@mutmutco/cli 4.3.56 → 4.3.58

package/dist/main.cjs

@@ -6046,6 +6046,15 @@ var REGISTRY_FETCH_TIMEOUT_MS = 8e3;
 init_fetch_retry();
 init_client_version();
 
+// ../shared/schedule-inventory.ts
+function classifyLlmValue(raw) {
+  const value = raw.trim().toLowerCase();
+  if (/^no\b|^none\b/.test(value)) return "no";
+  if (/^yes\b/.test(value)) return "yes";
+  if (/^embeddings\b/.test(value)) return "embeddings";
+  return "unknown";
+}
+
 // src/workflow-context.ts
 function parseWorkflowJobs(yaml) {
   const lines2 = yaml.split(/\r?\n/);
@@ -6324,25 +6333,10 @@ function resolvedLabel(entry, now) {
 var ORG = "mutmutco";
 var DOC_START_MARKER = "<!-- schedules:inventory:start -->";
 var DOC_END_MARKER = "<!-- schedules:inventory:end -->";
-function isJervResource(name) {
-  return /^jerv-memory(?:-|$)/i.test(name);
-}
 function llmFromHeader(yamlText) {
   const m = /^#\s*llm:\s*(.+)$/im.exec(yamlText);
   return m ? classifyLlmValue(m[1]) : "unknown";
 }
-function classifyLlmValue(raw) {
-  const value = raw.trim().toLowerCase();
-  if (/^no\b|^none\b/.test(value)) return "no";
-  if (/^yes\b/.test(value)) return "yes";
-  if (/^embeddings\b/.test(value)) return "embeddings";
-  return "unknown";
-}
-function readLlmDeclaration(text) {
-  if (!text) return "unknown";
-  const m = /\bllm:\s*(.+)/i.exec(text);
-  return m ? classifyLlmValue(m[1]) : "unknown";
-}
 function extractWorkflowCrons(yamlText) {
   const crons = [];
   for (const rawLine of yamlText.split("\n")) {
@@ -6366,126 +6360,6 @@ function workflowEntry(repo, workflowPath, yamlText) {
     harbourUnmanaged: isHarbourUnmanaged(yamlText)
   };
 }
-function awsRuleEntries(payload) {
-  if (!payload || typeof payload !== "object") {
-    throw new Error("aws events list-rules answered a non-object payload \u2014 refusing to read it as zero rules");
-  }
-  const { Rules: rules } = payload;
-  if (!Array.isArray(rules)) {
-    throw new Error("aws events list-rules answered no Rules array \u2014 refusing to read it as zero rules");
-  }
-  const entries = [];
-  for (const node of rules) {
-    if (!node || typeof node !== "object") {
-      throw new Error("aws events list-rules returned a non-object rule \u2014 refusing to read it as no rule");
-    }
-    const { Name, ScheduleExpression, State, Description } = node;
-    if (typeof Name !== "string") {
-      throw new Error("aws events list-rules returned a rule with no Name string \u2014 refusing to read it as no rule");
-    }
-    if (typeof ScheduleExpression !== "string") continue;
-    if (State !== "ENABLED" || isJervResource(Name)) continue;
-    entries.push({
-      name: Name,
-      cadence: ScheduleExpression,
-      executor: "aws-eventbridge-rule",
-      // An AWS rule declares `llm:` in its own Description (the shared convention) — a rule with no
-      // Description reads `unknown`, and stack-internal plumbing like the Lambda warmer should say
-      // `llm: no` there to go green.
