@mutmutco/cli 4.0.1 → 4.0.3

package/dist/main.cjs

@@ -8237,6 +8237,25 @@ function awsScheduleRefs(payload) {
   }
   return refs;
 }
+function decorateAwsModel(entries, registry2, verdicts) {
+  if (!registry2 || registry2.length === 0) return [...entries];
+  const rowById = new Map(registry2.map((r) => [r.id, r]));
+  const literalById = /* @__PURE__ */ new Map();
+  for (const v of verdicts ?? []) {
+    if (typeof v.modelId === "string" && v.modelId.trim() && !literalById.has(v.id)) {
+      literalById.set(v.id, v.modelId);
+    }
+  }
+  return entries.map((e) => {
+    if (!e.scheduleId) return e;
+    const row = rowById.get(e.scheduleId);
+    if (!row || row.executor !== "cursor-agent") return e;
+    const literal = literalById.get(e.scheduleId);
+    if (literal) return { ...e, model: literal };
+    if (row.model) return { ...e, model: `role: ${row.model}` };
+    return { ...e, model: "org-default" };
+  });
+}
 var DECLARED_ENTRIES = [
   { name: "mmi-backup (mm-central, mmi-fofu, zuber, mmi-oguz)", cadence: "17 2 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup \u2192 /opt/mmi-control/nightly-backup.sh (verify: mmi-cli devops runtime box get <box> --ssh)" },
   // #3370: the floor under runner-hygiene.yml. That workflow runs ON the runner and needs checkout +
@@ -8247,8 +8266,16 @@ var DECLARED_ENTRIES = [
   // #4118: Listening + systemd-active ≠ GitHub online after acquirejob 503. restart.conf cannot see
   // it; an Actions workflow on mmi-live cannot heal it when half the fleet is offline. Root cron.
   { name: "mmi-runner-online-reconcile (mmi-runner)", cadence: "*/5 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-online \u2192 /opt/mmi-control/runner-online-reconcile.sh; API-offline + _diag acquirejob, max 2 restarts/tick (verify: mmi-cli devops runtime box get mmi-runner --ssh)" },
-  { name: "zuber-bake", cadence: "*:05/30 (every 30 min)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake.timer \u2192 rolling overlay bake, metro tier, next ~6h window (verify over ssh)" },
-  { name: "zuber-bake-full", cadence: "00:30 UTC (03:30 TRT, daily)", executor: "zuber systemd timer", llm: "no", resolved: "declared", source: "zuber-bake-full.timer \u2192 full 24h overlay rebuild, all 81 il (verify over ssh)" }
+  // #3852: the runner /tmp sweep — daily inode hygiene (03:41 UTC), deliberately the one clutter path the
+  // out-of-band disk-relief script must never touch. Verified installed 2026-08-18: the cron.d file and
+  // flock line match scripts/runner-tmp-sweep.cron exactly.
+  { name: "mmi-runner-tmp-sweep (mmi-runner)", cadence: "41 3 * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-runner-tmp-sweep \u2192 /opt/mmi-control/runner-tmp-sweep.sh; daily inode hygiene, flock -n (verify: mmi-cli devops runtime box get mmi-runner --ssh)" }
+  // RETIRED 2026-08-18 (MMI-Hub#5234): `zuber-bake` (every 30 min) and `zuber-bake-full` (daily 00:30 UTC)
+  // were declared as zuber systemd timers. The ZuberShade full park (#1774, 2026-08-06) stopped them: on
+  // the box (46.225.58.31) zuber-bake.timer / zuber-bake-full.timer answer not-found and
+  // zuber-bake-demand.timer is disabled — no bake/oven timer remains armed, and the notebook must not
+  // claim a job the box does not run. Re-add when the hold lifts and the demand bake re-arms
+  // (MMC-ZuberShade docs/aws-teardown-hold-2026-08-03.md).
 ];
 function sortEntries(entries) {
   return [...entries].sort(
@@ -8263,10 +8290,12 @@ function formatSchedulesTable(entries, now = /* @__PURE__ */ new Date()) {
