@mutmutco/cli 4.5.46 → 4.5.48

package/dist/main.cjs

@@ -14365,6 +14365,9 @@ async function activateProductRuleset(repo, rulesetBody, client, enforcement = "
   return { action: "created", enforcement };
 }
 
+// src/bootstrap-apply.ts
+var import_node_crypto5 = require("node:crypto");
+
 // src/bootstrap-seeds.ts
 var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
 function loadBootstrapSeeds(manifestJson) {
@@ -15593,6 +15596,32 @@ function planSeedAction(seed, exists) {
   }
   return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
 }
+var GATE_RENDER_NOTE = "# Rendered from the registry gate config by mmi-cli devops bootstrap apply <repo> --only gate.yml --from-config; edit the config, not this file.\n";
+var gateHash = (body) => (0, import_node_crypto5.createHash)("sha256").update(body, "utf8").digest("hex");
+function parseGateRenderStamp(content) {
+  const match = /^# mmi-gate-render: sha256=([a-f0-9]{64})\n/.exec(content);
+  return match ? { hash: match[1], body: content.slice(match[0].length) } : null;
+}
+function verifyGateRenderStamp(content) {
+  const stamp = parseGateRenderStamp(content);
+  return stamp !== null && stamp.body.startsWith(GATE_RENDER_NOTE) && gateHash(stamp.body) === stamp.hash;
+}
+function stampGateRender(rendered) {
+  const body = GATE_RENDER_NOTE + rendered;
+  return `# mmi-gate-render: sha256=${gateHash(body)}
+${body}`;
+}
+function planGateFromConfig(current, rendered) {
+  const target = ".github/workflows/gate.yml";
+  const base = { target, ownership: "repo" };
+  if (current === null) return { ...base, action: "create", reason: "registry gate config; review via branch + PR" };
+  const stamp = parseGateRenderStamp(current);
+  if (stamp) {
+    if (!verifyGateRenderStamp(current)) return { ...base, action: "skip", refused: true, reason: "REFUSED: stamped gate was hand-edited since its last render (diff below)" };
+    return stamp.body === GATE_RENDER_NOTE + rendered ? { ...base, action: "skip", reason: "already current from registry gate config" } : { ...base, action: "update", reason: "registry gate config changed; update stamped gate via branch + PR" };
+  }
+  return current === rendered ? { ...base, action: "update", reason: "adopt legacy gate: add registry render stamp via branch + PR" } : { ...base, action: "skip", refused: true, reason: "REFUSED: unstamped gate differs from registry render; make the registry config reproduce the file first, then re-run to adopt (diff below)" };
+}
 function reconcileSeedAction(action, content, isManagedBlock, remoteContent = null) {
   if (action.action === "skip") return action;
   if (content == null) {
@@ -17014,10 +17043,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.46",
-    tag: "v4.5.46",
-    commit: "bb8db7d8e78b",
-    npm: "@mutmutco/cli@4.5.46"
+    version: "4.5.48",
+    tag: "v4.5.48",
+    commit: "92f1d9951b04",
+    npm: "@mutmutco/cli@4.5.48"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17034,14 +17063,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.46"
+          v3Target: "v4.5.48"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.46 and redeploy the Hub Lambda from tag v4.5.46 (bb8db7d8e78b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.46 (@mutmutco/cli@4.5.46, tag commit bb8db7d8e78b \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.48 and redeploy the Hub Lambda from tag v4.5.48 (92f1d9951b04); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.48 (@mutmutco/cli@4.5.48, tag commit 92f1d9951b04 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -22319,7 +22348,7 @@ function checkLineEndings(probe) {
 // src/release-ledger.ts
 var import_node_fs22 = require("node:fs");
 var import_node_path22 = require("node:path");
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
@@ -22677,7 +22706,7 @@ function releaseLedgerPath(cwd) {
 }
 function atomicWriteJson(path2, ledger) {
   (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(path2), { recursive: true });
-  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}`;
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}`;
   (0, import_node_fs22.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
   (0, import_node_fs22.renameSync)(tmp, path2);
@@ -29092,13 +29121,13 @@ function renderPluginCachePlan(plan, applied) {
 }
 