-      llm: readLlmDeclaration(typeof Description === "string" ? Description : void 0),
-      resolved: "live",
-      source: `aws events rule ${Name} (eu-central-1)`
-    });
-  }
-  return entries;
-}
-function lambdaTargetFromArn(arn) {
-  const marker = ":function:";
-  const i = arn.indexOf(marker);
-  if (i < 0) return { functionName: arn.split(":").pop() ?? "" };
-  const rest = arn.slice(i + marker.length);
-  const q = rest.indexOf(":");
-  if (q < 0) return { functionName: rest };
-  return { functionName: rest.slice(0, q), qualifier: rest.slice(q + 1) };
-}
-function awsScheduleEntry(payload) {
-  if (!payload || typeof payload !== "object") {
-    throw new Error("aws scheduler get-schedule answered a non-object payload \u2014 refusing to read it as no schedule");
-  }
-  const { Name, ScheduleExpression, State, Target, Description, CreationDate } = payload;
-  if (typeof Name !== "string" || typeof ScheduleExpression !== "string") {
-    throw new Error("aws scheduler get-schedule answered no Name/ScheduleExpression strings \u2014 refusing to read it as no schedule");
-  }
-  if (State !== "ENABLED" || isJervResource(Name)) return null;
-  let target = "";
-  let qualifier;
-  let scheduleId;
-  if (Target && typeof Target === "object") {
-    const { Arn, Input } = Target;
-    if (typeof Arn === "string") {
-      const parsed = lambdaTargetFromArn(Arn);
-      target = parsed.functionName;
-      qualifier = parsed.qualifier;
-    }
-    if (typeof Input === "string") {
-      try {
-        const parsed = JSON.parse(Input);
-        if (typeof parsed?.scheduleId === "string" && parsed.scheduleId) scheduleId = parsed.scheduleId;
-      } catch {
-      }
-    }
-  }
-  const sourceBase = `aws scheduler schedule ${Name} (eu-central-1)`;
-  const source = qualifier && target ? `${sourceBase} \u2192 ${target}:${qualifier}` : sourceBase;
-  const armedAt = armedAtFromCreationDate(CreationDate);
-  return {
-    name: Name,
-    cadence: ScheduleExpression,
-    executor: target ? `aws-scheduler \u2192 ${target}` : "aws-scheduler",
-    llm: readLlmDeclaration(typeof Description === "string" ? Description : void 0),
-    resolved: "live",
-    source,
-    ...scheduleId ? { scheduleId } : {},
-    ...armedAt ? { armedAt } : {}
-  };
-}
-function armedAtFromCreationDate(creationDate) {
-  if (creationDate instanceof Date) {
-    return Number.isNaN(creationDate.getTime()) ? void 0 : creationDate.toISOString().slice(0, 10);
-  }
-  if (typeof creationDate === "string" && creationDate.trim()) {
-    const parsed = Date.parse(creationDate);
-    return Number.isNaN(parsed) ? void 0 : new Date(parsed).toISOString().slice(0, 10);
-  }
-  if (typeof creationDate === "number" && Number.isFinite(creationDate)) {
-    const ms = creationDate > 1e12 ? creationDate : creationDate * 1e3;
-    const date = new Date(ms);
-    return Number.isNaN(date.getTime()) ? void 0 : date.toISOString().slice(0, 10);
-  }
-  return void 0;
-}
-function awsScheduleRefs(payload) {
-  if (!payload || typeof payload !== "object") {
-    throw new Error("aws scheduler list-schedules answered a non-object payload \u2014 refusing to read it as zero schedules");
-  }
-  const { Schedules: schedules } = payload;
-  if (!Array.isArray(schedules)) {
-    throw new Error("aws scheduler list-schedules answered no Schedules array \u2014 refusing to read it as zero schedules");
-  }
-  const refs = [];
-  for (const s of schedules) {
-    if (!s || typeof s !== "object") {
-      throw new Error("aws scheduler list-schedules returned a non-object schedule \u2014 refusing to read it as no schedule");
-    }
-    const { Name, GroupName } = s;
-    if (typeof Name !== "string") {
-      throw new Error("aws scheduler list-schedules returned a schedule with no Name string \u2014 refusing to read it as no schedule");
-    }
-    if (isJervResource(Name)) continue;
-    refs.push(typeof GroupName === "string" && GroupName !== "default" && GroupName !== "" ? { name: Name, group: GroupName } : { name: Name });
-  }
-  return refs;
-}
 function decorateAwsModel(entries, registry2, verdicts) {
   if (!registry2 || registry2.length === 0) return [...entries];
   const rowById = new Map(registry2.map((r) => [r.id, r]));
@@ -6960,6 +6834,24 @@ async function fetchDeployFactsBySlug(slug, deps) {
     return null;
   }
 }
+async function fetchScheduleInventory(deps) {
+  try {
+    if (!deps.baseUrl) return null;
+    const token = await deps.token();
+    if (!token) return null;
+    const res = await retriedFetch(deps, `${deps.baseUrl.replace(/\/$/, "")}/schedules/inventory`, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (!body || !Array.isArray(body.entries) || !Array.isArray(body.incomplete) || !body.incomplete.every((v) => typeof v === "string") || typeof body.schedulerRead !== "boolean" || !body.schedulerRead && body.incomplete.length === 0) return null;
