
   const { mandatoryHits, untestedHits, testChanges, addedTests, removedProtected } = classify(changed, policy, present);
@@ -28073,13 +28146,13 @@ function changedFilesSince(base, cwd) {
 }
 function runTestPolicy(root, deps = {}) {
   const policy = deps.policy ?? loadPolicy(root);
-  const exists = deps.exists ?? ((path2) => (0, import_node_fs32.existsSync)(path2));
+  const exists = deps.exists ?? ((path2) => (0, import_node_fs33.existsSync)(path2));
   const counts = { mandatoryCount: (policy.mandatory ?? []).length, protectedCount: (policy.protected ?? []).length };
   const base = deps.changed ? "(injected)" : resolveBase(root, deps.base);
   const refusal = deps.changed ? null : untrustworthyRange(root, base);
   const changed = deps.changed ?? (refusal ? [] : changedFilesSince(base, root));
   const lookup = deps.override !== void 0 ? { override: deps.override, refusals: [] } : !deps.changed && !refusal ? readOverride(base, root) : { override: null, refusals: [] };
-  const present = (path2) => exists((0, import_node_path29.join)(root, path2));
+  const present = (path2) => exists((0, import_node_path30.join)(root, path2));
   const removedByThisDiff = removedPaths(changed);
   const staleFindings = [];
   const unresolved = unresolvedProtectedEntries(policy, root, exists).filter((p) => !removedByThisDiff.has(p));
@@ -28117,8 +28190,8 @@ function runTestPolicy(root, deps = {}) {
 }
 
 // src/project-info-sync.ts
-var import_node_fs33 = require("node:fs");
-var import_node_path30 = require("node:path");
+var import_node_fs34 = require("node:fs");
+var import_node_path31 = require("node:path");
 var UPDATE_PROJECT_INFO = `mutation($projectId: ID!, $shortDescription: String!, $readme: String!) {
   updateProjectV2(input: { projectId: $projectId, shortDescription: $shortDescription, readme: $readme }) {
     projectV2 { id }
@@ -28163,14 +28236,14 @@ function sharedName(entries, fallback) {
 }
 function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   if (!project2.projectId) throw new Error(`org project sync-info: ${targetRepo2} registry META has no projectId`);
-  const readmePath = (0, import_node_path30.join)(repoRoot2, "README.md");
-  if (!(0, import_node_fs33.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
+  const readmePath = (0, import_node_path31.join)(repoRoot2, "README.md");
+  if (!(0, import_node_fs34.existsSync)(readmePath)) throw new Error(`org project sync-info: ${targetRepo2} has no README.md`);
   const entries = entriesFor(project2, projects);
   const memberRepos = [...new Set(entries.flatMap((entry) => entry.repos ?? []))].filter((repo) => /^[^/]+\/[^/]+$/.test(repo)).sort((a, b) => a.localeCompare(b));
   const projectName = sharedName(entries, project2.name?.trim() || targetRepo2.split("/").pop() || targetRepo2);
   if (!memberRepos.length) throw new Error(`org project sync-info: project ${projectName} has no registered member repos`);
   const entryNames = entries.map((entry) => entry.name?.trim()).filter((name) => Boolean(name));
-  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs33.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
+  const shortDescription = memberRepos.length === 1 ? shortDescriptionFromReadme((0, import_node_fs34.readFileSync)(readmePath, "utf8")) : `Shared work across ${new Intl.ListFormat("en", { type: "conjunction" }).format(entryNames)}.`;
   const lines = [
     `# ${projectName}`,
     "",
@@ -28189,8 +28262,8 @@ function buildProjectInfoSyncPlan(targetRepo2, project2, projects, repoRoot2) {
   const targetBase = `https://github.com/${targetRepo2}`;
   const targetBranch = branchFor(targetRepo2, projects);
   const orgDocs = [
-    (0, import_node_fs33.existsSync)((0, import_node_path30.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
-    (0, import_node_fs33.existsSync)((0, import_node_path30.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
+    (0, import_node_fs34.existsSync)((0, import_node_path31.join)(repoRoot2, "docs", "org-readme.md")) ? `- [Org identity](${targetBase}/blob/${targetBranch}/docs/org-readme.md)` : "",
+    (0, import_node_fs34.existsSync)((0, import_node_path31.join)(repoRoot2, "docs", "org-architecture.md")) ? `- [Org architecture](${targetBase}/blob/${targetBranch}/docs/org-architecture.md)` : ""
   ].filter(Boolean);
   if (orgDocs.length) lines.push("", "## Organisation docs", "", ...orgDocs);
   return { projectId: project2.projectId, projectName, targetRepo: targetRepo2, memberRepos, shortDescription, readme: `${lines.join("\n")}
@@ -28212,7 +28285,7 @@ async function syncProjectInfo(plan, client, apply) {
 }
 
 // src/project-set.ts
-var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "ciExemptReason", "gate", "seedCanary"];
+var UNSET_KEYS = ["oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "dsManifestPath", "fofuEnabled", "consumesDesignSystem", "ci", "requiredChecks", "ciExemptReason", "gate", "seedCanary"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -28537,6 +28610,43 @@ function parseGateVar(raw) {
   }
   return out;
 }
+function parseTenantTasksVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("org project set: tenantTasks must be valid JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("org project set: tenantTasks must be a JSON object");
+  const entries = Object.entries(parsed);
+  if (entries.length > 20) throw new Error("org project set: tenantTasks supports at most 20 declarations");
+  const out = {};
+  const nameRe = /^[a-z0-9][a-z0-9-]{0,62}$/;
+  const serviceRe = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/;
+  const validStages = /* @__PURE__ */ new Set(["dev", "rc", "main"]);
+  for (const [name, rawTask] of entries) {
+    if (!nameRe.test(name)) throw new Error(`org project set: tenantTasks name ${JSON.stringify(name)} must be lowercase kebab-case`);
+    if (!rawTask || typeof rawTask !== "object" || Array.isArray(rawTask)) throw new Error(`org project set: tenantTasks.${name} must be an object`);
+    const task = rawTask;
+    if (Object.keys(task).some((key) => !["service", "command", "stages", "timeoutSeconds", "artifact"].includes(key))) throw new Error(`org project set: tenantTasks.${name} has an unknown field`);
+    if (typeof task.service !== "string" || !serviceRe.test(task.service)) throw new Error(`org project set: tenantTasks.${name}.service has an unsafe shape`);
+    if (!Array.isArray(task.command) || task.command.length < 1 || task.command.length > 32 || task.command.some((arg) => typeof arg !== "string" || arg.length < 1 || arg.length > 256 || /[\u0000\r\n]/.test(arg))) throw new Error(`org project set: tenantTasks.${name}.command must be 1-32 bounded argv strings`);
+    if (!Array.isArray(task.stages) || task.stages.length < 1 || task.stages.length > 3 || task.stages.some((stage) => typeof stage !== "string" || !validStages.has(stage)) || new Set(task.stages).size !== task.stages.length) throw new Error(`org project set: tenantTasks.${name}.stages must be unique dev/rc/main values`);
+    if (task.timeoutSeconds !== void 0 && (!Number.isInteger(task.timeoutSeconds) || task.timeoutSeconds < 1 || task.timeoutSeconds > 3600)) throw new Error(`org project set: tenantTasks.${name}.timeoutSeconds must be an integer 1..3600`);
+    const artifact = task.artifact ?? "none";
+    if (artifact !== "none" && artifact !== "required") throw new Error(`org project set: tenantTasks.${name}.artifact must be none or required`);
+    const carriesPlaceholder = task.command.some((arg) => arg.includes("{artifact}"));
+    if (artifact === "required" !== carriesPlaceholder) throw new Error(`org project set: tenantTasks.${name} must use {artifact} exactly when artifact is required`);
+    out[name] = {
+      service: task.service,
+      command: task.command,
+      stages: task.stages,
+      ...task.timeoutSeconds !== void 0 ? { timeoutSeconds: task.timeoutSeconds } : {},
+      ...artifact !== "none" ? { artifact } : {}
+    };
+  }
+  return out;
+}
 var SETTABLE_VAR_KEYS = [
   "name",
   "division",
@@ -28556,6 +28666,7 @@ var SETTABLE_VAR_KEYS = [
   "requiredGcpApis",
   "requiredRuntimeSecrets",
   "requiredBuildSecrets",
+  "tenantTasks",
   "edgeDomains",
   "statusFieldId",
   "statusOptions",
@@ -28584,6 +28695,7 @@ var SETTABLE_VAR_HINTS = {
   requiredGcpApis: "comma-string",
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
+  tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required"}}; use {artifact} in argv when required',
   secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; clear with --unset secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
@@ -28656,6 +28768,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseRuntimeSecretsVar(raw);
     } else if (key === "requiredBuildSecrets") {
       patch[key] = parseBuildSecretsVar(raw);
+    } else if (key === "tenantTasks") {
+      patch[key] = parseTenantTasksVar(raw);
     } else if (key === "secrets") {
       patch[key] = parseSecretsCatalogVar(raw);
     } else if (key === "edgeDomains") {
@@ -28975,8 +29089,8 @@ function writeError(res) {
 }
 
 // src/secrets-commands.ts
-var import_node_fs34 = require("node:fs");
-var import_node_path31 = require("node:path");
+var import_node_fs35 = require("node:fs");
+var import_node_path32 = require("node:path");
 var import_node_os13 = require("node:os");
 
 // src/secrets-diff.ts
@@ -29079,18 +29193,18 @@ function collectMap(value, previous = []) {
   return [...previous, value];
 }
 async function decryptRailsCredentials(input) {
-  const appDir = (0, import_node_path31.resolve)(input.appDir ?? process.cwd());
+  const appDir = (0, import_node_path32.resolve)(input.appDir ?? process.cwd());
   const credentialsFile = input.credentialsFile ?? DEFAULT_RAILS_CREDENTIALS_FILE;
   const masterKeyFile = input.masterKeyFile ?? DEFAULT_RAILS_MASTER_KEY_FILE;
-  const credentialsPath = (0, import_node_path31.resolve)(appDir, credentialsFile);
-  const masterKeyPath = (0, import_node_path31.resolve)(appDir, masterKeyFile);
+  const credentialsPath = (0, import_node_path32.resolve)(appDir, credentialsFile);
+  const masterKeyPath = (0, import_node_path32.resolve)(appDir, masterKeyFile);
   const env = {
     ...process.env,
     MMI_RAILS_CREDENTIALS_FILE: credentialsPath,
     MMI_RAILS_MASTER_KEY_FILE: masterKeyPath
   };
-  if ((0, import_node_fs34.existsSync)(masterKeyPath)) {
-    env.RAILS_MASTER_KEY = (0, import_node_fs34.readFileSync)(masterKeyPath, "utf8").trim();
+  if ((0, import_node_fs35.existsSync)(masterKeyPath)) {
+    env.RAILS_MASTER_KEY = (0, import_node_fs35.readFileSync)(masterKeyPath, "utf8").trim();
   }
   const script = [
     'require "json"',
@@ -29100,9 +29214,9 @@ async function decryptRailsCredentials(input) {
     'config = ActiveSupport::EncryptedConfiguration.new(config_path: config_path, key_path: key_path, env_key: "RAILS_MASTER_KEY", raise_if_missing_key: true)',
     "puts JSON.generate(config.config)"
   ].join("\n");
-  const scriptDir = (0, import_node_fs34.mkdtempSync)((0, import_node_path31.join)((0, import_node_os13.tmpdir)(), "mmi-rails-decrypt-"));
-  const scriptPath = (0, import_node_path31.join)(scriptDir, "decrypt.rb");
-  (0, import_node_fs34.writeFileSync)(scriptPath, script, "utf8");
+  const scriptDir = (0, import_node_fs35.mkdtempSync)((0, import_node_path32.join)((0, import_node_os13.tmpdir)(), "mmi-rails-decrypt-"));
+  const scriptPath = (0, import_node_path32.join)(scriptDir, "decrypt.rb");
+  (0, import_node_fs35.writeFileSync)(scriptPath, script, "utf8");
   try {
     const args = ["exec", "ruby", scriptPath];
     const cmd = process.platform === "win32" ? "cmd.exe" : "bundle";
@@ -29114,7 +29228,7 @@ async function decryptRailsCredentials(input) {
     });
     return JSON.parse(stdout);
   } finally {
-    (0, import_node_fs34.rmSync)(scriptDir, { recursive: true, force: true });
+    (0, import_node_fs35.rmSync)(scriptDir, { recursive: true, force: true });
   }
 }
 async function readSecretStdin() {
@@ -29204,7 +29318,7 @@ function registerSecretsCommands(program3) {
     let body;
     if (o.file) {
       try {
-        body = (0, import_node_fs34.readFileSync)((0, import_node_path31.resolve)(o.file), "utf8");
+        body = (0, import_node_fs35.readFileSync)((0, import_node_path32.resolve)(o.file), "utf8");
       } catch (e) {
         return fail(`secrets org-catalog: cannot read --file ${o.file}: ${e.message}`);
       }
@@ -29309,7 +29423,7 @@ function registerSecretsCommands(program3) {
       {
         ...d,
         decryptRailsCredentials,
-        removeFile: (path2) => (0, import_node_fs34.unlinkSync)((0, import_node_path31.resolve)(o.appDir ?? process.cwd(), path2))
+        removeFile: (path2) => (0, import_node_fs35.unlinkSync)((0, import_node_path32.resolve)(o.appDir ?? process.cwd(), path2))
       },
       {
         repo: o.repo,
@@ -29354,7 +29468,7 @@ function registerSecretsCommands(program3) {
 }
 