 // ../shared/github-quota-scope.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
-  return `github-app-v1:${(0, import_node_crypto6.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
+  return `github-app-v1:${(0, import_node_crypto7.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
 }
 
 // src/app-actor.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var APP_ACTOR_ENV = "MMI_ACTOR";
 var APP_VAULT_REPO = "mutmutco/MMI-Hub";
 var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
@@ -29149,7 +29178,7 @@ function mintAppJwt(appId, privateKeyPem, nowSec) {
     exp: now + APP_JWT_TTL_S,
     iss: appId
   }));
-  const signer = (0, import_node_crypto7.createSign)("RSA-SHA256");
+  const signer = (0, import_node_crypto8.createSign)("RSA-SHA256");
   signer.update(`${header}.${payload}`);
   return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
 }
@@ -30045,7 +30074,7 @@ var import_node_os16 = require("node:os");
 var import_node_path27 = require("node:path");
 
 // src/box-control.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var MANIFEST_PATH = "infra/box-control/manifest.json";
 var ALLOWED_POST = /* @__PURE__ */ new Set(["systemctl daemon-reload"]);
 function parseManifest(text) {
@@ -30092,7 +30121,7 @@ function filesForBox(files, box) {
   return files.flatMap((file) => file.targets.filter((t) => t.box === box).map((t) => ({ file, dest: t.dest })));
 }
 function md5(content) {
-  return (0, import_node_crypto8.createHash)("md5").update(content).digest("hex");
+  return (0, import_node_crypto9.createHash)("md5").update(content).digest("hex");
 }
 function planRemoteScript(dests) {
   const lines2 = ["set -u"];
@@ -31958,7 +31987,7 @@ function renderDeployPortDoctor(report) {
 }
 
 // src/bootstrap-drift.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 function byteComparableSeeds(manifest, cls) {
   return manifest.seeds.filter((s) => s.ownership === "org" && s.source === "self" && s.classes.includes(cls));
 }
@@ -31978,7 +32007,7 @@ function compareSeedBytes(hubContent, repoContent) {
   return normalize(hubContent) === normalize(repoContent) ? "match" : "drift";
 }
 function seedContentHash(content) {
-  return (0, import_node_crypto9.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
+  return (0, import_node_crypto10.createHash)("sha256").update(content.replace(/\r\n/g, "\n"), "utf8").digest("hex");
 }
 function auditRepoSeedDrift(repo, seeds, hubContents, repoReads) {
   const byTarget = new Map(repoReads.map((r) => [r.target, r.content]));
@@ -32140,7 +32169,7 @@ function renderPropagationReport(plan) {
 }
 
 // src/bootstrap-propagation-identity.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 var PROPAGATION_BRANCH_PREFIX = "seed-propagate-";
 var TARGET_MARKER_NAME = "mmi-bootstrap-propagation-target";
 function safeBranchPart(value, maxLength, fallback) {
@@ -32153,7 +32182,7 @@ function repoSlug2(repo) {
 function propagationBranch(repo, target) {
   const repoPart = safeBranchPart(repoSlug2(repo), 32, "repo");
   const targetPart = safeBranchPart(target, 48, "target");
-  const hash = (0, import_node_crypto10.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
+  const hash = (0, import_node_crypto11.createHash)("sha256").update(repo.trim().toLowerCase()).update("\0").update(target).digest("hex").slice(0, 12);
   return `${PROPAGATION_BRANCH_PREFIX}${repoPart}-${targetPart}-${hash}`;
 }
 function legacyPropagationBranch(repo) {
@@ -33309,7 +33338,7 @@ function renderBootstrapVerifyReport(report) {
 }
 