+    if (!body.entries.every((e) => e && typeof e.name === "string" && typeof e.cadence === "string" && typeof e.executor === "string" && typeof e.source === "string" && e.resolved === "live" && ["yes", "no", "embeddings", "unknown"].includes(e.llm) && (e.scheduleId === void 0 || typeof e.scheduleId === "string") && (e.armedAt === void 0 || typeof e.armedAt === "string"))) return null;
+    return body;
+  } catch {
+    return null;
+  }
+}
 async function fetchSchedulesList(deps) {
   if (!deps.baseUrl) return null;
   const token = await deps.token();
@@ -7071,6 +6963,9 @@ async function tenantReconcile(payload, deps) {
 async function tenantDeploy(payload, deps) {
   return postJson("/tenant-deploy", payload, deps, "POST", { noRetry: true, timeoutMs: TENANT_DEPLOY_TIMEOUT_MS });
 }
+async function releaseAnnouncement(payload, deps) {
+  return postJson("/release-announcement", payload, deps, "POST", { noRetry: true, timeoutMs: 3e4 });
+}
 async function actionsCanary(payload, deps) {
   return postJson("/actions-canary", payload, deps, "POST", { noRetry: true });
 }
@@ -15877,10 +15772,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.3.56",
-    tag: "v4.3.56",
-    commit: "497a375fabfc",
-    npm: "@mutmutco/cli@4.3.56"
+    version: "4.3.58",
+    tag: "v4.3.58",
+    commit: "aa4958ac3926",
+    npm: "@mutmutco/cli@4.3.58"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -15897,14 +15792,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.3.56"
+          v3Target: "v4.3.58"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.3.56 and redeploy the Hub Lambda from tag v4.3.56 (497a375fabfc); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.3.56 (@mutmutco/cli@4.3.56, tag commit 497a375fabfc \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.3.58 and redeploy the Hub Lambda from tag v4.3.58 (aa4958ac3926); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.3.58 (@mutmutco/cli@4.3.58, tag commit aa4958ac3926 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -26539,6 +26434,11 @@ function rcandVersionStep(targets) {
 function trainPlan(command, options = {}) {
   const isHub = options.repo?.toLowerCase() === "mutmutco/mmi-hub";
   const isDirect = options.releaseTrack === "direct" || options.releaseTrack === void 0 && isHub;
+  const authority = {
+    label: isHub ? "verify Hub master-admin train authority" : "verify project-admin or master train authority on this repo",
+    command: "mmi-cli oracle org access role <owner/repo> --json",
+    gated: true
+  };
   if (command === "rcand") {
     if (isDirect) {
       return [
@@ -26546,7 +26446,7 @@ function trainPlan(command, options = {}) {
       ];
     }
     return [
-      { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+      authority,
       { label: "verify current branch is development", gated: true },
       rcandVersionStep(options),
       { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -26559,7 +26459,7 @@ function trainPlan(command, options = {}) {
   if (command === "release") {
     if (isDirect) {
       return [
-        { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+        authority,
         { label: "verify current branch is development", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
         { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
@@ -26574,7 +26474,7 @@ function trainPlan(command, options = {}) {
     }
     if (options.dev) {
       return [
-        { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+        authority,
         { label: "verify current branch is development", gated: true },
         { label: "guard: refuse if origin/rc carries content not in development (a dev -> main release would drop it)", command: "git rev-list --count --right-only --cherry-pick --no-merges origin/development...origin/rc", gated: true },
         { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -26590,7 +26490,7 @@ function trainPlan(command, options = {}) {
       ];
     }
     return [
-      { label: "verify operator is a master-admin org owner", command: "gh api orgs/<owner>/memberships/<login> --jq .role", gated: true },
+      authority,
       { label: "verify current branch is rc", gated: true },
       { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
       { label: "preflight required main secret names", command: "mmi-cli vault secrets preflight --stage main --repo <owner/repo>", gated: true },
@@ -26605,6 +26505,7 @@ function trainPlan(command, options = {}) {
     ];
   }
   return [
+    authority,
     { label: "verify the fix is merged on development (the only hotfix origin)", gated: true },
     // #6068: hotfix start/release run the SAME shared preflight as release/rcand, before any git mutation.