 // src/app-actor.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -29398,7 +29512,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto5.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto6.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -29514,7 +29628,7 @@ function emitCliCallTelemetry(command) {
 }
 
 // src/box-commands.ts
-var import_node_fs35 = require("node:fs");
+var import_node_fs36 = require("node:fs");
 
 // src/box.ts
 var BOX_KEYS = {
@@ -29593,7 +29707,7 @@ function formatBoxTable(boxes) {
   const addrW = w((b) => b.address || "(no public ipv4)", "ADDRESS");
   const projW = w((b) => b.project, "PROJECT");
   const statW = w((b) => b.status, "STATUS");
-  const row = (name, addr, proj, stat3, key) => `${name.padEnd(nameW)}  ${addr.padEnd(addrW)}  ${proj.padEnd(projW)}  ${stat3.padEnd(statW)}  ${key}`;
+  const row = (name, addr, proj, stat4, key) => `${name.padEnd(nameW)}  ${addr.padEnd(addrW)}  ${proj.padEnd(projW)}  ${stat4.padEnd(statW)}  ${key}`;
   const lines = [row("BOX", "ADDRESS", "PROJECT", "STATUS", "SSH KEY (vault path)")];
   for (const b of boxes) {
     lines.push(row(b.name, b.address || "(no public ipv4)", b.project, b.status, b.sshKeyPath));
@@ -29717,7 +29831,7 @@ function registerBoxCommands(program3) {
       }
       if (o.json) console.log(JSON.stringify({ box: found, incomplete }, null, 2));
       else if (o.ssh && o.script) {
-        (0, import_node_fs35.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
+        (0, import_node_fs36.writeFileSync)(o.script, sshRecipeScript(found), "utf8");
         console.log(`wrote ${o.script} \u2014 run: bash "${o.script}"`);
       } else if (o.ssh) console.log(`${formatSshRecipe(found)}
 ${SSH_RECIPE_AGENT_NOTE}`);
@@ -29731,7 +29845,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 }
 
 // src/schedules-commands.ts
-var import_promises5 = require("node:fs/promises");
+var import_promises6 = require("node:fs/promises");
 var import_node_child_process17 = require("node:child_process");
 var import_node_util7 = require("node:util");
 var execFileP5 = (0, import_node_util7.promisify)(import_node_child_process17.execFile);
@@ -29846,7 +29960,7 @@ async function awsJson(args) {
   try {
     return await run();
   } catch {
-    await new Promise((resolve5) => setTimeout(resolve5, AWS_RETRY_DELAY_MS));
+    await new Promise((resolve6) => setTimeout(resolve6, AWS_RETRY_DELAY_MS));
     return run();
   }
 }
@@ -29947,9 +30061,9 @@ function registerSchedulesCommands(program3) {
           await failGraceful("org schedules --doc: refusing to regenerate the doc from an incomplete read (see warnings above).");
           return;
         }
-        const docText = await (0, import_promises5.readFile)(o.doc, "utf8");
+        const docText = await (0, import_promises6.readFile)(o.doc, "utf8");
         const spliced = spliceDoc(docText, renderDocSection(entries, now.toISOString()));
-        await (0, import_promises5.writeFile)(o.doc, spliced, "utf8");
+        await (0, import_promises6.writeFile)(o.doc, spliced, "utf8");
         reportParked(parkedLines);
         reportDrift(drift);
         console.log(`org schedules: wrote ${entries.length} entries into ${o.doc}`);
@@ -30035,8 +30149,8 @@ function registerSchedulesCommands(program3) {
 }
 
 // src/schedules-lift-command.ts
-var import_promises6 = require("node:fs/promises");
-var import_node_path32 = require("node:path");
+var import_promises7 = require("node:fs/promises");
+var import_node_path33 = require("node:path");
 var DEFAULT_WORKFLOWS_DIR = ".github/workflows";
 var SCHEDULE_REPO_RE = /^[A-Za-z0-9_.-]+$/;
 var SchedulesLiftUsageError = class extends Error {
@@ -30056,14 +30170,14 @@ var RegistryUnreachableError = class extends Error {
 async function readWorkflowFiles(dir) {
   let names;
   try {
-    names = await (0, import_promises6.readdir)(dir);
+    names = await (0, import_promises7.readdir)(dir);
   } catch {
     return [];
   }
   const files = [];
   for (const name of names.sort()) {
     if (!/\.ya?ml$/.test(name)) continue;
-    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises6.readFile)((0, import_node_path32.join)(dir, name), "utf8") });
+    files.push({ path: `.github/workflows/${name}`, text: await (0, import_promises7.readFile)((0, import_node_path33.join)(dir, name), "utf8") });
   }
   return files;
 }
@@ -30211,12 +30325,12 @@ function registerEdgeCommands(program3) {
 }
 
 // src/bootstrap-commands.ts
-var import_node_fs36 = require("node:fs");
+var import_node_fs37 = require("node:fs");
 var import_node_os14 = require("node:os");
-var import_node_path33 = require("node:path");
+var import_node_path34 = require("node:path");
 
 // src/bootstrap-drift.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -30236,7 +30350,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto6.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -31093,13 +31207,13 @@ function registerBootstrapCommands(program3) {
       client: defaultGitHubClient(),
       projectMeta: meta,
       deployModel: typeof meta?.deployModel === "string" ? meta.deployModel : void 0,
-      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs36.existsSync)(path2) ? (0, import_node_fs36.readFileSync)(path2, "utf8") : null,
+      readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs37.existsSync)(path2) ? (0, import_node_fs37.readFileSync)(path2, "utf8") : null,
       // requiredGcpApis is stored as an array by a JSON write, but `org project set --var KEY=VALUE` stores a raw
       // comma-string — accept either so the seeded value verifies regardless of how it was written.
       // #3689: the same committed map the org access audit reads (#3664), so a sanctioned admin is not a
       // permanent bootstrap failure on one surface and an intended state on the other. Absent file → no
       // sanction, which is the pre-#3664 behaviour.
-      sanctionedAdmins: (0, import_node_fs36.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs36.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
+      sanctionedAdmins: (0, import_node_fs37.existsSync)("access-matrix.json") ? entriesValueByCanonicalRepo(loadSanctionedAdmins((0, import_node_fs37.readFileSync)("access-matrix.json", "utf8")), repo) : void 0,
       requiredGcpApis: (() => {
         const v = meta?.requiredGcpApis;
         if (Array.isArray(v)) return v;
@@ -31152,14 +31266,14 @@ function registerBootstrapCommands(program3) {
   bootstrap.command("drift").description("#3818: compare every org-owned whole-file seed against MMI-Hub's copy across the registry roster; read-only").option("--repo <owner/repo>", "audit one repo instead of the roster (never a fleet verdict)").option("--json", "machine-readable output").action(async () => {
     const o = { repo: rawValue("--repo", ""), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs36.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
+    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap drift: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the reference this compares against`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap drift: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs36.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
     const hubContents = /* @__PURE__ */ new Map();
     for (const s of manifest.seeds) {
       if (s.ownership !== "org" || s.source !== "self") continue;
-      hubContents.set(s.target, (0, import_node_fs36.existsSync)(s.target) ? (0, import_node_fs36.readFileSync)(s.target, "utf8") : null);
+      hubContents.set(s.target, (0, import_node_fs37.existsSync)(s.target) ? (0, import_node_fs37.readFileSync)(s.target, "utf8") : null);
     }
     let targets;
     let classOf = (_repo) => "deployable";
@@ -31238,10 +31352,10 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs36.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
+    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap apply: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs36.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.only.trim();
@@ -31252,16 +31366,16 @@ function registerBootstrapCommands(program3) {
   ${known}`);
     }
     const gh = async (args) => execFileP2("gh", args, { timeout: 2e4 });
-    const readFile9 = (p) => (0, import_node_fs36.existsSync)(p) ? (0, import_node_fs36.readFileSync)(p, "utf8") : null;
+    const readFile9 = (p) => (0, import_node_fs37.existsSync)(p) ? (0, import_node_fs37.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     const putSeed = async (target, content, ref, sha) => {
-      const tmp = (0, import_node_path33.join)((0, import_node_os14.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs36.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
+      const tmp = (0, import_node_path34.join)((0, import_node_os14.tmpdir)(), `mmi-seed-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(target, content, ref, sha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, target, tmp));
       } finally {
         try {
-          (0, import_node_fs36.unlinkSync)(tmp);
+          (0, import_node_fs37.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -31526,10 +31640,10 @@ LIVE apply to ${repo}:
   bootstrap.command("propagate").description("#4238: re-entrant canary\u2192wave tick \u2014 plan (or, with --execute, open) per-repo PRs fanning an org-owned seed out to the fleet").option("--target <path>", "the manifest target to propagate (an ownership:org + source:self seed, e.g. .github/workflows/agent-pr.yml)").option("--execute", "LIVE tick via gh (master-gated) \u2014 opens/reuses per-repo seed-propagate PRs; dry-run prints the plan only").option("--json", "machine-readable output").action(async () => {
     const o = { target: rawValue("--target", ""), execute: rawFlag("--execute"), json: rawFlag("--json") };
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs36.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
+    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap propagate: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the Hub's copies ARE the desired state this tick propagates`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap propagate: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs36.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
     if (!o.target) {
       return fail(`bootstrap propagate: --target <path> is required \u2014 one of:
@@ -31538,8 +31652,8 @@ LIVE apply to ${repo}:
     const seed = propagatable.find((s) => s.target === o.target);
     if (!seed) return fail(`bootstrap propagate: --target '${o.target}' names no ownership:org + source:self seed in ${manifestPath}. Propagatable targets:
   ${propagatable.map((s) => s.target).join("\n  ")}`);
-    if (!(0, import_node_fs36.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
-    const hubContent = (0, import_node_fs36.readFileSync)(seed.target, "utf8");
+    if (!(0, import_node_fs37.existsSync)(seed.target)) return fail(`bootstrap propagate: the Hub's own copy of '${seed.target}' is missing \u2014 nothing to propagate`);
+    const hubContent = (0, import_node_fs37.readFileSync)(seed.target, "utf8");
     const isWorkflowSeed = seed.target.startsWith(".github/workflows/");
     const cfg = await loadConfig();
     const projects = await fetchProjectsList(registryClientDeps(cfg));
@@ -31548,9 +31662,9 @@ LIVE apply to ${repo}:
     }
     const rosterRepos2 = collectRegistryRepos(projects).filter((r) => r.toLowerCase() !== "mutmutco/mmi-hub");
     let independentCount = rosterRepos2.length;
-    if ((0, import_node_fs36.existsSync)("projects.json")) {
+    if ((0, import_node_fs37.existsSync)("projects.json")) {
       try {
-        const local = JSON.parse((0, import_node_fs36.readFileSync)("projects.json", "utf8"));
+        const local = JSON.parse((0, import_node_fs37.readFileSync)("projects.json", "utf8"));
         const localRepos = /* @__PURE__ */ new Set();
         for (const p of local.projects ?? []) for (const r of p.repos ?? []) {
           const full = (r.includes("/") ? r : `mutmutco/${r}`).toLowerCase();
@@ -31666,13 +31780,13 @@ LIVE apply to ${repo}:
         } catch {
           existingSha = void 0;
         }
-        const tmp = (0, import_node_path33.join)((0, import_node_os14.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-        (0, import_node_fs36.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, hubContent, branch, existingSha)), "utf8");
+        const tmp = (0, import_node_path34.join)((0, import_node_os14.tmpdir)(), `mmi-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+        (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, hubContent, branch, existingSha)), "utf8");
         try {
           await gh(contentPutInputArgs(rec.repo, seed.target, tmp));
         } finally {
           try {
-            (0, import_node_fs36.unlinkSync)(tmp);
+            (0, import_node_fs37.unlinkSync)(tmp);
           } catch {
           }
         }
@@ -31730,10 +31844,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       return fail(`bootstrap rollback: ${e.message}`);
     }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
-    if (!(0, import_node_fs36.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
+    if (!(0, import_node_fs37.existsSync)(manifestPath)) return fail(`bootstrap rollback: ${manifestPath} not found; run from the MMI-Hub repo root \u2014 the manifest names which targets are org-owned and therefore propagated (and rollback-able)`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
     if (!seedSource.ok) return fail(`bootstrap rollback: ${seedSource.reason}`);
-    const manifest = loadBootstrapSeeds((0, import_node_fs36.readFileSync)(manifestPath, "utf8"));
+    const manifest = loadBootstrapSeeds((0, import_node_fs37.readFileSync)(manifestPath, "utf8"));
     const propagatable = manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self");
     if (!o.target) {
       return fail(`bootstrap rollback: --target <path> is required \u2014 one of:
@@ -31750,10 +31864,10 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
     let candidates;
     if (o.record) {
-      if (!(0, import_node_fs36.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
+      if (!(0, import_node_fs37.existsSync)(o.record)) return fail(`bootstrap rollback: --record '${o.record}' not found`);
       let parsed;
       try {
-        parsed = JSON.parse((0, import_node_fs36.readFileSync)(o.record, "utf8"));
+        parsed = JSON.parse((0, import_node_fs37.readFileSync)(o.record, "utf8"));
       } catch (e) {
         return fail(`bootstrap rollback: --record '${o.record}' is not valid JSON: ${e.message}`);
       }
@@ -31822,13 +31936,13 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
       } catch {
         existingSha = void 0;
       }
-      const tmp = (0, import_node_path33.join)((0, import_node_os14.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      (0, import_node_fs36.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
+      const tmp = (0, import_node_path34.join)((0, import_node_os14.tmpdir)(), `mmi-rollback-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
+      (0, import_node_fs37.writeFileSync)(tmp, JSON.stringify(contentPutBody(seed.target, preSeedContent, plan.branch, existingSha)), "utf8");
       try {
         await gh(contentPutInputArgs(repo, seed.target, tmp));
       } finally {
         try {
-          (0, import_node_fs36.unlinkSync)(tmp);
+          (0, import_node_fs37.unlinkSync)(tmp);
         } catch {
         }
       }
@@ -31850,12 +31964,12 @@ Rollback: \`mmi-cli devops bootstrap rollback ${rec.repo} --target ${seed.target
 }
 