 // src/bootstrap-seed-delivery.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 init_github_client();
 var SHA = /^[a-f0-9]{40}$/;
 async function readSeedFile(repo, target, ref, client) {
@@ -33332,7 +33361,7 @@ async function readTargetedSeedFiles(repo, plan, target, ref, client) {
   const candidate = ref === plan.baseSha ? base : await readSeedFile(repo, target, ref, client);
   return { base, candidate };
 }
-async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, client) {
+async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, client, forcePr = false) {
   const [rules, base] = await Promise.all([
     client.rest("GET", `repos/${repo}/rules/branches/${encodeURIComponent(baseBranch)}`),
     client.rest("GET", `repos/${repo}/git/ref/heads/${encodeURIComponent(baseBranch)}`)
@@ -33342,8 +33371,10 @@ async function targetedSeedPlan(repo, slug, target, baseBranch, sourceSha, clien
   }
   const baseSha = base?.object?.sha;
   if (!baseSha || !SHA.test(baseSha) || !SHA.test(sourceSha)) throw new Error("bootstrap apply: seed identity is unreadable");
-  const identity = (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
-  return { ...planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`), baseSha, baseBranch };
+  const identity = (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify([repo.toLowerCase(), target, baseSha, sourceSha])).digest("hex").slice(0, 24);
+  const delivery = planSeedDelivery(rules, slug, baseBranch, `bootstrap-seed-${identity}`);
+  const scoped = forcePr && delivery.mode === "direct" ? { mode: "pr", ref: `bootstrap-seed-${identity}-${slug}`, branch: `bootstrap-seed-${identity}-${slug}`, reason: "registry gate render requires review" } : delivery;
+  return { ...scoped, baseSha, baseBranch };
 }
 async function verifyTargetedSeedBranch(repo, plan, target, client, allowMissing = false) {
   let ref;
@@ -33405,6 +33436,24 @@ async function enableTargetedSeedAutoMerge(repo, number, plan, target, expected,
 