     { label: "verify registry META for this project", command: "mmi-cli oracle org project get <owner/repo>", gated: true },
@@ -30114,7 +30015,7 @@ function buildSetDeployPatch(_slug, input) {
 }
 var DEPLOY_STAGE_BRANCH = { dev: "development", rc: "rc", main: "main" };
 function filelessTransitionGuide(repo, stage) {
-  const authority = stage === "main" ? "Authority: main is master-admin only." : "Authority: a project-admin may complete this for their own repo; master may also do it.";
+  const authority = "Authority: a project-admin may complete this for their own repo; master may also do it.";
   return [
     `Fileless transition for ${repo} (${stage}):`,
     `  ${authority}`,
@@ -35588,15 +35489,9 @@ function writeError(res) {
 
 // src/schedules-commands.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_child_process11 = require("node:child_process");
-var import_node_util6 = require("node:util");
 init_clean_exit();
 init_github_client();
 init_cli_shared();
-var execFileP4 = (0, import_node_util6.promisify)(import_node_child_process11.execFile);
-var AWS_REGION = "eu-central-1";
-var AWS_TIMEOUT_MS = 3e4;
-var AWS_RETRY_DELAY_MS = 1500;
 async function listWorkflows(client, repo) {
   const all = [];
   for (let page = 1; ; page += 1) {
@@ -35693,44 +35588,11 @@ async function githubEntries(client) {
   drift.push(...reconciliation.map(renderDrift));
   return { entries, incomplete, drift, reconciliation, readRepos, workflowNames: [...workflows.map((w) => w.name), ...unreadableNames], disabledWorkflowNames };
 }
-async function awsJson(args) {
-  const run = async () => {
-    const { stdout } = await execFileP4("aws", [...args, "--region", AWS_REGION, "--output", "json"], {
-      encoding: "utf8",
-      windowsHide: true,
-      timeout: AWS_TIMEOUT_MS
-    });
-    return JSON.parse(stdout);
-  };
-  try {
-    return await run();
-  } catch {
-    await new Promise((resolve7) => setTimeout(resolve7, AWS_RETRY_DELAY_MS));
-    return run();
-  }
-}
 async function awsEntries() {
-  const entries = [];
-  const incomplete = [];
-  try {
-    entries.push(...awsRuleEntries(await awsJson(["events", "list-rules"])));
-  } catch (e) {
-    incomplete.push(`aws: events list-rules failed \u2014 ${e.message}`);
-  }
-  let schedulerRead = false;
-  try {
-    const refs = awsScheduleRefs(await awsJson(["scheduler", "list-schedules"]));
-    for (const ref of refs) {
-      const args = ["scheduler", "get-schedule", "--name", ref.name, ...ref.group ? ["--group-name", ref.group] : []];
-      const entry = awsScheduleEntry(await awsJson(args));
-      if (entry) entries.push(entry);
-    }
-    schedulerRead = true;
-  } catch (e) {
-    incomplete.push(`aws: scheduler listing failed \u2014 ${e.message}`);
-  }
-  const reconciliation = unlauncheredLlmDrifts(entries);
-  return { entries, incomplete, drift: reconciliation.map(renderDrift), reconciliation, schedulerRead };
+  const inventory = await fetchScheduleInventory(registryClientDeps(await loadConfig()));
+  if (!inventory) return { entries: [], incomplete: ["aws: Hub schedule inventory unavailable or unauthenticated"], drift: [], reconciliation: [], schedulerRead: false };
+  const reconciliation = unlauncheredLlmDrifts(inventory.entries);
+  return { ...inventory, reconciliation, drift: reconciliation.map(renderDrift) };
 }
 async function readOrFail(read) {
   try {
@@ -36587,8 +36449,13 @@ async function resolveStageBuildSecrets(input) {
         out[envKey] = fromVault;
         continue;
       }
+      const fromGitHub = await input.githubToken?.();
+      if (fromGitHub) {
+        out[envKey] = fromGitHub;
+        continue;
+      }
       missing.push(
-        `${envKey}=${GITHUB_PACKAGES_TOKEN_REF} (central deploy mints this; local /stage needs process env ${envKey} or a stageless project vault secret ${envKey} \u2014 a GitHub PAT with read:packages for npm.pkg.github.com; declare+set via vault secrets, never commit the value)`
+        `${envKey}=${GITHUB_PACKAGES_TOKEN_REF} (sign in with gh auth login using a package-readable GitHub identity, or provide process env ${envKey} or stageless project vault secret ${envKey}; npm.pkg.github.com still requires package read permission)`