 // src/stage-commands.ts
-var import_node_fs38 = require("node:fs");
-var import_node_path35 = require("node:path");
+var import_node_fs39 = require("node:fs");
+var import_node_path36 = require("node:path");
 
 // src/port-registry.ts
-var import_node_fs37 = require("node:fs");
-var import_node_path34 = require("node:path");
+var import_node_fs38 = require("node:fs");
+var import_node_path35 = require("node:path");
 
 // ../infra/port-geometry.mjs
 var PORT_BLOCK = 100;
@@ -31869,8 +31983,8 @@ function nextPortBlock(registry2) {
   return [base, base + PORT_SPAN];
 }
 function loadPortRegistry(path2) {
-  if (!(0, import_node_fs37.existsSync)(path2)) return {};
-  const raw = JSON.parse((0, import_node_fs37.readFileSync)(path2, "utf8"));
+  if (!(0, import_node_fs38.existsSync)(path2)) return {};
+  const raw = JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8"));
   const out = {};
   for (const [key, value] of Object.entries(raw)) {
     if (Array.isArray(value) && value.length === 2 && value.every((n) => typeof n === "number")) {
@@ -31884,9 +31998,9 @@ function ensurePortRange(repo, path2) {
   const existing = registry2[repo];
   if (existing) return existing;
   const range = nextPortBlock(registry2);
-  const raw = (0, import_node_fs37.existsSync)(path2) ? JSON.parse((0, import_node_fs37.readFileSync)(path2, "utf8")) : {};
+  const raw = (0, import_node_fs38.existsSync)(path2) ? JSON.parse((0, import_node_fs38.readFileSync)(path2, "utf8")) : {};
   raw[repo] = range;
-  (0, import_node_fs37.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
+  (0, import_node_fs38.writeFileSync)(path2, JSON.stringify(raw, null, 2) + "\n", "utf8");
   return range;
 }
 function portCursorSeed(registry2) {
@@ -31908,22 +32022,22 @@ function existingPortRange(repo, registry2) {
   return registry2[repo] ?? null;
 }
 function portRangeInfraAt(root, source) {
-  const registryPath = (0, import_node_path34.join)(root, "infra", "port-ranges.json");
-  const ddbScriptPath = (0, import_node_path34.join)(root, "infra", "port-ddb.mjs");
-  if (!(0, import_node_fs37.existsSync)(registryPath) || !(0, import_node_fs37.existsSync)(ddbScriptPath)) return null;
+  const registryPath = (0, import_node_path35.join)(root, "infra", "port-ranges.json");
+  const ddbScriptPath = (0, import_node_path35.join)(root, "infra", "port-ddb.mjs");
+  if (!(0, import_node_fs38.existsSync)(registryPath) || !(0, import_node_fs38.existsSync)(ddbScriptPath)) return null;
   return { root, source, registryPath, ddbScriptPath };
 }
 function resolvePortRangeInfra(cwd, packageDir) {
   const direct = portRangeInfraAt(cwd, "cwd");
   if (direct) return direct;
-  for (let dir = cwd; ; dir = (0, import_node_path34.dirname)(dir)) {
-    const sibling = portRangeInfraAt((0, import_node_path34.join)(dir, "MMI-Hub"), "sibling-hub");
+  for (let dir = cwd; ; dir = (0, import_node_path35.dirname)(dir)) {
+    const sibling = portRangeInfraAt((0, import_node_path35.join)(dir, "MMI-Hub"), "sibling-hub");
     if (sibling) return sibling;
-    const parent = (0, import_node_path34.dirname)(dir);
+    const parent = (0, import_node_path35.dirname)(dir);
     if (parent === dir) break;
   }
   if (packageDir) {
-    const pkgRoot = (0, import_node_path34.join)(packageDir, "..", "..");
+    const pkgRoot = (0, import_node_path35.join)(packageDir, "..", "..");
     const pkgFrom = portRangeInfraAt(pkgRoot, "pkg-root");
     if (pkgFrom) return pkgFrom;
   }
@@ -32117,8 +32231,8 @@ function registerStageCommands(program3) {
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     return decideStage({
       registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-      hasCompose: (0, import_node_fs38.existsSync)((0, import_node_path35.join)(process.cwd(), "docker-compose.yml")),
-      hasEnvExample: (0, import_node_fs38.existsSync)((0, import_node_path35.join)(process.cwd(), ".env.example"))
+      hasCompose: (0, import_node_fs39.existsSync)((0, import_node_path36.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs39.existsSync)((0, import_node_path36.join)(process.cwd(), ".env.example"))
     });
   }
   async function fetchStageVaultEnvMerge() {
@@ -32610,9 +32724,9 @@ function registerBoardCommands(program3) {
 }
 
 // src/merge-cleanup.ts
-var import_node_fs39 = require("node:fs");
-var import_promises8 = require("node:fs/promises");
-var import_node_path37 = require("node:path");
+var import_node_fs40 = require("node:fs");
+var import_promises9 = require("node:fs/promises");
+var import_node_path38 = require("node:path");
 var import_node_os15 = require("node:os");
 var import_node_child_process18 = require("node:child_process");
 
@@ -32699,23 +32813,23 @@ function boardAdvanceFailureMessage(result) {
 }
 
 // src/deferred-registry-store.ts
-var import_promises7 = require("node:fs/promises");
-var import_node_path36 = require("node:path");
-var sleep2 = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+var import_promises8 = require("node:fs/promises");
+var import_node_path37 = require("node:path");
+var sleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
 async function atomicWrite(target, contents) {
   const tmp = `${target}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
-  await (0, import_promises7.writeFile)(tmp, contents, "utf8");
+  await (0, import_promises8.writeFile)(tmp, contents, "utf8");
   try {
     await renameWithRetry(tmp, target);
   } catch (e) {
-    await (0, import_promises7.unlink)(tmp).catch(() => void 0);
+    await (0, import_promises8.unlink)(tmp).catch(() => void 0);
     throw e;
   }
 }
 async function renameWithRetry(from, to, attempts = 5, backoffMs = 20) {
   for (let i = 0; ; i++) {
     try {
-      await (0, import_promises7.rename)(from, to);
+      await (0, import_promises8.rename)(from, to);
       return;
     } catch (e) {
       const code = e.code;
@@ -32727,7 +32841,7 @@ async function renameWithRetry(from, to, attempts = 5, backoffMs = 20) {
 async function readStrict(registryPath) {
   let text;
   try {
-    text = await (0, import_promises7.readFile)(registryPath, "utf8");
+    text = await (0, import_promises8.readFile)(registryPath, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw e;
@@ -32744,19 +32858,19 @@ function makeDeferredWorktreeStore(registryPath, lockOpts = {}) {
     // Lenient read for the sweep's initial fetch: any error (missing/corrupt) yields an empty queue.
     read: async () => {
       try {
-        return parseDeferredWorktreesFile(await (0, import_promises7.readFile)(registryPath, "utf8"));
+        return parseDeferredWorktreesFile(await (0, import_promises8.readFile)(registryPath, "utf8"));
       } catch {
         return [];
       }
     },
     // Standalone atomic write — THROWS on failure (no best-effort swallow, #2846).
     write: async (entries) => {
-      await (0, import_promises7.mkdir)((0, import_node_path36.dirname)(registryPath), { recursive: true });
+      await (0, import_promises8.mkdir)((0, import_node_path37.dirname)(registryPath), { recursive: true });
       await atomicWrite(registryPath, serializeDeferredWorktrees(entries));
     },
     // Serialized read-modify-write under the repo-wide lock (#2846).
     update: async (mutate) => {
-      await (0, import_promises7.mkdir)((0, import_node_path36.dirname)(registryPath), { recursive: true });
+      await (0, import_promises8.mkdir)((0, import_node_path37.dirname)(registryPath), { recursive: true });
       const deadline = Date.now() + opts.maxWaitMs;
       for (; ; ) {
         const guard = await acquireLock(lockPath, opts, deadline);
@@ -32927,7 +33041,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
   );
   const repoRoot2 = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path37.dirname)((0, import_node_path37.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path38.dirname)((0, import_node_path38.dirname)(worktreeGitRoot)) : repoRoot2;
   const gcActor = describeActor({ env: process.env, surface: detectSurface(process.env), cwd: process.cwd() });
   const owners = readWorktreeOwners(primaryRepoRoot);
   const removalNow = Date.now();
@@ -32984,7 +33098,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
       const cleanup = await cleanupPrMergeLocalBranch(branch.branch, {
         beforeWorktrees,
         startingPath: branch.worktreePath,
-        pathExists: (p) => (0, import_node_fs39.existsSync)(p),
+        pathExists: (p) => (0, import_node_fs40.existsSync)(p),
         execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
         teardownWorktreeStage,
         deferredStore,
@@ -33022,7 +33136,7 @@ async function applyGcPlan(plan, remote, opts = {}) {
     let removalAttempted = false;
     try {
       const cleanupTarget = resolveSafeSiblingWorktreeCleanupTarget(wt.path, cleanupRoots, {
-        realpath: (path2) => (0, import_node_fs39.realpathSync)(path2)
+        realpath: (path2) => (0, import_node_fs40.realpathSync)(path2)
       });
       if (!cleanupTarget.ok) {
         result.failed.push(`${wt.path}: ${cleanupTarget.reason}`);
@@ -33109,13 +33223,13 @@ async function composeOverrideBodyFile(prNumber, repoArgs, gh) {
     const commits = JSON.parse(raw).commits ?? [];
     const body = squashBodyWithOverride(commits.map((c) => ({ headline: c.messageHeadline ?? "", body: c.messageBody ?? "" })), process.cwd());
     if (!body) return void 0;
-    const dir = (0, import_node_fs39.mkdtempSync)((0, import_node_path37.join)((0, import_node_os15.tmpdir)(), "mmi-squash-body-"));
-    const path2 = (0, import_node_path37.join)(dir, "body.txt");
-    (0, import_node_fs39.writeFileSync)(path2, `${body}
+    const dir = (0, import_node_fs40.mkdtempSync)((0, import_node_path38.join)((0, import_node_os15.tmpdir)(), "mmi-squash-body-"));
+    const path2 = (0, import_node_path38.join)(dir, "body.txt");
+    (0, import_node_fs40.writeFileSync)(path2, `${body}
 `, "utf8");
     return { path: path2, cleanup: () => {
       try {
-        (0, import_node_fs39.rmSync)(dir, { recursive: true, force: true });
+        (0, import_node_fs40.rmSync)(dir, { recursive: true, force: true });
       } catch {
       }
     } };
@@ -33237,13 +33351,13 @@ var realWorktreeDirRemover = {
   probe: (p) => {
     let st;
     try {
-      st = (0, import_node_fs39.lstatSync)(p);
+      st = (0, import_node_fs40.lstatSync)(p);
     } catch {
       return null;
     }
     if (st.isSymbolicLink()) return "link";
     try {
-      (0, import_node_fs39.readlinkSync)(p);
+      (0, import_node_fs40.readlinkSync)(p);
       return "link";
     } catch {
     }
@@ -33251,7 +33365,7 @@ var realWorktreeDirRemover = {
   },
   readdir: (p) => {
     try {
-      return (0, import_node_fs39.readdirSync)(p);
+      return (0, import_node_fs40.readdirSync)(p);
     } catch {
       return [];
     }
@@ -33260,12 +33374,12 @@ var realWorktreeDirRemover = {
   // leaving the target); a file symlink with unlink. rmdir first, fall back to unlink.
   detachLink: (p) => {
     try {
-      (0, import_node_fs39.rmdirSync)(p);
+      (0, import_node_fs40.rmdirSync)(p);
     } catch {
-      (0, import_node_fs39.unlinkSync)(p);
+      (0, import_node_fs40.unlinkSync)(p);
     }
   },
-  removeTree: (p) => (0, import_promises8.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
+  removeTree: (p) => (0, import_promises9.rm)(p, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 })
 };
 async function resolvePrimaryCheckout(execGit) {
   try {
@@ -33277,13 +33391,13 @@ async function resolvePrimaryCheckout(execGit) {
 function worktreeRemoveDeps(execGit) {
   return {
     git: execGit,
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
     // #3064: unlink any reparse point (esp. a `node_modules` junction to base) before the git-native
     // `worktree remove --force`, which would otherwise recurse through it and empty the base checkout.
     detachReparsePoints: (worktreePath) => detachReparsePoints(worktreePath, realWorktreeDirRemover),
     removeWorktreeDir: async (worktreePath) => removeWorktreeTree(worktreePath, await resolvePrimaryCheckout(execGit), realWorktreeDirRemover),
     // #4850: verify the directory is actually gone before any caller reports completion.
-    pathExists: (worktreePath) => (0, import_node_fs39.existsSync)(worktreePath)
+    pathExists: (worktreePath) => (0, import_node_fs40.existsSync)(worktreePath)
   };
 }
 async function worktreeHasStageState(worktreePath) {
@@ -33297,9 +33411,9 @@ async function worktreeHasStageState(worktreePath) {
   }
 }
 function stageStateFileBelongsToWorktree(statePath, worktreePath) {
-  if (!(0, import_node_fs39.existsSync)(statePath)) return false;
+  if (!(0, import_node_fs40.existsSync)(statePath)) return false;
   try {
-    const state = JSON.parse((0, import_node_fs39.readFileSync)(statePath, "utf8"));
+    const state = JSON.parse((0, import_node_fs40.readFileSync)(statePath, "utf8"));
     const recordedCwd = typeof state.identity?.cwd === "string" ? state.identity.cwd : typeof state.cwd === "string" ? state.cwd : "";
     return Boolean(recordedCwd && isPathUnderDirectory2(recordedCwd, worktreePath));
   } catch {
@@ -33456,7 +33570,7 @@ var PR_SNAPSHOT_READ_DELAY_MS = 2e3;
 async function readRestPrSnapshotWithRetry(prNumber, repo, gh = defaultGhApi, options) {
   const retries = options?.retries ?? PR_SNAPSHOT_READ_RETRIES;
   const delayMs = options?.delayMs ?? PR_SNAPSHOT_READ_DELAY_MS;
-  const sleep3 = options?.sleep ?? ((ms) => new Promise((resolve5) => setTimeout(resolve5, ms)));
+  const sleep3 = options?.sleep ?? ((ms) => new Promise((resolve6) => setTimeout(resolve6, ms)));
   let lastError = "no attempt completed";
   for (let attempt = 0; attempt < retries; attempt++) {
     try {
@@ -33734,14 +33848,14 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/worktree-lifecycle-commands.ts
-var import_node_fs41 = require("node:fs");
-var import_promises9 = require("node:fs/promises");
-var import_node_path39 = require("node:path");
+var import_node_fs42 = require("node:fs");
+var import_promises10 = require("node:fs/promises");
+var import_node_path40 = require("node:path");
 
