@mutmutco/cli 4.3.55 → 4.3.57

package/dist/main.cjs

@@ -15877,10 +15877,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.55",
-    tag: "v4.3.55",
-    commit: "7f7f602ac9bc",
-    npm: "@mutmutco/cli@4.3.55"
+    version: "4.3.57",
+    tag: "v4.3.57",
+    commit: "b988569fdfe3",
+    npm: "@mutmutco/cli@4.3.57"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15897,14 +15897,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.55"
+          v3Target: "v4.3.57"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.55 and redeploy the Hub Lambda from tag v4.3.55 (7f7f602ac9bc); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.55 (@mutmutco/cli@4.3.55, tag commit 7f7f602ac9bc \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.57 and redeploy the Hub Lambda from tag v4.3.57 (b988569fdfe3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.57 (@mutmutco/cli@4.3.57, tag commit b988569fdfe3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -18916,6 +18916,21 @@ function prodReleaseTargets(model) {
   if (model === "registry-publish") return [{ workflow: "publish.yml", event: "release" }];
   return [];
 }
+function trainObservesShipment(model) {
+  return isCentralDispatchModel(model) || prodReleaseTargets(model).length > 0;
+}
+function shipLegsGreen(deploy, publish) {
+  const green = (s) => s === "complete" || s === "skipped";
+  return green(deploy?.state) && green(publish?.state);
+}
+async function announceShippedRelease(deps, args, model, legs, deferred) {
+  if (!deps.announce) return void 0;
+  if (trainObservesShipment(model) && !shipLegsGreen(legs.deploy, legs.publish)) {
+    const failed = legs.deploy.state === "failed" || legs.publish.state === "failed";
+    return `not announced: deploy/publish ${failed ? "FAILED" : "not proven green"} \u2014 ${deferred}`;
+  }
+  return (await deps.announce(args)).note;
+}
 async function listTargetRun(deps, repo, target, headSha) {
   let rows;
   try {
@@ -22836,6 +22851,9 @@ async function recordRcandDeployLegs(ledger, deps, anchors, deployModel, d, opts
   await recordPhase(ledger, deps, anchors, "alignment", phaseEntry({ state: "skipped", sha, note: "rcand aligns no branch \u2014 alignment rides the release" }), { ...opts, landed });
   return dispatch;
 }
+function releaseAnnounceDeferral(model, summaryFile) {
+  return prodReleaseTargets(model).length > 0 ? `\`mmi-cli devops release --resume --watch${summaryFile ? ` --announce-summary-file ${summaryFile}` : ""}\` announces it once they are green` : "a central deploy is proven only under --watch, so this release stays unannounced";
+}
 async function completeMainRelease(deps, ctx, meta, deployModel, watch, options, tag, releaseSha, startBranch, preFold, tagProbe, branchHints, ledger, alignEarly) {
   const resumeCommand = options.dev ? "mmi-cli devops release --dev --apply" : "mmi-cli devops release --apply";
   const ledgerAnchors = { repo: ctx.repo, tag, tagSha: releaseSha };
@@ -22940,13 +22958,12 @@ ${recovery.note}`), recoveryInput);
     throw partialTrainRecoveryError(e, recoveryInput);
   }
   await recordPhase(ledger, deps, ledgerAnchors, "promotion", phaseEntry({ state: "complete", sha: releaseSha, note: `immutable ${tag} pushed at ${releaseSha.slice(0, 12)}; origin/main fast-forwarded to it` }), { landed: "the immutable tag and the green required-check wall" });
-  deps.warn?.("Release: Creating the release announcement");
+  deps.warn?.("Release: Creating the GitHub Release");
+  const autoRunSince = (deps.now ?? Date.now)();
   const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
-  const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   let alignment = alignEarly ? await alignEarly() : void 0;
-  const autoRunSince = (deps.now ?? Date.now)();
   const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, releaseSha, "report", meta.publishDir);
   const deployRunRepo = releaseRunRepoFor(deployModel, ctx.repo);
   const failedReleaseRun = deployDispatch0.workflowRuns?.find((run) => run.conclusion === "failure");
@@ -22965,7 +22982,8 @@ ${recovery.note}`), recoveryInput);
     }
   );
   const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, recoveredDeployDispatch);
-  await recordPhase(ledger, deps, ledgerAnchors, "deploy", phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha })), {
+  const deployLeg = phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha }));
+  await recordPhase(ledger, deps, ledgerAnchors, "deploy", deployLeg, {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
   const publishDispatch0 = deployDispatch.deployStatus === "success" ? await dispatchPublishIfRequired(deps, ctx, meta, deployModel, "main", tag, watch, "report") : null;
@@ -22981,21 +22999,30 @@ ${recovery.note}`), recoveryInput);
   if (!publishDispatch && deployDispatch.deployStatus !== "success" && meta.publishRequired && (deployModel === "tenant-container" || deployModel === "solo-container")) {
     publishSkipNote = deployDispatch.deployStatus === "failure" ? "box deploy failed - redeploy the box before publishing" : "box deploy not confirmed (run with --watch) - publish after the box deploy lands";