       );
       continue;
     }
@@ -36622,6 +36489,7 @@ async function fetchVaultRef(fetchVault, ref) {
 }
 
 // src/stage-commands.ts
+init_github_client();
 function registerStageCommands(program3) {
   function stagePortFromArgv() {
     const raw = rawValue("--port", "");
@@ -36681,7 +36549,8 @@ function registerStageCommands(program3) {
     const d = makeSecretsDeps(cfg);
     const merge = await resolveStageBuildSecrets({
       requiredBuildSecrets: required,
-      fetchVault: (key, opts) => fetchSecretValue(d, key, opts ?? {})
+      fetchVault: (key, opts) => fetchSecretValue(d, key, opts ?? {}),
+      githubToken
     });
     return Object.keys(merge).length ? merge : void 0;
   }
@@ -37083,7 +36952,7 @@ function renderVerifySecrets(body) {
 }
 
 // src/command-register-collaboration.ts
-var import_node_child_process16 = require("node:child_process");
+var import_node_child_process15 = require("node:child_process");
 var import_node_fs41 = require("node:fs");
 var import_promises7 = require("node:fs/promises");
 init_clean_exit();
@@ -37469,12 +37338,12 @@ function boardAdvanceFailureMessage(result) {
 }
 
 // src/test-policy-core.ts
-var import_node_child_process13 = require("node:child_process");
+var import_node_child_process12 = require("node:child_process");
 var import_node_fs35 = require("node:fs");
 var import_node_path33 = require("node:path");
 
 // src/test-command-policy-shared.mjs
-var import_node_child_process12 = require("node:child_process");
+var import_node_child_process11 = require("node:child_process");
 var TEST_COMMAND_CLASS = "test";
 var TRAILER_KEY = "Test-Policy-Override";
 var OVERRIDE_RE = /^Test-Policy-Override:\s*(.+)$/im;
@@ -37591,7 +37460,7 @@ function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, overrid
   };
 }
 function git(args, cwd) {
-  return (0, import_node_child_process12.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return (0, import_node_child_process11.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 function parseScope(value) {
   const scoped = /^\[([^\]]*)\]\s*([\s\S]*)$/.exec(value);
@@ -38090,14 +37959,14 @@ function evaluate(changed, policy, present = () => false) {
   return findings;
 }
 function git2(args, cwd) {
-  return (0, import_node_child_process13.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return (0, import_node_child_process12.execFileSync)("git", args, { windowsHide: true, cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 var COAUTHOR_KEY = "Co-authored-by";
 var GH_MESSAGE_SEPARATOR = /^-{5,}$/;
 var LIFTED_KEYS = new RegExp(`^(?:${TRAILER_KEY}|${COAUTHOR_KEY}):`, "i");
 function parseTrailers(message2, cwd) {
   try {
-    return (0, import_node_child_process13.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
+    return (0, import_node_child_process12.execFileSync)("git", ["interpret-trailers", "--parse", "--unfold"], {
       windowsHide: true,
       cwd,
       input: message2,
@@ -38853,7 +38722,7 @@ function postMergeReconWarnings(input) {
 }
 
 // src/review-verdict.ts
-var import_node_child_process14 = require("node:child_process");
+var import_node_child_process13 = require("node:child_process");
 var import_node_fs38 = require("node:fs");
 var import_node_os19 = require("node:os");
 var import_node_path36 = require("node:path");
@@ -38953,8 +38822,8 @@ async function checkPrReview(number, repo, head, deps = {
 }
 function computePrPatchId(number, repo) {
   return new Promise((resolve7, reject) => {
-    const gh = (0, import_node_child_process14.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
-    const git3 = (0, import_node_child_process14.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+    const gh = (0, import_node_child_process13.spawn)("gh", ["pr", "diff", number, "--repo", repo], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    const git3 = (0, import_node_child_process13.spawn)("git", ["patch-id", "--stable"], { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