   const cadW = w((e) => e.cadence, "CADENCE");
   const exeW = w((e) => e.executor, "EXECUTOR");
   const llmW = w((e) => e.llm, "LLM");
+  const modelOf = (e) => e.model ?? "-";
+  const modW = w((e) => modelOf(e), "MODEL");
   const resW = w((e) => resolvedOf.get(e) ?? e.resolved, "RESOLVED");
-  const row = (n, c, x, l, r, s) => `${n.padEnd(nameW)}  ${c.padEnd(cadW)}  ${x.padEnd(exeW)}  ${l.padEnd(llmW)}  ${r.padEnd(resW)}  ${s}`;
-  const lines = [row("JOB", "CADENCE", "EXECUTOR", "LLM", "RESOLVED", "SOURCE")];
-  for (const e of entries) lines.push(row(e.name, e.cadence, e.executor, e.llm, resolvedOf.get(e) ?? e.resolved, e.source));
+  const row = (n, c, x, l, m, r, s) => `${n.padEnd(nameW)}  ${c.padEnd(cadW)}  ${x.padEnd(exeW)}  ${l.padEnd(llmW)}  ${m.padEnd(modW)}  ${r.padEnd(resW)}  ${s}`;
+  const lines = [row("JOB", "CADENCE", "EXECUTOR", "LLM", "MODEL", "RESOLVED", "SOURCE")];
+  for (const e of entries) lines.push(row(e.name, e.cadence, e.executor, e.llm, modelOf(e), resolvedOf.get(e) ?? e.resolved, e.source));
   return lines.join("\n");
 }
 function withTickState(entry, now = /* @__PURE__ */ new Date()) {
@@ -8274,11 +8303,11 @@ function withTickState(entry, now = /* @__PURE__ */ new Date()) {
 }
 function renderDocSection(entries, generatedAtIso) {
   const lines = [
-    "| Job | Cadence | Executor | LLM | Resolved | Source |",
-    "|---|---|---|---|---|---|"
+    "| Job | Cadence | Executor | LLM | Model | Resolved | Source |",
+    "|---|---|---|---|---|---|---|"
   ];
   for (const e of entries) {
-    lines.push(`| ${e.name} | \`${e.cadence}\` | ${e.executor} | ${e.llm} | ${e.resolved} | ${e.source} |`);
+    lines.push(`| ${e.name} | \`${e.cadence}\` | ${e.executor} | ${e.llm} | ${e.model ?? "-"} | ${e.resolved} | ${e.source} |`);
   }
   return [
     DOC_START_MARKER,
@@ -8694,6 +8723,22 @@ async function fetchSchedulesList(deps) {
     return null;
   }
 }
+async function fetchRunVerdicts(deps) {
+  if (!deps.baseUrl) return null;
+  const token = await deps.token();
+  if (!token) return null;
+  try {
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/schedules/verdicts`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    return Array.isArray(body?.runVerdicts) ? body.runVerdicts : null;
+  } catch {
+    return null;
+  }
+}
 async function fetchOrgConfig(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
@@ -9110,6 +9155,7 @@ var OWNER2 = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
 var ORG_INFRA_SLUG = "_org";
+var JERV_VAULT_POINTER = "Not in the MMI vault? Jerv service, personal API and model-provider credentials live in the separate Jerv AWS Vault \u2014 enumerate: `jerv-cli vault list`; consume keyless: `jerv-cli vault use <KEY> -- <cmd>` (values are never printed).";
 var KEY_MAX_PATH_SEGMENTS = 4;
 var KEY_RE = new RegExp(`^(?:[a-z0-9][a-z0-9-]*/){0,${KEY_MAX_PATH_SEGMENTS}}[A-Za-z][A-Za-z0-9_]*$`);
 function isValidSecretKey(key) {
@@ -9126,7 +9172,7 @@ function secretParamName(slug, key) {
   return `${SSM_ROOT}/${slug}/${key}`;
 }
 function formatSecretList(items) {
-  if (!items.length) return "no secrets";
+  if (!items.length) return `no secrets \u2014 ${JERV_VAULT_POINTER}`;
   const width = Math.max(...items.map((i) => i.key.length));
   return items.map((i) => {
     const head = `${i.canManage ? "*" : " "} ${i.key.padEnd(width)}  ${i.tier}`;
@@ -9317,7 +9363,7 @@ function formatCapabilities(r) {
   const items = [...r.capabilities ?? []].sort((a, b) => a.scope.localeCompare(b.scope));
   if (!items.length) return `${head}
 