 // src/bootstrap-commands.ts
 var execGitForSeedSource = async (args) => (await execFileP("git", args, { timeout: GIT_TIMEOUT_MS })).stdout;
+async function gateRenderDiff(current, rendered) {
+  const dir = (0, import_node_fs28.mkdtempSync)((0, import_node_path28.join)((0, import_node_os17.tmpdir)(), "mmi-gate-diff-"));
+  const before = (0, import_node_path28.join)(dir, "committed-gate.yml");
+  const after = (0, import_node_path28.join)(dir, "registry-render.yml");
+  try {
+    (0, import_node_fs28.writeFileSync)(before, current);
+    (0, import_node_fs28.writeFileSync)(after, rendered);
+    try {
+      return (await execFileP("git", ["diff", "--no-index", "--", before, after], { timeout: GIT_TIMEOUT_MS })).stdout;
+    } catch (e) {
+      const result = e;
+      if (result.code === 1 && result.stdout) return result.stdout;
+      throw e;
+    }
+  } finally {
+    (0, import_node_fs28.rmSync)(dir, { recursive: true, force: true });
+  }
+}
 function bootstrapTrainDoctorDeps() {
   return {
     run: async (file, args) => (process.platform === "win32" && file === "npm" ? await execFileP("cmd.exe", ["/c", "npm", ...args], { timeout: 3e4 }) : await execFileP(file, args, { timeout: 3e4 })).stdout,
@@ -33645,18 +33694,21 @@ function registerBootstrapCommands(program3) {
     }
     if (findings.some((f) => f.state !== "waived")) process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--from-config", "with --only gate.yml: adopt an equal legacy gate with a render stamp, then update from registry config via review PR; refuse hand edits").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
       deployModel: rawValue("--deploy-model", ""),
       releaseTrack: rawValue("--release-track", ""),
       only: rawValue("--only", ""),
+      fromConfig: rawFlag("--from-config"),
       execute: rawFlag("--execute"),
       json: rawFlag("--json"),
       box: rawValue("--box", ""),
       domains: rawValue("--domains", "")
     };
+    if (o.fromConfig && (o.only.trim() !== ".github/workflows/gate.yml" && o.only.trim() !== "gate.yml" || o.class !== "deployable" || cmdOpts.var?.length))
+      return fail("bootstrap apply: --from-config requires --only gate.yml, --class deployable, and no --var overrides");
     if (o.domains && !o.box) return fail("bootstrap apply: --domains requires --box");
     if (o.box && o.only) return fail("bootstrap apply: --box cannot be combined with --only");
     let boxDomains;
@@ -33725,7 +33777,7 @@ function registerBootstrapCommands(program3) {
     const manifest = loadBootstrapSeeds((0, import_node_fs28.readFileSync)(manifestPath, "utf8"));
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
-    const onlyTarget = o.only.trim();
+    const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
     const seedsToApply = onlyTarget ? manifest.seeds.filter((s) => s.target === onlyTarget || s.target.replace("{{REPO_SLUG}}", slug) === onlyTarget) : manifest.seeds;
     if (onlyTarget && !seedsToApply.length) {
       const known = manifest.seeds.map((s) => s.target).join("\n  ");
@@ -33761,6 +33813,8 @@ function registerBootstrapCommands(program3) {
       registryMeta = meta;
       registryRequiredCheckBranches = meta?.requiredCheckBranches;
       for (const [k, v] of Object.entries(gateConfigToVars(meta?.gate))) if (rawVars[k] == null) rawVars[k] = v;
+    } else if (o.fromConfig) {
+      return failGraceful(`bootstrap apply: registry META unreadable (${metaRead.error}); --from-config requires the committed registry gate config`);
     } else if (o.execute && !onlyTarget) {
       return failGraceful(`bootstrap apply: registry META unreadable (${metaRead.error}); refusing the live registry write, which would reset a registered project's releaseTrack and edgeDomains to class defaults (#7138)`);
     } else {
@@ -33867,10 +33921,42 @@ function registerBootstrapCommands(program3) {
     let scopedPlan;
     let scopedContent;
     let seededToBranch = 0;
+    let configGateAction;
+    let configGateContent;
     if (onlyTarget) {
-      scopedPlan = await targetedSeedPlan(repo, slug, onlyTarget, baseBranch, seedSource.sha, controlClient);
+      scopedPlan = await targetedSeedPlan(repo, slug, onlyTarget, baseBranch, seedSource.sha, controlClient, o.fromConfig);
       seedPlan = scopedPlan;
-      if (o.execute && scopedPlan.branch) {
+      if (o.fromConfig) {
+        const gate = registryMeta?.gate;
+        if (!gate || !Object.keys(gate).length) return failGraceful("bootstrap apply: --from-config requires a non-empty registry gate config; set it with oracle org project set --var gate={...} first");
+        const gateSeed = seedsToApply[0];
+        if (gateSeed.waivers?.[slug]) return failGraceful(`bootstrap apply: gate.yml is waived for ${slug}: ${gateSeed.waivers[slug]}`);
+        if (gateSeed.source !== "seed:gate.template.yml") return failGraceful("bootstrap apply: gate template is not the ci-reconcile seed");
+        try {
+          const gateVars = withDerivedRepoVars(
+            { ...gateConfigToVars(gate), REPO_SLUG: slug },
+            parsedRepo,
+            "deployable",
+            effectiveTrack,
+            registryMeta?.requiredCheckBranches,
+            registryMeta?.requiredChecks