 // src/worktree-install-cache.ts
-var import_node_crypto7 = require("node:crypto");
-var import_node_fs40 = require("node:fs");
-var import_node_path38 = require("node:path");
+var import_node_crypto8 = require("node:crypto");
+var import_node_fs41 = require("node:fs");
+var import_node_path39 = require("node:path");
 var CACHE_DIR = "worktree-install-cache";
 var MANIFEST = "manifest.json";
 var NODE_MODULES2 = "node_modules";
@@ -33754,24 +33868,24 @@ var LOCKFILE_NAMES = [
   "package-lock.json"
 ];
 var realWorktreeInstallCacheFs = {
-  exists: import_node_fs40.existsSync,
-  readFile: (path2) => (0, import_node_fs40.readFileSync)(path2, "utf8"),
-  lstat: (path2) => (0, import_node_fs40.lstatSync)(path2),
-  copyDir: (from, to) => (0, import_node_fs40.cpSync)(from, to, { recursive: true, force: true }),
+  exists: import_node_fs41.existsSync,
+  readFile: (path2) => (0, import_node_fs41.readFileSync)(path2, "utf8"),
+  lstat: (path2) => (0, import_node_fs41.lstatSync)(path2),
+  copyDir: (from, to) => (0, import_node_fs41.cpSync)(from, to, { recursive: true, force: true }),
   mkdirp: (path2) => {
-    (0, import_node_fs40.mkdirSync)(path2, { recursive: true });
+    (0, import_node_fs41.mkdirSync)(path2, { recursive: true });
   },
-  writeFile: (path2, contents) => (0, import_node_fs40.writeFileSync)(path2, contents, "utf8"),
+  writeFile: (path2, contents) => (0, import_node_fs41.writeFileSync)(path2, contents, "utf8"),
   rm: (path2) => {
-    (0, import_node_fs40.rmSync)(path2, { recursive: true, force: true });
+    (0, import_node_fs41.rmSync)(path2, { recursive: true, force: true });
   }
 };
 function hashLockfileBytes(contents) {
-  return (0, import_node_crypto7.createHash)("sha256").update(contents).digest("hex");
+  return (0, import_node_crypto8.createHash)("sha256").update(contents).digest("hex");
 }
 function resolveWorktreeInstallLockfile(packageDir, fs2 = realWorktreeInstallCacheFs) {
   for (const name of LOCKFILE_NAMES) {
-    const path2 = (0, import_node_path38.join)(packageDir, name);
+    const path2 = (0, import_node_path39.join)(packageDir, name);
     if (!fs2.exists(path2)) continue;
     try {
       const hash = hashLockfileBytes(fs2.readFile(path2));
@@ -33786,8 +33900,8 @@ function worktreeInstallCacheEntry(primaryRoot, lockfileHash) {
   const root = repoRuntimeStatePath(primaryRoot, CACHE_DIR, lockfileHash);
   return {
     root,
-    manifestPath: (0, import_node_path38.join)(root, MANIFEST),
-    nodeModulesPath: (0, import_node_path38.join)(root, NODE_MODULES2)
+    manifestPath: (0, import_node_path39.join)(root, MANIFEST),
+    nodeModulesPath: (0, import_node_path39.join)(root, NODE_MODULES2)
   };
 }
 function readWorktreeInstallCacheManifest(manifestPath, fs2 = realWorktreeInstallCacheFs) {
@@ -33827,7 +33941,7 @@ function invalidateWorktreeInstallCacheEntry(entry, fs2 = realWorktreeInstallCac
   }
 }
 function removeMaterializedTree(packageDir, fs2) {
-  const dest = (0, import_node_path38.join)(packageDir, NODE_MODULES2);
+  const dest = (0, import_node_path39.join)(packageDir, NODE_MODULES2);
   if (!fs2.exists(dest)) return;
   fs2.rm(dest);
   if (fs2.exists(dest)) {
@@ -33835,7 +33949,7 @@ function removeMaterializedTree(packageDir, fs2) {
   }
 }
 function materializeCachedNodeModules(entry, destPackageDir, fs2 = realWorktreeInstallCacheFs) {
-  const dest = (0, import_node_path38.join)(destPackageDir, NODE_MODULES2);
+  const dest = (0, import_node_path39.join)(destPackageDir, NODE_MODULES2);
   try {
     if (fs2.exists(dest)) fs2.rm(dest);
     fs2.mkdirp(destPackageDir);
@@ -33850,7 +33964,7 @@ function materializeCachedNodeModules(entry, destPackageDir, fs2 = realWorktreeI
   }
 }
 async function storeWorktreeInstallCacheEntry(primaryRoot, lockfile3, command, sourcePackageDir, fs2 = realWorktreeInstallCacheFs, now = Date.now()) {
-  const source = (0, import_node_path38.join)(sourcePackageDir, NODE_MODULES2);
+  const source = (0, import_node_path39.join)(sourcePackageDir, NODE_MODULES2);
   if (!isMaterializableNodeModulesDir(source, fs2)) return;
   const entry = worktreeInstallCacheEntry(primaryRoot, lockfile3.hash);
   const manifest = {
@@ -34110,7 +34224,7 @@ function classifyStaleLeaks(input) {
 var defaultOrphanDirScanDeps = {
   listDirs: (root) => {
     try {
-      return (0, import_node_fs41.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path39.join)(root, e.name));
+      return (0, import_node_fs42.readdirSync)(root, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (0, import_node_path40.join)(root, e.name));
     } catch {
       return [];
     }
@@ -34276,13 +34390,13 @@ function registerWorktreeCommands(program3) {
       const detached = headBorn && !symbolicBranch;
       const branch = symbolicBranch || (detached ? "HEAD" : "");
       if (!wtPath || !branch) return fail("worktree land: not inside a git worktree");
-      const gitFile = (0, import_node_path39.join)(wtPath, ".git");
-      const isLinked = (0, import_node_fs41.existsSync)(gitFile) && (0, import_node_fs41.statSync)(gitFile).isFile();
+      const gitFile = (0, import_node_path40.join)(wtPath, ".git");
+      const isLinked = (0, import_node_fs42.existsSync)(gitFile) && (0, import_node_fs42.statSync)(gitFile).isFile();
       if (apply && !isLinked) {
         return fail("worktree land: run from inside the linked worktree you want to land (this is the primary checkout)");
       }
       const commonDir = (await execFileP2("git", ["rev-parse", "--git-common-dir"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim();
-      const primaryCheckout = commonDir ? (0, import_node_path39.dirname)(commonDir) : wtPath;
+      const primaryCheckout = commonDir ? (0, import_node_path40.dirname)(commonDir) : wtPath;
       const localBranchNames = await execFileP2("git", ["-C", primaryCheckout, "for-each-ref", "--format=%(refname:short)", "refs/heads"], { timeout: GIT_TIMEOUT_MS }).then(({ stdout }) => new Set((stdout || "").split("\n").map((l) => l.trim()).filter(Boolean))).catch(() => void 0);
       const orphan = classifyOrphanedWorktree({
         branch,
@@ -34320,13 +34434,13 @@ function registerWorktreeCommands(program3) {
       }
       const landStatus = (await execFileP2("git", ["-C", wtPath, "status", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "unreadable" }))).stdout || "";
       const gitInWorktree = async (args) => (await execFileP2("git", ["-C", wtPath, ...args], { timeout: GIT_TIMEOUT_MS })).stdout;
-      const orphanDirt = headBorn ? void 0 : await classifyOrphanWorktreeDirt(landStatus, { git: gitInWorktree, readTextFile: (p) => (0, import_promises9.readFile)(p, "utf8") });
+      const orphanDirt = headBorn ? void 0 : await classifyOrphanWorktreeDirt(landStatus, { git: gitInWorktree, readTextFile: (p) => (0, import_promises10.readFile)(p, "utf8") });
       const landDirty = headBorn ? landStatus.trim().length > 0 : orphanDirt.dirt !== "clean";
       if (landDirty) {
         return fail(`worktree land: refusing to land '${branch}' \u2014 uncommitted changes in ${wtPath}; commit, stash, or remove the worktree manually`, { code: ERROR_CODES.ERR_BAD_ENUM });
       }
       const orphanTip = orphan.orphan ? orphanDirt?.tip ?? await readOrphanWorktreeTip(
-        { git: gitInWorktree, readTextFile: (p) => (0, import_promises9.readFile)(p, "utf8") },
+        { git: gitInWorktree, readTextFile: (p) => (0, import_promises10.readFile)(p, "utf8") },
         orphan.kind
       ) : void 0;
       const lastCommit = orphanTip ? {
@@ -34556,10 +34670,10 @@ async function gatherWorktreeContext() {
     if (s) stages.push({ path: wt.path, port: s.port });
   }
   const worktreeGitRoot = await currentRepoWorktreeGitRoot(repoRoot2);
-  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path39.dirname)((0, import_node_path39.dirname)(worktreeGitRoot)) : repoRoot2;
+  const primaryRepoRoot = worktreeGitRoot ? (0, import_node_path40.dirname)((0, import_node_path40.dirname)(worktreeGitRoot)) : repoRoot2;
   const wtRoot = siblingMmiWorktreesRoot(primaryRepoRoot);
   let orphanDirs = [];
-  if ((0, import_node_fs41.existsSync)(wtRoot)) {
+  if ((0, import_node_fs42.existsSync)(wtRoot)) {
     orphanDirs = scanOrphanDirs(wtRoot, worktreeGitRoot, {
       ...defaultOrphanDirScanDeps,
       listDirs: (root) => worktreeScanDirs(root, primaryRepoRoot, defaultOrphanDirScanDeps.listDirs, isRepoCheckoutDir)
@@ -34595,8 +34709,8 @@ ${err.stderr ?? ""}`;
 }
 