-no vault credentials visible`;
+no vault credentials visible \u2014 ${JERV_VAULT_POINTER}`;
   const width = Math.max(...items.map((i) => i.scope.length));
   const lines = items.map(
     (i) => `${i.accessible ? "+" : " "} ${i.scope.padEnd(width)}  ${i.tier.padEnd(7)} ${i.grantScope ? `${i.reason} (${i.grantScope})` : i.reason}`
@@ -9440,7 +9486,8 @@ function resolveNotFoundGuidance(input) {
   const lines = [
     `Secret ${key} was not found at ${tried}, and no key named ${leaf} is visible to you.`,
     `Locate it by intent first: \`mmi-cli vault secrets find "<what it is for>"\` \u2014 it returns the exact keyless-use command.`,
-    mnemonic
+    mnemonic,
+    JERV_VAULT_POINTER
   ];
   if (isMaster) {
     lines.push("You are master: if it truly does not exist yet, create it with `mmi-cli vault secrets set` rather than requesting a grant from yourself.");
@@ -9722,6 +9769,7 @@ async function secretsVerify(deps, key, opts) {
     if (!value) {
       deps.err(`${key}: ABSENT or unreachable at this coordinate \u2014 no value could be read`);
       deps.err(`Locate a key across every vault you can reach: mmi-cli oracle org access capabilities${opts.repo ? ` --repo ${opts.repo}` : ""}`);
+      deps.err(JERV_VAULT_POINTER);
       return false;
     }
     deps.log(`${key}: PRESENT (${value.length} chars) \u2014 reachability only; no provider verifier is configured for ${secretLeafName(key)}, so the credential itself was not validated`);
@@ -10377,6 +10425,7 @@ async function fetchSecretForUse(deps, { repo, key, slug }) {
 // src/report.ts
 var HUB_REPO = "mutmutco/MMI-Hub";
 var REPORT_LABEL = "report";
+var LEARNING_LABEL = "learning";
 var REPORT_LOOP_KIND = "friction";
 var REPORT_SURFACE_WAIVER_REASON = "Hub-only friction filing; attribution repo is footer-only; no honest single surface";
 function preflightReportSurface() {
@@ -10774,10 +10823,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.0.1",
-    tag: "v4.0.1",
-    commit: "2807e6205fab",
-    npm: "@mutmutco/cli@4.0.1"
+    version: "4.0.3",
+    tag: "v4.0.3",
+    commit: "3a588e3fa3a3",
+    npm: "@mutmutco/cli@4.0.3"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -10794,14 +10843,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.0.1"
+          v3Target: "v4.0.3"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.0.1 and redeploy the Hub Lambda from tag v4.0.1 (2807e6205fab); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.0.1 (@mutmutco/cli@4.0.1, tag commit 2807e6205fab \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.0.3 and redeploy the Hub Lambda from tag v4.0.3 (3a588e3fa3a3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.0.3 (@mutmutco/cli@4.0.3, tag commit 3a588e3fa3a3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -17561,6 +17610,7 @@ async function postIssueComment(client, input) {
 
 // src/skill-lesson.ts
 var SKILL_LESSON_LABEL = "skill-lesson";
+var SKILL_LESSON_FILE_LABELS = [SKILL_LESSON_LABEL, LEARNING_LABEL];
 var SKILL_LESSON_LOOP_KIND = "lesson";
 var SKILL_NAMES = ["bootstrap", "browser-automation", "doctor", "epic", "hotfix", "mmi", "onboard", "rcand", "release", "resume", "secrets", "stage"];
 function assertSkillName(name) {
@@ -17593,6 +17643,7 @@ function findDuplicateLesson(source, openLessons) {
 }
 
 // src/session-identity.ts
+var import_node_crypto4 = require("node:crypto");
 var import_node_os7 = require("node:os");
 