     let out = "";
     let ghErr = "";
     let gitErr = "";
@@ -39036,7 +38905,7 @@ async function postPrCommentFromFile(number, repo, body) {
 }
 
 // src/pr-create-docs-check.ts
-var import_node_child_process15 = require("node:child_process");
+var import_node_child_process14 = require("node:child_process");
 init_cli_shared();
 var GIT_TIMEOUT_MS2 = 15e3;
 function catFileBatch(root, ref, paths) {
@@ -39044,7 +38913,7 @@ function catFileBatch(root, ref, paths) {
   return new Promise((resolve7) => {
     const chunks = [];
     let settled = false;
-    const child2 = (0, import_node_child_process15.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
+    const child2 = (0, import_node_child_process14.spawn)("git", ["-C", root, "cat-file", "--batch", "--buffer"], { windowsHide: true });
     const finish = () => {
       if (settled) return;
       settled = true;
@@ -40191,7 +40060,7 @@ function scheduleRelatedDiscovery(o) {
   try {
     const args = ["issue", "discover-related", "--number", String(o.number), "--title", o.title, "--body", o.body, "--fail-soft"];
     if (o.repo) args.push("--repo", o.repo);
-    spawnDetachedSelf(args, { spawn: import_node_child_process16.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
+    spawnDetachedSelf(args, { spawn: import_node_child_process15.spawn, execPath: process.execPath, scriptPath: process.argv[1] }, { cwd: process.cwd() });
   } catch {
   }
 }
@@ -41887,7 +41756,7 @@ ${SSH_RECIPE_AGENT_NOTE}`);
 }
 
 // src/dist-drift.ts
-var import_node_child_process17 = require("node:child_process");
+var import_node_child_process16 = require("node:child_process");
 var import_node_crypto13 = require("node:crypto");
 var import_node_fs44 = require("node:fs");
 var import_node_os20 = require("node:os");
@@ -42032,7 +41901,7 @@ function bomPathFor(root) {
   }
 }
 function rebuildTo(packageRoot, outDir) {
-  (0, import_node_child_process17.execFileSync)(process.execPath, ["build.mjs"], {
+  (0, import_node_child_process16.execFileSync)(process.execPath, ["build.mjs"], {
     cwd: packageRoot,
     env: { ...process.env, MMI_DIST_OUTDIR: outDir },
     windowsHide: true,
@@ -42259,7 +42128,7 @@ function registerSchedulesLiftCommand(program3, deps = {}) {
 }
 
 // src/spawn-policy-core.ts
-var import_node_child_process18 = require("node:child_process");
+var import_node_child_process17 = require("node:child_process");
 var import_node_fs45 = require("node:fs");
 var import_node_path43 = require("node:path");
 var SPAWNERS = ["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"];
@@ -42330,7 +42199,7 @@ function findViolationsInSource(raw) {
   return found;
 }
 function policedFiles(root) {
-  const r = (0, import_node_child_process18.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
+  const r = (0, import_node_child_process17.spawnSync)("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     encoding: "utf8",
     windowsHide: true,
@@ -42636,50 +42505,6 @@ init_house_map();
 // src/hotfix-apply.ts
 var import_promises9 = require("node:fs/promises");
 
-// src/slack-alert.ts
-var SSM_REGION = "eu-central-1";
-var SSM_TOKEN_PARAM = "/mmi-future/_org/slack/SLACK_BOT_TOKEN";
-var SSM_CHANNEL_PARAM = "/mmi-future/_org/slack/SLACK_ALERTS_CHANNEL";
-var SLACK_TIMEOUT_MS = 1e4;
-async function readSsmParameter(deps, name, decrypt) {
-  const args = [
-    "ssm",
-    "get-parameter",
-    "--region",
-    SSM_REGION,
-    "--name",
-    name,
-    "--query",
-    "Parameter.Value",
-    "--output",
-    "text",
-    ...decrypt ? ["--with-decryption"] : []
-  ];
-  const value = (await deps.run("aws", args)).trim();
-  if (!value || value === "None") throw new Error(`SSM parameter ${name} is empty`);
-  return value;
-}
-async function postToChannel(deps, channel, text) {
-  const resolved = channel.trim();
-  if (!resolved || resolved === "None") throw new Error("no Slack channel resolved");
-  const token = await readSsmParameter(deps, SSM_TOKEN_PARAM, true);
-  const fetchImpl = deps.fetchImpl ?? fetch;
-  const res = await fetchImpl("https://slack.com/api/chat.postMessage", {