 // src/issue-commands.ts
-var import_node_fs42 = require("node:fs");
-var import_node_crypto8 = require("node:crypto");
+var import_node_fs43 = require("node:fs");
+var import_node_crypto9 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 var ReparentConflictError = class extends Error {
   constructor(message, payload) {
@@ -34613,7 +34727,7 @@ async function editIssue(client, options, deps = {}) {
   const url = `https://github.com/${repo}/issues/${parsed.number}`;
   const patch = {};
   let bodyChanged = false;
-  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs42.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
+  const textDeps = () => deps.textDeps ?? { readFile: (p, e) => Promise.resolve((0, import_node_fs43.readFileSync)(p, e)), readStdin: () => Promise.resolve("") };
   if (options.titleFile !== void 0) {
     patch.title = await resolveIssueTitle({ title: options.title, titleFile: options.titleFile }, textDeps());
   } else if (options.title !== void 0) {
@@ -34887,7 +35001,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto8.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto9.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -35218,7 +35332,7 @@ function extendCreateCommand(issue2, batchAttach) {
     if (opts.batch) {
       let specs;
       try {
-        const raw = (0, import_node_fs42.readFileSync)(opts.batch, "utf8");
+        const raw = (0, import_node_fs43.readFileSync)(opts.batch, "utf8");
         specs = JSON.parse(raw);
         if (!Array.isArray(specs)) throw new Error("batch file must contain a JSON array");
       } catch (e) {
@@ -35293,8 +35407,8 @@ ${lines}`, {
 }
 
 // src/train-commands.ts
-var import_node_fs43 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs44 = require("node:fs");
+var import_node_path41 = require("node:path");
 var RELEASE_BUMP_INTENTS = ["major", "minor", "patch"];
 function resolveReleaseBumpIntent(raw) {
   const intent = typeof raw === "string" ? raw.trim() : "";
@@ -35305,7 +35419,7 @@ function resolveReleaseBumpIntent(raw) {
 }
 function readRepoVersion() {
   try {
-    return JSON.parse((0, import_node_fs43.readFileSync)((0, import_node_path40.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
+    return JSON.parse((0, import_node_fs44.readFileSync)((0, import_node_path41.join)(process.cwd(), ".claude-plugin", "plugin.json"), "utf8")).version || void 0;
   } catch {
     return void 0;
   }
@@ -35462,9 +35576,9 @@ function registerDeployCommands(program3) {
 }
 
 // src/discovery-commands.ts
-var import_node_fs44 = require("node:fs");
+var import_node_fs45 = require("node:fs");
 var import_node_os16 = require("node:os");
-var import_node_path41 = require("node:path");
+var import_node_path42 = require("node:path");
 var GC_GH_TIMEOUT_MS3 = 2e4;
 async function collectStatus() {
   const repo = await resolveRepo();
@@ -35654,8 +35768,8 @@ async function collectOnboardStatus(opts = {}) {
   }
   const home = (0, import_node_os16.homedir)();
   const plugin = onboardPluginGate({
-    readKnown: () => readFileSyncSafe((0, import_node_path41.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs44.readFileSync),
-    readSettings: () => readFileSyncSafe((0, import_node_path41.join)(home, ".claude", "settings.json"), import_node_fs44.readFileSync)
+    readKnown: () => readFileSyncSafe((0, import_node_path42.join)(home, ...KNOWN_MARKETPLACES_RELATIVE), import_node_fs45.readFileSync),
+    readSettings: () => readFileSyncSafe((0, import_node_path42.join)(home, ".claude", "settings.json"), import_node_fs45.readFileSync)
   });
   return { track, board, registry: registry2, secrets, plugin, estateCli, doors: opts.doors ?? [], nextCommand };
 }
@@ -35815,7 +35929,7 @@ function formatExplainCommand(cmd, rootName) {
   return lines.join("\n").trimEnd();
 }
 function formatExplainGroup(cmd, rootName) {
-  const canonical = (node) => canonicalPathFor(node.path) ?? node.path;
+  const canonical = (node) => node.path;
   const lines = [
     `${rootName} ${canonical(cmd)}${cmd.description ? ` \u2014 ${cmd.description}` : ""}`,
     `Category: ${cmd.category} \xB7 Discovery: ${cmd.discovery}`,
@@ -35841,7 +35955,7 @@ function formatExplainLoop(playbook) {
 }
 function findCommandInManifest(manifest, commandPath3) {
   const visit = (command) => {
-    if (command.path === commandPath3 || canonicalPathFor(command.path) === commandPath3) return command;
+    if (command.path === commandPath3 || command.flat_path === commandPath3) return command;
     for (const child2 of command.subcommands) {
       const found = visit(child2);
       if (found) return found;
@@ -35877,7 +35991,7 @@ function registerExplainCommand(program3) {
 }
 
 // src/pr-commands.ts
-var import_promises10 = require("node:fs/promises");
+var import_promises11 = require("node:fs/promises");
 var GC_GH_TIMEOUT_MS4 = 2e4;
 var CHECKS_WATCH_POLL_MS = 15e3;
 var CHECKS_WATCH_TIMEOUT_MS = 10 * 6e4;
@@ -36046,10 +36160,10 @@ function registerPrLifecycleCommands(program3) {
     let body;
     try {
       if (o.title || o.titleFile) {
-        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises10.readFile, readStdin });
+        title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
       }
       if (o.body || o.bodyFile) {
-        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
+        body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
       }
     } catch (e) {
       return fail(`pr edit: ${e.message}`);
@@ -36079,7 +36193,7 @@ function registerPrLifecycleCommands(program3) {
     }
     let body;
     try {
-      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises10.readFile, readStdin });
+      body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
     } catch (e) {
       return fail(`pr comment: ${e.message}`);
     }
@@ -36790,19 +36904,19 @@ function registerOrgHealthQuery(program3, deps = defaultOrgHealthQueryDeps()) {
 }
 
 // src/plugin-release-catchup.ts
-var import_node_fs45 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_fs46 = require("node:fs");
+var import_node_path43 = require("node:path");
 var import_node_os17 = require("node:os");
 var RELEASE_CATCHUP_TTL_MS = 24 * 60 * 60 * 1e3;
 var RELEASE_CATCHUP_DISABLE_ENV = "MMI_NO_RELEASE_CATCHUP";
 function releaseCatchupStatePath(env = process.env) {
   if (env.MMI_RELEASE_CATCHUP_STATE) return env.MMI_RELEASE_CATCHUP_STATE;
   if (process.platform === "win32") {
-    const base2 = env.LOCALAPPDATA || (0, import_node_path42.join)((0, import_node_os17.homedir)(), "AppData", "Local");
-    return (0, import_node_path42.join)(base2, "MMI Future", "mmi-cli", "release-catchup.json");
+    const base2 = env.LOCALAPPDATA || (0, import_node_path43.join)((0, import_node_os17.homedir)(), "AppData", "Local");
+    return (0, import_node_path43.join)(base2, "MMI Future", "mmi-cli", "release-catchup.json");
   }
-  const base = env.XDG_STATE_HOME || (0, import_node_path42.join)((0, import_node_os17.homedir)(), ".local", "state");
-  return (0, import_node_path42.join)(base, "mmi-cli", "release-catchup.json");
+  const base = env.XDG_STATE_HOME || (0, import_node_path43.join)((0, import_node_os17.homedir)(), ".local", "state");
+  return (0, import_node_path43.join)(base, "mmi-cli", "release-catchup.json");
 }
 function releaseCatchupDue(state, now, force = false) {
   if (force) return true;
@@ -36812,7 +36926,7 @@ function releaseCatchupDue(state, now, force = false) {
 function newestCachedPluginVersion(home) {
   let names;
   try {
-    names = (0, import_node_fs45.readdirSync)(pluginCacheRoot(home));
+    names = (0, import_node_fs46.readdirSync)(pluginCacheRoot(home));
   } catch {
     return void 0;
   }
@@ -36820,15 +36934,15 @@ function newestCachedPluginVersion(home) {
 }
 function marketplaceClonePath(home) {
   try {
-    const parsed = JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(home, ".claude", "plugins", "known_marketplaces.json"), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path43.join)(home, ".claude", "plugins", "known_marketplaces.json"), "utf8"));
     if (parsed.mutmutco?.installLocation) return parsed.mutmutco.installLocation;
   } catch {
   }
-  return (0, import_node_path42.join)(home, ".claude", "plugins", "marketplaces", "mutmutco");
+  return (0, import_node_path43.join)(home, ".claude", "plugins", "marketplaces", "mutmutco");
 }
 function readCatalogVersion(home) {
   try {
-    const parsed = JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(marketplaceClonePath(home), ".claude-plugin", "marketplace.json"), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path43.join)(marketplaceClonePath(home), ".claude-plugin", "marketplace.json"), "utf8"));
     return parsed.plugins?.find((p) => p.name === "mmi")?.version;
   } catch {
     return void 0;
@@ -36836,7 +36950,7 @@ function readCatalogVersion(home) {
 }
 function readMmiInstallRecord(home) {
   try {
-    const parsed = JSON.parse((0, import_node_fs45.readFileSync)((0, import_node_path42.join)(home, ".claude", "plugins", "installed_plugins.json"), "utf8"));
+    const parsed = JSON.parse((0, import_node_fs46.readFileSync)((0, import_node_path43.join)(home, ".claude", "plugins", "installed_plugins.json"), "utf8"));
     const record = parsed.plugins?.["mmi@mutmutco"]?.[0];
     return record?.version ? { version: record.version, gitCommitSha: record.gitCommitSha } : void 0;
   } catch {
@@ -36865,7 +36979,7 @@ async function runReleaseCatchup(home, env, deps, opts = {}) {
     cliUpdated = true;
   }
   const cliUpdateDetail = cliUpdated ? `CLI ${runningCli} \u2192 ${latest}; the next mmi-cli invocation runs ${latest}` : `CLI ${runningCli} is current against released ${latest}`;
-  if (!(0, import_node_fs45.existsSync)(pluginCacheRoot(home))) {
+  if (!(0, import_node_fs46.existsSync)(pluginCacheRoot(home))) {
     deps.writeState(statePath, { checkedAt: deps.now(), latest });
     return {
       ok: true,
@@ -36898,8 +37012,8 @@ async function runReleaseCatchup(home, env, deps, opts = {}) {
     return { ok: false, detail: `${cliUpdateDetail}; plugin install record could not be cleared (still ${prior.version})` };
   }
   const installed = await deps.runClaude(["plugin", "install", "mmi@mutmutco"], "claude plugin install mmi@mutmutco");
-  const payload = (0, import_node_path42.join)(pluginCacheRoot(home), latest, ".pi-plugin");
-  if (!installed || !(0, import_node_fs45.existsSync)(payload)) {
+  const payload = (0, import_node_path43.join)(pluginCacheRoot(home), latest, ".pi-plugin");
+  if (!installed || !(0, import_node_fs46.existsSync)(payload)) {
     const why = installed ? `install of ${latest} did not produce a verifiable .pi-plugin payload` : `install of ${latest} failed`;
     if (!prior) return { ok: false, detail: `${cliUpdateDetail}; ${why}; no prior record to restore` };
     const rollback = await restorePriorRecord(home, prior, deps);
@@ -36998,6 +37112,7 @@ var surfaces_default = {
       surfaceId: "mmi-cli"
     },
     hookPolicy: {
+      consoleLauncherPath: "bin/mmi-hook-console.cmd",
       launcherPath: "bin/mmi-hook",
       ownerPath: "scripts/hook-policy.mjs",
       runnerPath: "scripts/hook-run.mjs",
@@ -37661,6 +37776,7 @@ var surfaces_default = {
           "scripts/hook-trace.mjs",
           "bin/mmi-hook",
           "bin/mmi-hook.exe",
+          "bin/mmi-hook-console.cmd",
           "native/windows-hook-launcher.c",
           "scripts/build-windows-hook-launcher.ps1",
           "scripts/probe-windows-hook-window.ps1"
@@ -39182,9 +39298,9 @@ function ghAccountCaveat(announcedLogin, accounts) {
 }
 