 // src/plugin-guard-io.ts
@@ -18580,12 +18631,19 @@ async function runPluginHeal(surface = detectSurface(process.env)) {
 // src/session-identity.ts
 var SESSION_ID_ENV_VARS = [
   "MMI_SESSION_ID",
+  "MMI_GATE_SESSION_ID",
   "CLAUDE_SESSION_ID",
   "CLAUDE_CODE_SESSION_ID",
   "CODEX_SESSION_ID",
+  "CODEX_THREAD_ID",
   "CURSOR_SESSION_ID",
+  "HERMES_SESSION_ID",
   "PI_SESSION_ID"
 ];
+var SYNTH_SESSION_PREFIX = "synth-";
+function isHostSessionId(session) {
+  return Boolean(session) && !session.startsWith(SYNTH_SESSION_PREFIX);
+}
 function readSessionId(env) {
   for (const key of SESSION_ID_ENV_VARS) {
     const value = env[key]?.trim();
@@ -18593,11 +18651,18 @@ function readSessionId(env) {
   }
   return void 0;
 }
+var synthesizedSessionId;
+function fallbackSessionId(surface) {
+  if (!synthesizedSessionId) {
+    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto4.randomBytes)(3).toString("hex")}`;
+  }
+  return synthesizedSessionId;
+}
 function describeSessionIdentity(env = process.env) {
-  const session = readSessionId(env);
+  const surface = detectSurface(env);
   return {
-    ...session ? { session } : {},
-    surface: detectSurface(env),
+    session: readSessionId(env) ?? fallbackSessionId(surface),
+    surface,
     host: (0, import_node_os7.hostname)()
   };
 }
@@ -19865,7 +19930,7 @@ async function postClaimMarkerComment(client, item) {
     const actor = describeSessionIdentity();
     const marker = {
       v: 1,
-      ...actor.session ? { session: actor.session } : {},
+      session: actor.session,
       surface: actor.surface,
       host: actor.host,
       ts: (/* @__PURE__ */ new Date()).toISOString()
@@ -20006,7 +20071,7 @@ function sameClaimHost(a, b) {
 }
 function laneOwnership(marker, current) {
   if (!marker) return "unknown";
-  if (marker.session && current.session) {
+  if (isHostSessionId(marker.session) && isHostSessionId(current.session)) {
     return marker.session === current.session ? "mine" : "other";
   }
   if (marker.surface && current.surface && marker.surface !== current.surface) return "other";
@@ -21682,14 +21747,14 @@ function renderVerifyBroker(input) {
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 var import_node_fs22 = require("node:fs");
 var import_promises3 = require("node:fs/promises");
 var import_node_path20 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto4.createHash)("sha256");
+  const hash = (0, import_node_crypto5.createHash)("sha256");
   for await (const chunk of (0, import_node_fs22.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -22829,7 +22894,7 @@ async function announceRelease(deps, args) {
 }
 
 // src/repo-index.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_child_process12 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
 var import_node_path21 = require("node:path");
@@ -23019,7 +23084,7 @@ function rebuildRepoIndex(cwd, repoSlug3) {
       continue;
     }
     if (text.length > 15e5) continue;
-    const hash = (0, import_node_crypto5.createHash)("sha256").update(text).digest("hex").slice(0, 16);
+    const hash = (0, import_node_crypto6.createHash)("sha256").update(text).digest("hex").slice(0, 16);
     const symbols = extractSymbols(text);
     const docBlurb = extractModuleBlurb(text);
     const top = rel.includes("/") ? rel.split("/")[0] : "";
@@ -23124,16 +23189,16 @@ function inferRepoSlug(cwd, exec = import_node_child_process12.execFileSync) {
 }
 
 // src/repo-index-cloud-client.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 
 // src/repo-index-v4/builder.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var import_node_child_process13 = require("node:child_process");
 var import_node_fs25 = require("node:fs");
 var import_node_path23 = require("node:path");
 
 // src/repo-index-v4/chunks.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var import_node_fs24 = require("node:fs");
 var import_node_path22 = require("node:path");
 