   }
-  await recordPhase(ledger, deps, ledgerAnchors, "publish", phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, {
+  const publishLeg = phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, {
     releaseSha,
     repo: ctx.repo,
     ...publishSkipNote !== void 0 ? { skipPublishNote: publishSkipNote } : {}
-  })), {
+  }));
+  await recordPhase(ledger, deps, ledgerAnchors, "publish", publishLeg, {
     landed: "the immutable tag, the green required-check wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
   let dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
   if (publishSkipNote) dispatch = { ...dispatch, note: `${dispatch.note}; tenant-publish.yml skipped (${publishSkipNote})` };
+  const announcing = announceShippedRelease(
+    deps,
+    { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
+    deployModel,
+    { deploy: deployLeg, publish: publishLeg },
+    releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
+  );
   if (watch && alignment) {
     alignment = {
       dev: await awaitAlignmentLanded(deps, ctx, alignment.dev, "development"),
       ...alignment.rc ? { rc: await awaitAlignmentLanded(deps, ctx, alignment.rc, "rc") } : {}
     };
   }
+  const announceNote = await announcing;
   return { checks, releaseUrl, announceNote, dispatch, ledgerAnchors, ...alignment ? { alignment } : {} };
 }
 function resumeStateOf(status) {
@@ -23243,6 +23270,7 @@ async function runReleaseResumePipeline(deps, options, prepared) {
 Live origin/tag/Release proof stays authoritative; nothing was written. Inspect ${ledger.path} before retrying.`
     );
   }
+  const shippedBefore = shipLegsGreen(persisted?.phases.deploy, persisted?.phases.publish);
   if (persisted?.lane && persisted.lane !== "release") {
     throw new Error(`release --resume refused: the ${tag} ledger belongs to the ${persisted.lane} lane \u2014 finish it with ${ledgerLaneResumeCommand(persisted)} (#6068). Nothing was written.`);
   }
@@ -23299,8 +23327,8 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       deployStatus: historicalDeploy,
       workflowRuns: historicalRows
     });
+    const phaseInputs = phaseInputsFromRunRows(deployModel, dispatch2.workflowRuns ?? historicalRows, tagSha, { repo: ctx.repo });
     if (persisted) {
-      const phaseInputs = phaseInputsFromRunRows(deployModel, dispatch2.workflowRuns ?? historicalRows, tagSha, { repo: ctx.repo });
       if (persisted.phases.deploy.superseded !== true) {
         await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(phaseInputs.deploy), { strict: true, landed: "the verified GitHub Release and origin/main at the immutable tag SHA" });
       }
@@ -23309,6 +23337,13 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: "re-verified live: origin/main contains the immutable tag SHA" }), { strict: true, landed: "nothing beyond the already-public release" });
     }
     if (isJervHubRepo(ctx.repo)) steps2.push(dispatch2.note);
+    const announceNote2 = persisted && !shippedBefore && persisted.phases.deploy.superseded !== true && prodReleaseTargets(deployModel).length > 0 ? await announceShippedRelease(
+      deps,
+      { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
+      deployModel,
+      phaseInputs,
+      releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
+    ) : void 0;
     if (persisted) {
       await recordPhase(ledger, deps, anchors, "alignment", phaseEntry(alignmentPhaseEntry(devRollForward2, rcAlignment2)), { strict: true, landed: "the released, verified, deploy-resolved release (alignment PRs reused/landed)" });
     }
@@ -23326,6 +23361,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       state: state2,
       resumed: true,
       steps: steps2,
+      ...announceNote2 ? { announceNote: announceNote2 } : {},
       devRollForward: devRollForward2,
       rcAlignment: rcAlignment2,
       dispatch: dispatch2,
@@ -23382,16 +23418,15 @@ ${recovery.note}`), recoveryInput);
   await runGitPush(deps, ["push", "origin", `${tagSha}:refs/heads/main`]);
   steps.push(`pushed ${tagSha.slice(0, 12)} to origin/main`);
   await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
-  deps.warn?.("Release: Creating the release announcement");
+  deps.warn?.("Release: Creating the GitHub Release");
+  const autoRunSince = (deps.now ?? Date.now)();
   const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   steps.push(`created the GitHub Release for ${tag}`);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
   steps.push("verified the Release published against the tagged commit");
   await recordPhase(ledger, deps, anchors, "githubRelease", phaseEntry({ state: "complete", sha: tagSha, runUrl: releaseUrl, note: "verified the Release published against the tagged commit" }), { strict: ledgerMode === "strict", landed: "the immutable tag, the re-proven wall, and the origin/main push" });
-  const announceNote = deps.announce ? (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note : void 0;
   let devRollForward = await rollDevelopmentForward(deps, ctx, tag);