 // src/doctor-io.ts
-var import_node_fs46 = require("node:fs");
+var import_node_fs47 = require("node:fs");
 var import_node_os18 = require("node:os");
-var import_node_path43 = require("node:path");
+var import_node_path44 = require("node:path");
 var import_node_child_process19 = require("node:child_process");
 var import_node_util8 = require("node:util");
 var execFileP6 = (0, import_node_util8.promisify)(import_node_child_process19.execFile);
@@ -39192,7 +39308,7 @@ var MMI_PLUGIN_ID2 = "mmi@mutmutco";
 function installedClaudePluginVersion() {
   try {
     const file = JSON.parse(
-      (0, import_node_fs46.readFileSync)((0, import_node_path43.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
+      (0, import_node_fs47.readFileSync)((0, import_node_path44.join)((0, import_node_os18.homedir)(), ".claude", "plugins", "installed_plugins.json"), "utf8")
     );
     const versions = (file.plugins?.[MMI_PLUGIN_ID2] ?? []).map((r) => r.version).filter((v) => Boolean(v));
     if (versions.length === 0) return void 0;
@@ -39203,7 +39319,7 @@ function installedClaudePluginVersion() {
 }
 function manifestVersion(path2) {
   try {
-    const manifest = JSON.parse((0, import_node_fs46.readFileSync)(path2, "utf8"));
+    const manifest = JSON.parse((0, import_node_fs47.readFileSync)(path2, "utf8"));
     return typeof manifest.version === "string" && manifest.version.trim() ? manifest.version.trim() : void 0;
   } catch {
     return void 0;
@@ -39213,22 +39329,22 @@ function installedSurfacePluginVersion(surface) {
   const token = surfaceToken(surface);
   if (token === "kilo") {
     try {
-      const stamp = (0, import_node_fs46.readFileSync)((0, import_node_path43.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
+      const stamp = (0, import_node_fs47.readFileSync)((0, import_node_path44.join)((0, import_node_os18.homedir)(), ".kilo", ".mmi-kilo-version"), "utf8").trim();
       return stamp || void 0;
     } catch {
       return void 0;
     }
   }
   if (token === "cursor") {
-    return manifestVersion((0, import_node_path43.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path44.join)(cursorLocalPluginRoot(), ".cursor-plugin", "plugin.json"));
   }
   if (token === "jervcode") {
     const entry = mmiPiWrapperEntry();
     if (!entry) return void 0;
-    return manifestVersion((0, import_node_path43.join)(decodeURIComponent(entry.replace(/^file:\/\/\/?/, "")), "package.json"));
+    return manifestVersion((0, import_node_path44.join)(decodeURIComponent(entry.replace(/^file:\/\/\/?/, "")), "package.json"));
   }
   if (token === "kimi") {
-    return manifestVersion((0, import_node_path43.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
+    return manifestVersion((0, import_node_path44.join)(surfaceConfigRoot(surface), "plugins", "managed", "mmi", ".kimi-plugin", "plugin.json"));
   }
   if (token === "claude") return installedClaudePluginVersion();
   if (token !== "codex") return void 0;
@@ -39266,13 +39382,13 @@ function worktreeRootSync() {
 }
 var gitignorePath = () => {
   const root = worktreeRootSync();
-  return root === null ? null : (0, import_node_path43.join)(root, ".gitignore");
+  return root === null ? null : (0, import_node_path44.join)(root, ".gitignore");
 };
 function readGitignore() {
   const path2 = gitignorePath();
   if (path2 === null) return null;
   try {
-    return (0, import_node_fs46.readFileSync)(path2, "utf8");
+    return (0, import_node_fs47.readFileSync)(path2, "utf8");
   } catch {
     return null;
   }
@@ -39281,7 +39397,7 @@ function writeGitignore(content) {
   const path2 = gitignorePath();
   if (path2 === null) return false;
   try {
-    (0, import_node_fs46.writeFileSync)(path2, content, "utf8");
+    (0, import_node_fs47.writeFileSync)(path2, content, "utf8");
     return true;
   } catch {
     return false;
@@ -39300,7 +39416,7 @@ async function repoRoot() {
 }
 function hasRepoLocalWorktrees() {
   const root = worktreeRootSync();
-  return root !== null && (0, import_node_fs46.existsSync)((0, import_node_path43.join)(root, ".worktrees"));
+  return root !== null && (0, import_node_fs47.existsSync)((0, import_node_path44.join)(root, ".worktrees"));
 }
 