@@ -23200,7 +23265,7 @@ async function parserFor(language) {
   return parser;
 }
 function sha256(value) {
-  return (0, import_node_crypto6.createHash)("sha256").update(value).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(value).digest("hex");
 }
 function pointerId(path2, kind, contentHash, start, end, symbol) {
   return sha256(["repo-index-v4", path2, kind, contentHash, String(start), String(end), symbol ?? ""].join("\0"));
@@ -23320,7 +23385,7 @@ function canonicalJson(value) {
   return `{${Object.keys(record).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(record[k])}`).join(",")}}`;
 }
 function sha2562(value) {
-  return (0, import_node_crypto7.createHash)("sha256").update(canonicalJson(value)).digest("hex");
+  return (0, import_node_crypto8.createHash)("sha256").update(canonicalJson(value)).digest("hex");
 }
 function quantizeV4Vector(vector) {
   return vector.map((value) => Number(value.toFixed(V4_VECTOR_DECIMAL_PLACES)));
@@ -23516,16 +23581,23 @@ async function probeRepoIndexV4ReadinessCloud(queries, deps) {
   if (!token) return { ok: false, error: "no Hub session token (run `gh auth login`)" };
   const baseUrl = deps.baseUrl.replace(/\/$/, "");
   const headers = { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" "), "content-type": "application/json" };
-  try {
+  const shadowPass = async () => {
     for (const query of queries) {
-      const res2 = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/v4/shadow`, {
+      const res = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/v4/shadow`, {
         method: "POST",
         headers,
         body: JSON.stringify({ q: query.query, mode: query.mode, readinessProbe: true })
       }, { attempts: RETRY_ATTEMPTS2, timeoutMs: 12e4, sleep: deps.retrySleep });
-      const body2 = await res2.json().catch(() => ({}));
-      if (!res2.ok) return { ok: false, error: `${query.id}: ${body2.error ?? `v4 readiness probe HTTP ${res2.status}`}${body2.errorClass ? ` (${body2.errorClass})` : ""}`, status: res2.status };
+      const body = await res.json().catch(() => ({}));
+      if (!res.ok) return { ok: false, error: `${query.id}: ${body.error ?? `v4 readiness probe HTTP ${res.status}`}${body.errorClass ? ` (${body.errorClass})` : ""}`, status: res.status };
     }
+    return { ok: true };
+  };
+  try {
+    const warmup = await shadowPass();
+    if (!warmup.ok) return warmup;
+    const verdict = await shadowPass();
+    if (!verdict.ok) return verdict;
     const res = await fetchWithRetry(deps.fetch ?? fetch, `${baseUrl}/repo-index/status`, {
       method: "GET",
       headers: { ...clientVersionHeaders(), Authorization: ["Bearer", token].join(" ") }
@@ -23534,8 +23606,8 @@ async function probeRepoIndexV4ReadinessCloud(queries, deps) {
     if (!res.ok) return { ok: false, error: body.error ?? `v4 readiness status HTTP ${res.status}`, status: res.status };
     const readiness = body.v4Readiness;
     const complete = !!readiness && ["ready", "not-ready"].includes(readiness.verdict) && Array.isArray(readiness.reasons) && Number.isFinite(readiness.goldenCount) && Number.isFinite(readiness.evidenceCount) && !!readiness.modes && ["lexical", "semantic", "hybrid"].every((mode) => {
-      const verdict = readiness.modes[mode]?.verdict;
-      return verdict === "ready" || verdict === "not-ready";
+      const verdict2 = readiness.modes[mode]?.verdict;
+      return verdict2 === "ready" || verdict2 === "not-ready";
     });
     if (!complete) return { ok: false, error: "Hub status omitted the explicit v4 readiness verdict/reasons/modes contract", status: res.status };
     return { ok: true, readiness };
@@ -23640,7 +23712,7 @@ async function searchRepoIndexCloud(query, opts, deps) {
     const body = await res.json().catch(() => ({}));
     if (!res.ok) return { ok: false, error: body.error ?? `search HTTP ${res.status}`, status: res.status };
     const shadowRate = Math.max(0, Math.min(1, Number(process.env.MMI_REPO_INDEX_V4_SHADOW_RATE ?? 0.1) || 0));
-    if ((0, import_node_crypto8.createHash)("sha256").update(query).digest()[0] / 256 < shadowRate) {
+    if ((0, import_node_crypto9.createHash)("sha256").update(query).digest()[0] / 256 < shadowRate) {
       void fetchWithRetry(
         deps.fetch ?? fetch,
         `${deps.baseUrl.replace(/\/$/, "")}/repo-index/v4/shadow`,
@@ -25979,7 +26051,7 @@ function registerSecretsCommands(program3) {
 }
 