-    method: "POST",
-    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json; charset=utf-8" },
-    body: JSON.stringify({ channel: resolved, text, unfurl_links: false }),
-    signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
-  });
-  const json = await res.json().catch(() => ({}));
-  if (!json.ok) throw new Error(`slack postMessage failed: ${json.error ?? `http ${res.status}`}`);
-  return { status: "posted", note: "posted" };
-}
-async function postToAlertsChannel(deps, text) {
-  const channel = await readSsmParameter(deps, SSM_CHANNEL_PARAM, false);
-  await postToChannel(deps, channel, text);
-  return { status: "posted", note: "posted to the alerts channel" };
-}
-
 // src/release-announce.ts
 var ANNOUNCE_REPO = "mutmutco/MMI-Hub";
 var MAX_BULLETS = 6;
@@ -42786,12 +42611,6 @@ async function announceRelease(deps, args) {
     if (args.summaryFile) {
       if (!deps.readFile) throw new Error("summary file given but deps.readFile is missing");
       lines2 = summaryFileLines(await deps.readFile(args.summaryFile), neutralize);
-      if (deps.removeFile) {
-        try {
-          await deps.removeFile(args.summaryFile);
-        } catch {
-        }
-      }
     }
     if (lines2.length === 0) {
       if (target.kind !== "alerts") {
@@ -42807,12 +42626,16 @@ async function announceRelease(deps, args) {
       releaseUrl,
       ...target.kind === "channel" ? { language: target.language } : {}
     });
-    if (target.kind === "alerts") {
-      await postToAlertsChannel(deps, text);
-      return { status: "announced", note: `announced ${args.tag} to the alerts channel` };
+    const delivery = await deps.postAnnouncement({ repo: args.repo, tag: args.tag, text });
+    if (delivery === "skipped") return { status: "skipped", note: missingChannelNote(args.repo) };
+    if (args.summaryFile && deps.removeFile) {
+      try {
+        await deps.removeFile(args.summaryFile);
+      } catch {
+      }
     }
-    await postToChannel(deps, target.channel, text);
-    return { status: "announced", note: `announced ${args.tag} to the project release channel` };
+    const destination = target.kind === "alerts" ? "alerts channel" : "project release channel";
+    return { status: "announced", note: `${delivery === "already-posted" ? "already announced" : "announced"} ${args.tag} to the ${destination}` };
   } catch (e) {
     return { status: "failed", note: `announce failed (release unaffected): ${e.message}` };
   }
@@ -43939,12 +43762,12 @@ async function findInFlightHotfixVersion(deps, ctx, latestMainTag, workflows = H
 }
 
 // src/hotfix-coverage.ts
-var import_node_child_process19 = require("node:child_process");
+var import_node_child_process18 = require("node:child_process");
 var CHERRY_TRAILER = /\(cherry picked from commit ([0-9a-f]{7,40})\)/g;
 function checkHotfixCoverage(options = {}) {
   const { cwd = process.cwd(), mainRef = "origin/main", rcRef = "origin/rc", manifestPaths = [] } = options;
   const ack = (options.ack ?? []).filter(Boolean);
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process19.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process18.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const revList = (range) => {
     const out = git3(["rev-list", "--no-merges", range]).trim();
     return out ? out.split("\n") : [];
@@ -44012,7 +43835,7 @@ function checkHotfixCoverage(options = {}) {
 }
 function checkHotfixCarries(options) {
   const { cwd = process.cwd(), branch, baseRef, targets } = options;
-  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process19.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
+  const git3 = options.git ?? ((args, opts) => (0, import_node_child_process18.execFileSync)("git", args, { cwd, encoding: "utf8", input: opts?.input, stdio: ["pipe", "pipe", "pipe"] }));
   const isAncestor = (sha, ref) => {
     try {
       git3(["merge-base", "--is-ancestor", sha, ref]);
@@ -44282,6 +44105,15 @@ function trainApplyDeps() {
     // registry releaseChannel META for a product repo — best-effort inside announceRelease itself.