 // src/cross-repo-filing-issue.ts
@@ -39396,7 +39512,7 @@ function binaryOnPath(bin) {
   for (const dir of pathEnvEntries(process.env.PATH ?? "")) {
     for (const ext of exts) {
       try {
-        if ((0, import_node_fs47.existsSync)((0, import_node_path44.join)(dir, `${bin}${ext}`))) return true;
+        if ((0, import_node_fs48.existsSync)((0, import_node_path45.join)(dir, `${bin}${ext}`))) return true;
       } catch {
       }
     }
@@ -39418,8 +39534,8 @@ ${r.stderr ?? ""}`).catch(() => "");
 function ghMultiAccountCaveat(announcedLogin) {
   try {
     const hostsPath = ghHostsConfigPath(process.env, process.platform);
-    if (!hostsPath || !(0, import_node_fs47.existsSync)(hostsPath)) return void 0;
-    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs47.readFileSync)(hostsPath, "utf8")));
+    if (!hostsPath || !(0, import_node_fs48.existsSync)(hostsPath)) return void 0;
+    return ghAccountCaveat(announcedLogin, parseGhHostsAccounts((0, import_node_fs48.readFileSync)(hostsPath, "utf8")));
   } catch {
     return void 0;
   }
@@ -39427,7 +39543,7 @@ function ghMultiAccountCaveat(announcedLogin) {
 var ENV_HEAL_LOCK_STALE_MS = 10 * 6e4;
 var ENV_HEAL_LOCK_MAX_WAIT_MS = 2 * 6e4;
 function envHealLockPath(home) {
-  return (0, import_node_path44.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
+  return (0, import_node_path45.join)(home, ".claude", "plugins", ".mmi-env-heal.lock");
 }
 async function withEnvHealLock(what, run) {
   try {
@@ -39560,7 +39676,7 @@ function mmiDoctorDeps(opts = {}) {
       );
       const result = applyPluginCachePlan(
         plan,
-        (p) => (0, import_node_fs47.rmSync)(p, { recursive: true }),
+        (p) => (0, import_node_fs48.rmSync)(p, { recursive: true }),
         stagingApplyFsGuard(configRoot)
       );
       return {
@@ -39632,7 +39748,7 @@ function mmiDoctorDeps(opts = {}) {
       disableAutoUpdate: () => {
         if (detectSurface(process.env) === "codex") return void 0;
         return disableOrgMarketplaceBackgroundUpdates(
-          (0, import_node_path44.join)((0, import_node_os19.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE),
+          (0, import_node_path45.join)((0, import_node_os19.homedir)(), ...KNOWN_MARKETPLACES_RELATIVE),
           [MMI_MARKETPLACE_NAME]
         );
       }
@@ -39646,7 +39762,7 @@ function mmiDoctorDeps(opts = {}) {
     // adopted the generated routing index (MMG-Unlive: `docs/Archive/**` only, no index, no gate.yml) would
     // get a permanent — demanding an artifact it never asked for.
     docsIndexState: (root) => {
-      if (!(0, import_node_fs47.existsSync)((0, import_node_path44.join)(root, DOCS_INDEX_PATH))) return void 0;
+      if (!(0, import_node_fs48.existsSync)((0, import_node_path45.join)(root, DOCS_INDEX_PATH))) return void 0;
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -39655,7 +39771,7 @@ function mmiDoctorDeps(opts = {}) {
     },
     // #4168: working-tree heal — write if drifted, then re-check. Commit remains the operator's step.
     healDocsIndex: (root) => {
-      if (!(0, import_node_fs47.existsSync)((0, import_node_path44.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
+      if (!(0, import_node_fs48.existsSync)((0, import_node_path45.join)(root, DOCS_INDEX_PATH))) return { drift: false, docCount: 0 };
       const real = createDocsIndexDeps(root);
       let docs2;
       const listDocs = () => docs2 ??= real.listDocs();
@@ -39693,8 +39809,8 @@ function mmiDoctorDeps(opts = {}) {
         });
         const raced = await Promise.race([
           work.then((r) => ({ ...r, timedOut: false })),
-          new Promise((resolve5) => {
-            ceiling = setTimeout(() => resolve5({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
+          new Promise((resolve6) => {
+            ceiling = setTimeout(() => resolve6({ timedOut: true, scanned: 0, findings: 0, fixed: 0, failed: 0 }), BOARD_DOCTOR_TIMEOUT_MS);
           })
         ]);
         if (raced.timedOut) return { scanned: 0, findings: 0, fixed: 0, failed: 0, timedOut: true };
@@ -39727,8 +39843,8 @@ function mmiDoctorDeps(opts = {}) {
             incomplete: nb.incomplete,
             timedOut: false
           })),
-          new Promise((resolve5) => {
-            ceiling = setTimeout(() => resolve5({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
+          new Promise((resolve6) => {
+            ceiling = setTimeout(() => resolve6({ driftLines: [], incomplete: [], timedOut: true }), SCHEDULES_DRIFT_TIMEOUT_MS);
           })
         ]);
         if (!raced.timedOut && raced.incomplete.length === 0) writeSchedulesDriftCache(cachePath, raced.driftLines);
@@ -40021,19 +40137,19 @@ program2.hook("preAction", async (_thisCommand, actionCommand) => {
 });
 var rules = program2.command("rules").description("org-managed .gitignore delivery");
 rules.command("gitignore").option("--write", "upsert the managed block into .gitignore (default: check only, non-zero exit on drift)").option("--json", "machine-readable output").description("verify (or --write) this repo's org-managed .gitignore block matches the SSOT").action((opts) => {
-  const path2 = (0, import_node_path44.join)(process.cwd(), ".gitignore");
-  const current = (0, import_node_fs47.existsSync)(path2) ? (0, import_node_fs47.readFileSync)(path2, "utf8") : null;
+  const path2 = (0, import_node_path45.join)(process.cwd(), ".gitignore");
+  const current = (0, import_node_fs48.existsSync)(path2) ? (0, import_node_fs48.readFileSync)(path2, "utf8") : null;
   const plan = planManagedGitignore(current);
   const drift = [...plan.added.map((l) => `+${l}`), ...plan.removed.map((l) => `-${l}`)].join(", ") || "block normalize";
   if (opts.json) {
-    if (opts.write && plan.changed) (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
+    if (opts.write && plan.changed) (0, import_node_fs48.writeFileSync)(path2, plan.content, "utf8");
     console.log(JSON.stringify(plan, null, 2));
     if (!opts.write && plan.changed) process.exitCode = 1;
     return;
   }
   if (opts.write) {
     if (plan.changed) {
-      (0, import_node_fs47.writeFileSync)(path2, plan.content, "utf8");
+      (0, import_node_fs48.writeFileSync)(path2, plan.content, "utf8");
       console.log(`mmi-cli devops org rules gitignore: updated .gitignore (${drift})`);
     } else {
       console.log("mmi-cli devops org rules gitignore: up to date");
@@ -40192,8 +40308,8 @@ gcCmd.option("--dry-run", "show what would be deleted (default)").option("--appl
   if (!Number.isFinite(limit) || limit < 1) return fail("worktree gc: --limit must be a positive integer");
   let root;
   if (o.root !== void 0) {
-    root = (0, import_node_path44.resolve)(o.root);
-    if (!(0, import_node_fs47.existsSync)(root) || !(0, import_node_fs47.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
+    root = (0, import_node_path45.resolve)(o.root);
+    if (!(0, import_node_fs48.existsSync)(root) || !(0, import_node_fs48.statSync)(root).isDirectory()) return fail(`worktree gc: --root ${o.root} is not a directory`);
     const gcRepoRoot = (await execFileP2("git", ["rev-parse", "--show-toplevel"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout.trim() || process.cwd();
     if (isPathUnderDirectory2(gcRepoRoot, root)) {
       return fail(`worktree gc: --root ${root} contains this checkout \u2014 name a worktrees root, not the repo or an ancestor of it`);
@@ -40241,7 +40357,7 @@ function runWorktreeInstall(command, cwd, quiet, opts) {
     quiet ? "ignore" : "inherit",
     "pipe"
   ];
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const child2 = opts?.shell ? (0, import_node_child_process20.spawn)(command, { cwd, stdio, windowsHide: true, shell: true }) : (() => {
       const [bin, ...args] = command.split(" ");
       const file = isWin2 ? "cmd.exe" : bin;
@@ -40268,7 +40384,7 @@ function runWorktreeInstall(command, cwd, quiet, opts) {
     });
     child2.on("exit", (code) => {
       clearTimeout(timer);
-      if (code === 0) return resolve5();
+      if (code === 0) return resolve6();
       const tail = stderrTail.trim();
       reject(new Error(`${command} exited ${code} in ${cwd}${tail ? `
 ${tail}` : ""}`));
@@ -40290,7 +40406,7 @@ async function currentWorktreeRemovalContext(command, force) {
   };
 }
 async function unprovenWorktreeReason(wtPath, repoRoot2) {
-  if (!(0, import_node_fs47.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
+  if (!(0, import_node_fs48.existsSync)(wtPath)) return `${wtPath} does not exist on disk`;
   const porcelain = (await execFileP2("git", ["-C", repoRoot2, "worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout;
   const registered = parseWorktreePorcelainEntries(porcelain);
   if (!registered.length) {
@@ -40320,26 +40436,26 @@ function makeProvisionDeps(worktreeRoot, quiet, log) {
 function acquireWorktreeSetupLock(worktreeRoot) {
   const lockPath = repoRuntimeStatePath(worktreeRoot, "worktree-setup.lock");
   const take = () => {
-    const fd = (0, import_node_fs47.openSync)(lockPath, "wx");
+    const fd = (0, import_node_fs48.openSync)(lockPath, "wx");
     try {
-      (0, import_node_fs47.writeSync)(fd, String(Date.now()));
+      (0, import_node_fs48.writeSync)(fd, String(Date.now()));
     } finally {
-      (0, import_node_fs47.closeSync)(fd);
+      (0, import_node_fs48.closeSync)(fd);
     }
     return () => {
       try {
-        (0, import_node_fs47.rmSync)(lockPath, { force: true });
+        (0, import_node_fs48.rmSync)(lockPath, { force: true });
       } catch {
       }
     };
   };
   try {
-    (0, import_node_fs47.mkdirSync)((0, import_node_path44.dirname)(lockPath), { recursive: true });
+    (0, import_node_fs48.mkdirSync)((0, import_node_path45.dirname)(lockPath), { recursive: true });
     return take();
   } catch {
     try {
-      if (Date.now() - (0, import_node_fs47.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
-        (0, import_node_fs47.rmSync)(lockPath, { force: true });
+      if (Date.now() - (0, import_node_fs48.statSync)(lockPath).mtimeMs > WORKTREE_SETUP_LOCK_TTL_MS) {
+        (0, import_node_fs48.rmSync)(lockPath, { force: true });
         return take();
       }
     } catch {
@@ -40455,7 +40571,7 @@ withExamples(mutating(
     }
     if (!resumed) {
       step = `git worktree add ${wtPath}`;
-      const wtPathPreExisted = (0, import_node_fs47.existsSync)(wtPath);
+      const wtPathPreExisted = (0, import_node_fs48.existsSync)(wtPath);
       const partialRemove = worktreeRemoveDeps(async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout);
       await withWorktreeAddLock(repoRoot2, () => addWorktreeRobust(wtPath, branch, base, {
         // #4834: `-c core.longpaths=true` rides the add command itself — a Windows worktree path
@@ -40471,13 +40587,13 @@ withExamples(mutating(
         },
         deleteBranch: (b) => execFileP2("git", ["branch", "-D", b], { timeout: GIT_TIMEOUT_MS }).then(() => void 0),
         cleanupPartial: async () => {
-          if (wtPathPreExisted || !(0, import_node_fs47.existsSync)(wtPath)) return;
+          if (wtPathPreExisted || !(0, import_node_fs48.existsSync)(wtPath)) return;
           partialRemove.detachReparsePoints(wtPath);
           await execFileP2("git", ["worktree", "remove", "--force", wtPath], { timeout: GIT_TIMEOUT_MS }).catch(() => partialRemove.removeWorktreeDir(wtPath).then(() => void 0));
           await execFileP2("git", ["worktree", "prune"], { timeout: GIT_TIMEOUT_MS }).catch(() => {
           });
         },
-        sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+        sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
         log: (m) => {
           if (!o.json) console.error(`  ${m}`);
         }
@@ -40929,9 +41045,7 @@ docs.command("refs").description("deterministic doc reference gate: every backti
   try {
     const root = await repoRoot();
     const commandPaths = new Set(
-      buildCommandManifest(program2).index.map(
-        (entry) => entry.house && entry.house !== "core" ? `${entry.house} ${entry.path}` : entry.path
-      )
+      buildCommandManifest(program2).index.map((entry) => entry.path)
     );
     const result = runDocRefs(root, { commandPaths });
     if (o.json) {
@@ -41014,7 +41128,7 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; project-admin own dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; project-admin own dev/rc, master main").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
     let lines;
     if (o.lines !== void 0) {
@@ -41022,7 +41136,12 @@ tenant.command("control <owner/repo> <stage> <action>").description("bounded ten
       lines = Number(o.lines);
       if (!Number.isInteger(lines) || lines < 1 || lines > 2e3) return fail("runtime tenant control: --lines must be an integer between 1 and 2000");
     }
-    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines });
+    if (action === "run-task") {
+      if (!o.task) return fail("runtime tenant control: run-task requires --task <declared-name>");
+    } else if (o.task || o.artifact) {
+      return fail("runtime tenant control: --task/--artifact are valid only for run-task");
+    }
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines, task: o.task, artifact: o.artifact });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines: lines2, failure } = renderVerifySecrets(body);
@@ -41044,6 +41163,15 @@ tenant.command("control <owner/repo> <stage> <action>").description("bounded ten
     return failGraceful(`runtime tenant control: ${e.message}`);
   }
 });
+var tenantArtifact = tenant.command("artifact").description("private stage-bound inputs for declared tenant tasks");
+tenantArtifact.command("put <owner/repo> <stage> <path>").description("upload a private file through a short-lived Hub grant; prints only an opaque artifact id").option("--json", "machine-readable output").action(async (repo, stage, path2, o) => {
+  try {
+    const receipt = await putTenantArtifact(repo, stage, path2, registryClientDeps(await loadConfig()));
+    printLine(o.json ? JSON.stringify(receipt, null, 2) : `tenant artifact ${receipt.artifactId} ready for ${repo} ${stage} until ${receipt.expiresAt}`);
+  } catch (e) {
+    return failGraceful(e.message);
+  }
+});
 tenant.command("reconcile <owner/repo> <stage>").description("re-render this tenant stage's generated box assets from registry truth; project-admin own dev/rc, master main; watches by default").option("--watch", "wait for the tenant-reconcile.yml run (default)").option("--no-watch", "return after dispatch; do not redeploy until the reconcile run succeeds").option("--json", "machine-readable output").action(async (repo, stage, o) => {
   try {
     const result = await runTenantReconcile(trainApplyDeps(), { repo, stage, watch: o.watch });
@@ -41189,10 +41317,10 @@ project.command("get [owner/repo]").description("a project's META (board ids + p
     const track = resolveReleaseTrack(m, void 0, target);
     const stages = branchesForTrack(track).join(" -> ");
     const note = track === "direct" ? " (direct \u2014 no rc; /rcand refuses, /release ships development -> main)" : track === "trunk" ? " (trunk \u2014 main only)" : "";
+    const deployNote = m.deployModel === "registry-publish" ? "\ndeploys are repository-owned publish workflows (registry-publish); no central tenant deploy runs for this repo." : "\ndeploys run centrally (tenant-deploy.yml); product repos carry no deploy files.";
     console.error(
       `${m.name ?? target} \u2014 class ${m.class ?? "?"} \u2014 deploy ${m.deployModel ?? "?"}
-release track: ${track} \u2014 stages: ${stages}${note}
-deploys run centrally (tenant-deploy.yml); product repos carry no deploy files. Inspect nonsecret DEPLOY facts with \`mmi-cli oracle org project deploy get\`; full coords remain OIDC-gated.`
+release track: ${track} \u2014 stages: ${stages}${note}` + deployNote + " Inspect nonsecret DEPLOY facts with `mmi-cli oracle org project deploy get`; full coords remain OIDC-gated."
     );
   }
 });
@@ -41240,7 +41368,7 @@ project.command("set [owner/repo]").description("upsert project META (idempotent
   if (dupe) return fail(`org project set: KEY "${dupe}" was passed to both --var and --set; --set is an alias of --var, so pass each KEY once`);
   if (o.secretsFile) {
     try {
-      vars.push(`secrets=${(0, import_node_fs47.readFileSync)(o.secretsFile, "utf8")}`);
+      vars.push(`secrets=${(0, import_node_fs48.readFileSync)(o.secretsFile, "utf8")}`);
     } catch (e) {
       return fail(`org project set: cannot read --secrets-file ${o.secretsFile}: ${e.message}`);
     }
@@ -41566,7 +41694,7 @@ withExamples(mutating(
     try {
       title = await resolveIssueTitle(