 // src/app-actor.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -26023,7 +26095,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto9.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto10.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -26508,12 +26580,20 @@ async function readOrFail(read) {
 async function defaultRegistryRead() {
   return fetchSchedulesList(registryClientDeps(await loadConfig()));
 }
-async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defaultRegistryRead, readProjects = defaultProjectsRead) {
-  const [gh, aws, registryRead, projectsRead] = await Promise.all([
+async function defaultRunVerdictRead() {
+  return fetchRunVerdicts(registryClientDeps(await loadConfig()));
+}
+function modelRoleKeyOf(row) {
+  const model = row.model;
+  return typeof model === "string" && model.trim() ? model : void 0;
+}
+async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defaultRegistryRead, readProjects = defaultProjectsRead, readRunVerdicts = defaultRunVerdictRead) {
+  const [gh, aws, registryRead, projectsRead, runVerdictRead] = await Promise.all([
     githubEntries(client),
     awsEntries(),
     readOrFail(readRegistry),
-    readOrFail(readProjects)
+    readOrFail(readProjects),
+    readOrFail(readRunVerdicts)
   ]);
   const readFailures = [];
   if (registryRead.state === "failed") {
@@ -26523,10 +26603,16 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
     readFailures.push(`registry: could not read the projects list \u2014 schedulesMode opt-outs unresolved (nothing suppressed) \u2014 ${projectsRead.error}`);
   }
   const registry2 = registryRead.state === "ok" ? registryRead.value : null;
+  const runVerdicts = runVerdictRead.state === "ok" ? runVerdictRead.value : null;
   const projects = projectsRead.state === "ok" ? projectsRead.value : null;
+  const decoratedAws = decorateAwsModel(
+    aws.entries,
+    registry2?.map((r) => ({ id: r.id, executor: r.executor, model: modelRoleKeyOf(r) })) ?? null,
+    runVerdicts
+  );
   const recon = assembleReconciliation(gh.entries, new Set(gh.readRepos), registry2, new Set(gh.workflowNames), {
     // #3286: the harbour side joins registry rows against the live aws-scheduler clocks by scheduleId.
-    awsEntries: aws.entries,
+    awsEntries: decoratedAws,
     schedulerRead: Boolean(aws.schedulerRead)
   }, new Set(gh.disabledWorkflowNames));
   const selfManaged = /* @__PURE__ */ new Set();
@@ -26540,7 +26626,7 @@ async function fetchNotebook(client = defaultGitHubClient(), readRegistry = defa
   );
   const driftLines = reconciliation.map(renderDrift);
   return {
-    entries: sortEntries([...gh.entries, ...aws.entries, ...DECLARED_ENTRIES]),
+    entries: sortEntries([...gh.entries, ...decoratedAws, ...DECLARED_ENTRIES]),
     incomplete: [...gh.incomplete, ...aws.incomplete, ...recon.incomplete, ...readFailures],
     drift: driftLines,
     reconciliation,
@@ -26937,7 +27023,7 @@ var import_node_os14 = require("node:os");
 var import_node_path32 = require("node:path");
 
 // src/bootstrap-drift.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -26957,7 +27043,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto10.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto11.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -27120,7 +27206,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -27133,7 +27219,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto11.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto12.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -29673,7 +29759,7 @@ function registerBoardCommands(program3) {
   const board = program3.command("board").description("read, claim, show, and move Project v2 work items for the current repo");
   board.command("read", { isDefault: true }).description("read the board and print user-owned, claimable, and taken items").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo (defaults to git origin)").option("--bundle-details", "fetch body/comments only for user-owned and claimable issues").option("--bodies", "fetch body/comments for EVERY scoped row, including taken and unowned in-flight ones \u2014 for consumers that scope by Status rather than ownership (#4861); implies --bundle-details and costs one extra read per row").option("--allow-partial", "return partial board results when later page/detail reads fail").addHelpText("after", "\nread is always the authoritative live GitHub Project v2 board (#4926).\n--allow-partial applies to the paginated path and detail reads.\n").action((o) => runBoardRead(o));
   withExamples(mutating(
-    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
+    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs)").addHelpText("after", "\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "board claim", issues: args[0] ?? [] })
   ).action(async (issueRefs, o) => {
     if (issueRefs.length === 1) {
@@ -30294,7 +30380,7 @@ async function checkDocsIndexAtHead(opts, deps) {
 