   let rcAlignment = !directTrack && branchHints.hasRcBranch ? await alignRcForward(deps, ctx, tag) : void 0;
-  const autoRunSince = (deps.now ?? Date.now)();
   const deployDispatch0 = await dispatchDeploy(deps, ctx, "main", "main", deployModel, watch, autoRunSince, tagSha, "report", meta.publishDir);
   const recoveredDeployDispatch = await recoverFailedDispatchPhase(
     deps,
@@ -23408,7 +23443,8 @@ ${recovery.note}`), recoveryInput);
   );
   const deployDispatch = await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch);
   steps.push(`dispatched the ${deployModel} deploy path`);
-  await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha })), {
+  const deployLeg = phaseEntry(deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
+  await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
     strict: ledgerMode === "strict",
     landed: "the immutable tag, the re-proven wall, the origin/main push, and the verified GitHub Release"
   });
@@ -23421,15 +23457,24 @@ ${recovery.note}`), recoveryInput);
     publishDispatch0,
     { repo: releaseRunRepoFor(deployModel, ctx.repo), sha: tagSha, watched: isCentralDispatchModel(deployModel), workflow: isCentralDispatchModel(deployModel) ? "tenant-publish.yml" : "publish.yml" }
   ) : null;
-  await recordPhase(ledger, deps, anchors, "publish", phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo })), {
+  const publishLeg = phaseEntry(publishPhaseInput(deployModel, deployDispatch, publishDispatch, meta.publishRequired === true, { releaseSha: tagSha, repo: ctx.repo }));
+  await recordPhase(ledger, deps, anchors, "publish", publishLeg, {
     strict: ledgerMode === "strict",
     landed: "the immutable tag, the re-proven wall, origin/main, the verified GitHub Release, and the dispatched deploy path"
   });
   const dispatch = appendPublishDispatch(deployDispatch, publishDispatch);
+  const announcing = announceShippedRelease(
+    deps,
+    { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
+    deployModel,
+    { deploy: deployLeg, publish: publishLeg },
+    releaseAnnounceDeferral(deployModel, options.announceSummaryFile)
+  );
   if (watch) {
     devRollForward = await awaitAlignmentLanded(deps, ctx, devRollForward, "development");
     if (rcAlignment) rcAlignment = await awaitAlignmentLanded(deps, ctx, rcAlignment, "rc");
   }
+  const announceNote = await announcing;
   steps.push(`development roll-forward: ${devRollForward.status}`);
   if (rcAlignment) steps.push(`rc alignment: ${rcAlignment.status}`);
   const followUp = deriveTrainFollowUpStatus({
@@ -26494,6 +26539,11 @@ function rcandVersionStep(targets) {
 function trainPlan(command, options = {}) {
   const isHub = options.repo?.toLowerCase() === "mutmutco/mmi-hub";
   const isDirect = options.releaseTrack === "direct" || options.releaseTrack === void 0 && isHub;
+  const authority = {
+    label: isHub ? "verify Hub master-admin train authority" : "verify project-admin or master train authority on this repo",
+    command: "mmi-cli oracle org access role <owner/repo> --json",
+    gated: true
+  };
   if (command === "rcand") {
     if (isDirect) {
       return [
@@ -26501,7 +26551,7 @@ function trainPlan(command, options = {}) {
       ];
     }
     return [
-      { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+      authority,
       { label: "verify current branch is development", gated: true },
       rcandVersionStep(options),
       { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -26514,7 +26564,7 @@ function trainPlan(command, options = {}) {
   if (command === "release") {
     if (isDirect) {
       return [
-        { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+        authority,
         { label: "verify current branch is development", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
@@ -26529,7 +26579,7 @@ function trainPlan(command, options = {}) {
     }
     if (options.dev) {
       return [
-        { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+        authority,
         { label: "verify current branch is development", gated: true },
         { label: "guard: refuse if origin/rc carries content not in development (a dev -> main release would drop it)", command: "git rev-list --count --right-only --cherry-pick --no-merges origin/development...origin/rc", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -26545,7 +26595,7 @@ function trainPlan(command, options = {}) {
       ];
     }
     return [
-      { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+      authority,
       { label: "verify current branch is rc", gated: true },
       { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
       { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
@@ -26560,6 +26610,7 @@ function trainPlan(command, options = {}) {
     ];
   }
   return [
+    authority,
     { label: "verify the fix is merged on development (the only hotfix origin)", gated: true },
     // #6068: hotfix start/release run the SAME shared preflight as release/rcand, before any git mutation.
     { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -30069,7 +30120,7 @@ function buildSetDeployPatch(_slug, input) {
 }
 var DEPLOY_STAGE_BRANCH = { dev: "development", rc: "rc", main: "main" };
 function filelessTransitionGuide(repo, stage) {
-  const authority = stage === "main" ? "Authority: main is master-admin only." : "Authority: a project-admin may complete this for their own repo; master may also do it.";
+  const authority = "Authority: a project-admin may complete this for their own repo; master may also do it.";
   return [
     `Fileless transition for ${repo} (${stage}):`,
     `  ${authority}`,
@@ -43473,15 +43524,11 @@ ${decision.note}`);
   );
   await recordHotfixPhase(ledger, anchors, "promotion", { state: "complete", sha: mergedSha, note: `immutable ${tag} pushed at ${mergedSha.slice(0, 12)}; origin/main already carries it (merged hotfix PR #${pr.number})` }, "the immutable tag and the green required-check wall");
   let releaseNote;
-  let announceNote;
   if (releaseExists) {
     releaseNote = `Release ${tag} already exists \u2014 resumed without recreating`;
   } else {
     await deps.run("gh", ["release", "create", tag, "--repo", ctx.repo, "--target", "main", "--generate-notes", "--latest"]);
     releaseNote = `Release ${tag} created (target main)`;
-    if (deps.announce) {
-      announceNote = (await deps.announce({ repo: ctx.repo, tag, summaryFile: options.announceSummaryFile })).note;
-    }
   }
   await recordHotfixPhase(ledger, anchors, "githubRelease", { state: "complete", sha: mergedSha, note: releaseNote }, "the immutable tag, the green wall, and origin/main");
   const runs = [];
@@ -43554,6 +43601,13 @@ ${decision.note}`);
   );
   await recordHotfixPhase(ledger, anchors, "deploy", ledgerInputs.deploy, "the immutable tag, the green wall, origin/main, and the GitHub Release");
   await recordHotfixPhase(ledger, anchors, "publish", ledgerInputs.publish, "the immutable tag, the green wall, origin/main, the GitHub Release, and the deploy path");
+  const announceNote = releaseExists ? void 0 : await announceShippedRelease(
+    deps,
+    { repo: ctx.repo, tag, summaryFile: options.announceSummaryFile },
+    deployModel,
+    ledgerInputs,
+    "a hotfix is announced only by the run that proves it shipped, so this one stays unannounced"
+  );
   let verifyNote;
   if (deployModel === "hub-serverless") {
     const previousRef = clean3(await deps.run("git", ["rev-parse", "--abbrev-ref", "HEAD"]));
@@ -44525,7 +44579,7 @@ function registerTrainCommandsAndInventory(program3) {
 }
 function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   for (const commandName of ["rcand", "release"]) {
-    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit master-admin approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded master-only train after explicit approval").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
+    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit project-admin or master approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded repo-authorized train after explicit approval (Hub: master only)").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
     const RELEASE_ONLY_FLAGS = [
       { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line release Slack summary; required for a new MMI-Hub --apply (#883/#3901) and for a product repo whose registry META sets `releaseChannel` (#6523), in its `releaseLanguage`; nothing is posted to a project channel without it" },
       { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
@@ -45866,8 +45920,8 @@ ${filelessTransitionGuide(target, o.stage)}`
   }
   return reportWrite("org project set-deploy", res);
 });
-var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for your own repo's dev/rc stages (#5316, #5308) \u2014 new-task-only, dev/rc-only; editing an existing task or declaring a main-stage task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description('register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on dev/rc. Body shape {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 stages limited to dev/rc here; artifact "required" tasks must carry {artifact} in the command argv.').option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
+projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.55",
+  "version": "4.3.57",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",