         { title: opts.title, titleFile: opts.titleFile },
-        { readFile: import_promises11.readFile, readStdin }
+        { readFile: import_promises12.readFile, readStdin }
       );
     } catch (e) {
       return fail(
@@ -41608,8 +41736,8 @@ withExamples(mutating(
   let surfaceFlagLabel;
   try {
     issueType = resolveCreateType(o.type, "issue create", o.label);
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises12.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises12.readFile, readStdin });
     if (o.idempotencyKey) body = appendIdempotencyMarker(body, o.idempotencyKey);
     priority = resolveCreatePriority(o.priority, "issue create");
     extraLabels = [...o.label ?? []];
@@ -41790,7 +41918,7 @@ jsonParity(issue.command("comment <ref>").description("post a Markdown comment t
   }
   let body;
   try {
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises12.readFile, readStdin });
   } catch (e) {
     return fail(`issue comment: ${e.message}`);
   }
@@ -41850,8 +41978,8 @@ program2.command("report").description("file a friction report on the Hub board
   let title;
   const sourceRepo = o.repo ?? await resolveRepo(void 0);
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises12.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises12.readFile, readStdin });
     priority = resolveCreatePriority(o.priority, "report");
     if (!ISSUE_TYPES.includes(o.type)) {
       throw new Error(`unknown issue type "${o.type}" \u2014 expected one of: ${ISSUE_TYPES.join(", ")}`);
@@ -41905,8 +42033,8 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   let args;
   try {
     skill = assertSkillName(o.skill);
-    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
-    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
+    rawBody = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises12.readFile, readStdin });
+    const rawTitle = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises12.readFile, readStdin });
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = resolveCreatePriority(o.priority, "skill-lesson");
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
@@ -41965,8 +42093,8 @@ withExamples(pr.command("create").description("create a PR and print {number,url
   let body;
   let title;
   try {
-    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises11.readFile, readStdin });
-    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises11.readFile, readStdin });
+    title = await resolveIssueTitle({ title: o.title, titleFile: o.titleFile }, { readFile: import_promises12.readFile, readStdin });
+    body = await resolveIssueBody({ body: o.body, bodyFile: o.bodyFile }, { readFile: import_promises12.readFile, readStdin });
   } catch (e) {
     return fail(`pr create: ${e.message}`, e instanceof TextArgError ? { code: e.code, offending_flag: e.offendingFlag } : void 0);
   }
@@ -42008,11 +42136,11 @@ pr.command("view <number>").description("read a PR as structured JSON (merged st
   }
 });
 async function listCiWorkflowPaths(cwd = process.cwd()) {
-  const wfDir = (0, import_node_path44.join)(cwd, ".github", "workflows");
-  if (!(0, import_node_fs47.existsSync)(wfDir)) return [];
-  return (0, import_node_fs47.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
+  const wfDir = (0, import_node_path45.join)(cwd, ".github", "workflows");
+  if (!(0, import_node_fs48.existsSync)(wfDir)) return [];
+  return (0, import_node_fs48.readdirSync)(wfDir).filter((name) => /\.(ya?ml)$/i.test(name)).filter((name) => {
     try {
-      return workflowReportsPrChecks((0, import_node_fs47.readFileSync)((0, import_node_path44.join)(wfDir, name), "utf8"));
+      return workflowReportsPrChecks((0, import_node_fs48.readFileSync)((0, import_node_path45.join)(wfDir, name), "utf8"));
     } catch {
       return true;
     }
@@ -42064,16 +42192,16 @@ function ciAuditDeps() {
     // gate re-seed step is skipped gracefully rather than failing mid-run.
     readSeedFile: (path2) => {
       if (!root) return null;
-      const fullPath = (0, import_node_path44.join)(root, path2);
-      return (0, import_node_fs47.existsSync)(fullPath) ? (0, import_node_fs47.readFileSync)(fullPath, "utf8") : null;
+      const fullPath = (0, import_node_path45.join)(root, path2);
+      return (0, import_node_fs48.existsSync)(fullPath) ? (0, import_node_fs48.readFileSync)(fullPath, "utf8") : null;
     }
   };
 }
 function hubRoot() {
-  const fromPkg = (0, import_node_path44.join)(__dirname, "..", "..");
+  const fromPkg = (0, import_node_path45.join)(__dirname, "..", "..");
   const marker = "skills/bootstrap/seeds/manifest.json";
-  if ((0, import_node_fs47.existsSync)((0, import_node_path44.join)(fromPkg, marker))) return fromPkg;
-  if ((0, import_node_fs47.existsSync)((0, import_node_path44.join)(process.cwd(), marker))) return process.cwd();
+  if ((0, import_node_fs48.existsSync)((0, import_node_path45.join)(fromPkg, marker))) return fromPkg;
+  if ((0, import_node_fs48.existsSync)((0, import_node_path45.join)(process.cwd(), marker))) return process.cwd();
   return null;
 }
 async function waitLoopCorePool(label) {
@@ -42122,7 +42250,7 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     // reading as "your tests failed". One call per failing run, only at the verdict.
     diagnoseFailure: () => waitLoopDiagnosis("pr checks-wait", number, repo),
     baseBranch,
-    sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
     log: (message) => console.warn(message),
     timeoutMs,
     // Liveness on stderr, one line per poll. A silent bounded wait is indistinguishable from a hang, and
@@ -42202,7 +42330,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
         // then read its own wall-clock kill as a broken diff.
         diagnoseFailure: () => waitLoopDiagnosis("pr land", prNumber, repo),
         baseBranch: "development",
-        sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+        sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
         log: (message) => console.warn(message),
         // `pr land` inherits the same (raised) checks budget, so it needs the same liveness — otherwise the
         // 30m wait is SILENT and reads exactly like the hang #2940 was filed about, only three times longer.
@@ -42245,7 +42373,7 @@ pr.command("land <number>").description("agent merge path (#1440): train probe \
         } else {
           lastFailure = void 0;
         }
-        await new Promise((resolve5) => setTimeout(resolve5, PR_LAND_POLL_MS));
+        await new Promise((resolve6) => setTimeout(resolve6, PR_LAND_POLL_MS));
       }
       if (lastFailure) {
         throw new Error(
@@ -42345,7 +42473,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
       pollRateLimit: () => waitLoopCorePool("pr merge --wait"),
       diagnoseFailure: () => waitLoopDiagnosis("pr merge --wait", number, repo),
       baseBranch,
-      sleep: (ms) => new Promise((resolve5) => setTimeout(resolve5, ms)),
+      sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)),
       log: (message) => console.warn(message),
       progress: ({ state, elapsedMs, remainingMs }) => console.warn(`pr merge: --wait checks \u2014 ${state}, ${Math.round(elapsedMs / 1e3)}s elapsed, ${Math.round(remainingMs / 6e4)}m left`)
     });
@@ -42381,7 +42509,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
         }
         if (!repoForPostCleanup) throw e;
         console.warn(`pr merge: gh GraphQL rate-limited \u2014 merging PR #${number} via REST PUT instead (#4588).`);
-        const commitMessage = bodyFile ? (0, import_node_fs47.readFileSync)(bodyFile, "utf8") : void 0;
+        const commitMessage = bodyFile ? (0, import_node_fs48.readFileSync)(bodyFile, "utf8") : void 0;
         await defaultGitHubClient().rest("PUT", `repos/${repoForPostCleanup}/pulls/${number}/merge`, {
           body: { merge_method: method.slice(2), ...commitMessage ? { commit_message: commitMessage } : {} },
           timeoutMs: GH_MUTATION_TIMEOUT_MS
@@ -42477,7 +42605,7 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
     localCleanup = await cleanupPrMergeLocalBranch(headRef, {
       beforeWorktrees,
       startingPath,
-      pathExists: (p) => (0, import_node_fs47.existsSync)(p),
+      pathExists: (p) => (0, import_node_fs48.existsSync)(p),
       execGit: async (args) => (await execFileP2("git", args, { timeout: GIT_TIMEOUT_MS })).stdout,
       teardownWorktreeStage,
       deferredStore,
@@ -42578,8 +42706,8 @@ function trainApplyDeps() {
     // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
     // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
     // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
-    dispatchTenantControl: async ({ repo, stage, action, lines }) => {
-      const res = await tenantControl({ repo, stage, action, ...lines != null ? { lines } : {} }, registryClientDeps(await loadConfig()));
+    dispatchTenantControl: async ({ repo, stage, action, lines, task, artifact }) => {
+      const res = await tenantControl({ repo, stage, action, ...lines != null ? { lines } : {}, ...task ? { task } : {}, ...artifact ? { artifact } : {} }, registryClientDeps(await loadConfig()));
       if (res.ok) return { ok: true };
       const body = res.body;
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
@@ -42603,8 +42731,8 @@ function trainApplyDeps() {
     // Slack release announcement (#883): Hub-only + best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP2(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
-      readFile: (path2) => (0, import_promises11.readFile)(path2, "utf8"),
-      removeFile: (path2) => (0, import_promises11.unlink)(path2)
+      readFile: (path2) => (0, import_promises12.readFile)(path2, "utf8"),
+      removeFile: (path2) => (0, import_promises12.unlink)(path2)
     }, args),
     // #4713 (I/O-boundary census): `null` used to mean BOTH "this project configures no edge domains"
     // (a real answer) and "the registry read missed" — so a release verdict printed an environments block
@@ -42841,7 +42969,7 @@ for (const commandName of ["rcand", "release"]) {
       }
       let summaryLines;
       try {
-        summaryLines = summaryFileLines(await (0, import_promises11.readFile)(o.announceSummaryFile, "utf8"));
+        summaryLines = summaryFileLines(await (0, import_promises12.readFile)(o.announceSummaryFile, "utf8"));
       } catch (e) {
         return fail(`release: could not read --announce-summary-file ${o.announceSummaryFile}: ${e.message}`);
       }
@@ -43081,12 +43209,12 @@ access.command("audit").description("audit collaborator roles + train-branch pus
     targets = resolution.targets;
   }
   const derivedMatrix = registryProjects ? accessMatrixFromProjects(registryProjects) : {};
-  const fileMatrix = (0, import_node_fs47.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs47.readFileSync)("access-matrix.json", "utf8")) : {};
+  const fileMatrix = (0, import_node_fs48.existsSync)("access-matrix.json") ? loadAccessMatrix((0, import_node_fs48.readFileSync)("access-matrix.json", "utf8")) : {};
   const matrix = mergeAccessMatrix(fileMatrix, derivedMatrix);
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
-  const fileContracts = (0, import_node_fs47.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs47.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
+  const fileContracts = (0, import_node_fs48.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs48.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const sanctioned = (0, import_node_fs47.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs47.readFileSync)("access-matrix.json", "utf8")) : {};
+  const sanctioned = (0, import_node_fs48.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs48.readFileSync)("access-matrix.json", "utf8")) : {};
   const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
@@ -43124,16 +43252,16 @@ function directoryBytes(path2) {
   let total = 0;
   let entries;
   try {
-    entries = (0, import_node_fs47.readdirSync)(path2, { withFileTypes: true });
+    entries = (0, import_node_fs48.readdirSync)(path2, { withFileTypes: true });
   } catch {
     return 0;
   }
   for (const entry of entries) {
-    const child2 = (0, import_node_path44.join)(path2, entry.name);
+    const child2 = (0, import_node_path45.join)(path2, entry.name);
     if (entry.isDirectory()) total += directoryBytes(child2);
     else {
       try {
-        total += (0, import_node_fs47.statSync)(child2).size;
+        total += (0, import_node_fs48.statSync)(child2).size;
       } catch {
       }
     }
@@ -43141,25 +43269,25 @@ function directoryBytes(path2) {
   return total;
 }
 function listDirEntries(dir) {
-  return (0, import_node_fs47.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
+  return (0, import_node_fs48.readdirSync)(dir, { withFileTypes: true }).map((d) => ({ name: d.name, isDirectory: d.isDirectory() }));
 }
 function readInstalledPluginRefs(configRoot) {
   const p = installedPluginsPathForConfig(configRoot);
-  if (!(0, import_node_fs47.existsSync)(p)) return [];
+  if (!(0, import_node_fs48.existsSync)(p)) return [];
   try {
-    return installedPluginPaths((0, import_node_fs47.readFileSync)(p, "utf8"));
+    return installedPluginPaths((0, import_node_fs48.readFileSync)(p, "utf8"));
   } catch {
     return null;
   }
 }
 function pluginCacheFsDeps(configRoot, dirBytes) {
   return {
-    exists: (p) => (0, import_node_fs47.existsSync)(p),
-    listVersionDirs: (root) => (0, import_node_fs47.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
+    exists: (p) => (0, import_node_fs48.existsSync)(p),
+    listVersionDirs: (root) => (0, import_node_fs48.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name),
     dirBytes,
-    listStagingDirs: (root) => (0, import_node_fs47.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    listStagingDirs: (root) => (0, import_node_fs48.readdirSync)(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
       try {
-        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path44.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs47.statSync)(p).mtimeMs) };
+        return { name: d.name, mtimeMs: newestMtimeMs((0, import_node_path45.join)(root, d.name), listDirEntries, (p) => (0, import_node_fs48.statSync)(p).mtimeMs) };
       } catch {
         return { name: d.name, mtimeMs: Date.now() };
       }
@@ -43173,10 +43301,10 @@ function stagingApplyFsGuard(configRoot) {
   return {
     referencedPaths: () => readInstalledPluginRefs(configRoot),
     mtimeMs: (name) => {
-      const p = (0, import_node_path44.join)(stagingRoot, name);
-      if (!(0, import_node_fs47.existsSync)(p)) return null;
+      const p = (0, import_node_path45.join)(stagingRoot, name);
+      if (!(0, import_node_fs48.existsSync)(p)) return null;
       try {
-        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs47.statSync)(q).mtimeMs);
+        return newestMtimeMs(p, listDirEntries, (q) => (0, import_node_fs48.statSync)(q).mtimeMs);
       } catch {
         return null;
       }
@@ -43202,7 +43330,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
     { withBytes: true, configRoot, includeStaging: surface !== "codex" }
   );
   const anythingToDelete = plan.prune.length > 0 || plan.staging.length > 0;
-  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs47.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
+  const result = o.apply && anythingToDelete ? applyPluginCachePlan(plan, (p) => (0, import_node_fs48.rmSync)(p, { recursive: true, force: true }), stagingApplyFsGuard(configRoot)) : void 0;
   const warnings = plan.prune.length > 0 ? [CONCURRENT_SESSION_WARNING] : [];
   if (o.json) console.log(JSON.stringify({ ...plan, warnings, applied: result ?? null }));
   else console.log(renderPluginCachePlan(plan, result));
@@ -43210,7 +43338,7 @@ program2.command("plugin-prune").description(`prune stale cached MMI plugin vers
 });
 function readReleaseCatchupState(path2) {
   try {
-    const parsed = JSON.parse((0, import_node_fs47.readFileSync)(path2, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs48.readFileSync)(path2, "utf8"));
     return typeof parsed?.checkedAt === "number" ? parsed : void 0;
   } catch {
     return void 0;
@@ -43218,8 +43346,8 @@ function readReleaseCatchupState(path2) {
 }
 function writeReleaseCatchupState(path2, state) {
   try {
-    (0, import_node_fs47.mkdirSync)((0, import_node_path44.dirname)(path2), { recursive: true });
-    (0, import_node_fs47.writeFileSync)(path2, `${JSON.stringify(state)}
+    (0, import_node_fs48.mkdirSync)((0, import_node_path45.dirname)(path2), { recursive: true });
+    (0, import_node_fs48.writeFileSync)(path2, `${JSON.stringify(state)}
 `);
   } catch {
   }