     announce: (args) => announceRelease({
       run: async (file, cmdArgs) => (await execFileP(file, cmdArgs, { timeout: GH_TRAIN_TIMEOUT_MS })).stdout,
+      postAnnouncement: async (payload) => {
+        const res = await releaseAnnouncement(payload, registryClientDeps(await loadConfig()));
+        const body = res.body;
+        if (!res.ok) throw new Error(body?.error ?? `Hub announcement failed (HTTP ${res.status}); verify delivery before retrying`);
+        if (body?.ok !== true || body.status !== "posted" && body?.status !== "already-posted" && body?.status !== "skipped") {
+          throw new Error("Hub announcement returned an unverified delivery result; do not resend");
+        }
+        return body.status;
+      },
       readFile: (path2) => (0, import_promises10.readFile)(path2, "utf8"),
       removeFile: (path2) => (0, import_promises10.unlink)(path2),
       // #6521/#6523: the project's own release channel AND releaseLanguage, read from registry META in ONE
@@ -44573,7 +44405,7 @@ function registerTrainCommandsAndInventory(program3) {
 }
 function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
   for (const commandName of ["rcand", "release"]) {
-    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit master-admin approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded master-only train after explicit approval").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
+    const trainCmd = program3.command(commandName).description(`plan ${commandName} train operations; mutations require explicit project-admin or master approval`).option("--json", "machine-readable output").option("--watch", "block on the deploy/publish workflow runs and report their outcomes").option("--apply", "execute the guarded repo-authorized train after explicit approval (Hub: master only)").option("--resume", commandName === "rcand" ? "finish a candidate whose immutable public rc tag passed policy but origin/rc was not pushed (#3881)" : "finish a partial release or its protected post-release alignment without re-cutting, republishing, or redeploying (#3851/#3885)").option("--out <path>", "write the terminal result (--apply, --resume, --abort, --retry-publish) to this file as UTF-8 (no BOM) instead of stdout \u2014 the shell-free receipt path (#5983/#6068)");
     const RELEASE_ONLY_FLAGS = [
       { flags: "--announce-summary-file <path>", description: "agent-curated 3-6 line release Slack summary; required for a new MMI-Hub --apply (#883/#3901) and for a product repo whose registry META sets `releaseChannel` (#6523), in its `releaseLanguage`; nothing is posted to a project channel without it" },
       { flags: "--ack <shas>", description: "comma-separated dev shas a human verified are in the candidate, overriding the hotfix-coverage guard for a conflicted port whose -x trailer was lost (#958)" },
@@ -45914,8 +45746,8 @@ ${filelessTransitionGuide(target, o.stage)}`
   }
   return reportWrite("org project set-deploy", res);
 });
-var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for your own repo's dev/rc stages (#5316, #5308) \u2014 new-task-only, dev/rc-only; editing an existing task or declaring a main-stage task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description('register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on dev/rc. Body shape {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 stages limited to dev/rc here; artifact "required" tasks must carry {artifact} in the command argv.').option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
+projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.3.56",
+  "version": "4.3.58",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",