@mutmutco/cli 4.5.45 → 4.5.47

package/dist/main.cjs

@@ -14365,6 +14365,9 @@ async function activateProductRuleset(repo, rulesetBody, client, enforcement = "
   return { action: "created", enforcement };
 }
 
+// src/bootstrap-apply.ts
+var import_node_crypto5 = require("node:crypto");
+
 // src/bootstrap-seeds.ts
 var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
 function loadBootstrapSeeds(manifestJson) {
@@ -15593,6 +15596,32 @@ function planSeedAction(seed, exists) {
   }
   return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
 }
+var GATE_RENDER_NOTE = "# Rendered from the registry gate config by mmi-cli devops bootstrap apply <repo> --only gate.yml --from-config; edit the config, not this file.\n";
+var gateHash = (body) => (0, import_node_crypto5.createHash)("sha256").update(body, "utf8").digest("hex");
+function parseGateRenderStamp(content) {
+  const match = /^# mmi-gate-render: sha256=([a-f0-9]{64})\n/.exec(content);
+  return match ? { hash: match[1], body: content.slice(match[0].length) } : null;
+}
+function verifyGateRenderStamp(content) {
+  const stamp = parseGateRenderStamp(content);
+  return stamp !== null && stamp.body.startsWith(GATE_RENDER_NOTE) && gateHash(stamp.body) === stamp.hash;
+}
+function stampGateRender(rendered) {
+  const body = GATE_RENDER_NOTE + rendered;
+  return `# mmi-gate-render: sha256=${gateHash(body)}
+${body}`;
+}
+function planGateFromConfig(current, rendered) {
+  const target = ".github/workflows/gate.yml";
+  const base = { target, ownership: "repo" };
+  if (current === null) return { ...base, action: "create", reason: "registry gate config; review via branch + PR" };
+  const stamp = parseGateRenderStamp(current);
+  if (stamp) {
+    if (!verifyGateRenderStamp(current)) return { ...base, action: "skip", refused: true, reason: "REFUSED: stamped gate was hand-edited since its last render (diff below)" };
+    return stamp.body === GATE_RENDER_NOTE + rendered ? { ...base, action: "skip", reason: "already current from registry gate config" } : { ...base, action: "update", reason: "registry gate config changed; update stamped gate via branch + PR" };
+  }
+  return current === rendered ? { ...base, action: "update", reason: "adopt legacy gate: add registry render stamp via branch + PR" } : { ...base, action: "skip", refused: true, reason: "REFUSED: unstamped gate differs from registry render; make the registry config reproduce the file first, then re-run to adopt (diff below)" };
+}
 function reconcileSeedAction(action, content, isManagedBlock, remoteContent = null) {
   if (action.action === "skip") return action;
   if (content == null) {
@@ -17014,10 +17043,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.45",
-    tag: "v4.5.45",
-    commit: "f66545d593d2",
-    npm: "@mutmutco/cli@4.5.45"
+    version: "4.5.47",
+    tag: "v4.5.47",
+    commit: "d8722f771c7d",
+    npm: "@mutmutco/cli@4.5.47"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17034,14 +17063,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.45"
+          v3Target: "v4.5.47"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.45 and redeploy the Hub Lambda from tag v4.5.45 (f66545d593d2); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.45 (@mutmutco/cli@4.5.45, tag commit f66545d593d2 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.47 and redeploy the Hub Lambda from tag v4.5.47 (d8722f771c7d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.47 (@mutmutco/cli@4.5.47, tag commit d8722f771c7d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -22319,7 +22348,7 @@ function checkLineEndings(probe) {
 // src/release-ledger.ts
 var import_node_fs22 = require("node:fs");
 var import_node_path22 = require("node:path");
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
@@ -22677,7 +22706,7 @@ function releaseLedgerPath(cwd) {
 }
 function atomicWriteJson(path2, ledger) {
   (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(path2), { recursive: true });
-  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}`;
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}`;
   (0, import_node_fs22.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
   (0, import_node_fs22.renameSync)(tmp, path2);
@@ -29092,13 +29121,13 @@ function renderPluginCachePlan(plan, applied) {
 }
 
 // ../shared/github-quota-scope.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
-  return `github-app-v1:${(0, import_node_crypto6.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
+  return `github-app-v1:${(0, import_node_crypto7.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
 }
 
 // src/app-actor.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -29149,7 +29178,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto7.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto8.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -30045,7 +30074,7 @@ var import_node_os16 = require("node:os");
 var import_node_path27 = require("node:path");
 