 // src/issue-commands.ts
 var import_node_fs38 = require("node:fs");
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var ghRunner = async (args, timeoutMs) => (await execFileP2("gh", args, { timeout: timeoutMs })).stdout;
 var ReparentConflictError = class extends Error {
   constructor(message, payload) {
@@ -30585,7 +30671,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto12.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto13.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -31217,7 +31303,23 @@ async function collectStatus() {
   } catch {
     stage = { running: false };
   }
-  return { repo, branch, worktrees, myOpenPrs, claimedItems, stage };
+  let releaseTrack;
+  let branches;
+  try {
+    const cfg = await loadConfigOrDiscover();
+    if (cfg.sagaApiUrl) {
+      const slug = await repoSlug();
+      const deps = registryClientDeps(cfg);
+      const read = await fetchProjectBySlugChecked(slug, deps);
+      if (read.ok && read.project) {
+        const trackRepo = repo ?? `mutmutco/${slug}`;
+        releaseTrack = resolveReleaseTrack(read.project, void 0, trackRepo);
+        branches = branchesForTrack(releaseTrack);
+      }
+    }
+  } catch {
+  }
+  return { repo, branch, releaseTrack, branches, worktrees, myOpenPrs, claimedItems, stage };
 }
 var PRIORITY_RANK = {
   Urgent: 0,
@@ -31362,6 +31464,9 @@ function registerDiscoveryCommands(program3) {
       } else {
         console.log(`repo: ${report.repo ?? "unknown"}`);
         console.log(`branch: ${report.branch}`);
+        if (report.releaseTrack) {
+          console.log(`release track: ${report.releaseTrack} (${(report.branches ?? []).join(" -> ")})`);
+        }
         console.log(`worktrees: ${report.worktrees.length} linked`);
         console.log(`my open PRs: ${report.myOpenPrs.length}`);
         console.log(`claimed board items: ${report.claimedItems.length}`);
@@ -37502,7 +37607,7 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
     title = buildSkillLessonTitle(skill, rawTitle);
     priority = resolveCreatePriority(o.priority, "skill-lesson");
     body = buildSkillLessonBody(rawBody, sourceRepo, pluginSha);
-    args = buildIssueArgs({ type: "task", title, body, priority, repo: targetRepo3, labels: [SKILL_LESSON_LABEL] });
+    args = buildIssueArgs({ type: "task", title, body, priority, repo: targetRepo3, labels: [...SKILL_LESSON_FILE_LABELS] });
   } catch (e) {
     return fail(`skill-lesson: ${e.message}`);
   }
@@ -37544,9 +37649,11 @@ program2.command("skill-lesson").description("file a skill-lesson on the Hub boa
   });
   if (surfaceWarn) process.stderr.write(`${surfaceWarn}
 `);
-  try {
-    await execFileP2("gh", ["label", "create", SKILL_LESSON_LABEL, "--color", "c2e0c6", "--repo", targetRepo3], { timeout: GH_MUTATION_TIMEOUT_MS });
-  } catch {
+  for (const [label, color] of [[SKILL_LESSON_LABEL, "c2e0c6"], [LEARNING_LABEL, "ededed"]]) {
+    try {
+      await execFileP2("gh", ["label", "create", label, "--color", color, "--repo", targetRepo3], { timeout: GH_MUTATION_TIMEOUT_MS });
+    } catch {
+    }
   }
   const created = await ghCreate(args);
   const { projectItemId, onBoard } = await attachToProject(created.number, targetRepo3, priority);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.0.1",
+  "version": "4.0.3",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",