 // src/box-control.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 function parseManifest(text) {
@@ -30092,7 +30121,7 @@ function filesForBox(files, box) {
   return files.flatMap((file) => file.targets.filter((t) => t.box === box).map((t) => ({ file, dest: t.dest })));
 }
 function md5(content) {
-  return (0, import_node_crypto8.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto9.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -31958,7 +31987,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -31978,7 +32007,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto9.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto10.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -32140,7 +32169,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -32153,7 +32182,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto10.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto11.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -33309,7 +33338,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -33332,7 +33361,7 @@ async function readTargetedSeedFiles(repo, plan, target, ref, client) {
   const candidate = ref === plan.baseSha ? base : await readSeedFile(repo, target, ref, client);
   return { base, candidate };
 }
-async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, client) {
+async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, client, forcePr = false) {
   const [rules, base] = await Promise.all([
     client.rest("GET", `repos/${repo}/rules/branches/${encodeURIComponent(baseBranch)}`),
     client.rest("GET", `repos/${repo}/git/ref/heads/${encodeURIComponent(baseBranch)}`)
@@ -33342,8 +33371,10 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
-  return { ...planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`), baseSha, baseBranch };
+  const identity = (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
+  const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
+  return { ...scoped, baseSha, baseBranch };
 }
 async function verifyTargetedSeedBranch(repo, plan, target, client, allowMissing = false) {
   let ref;
@@ -33405,6 +33436,24 @@ async function enableTargetedSeedAutoMerge(repo, number, plan, target, expected,
 
 // src/bootstrap-commands.ts
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
+async function gateRenderDiff(current, rendered) {
+  const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-gate-diff-"));
+  const before = (0, import_node_path28.join)(dir, "committed-gate.yml");
+  const after = (0, import_node_path28.join)(dir, "registry-render.yml");
+  try {
+    (0, import_node_fs28.writeFileSync)(before, current);
+    (0, import_node_fs28.writeFileSync)(after, rendered);
+    try {
+      return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
+    } catch (e) {
+      const result = e;
+      if (result.code === 1 && result.stdout) return result.stdout;
+      throw e;
+    }
+  } finally {
+    (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
+  }
+}
 function bootstrapTrainDoctorDeps() {
   return {
     run: async (file, args) => (process.platform === "win32" && file === "npm" ? await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout: 3e4 }) : await execFileP(file, args, { timeout: 3e4 })).stdout,
@@ -33645,18 +33694,21 @@ function registerBootstrapCommands(program3) {
     }
     if (findings.some((f) => f.state !== "waived")) process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--from-config", "with --only gate.yml: adopt an equal legacy gate with a render stamp, then update from registry config via review PR; refuse hand edits").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
       deployModel: rawValue("--deploy-model", ""),
       releaseTrack: rawValue("--release-track", ""),
       only: rawValue("--only", ""),
+      fromConfig: rawFlag("--from-config"),
       execute: rawFlag("--execute"),
       json: rawFlag("--json"),
       box: rawValue("--box", ""),
       domains: rawValue("--domains", "")
     };
+    if (o.fromConfig && (o.only.trim() !== ".github/workflows/gate.yml" && o.only.trim() !== "gate.yml" || o.class !== "deployable" || cmdOpts.var?.length))
+      return fail("bootstrap apply: --from-config requires --only gate.yml, --class deployable, and no --var overrides");
     if (o.domains && !o.box) return fail("bootstrap apply: --domains requires --box");
     if (o.box && o.only) return fail("bootstrap apply: --box cannot be combined with --only");
     let boxDomains;
@@ -33725,7 +33777,7 @@ function registerBootstrapCommands(program3) {
     const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
-    const onlyTarget = o.only.trim();
+    const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const seedsToApply = onlyTarget ? manifest.seeds.filter((s) => s.target === onlyTarget || s.target.replace("{{REPO_SLUG}}", slug) === onlyTarget) : manifest.seeds;
     if (onlyTarget && !seedsToApply.length) {
       const known = manifest.seeds.map((s) => s.target).join("\n  ");
@@ -33761,6 +33813,8 @@ function registerBootstrapCommands(program3) {
       registryMeta = meta;
       registryRequiredCheckBranches = meta?.requiredCheckBranches;
       for (const [k, v] of Object.entries(gateConfigToVars(meta?.gate))) if (rawVars[k] == null) rawVars[k] = v;
+    } else if (o.fromConfig) {
+      return failGraceful(`bootstrap apply: registry META unreadable (${metaRead.error}); --from-config requires the committed registry gate config`);
     } else if (o.execute && !onlyTarget) {
       return failGraceful(`bootstrap apply: registry META unreadable (${metaRead.error}); refusing the live registry write, which would reset a registered project's releaseTrack and edgeDomains to class defaults (#7138)`);
     } else {
@@ -33867,10 +33921,42 @@ function registerBootstrapCommands(program3) {
     let scopedPlan;
     let scopedContent;
     let seededToBranch = 0;
+    let configGateAction;
+    let configGateContent;
     if (onlyTarget) {
-      scopedPlan = await targetedSeedPlan(repo, slug, onlyTarget, baseBranch, seedSource.sha, controlClient);
+      scopedPlan = await targetedSeedPlan(repo, slug, onlyTarget, baseBranch, seedSource.sha, controlClient, o.fromConfig);
       seedPlan = scopedPlan;
-      if (o.execute && scopedPlan.branch) {
+      if (o.fromConfig) {
+        const gate = registryMeta?.gate;
+        if (!gate || !Object.keys(gate).length) return failGraceful("bootstrap apply: --from-config requires a non-empty registry gate config; set it with oracle org project set --var gate={...} first");
+        const gateSeed = seedsToApply[0];
+        if (gateSeed.waivers?.[slug]) return failGraceful(`bootstrap apply: gate.yml is waived for ${slug}: ${gateSeed.waivers[slug]}`);
+        if (gateSeed.source !== "seed:gate.template.yml") return failGraceful("bootstrap apply: gate template is not the ci-reconcile seed");
+        try {
+          const gateVars = withDerivedRepoVars(
+            { ...gateConfigToVars(gate), REPO_SLUG: slug },
+            parsedRepo,
+            "deployable",
+            effectiveTrack,
+            registryMeta?.requiredCheckBranches,
+            registryMeta?.requiredChecks
+          );
+          const rendered = resolveSeedContent(gateSeed, gateVars, readFile9);
+          if (rendered === null || missingPlaceholders(rendered).length) return failGraceful("bootstrap apply: registry gate template is unreadable or has unfilled placeholders");
+          const base = (await readTargetedSeedFiles(repo, scopedPlan, onlyTarget, scopedPlan.baseSha, controlClient)).base?.content ?? null;
+          configGateAction = planGateFromConfig(base, rendered);
+          if (configGateAction.refused && base !== null) {
+            const stamped = parseGateRenderStamp(base);
+            const committedBody = stamped?.body.startsWith(GATE_RENDER_NOTE) ? stamped.body.slice(GATE_RENDER_NOTE.length) : stamped?.body ?? base;
+            console.error(await gateRenderDiff(committedBody, rendered));
+            return failGraceful(`bootstrap apply: ${configGateAction.reason}`);
+          }
+          configGateContent = stampGateRender(rendered);
+        } catch (e) {
+          return failGraceful(`bootstrap apply --from-config: ${e.message}`);
+        }
+      }
+      if (o.execute && scopedPlan.branch && configGateAction?.action !== "skip") {
         await prepareTargetedSeedBranch(repo, scopedPlan, onlyTarget, controlClient, gh2);
       }
     } else if (o.execute) {
@@ -33896,7 +33982,7 @@ function registerBootstrapCommands(program3) {
       }
     }
     const docsForIndex = [];
-    const seedReadRef = !o.execute && scopedPlan ? scopedPlan.baseSha : seedPlan.ref;
+    const seedReadRef = scopedPlan && (!o.execute || configGateAction?.action === "skip") ? scopedPlan.baseSha : seedPlan.ref;
     for (const seed of seedsToApply) {
       if (!seed.classes.includes(o.class)) continue;
       if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
@@ -33936,14 +34022,16 @@ function registerBootstrapCommands(program3) {
       } catch {
         exists = false;
       }
-      const planned = planSeedAction(resolved, scopedPlan ? baseContent !== null : exists);
+      const planned = configGateAction ?? planSeedAction(resolved, scopedPlan ? baseContent !== null : exists);
       if (scopedPlan && planned.action !== "skip") planned.action = exists ? "update" : "create";
       const isLegacyBlock = resolved.source === "managed-block";
       let content = null;
       let isManaged = isLegacyBlock || resolved.managedBlock != null;
       const preservedContent = scopedPlan ? baseContent : remoteContent;
       if (planned.action === "create" || planned.action === "update") {
-        if (isLegacyBlock) {
+        if (o.fromConfig) {
+          content = configGateContent;
+        } else if (isLegacyBlock) {
           content = upsertManagedGitignoreBlock(preservedContent).content;
         } else {
           const rulesetVars = preserveRuleset ? gateSeedVars(
@@ -34012,8 +34100,8 @@ function registerBootstrapCommands(program3) {
       }
     }
     let seedPrUrl;
-    const scopedHead = o.execute && scopedPlan?.branch ? await verifyTargetedSeedBranch(repo, scopedPlan, onlyTarget, controlClient) : null;
-    if (o.execute && seedPlan.mode === "pr" && seedPlan.branch && (seededToBranch > 0 || scopedContent !== void 0 && scopedHead !== null && scopedHead !== scopedPlan?.baseSha)) {
+    const scopedHead = o.execute && scopedPlan?.branch && configGateAction?.action !== "skip" ? await verifyTargetedSeedBranch(repo, scopedPlan, onlyTarget, controlClient) : null;
+    if (o.execute && seedPlan.mode === "pr" && seedPlan.branch && configGateAction?.action !== "skip" && (seededToBranch > 0 || scopedContent !== void 0 && scopedHead !== null && scopedHead !== scopedPlan?.baseSha)) {
       await gh2(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-F", `delete_branch_on_merge=${MANAGED_DELETE_BRANCH_ON_MERGE}`]).catch(() => {
       });
       const openPrs = await gh2(["pr", "list", "--repo", repo, "--head", seedPlan.branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
@@ -34031,9 +34119,9 @@ function registerBootstrapCommands(program3) {
           "--head",
           seedPlan.branch,
           "--title",
-          onlyTarget ? `chore: propagate ${onlyManagedBlock ? "Hub-managed block in" : "org-owned"} ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
+          o.fromConfig ? `chore: render ${onlyTarget} from registry gate config` : onlyTarget ? `chore: propagate ${onlyManagedBlock ? "Hub-managed block in" : "org-owned"} ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
           "--body",
-          onlyTarget ? `Auto-opened by \`mmi-cli devops bootstrap apply ${repo} --only ${onlyTarget} --execute\` (#3818).
+          o.fromConfig ? `Auto-opened by \`mmi-cli devops bootstrap apply ${repo} --only gate.yml --from-config --execute\`. The gate is rendered from the repo's registry gate config through the ci-reconcile seed renderer at MMI-Hub@${seedSource.sha}. This PR carries only \`${onlyTarget}\` for review; no registry META or other controls were changed.` : onlyTarget ? `Auto-opened by \`mmi-cli devops bootstrap apply ${repo} --only ${onlyTarget} --execute\` (#3818).
 
 ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owned \`${onlyTarget}\`` : `The org-owned \`${onlyTarget}\` seed`} is declared by MMI-Hub's \`skills/bootstrap/seeds/manifest.json\` at MMI-Hub@${seedSource.sha}; this PR reconciles that declared scope and preserves everything outside it. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
 
@@ -34946,7 +35034,7 @@ function formatSuiteStatus(report) {
 // src/suite-train.ts
 var import_node_fs29 = require("node:fs");
 var import_node_path29 = require("node:path");
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var SCHEMA = "mmi-suite-cut/v1";
 var SHA2 = /^[a-f0-9]{40}$/i;
 var RC_TAG = /^v\d+\.\d+\.\d+-rc\.\d+$/;
@@ -34982,7 +35070,7 @@ function readSuiteCut(path2) {
 }
 function writeSuiteCut(path2, record) {
   (0, import_node_fs29.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto12.randomBytes)(8).toString("hex")}.tmp`;
+  const temp = `${path2}.${(0, import_node_crypto13.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs29.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
     (0, import_node_fs29.renameSync)(temp, path2);
@@ -38761,7 +38849,7 @@ init_github_client();
 
 // src/issue-commands.ts
 var import_node_fs34 = require("node:fs");
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -39234,7 +39322,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto13.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto14.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -49303,14 +49391,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var import_node_fs48 = require("node:fs");
 var import_promises10 = require("node:fs/promises");
 var import_node_path46 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto14.createHash)("sha256");
+  const hash = (0, import_node_crypto15.createHash)("sha256");
   for await (const chunk of (0, import_node_fs48.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -49540,13 +49628,13 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var import_node_fs50 = require("node:fs");
 var import_node_os22 = require("node:os");
 var import_node_path48 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var import_node_fs49 = require("node:fs");
 var import_node_path47 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
@@ -49559,7 +49647,7 @@ function repoPath(root, declaredPath, label) {
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto15.createHash)("sha256");
+  const hash = (0, import_node_crypto16.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs49.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs49.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -49589,7 +49677,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha256 = (bytes) => `sha256:${(0, import_node_crypto16.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha256 = (bytes) => `sha256:${(0, import_node_crypto17.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha256(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha256(rebuiltBytes) : ABSENT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.45",
+  "version": "4.5.47",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",