+          );
+          const rendered = resolveSeedContent(gateSeed, gateVars, readFile9);
+          if (rendered === null || missingPlaceholders(rendered).length) return failGraceful("bootstrap apply: registry gate template is unreadable or has unfilled placeholders");
+          const base = (await readTargetedSeedFiles(repo, scopedPlan, onlyTarget, scopedPlan.baseSha, controlClient)).base?.content ?? null;
+          configGateAction = planGateFromConfig(base, rendered);
+          if (configGateAction.refused && base !== null) {
+            const stamped = parseGateRenderStamp(base);
+            const committedBody = stamped?.body.startsWith(GATE_RENDER_NOTE) ? stamped.body.slice(GATE_RENDER_NOTE.length) : stamped?.body ?? base;
+            console.error(await gateRenderDiff(committedBody, rendered));
+            return failGraceful(`bootstrap apply: ${configGateAction.reason}`);
+          }
+          configGateContent = stampGateRender(rendered);
+        } catch (e) {
+          return failGraceful(`bootstrap apply --from-config: ${e.message}`);
+        }
+      }
+      if (o.execute && scopedPlan.branch && configGateAction?.action !== "skip") {
         await prepareTargetedSeedBranch(repo, scopedPlan, onlyTarget, controlClient, gh2);
       }
     } else if (o.execute) {
@@ -33896,7 +33982,7 @@ function registerBootstrapCommands(program3) {
       }
     }
     const docsForIndex = [];
-    const seedReadRef = !o.execute && scopedPlan ? scopedPlan.baseSha : seedPlan.ref;
+    const seedReadRef = scopedPlan && (!o.execute || configGateAction?.action === "skip") ? scopedPlan.baseSha : seedPlan.ref;
     for (const seed of seedsToApply) {
       if (!seed.classes.includes(o.class)) continue;
       if (!seedMatchesDeployModel(seed, applyDeployModel)) continue;
@@ -33936,14 +34022,16 @@ function registerBootstrapCommands(program3) {
       } catch {
         exists = false;
       }
-      const planned = planSeedAction(resolved, scopedPlan ? baseContent !== null : exists);
+      const planned = configGateAction ?? planSeedAction(resolved, scopedPlan ? baseContent !== null : exists);
       if (scopedPlan && planned.action !== "skip") planned.action = exists ? "update" : "create";
       const isLegacyBlock = resolved.source === "managed-block";
       let content = null;
       let isManaged = isLegacyBlock || resolved.managedBlock != null;
       const preservedContent = scopedPlan ? baseContent : remoteContent;
       if (planned.action === "create" || planned.action === "update") {
-        if (isLegacyBlock) {
+        if (o.fromConfig) {
+          content = configGateContent;
+        } else if (isLegacyBlock) {
           content = upsertManagedGitignoreBlock(preservedContent).content;
         } else {
           const rulesetVars = preserveRuleset ? gateSeedVars(
@@ -34012,8 +34100,8 @@ function registerBootstrapCommands(program3) {
       }
     }
     let seedPrUrl;
-    const scopedHead = o.execute && scopedPlan?.branch ? await verifyTargetedSeedBranch(repo, scopedPlan, onlyTarget, controlClient) : null;
-    if (o.execute && seedPlan.mode === "pr" && seedPlan.branch && (seededToBranch > 0 || scopedContent !== void 0 && scopedHead !== null && scopedHead !== scopedPlan?.baseSha)) {
+    const scopedHead = o.execute && scopedPlan?.branch && configGateAction?.action !== "skip" ? await verifyTargetedSeedBranch(repo, scopedPlan, onlyTarget, controlClient) : null;
+    if (o.execute && seedPlan.mode === "pr" && seedPlan.branch && configGateAction?.action !== "skip" && (seededToBranch > 0 || scopedContent !== void 0 && scopedHead !== null && scopedHead !== scopedPlan?.baseSha)) {
       await gh2(["api", "-X", "PATCH", `repos/${repo}`, "-f", "allow_auto_merge=true", "-f", "allow_squash_merge=true", "-F", `delete_branch_on_merge=${MANAGED_DELETE_BRANCH_ON_MERGE}`]).catch(() => {
       });
       const openPrs = await gh2(["pr", "list", "--repo", repo, "--head", seedPlan.branch, "--base", baseBranch, "--state", "open", "--json", "number,url"]);
@@ -34031,9 +34119,9 @@ function registerBootstrapCommands(program3) {
           "--head",
           seedPlan.branch,
           "--title",
-          onlyTarget ? `chore: propagate ${onlyManagedBlock ? "Hub-managed block in" : "org-owned"} ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
+          o.fromConfig ? `chore: render ${onlyTarget} from registry gate config` : onlyTarget ? `chore: propagate ${onlyManagedBlock ? "Hub-managed block in" : "org-owned"} ${onlyTarget} from MMI-Hub` : `bootstrap: seed ${parsedRepo.name} (${baseBranch} is protected)`,
           "--body",
-          onlyTarget ? `Auto-opened by \`mmi-cli devops bootstrap apply ${repo} --only ${onlyTarget} --execute\` (#3818).
+          o.fromConfig ? `Auto-opened by \`mmi-cli devops bootstrap apply ${repo} --only gate.yml --from-config --execute\`. The gate is rendered from the repo's registry gate config through the ci-reconcile seed renderer at MMI-Hub@${seedSource.sha}. This PR carries only \`${onlyTarget}\` for review; no registry META or other controls were changed.` : onlyTarget ? `Auto-opened by \`mmi-cli devops bootstrap apply ${repo} --only ${onlyTarget} --execute\` (#3818).
 
 ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owned \`${onlyTarget}\`` : `The org-owned \`${onlyTarget}\` seed`} is declared by MMI-Hub's \`skills/bootstrap/seeds/manifest.json\` at MMI-Hub@${seedSource.sha}; this PR reconciles that declared scope and preserves everything outside it. It carries that file and nothing else \u2014 no labels, ruleset, merge settings or registry META were touched.
 
@@ -34946,18 +35034,30 @@ function formatSuiteStatus(report) {
 // src/suite-train.ts
 var import_node_fs29 = require("node:fs");
 var import_node_path29 = require("node:path");
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 var SCHEMA = "mmi-suite-cut/v1";
 var SHA2 = /^[a-f0-9]{40}$/i;
 var RC_TAG = /^v\d+\.\d+\.\d+-rc\.\d+$/;
 var RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
-function suitePins(record) {
+function suitePins(record, bundles) {
   return record.members.map((m) => m.carried ? { module: m.id, rc: m.rcPin, main: m.mainPin } : {
     module: m.id,
     rc: `https://${m.id === "katip" ? m.rcHost ?? m.host : m.host}/${m.id === "katip" ? "" : "rc/"}module.js?v=${m.tag}`,
-    main: `https://${m.host}/module.js?v=${suiteReleaseTag(m.tag)}`
+    main: mainPinFor(m.host, bundles[m.id], suiteReleaseTag(m.tag))
   });
 }
+function mainPinFor(host, bundles, tag) {
+  const path2 = [bundles?.dev, bundles?.main].map(pathOf).find(Boolean) ?? "/module.js";
+  return `https://${host}${path2}?v=${tag}`;
+}
+function pathOf(url) {
+  try {
+    return url ? new URL(url).pathname : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var bundlesOf = (members) => Object.fromEntries(members.map((m) => [m.id, m.bundles]));
 function suiteReleaseTag(rc) {
   if (!RC_TAG.test(rc)) throw new Error(`invalid rc tag ${rc}`);
   return rc.replace(/-rc\.\d+$/, "");
@@ -34982,7 +35082,7 @@ function readSuiteCut(path2) {
 }
 function writeSuiteCut(path2, record) {
   (0, import_node_fs29.mkdirSync)((0, import_node_path29.dirname)(path2), { recursive: true });
-  const temp = `${path2}.${(0, import_node_crypto12.randomBytes)(8).toString("hex")}.tmp`;
+  const temp = `${path2}.${(0, import_node_crypto13.randomBytes)(8).toString("hex")}.tmp`;
   try {
     (0, import_node_fs29.writeFileSync)(temp, JSON.stringify(record, null, 2), { flag: "wx" });
     (0, import_node_fs29.renameSync)(temp, path2);
@@ -35003,19 +35103,24 @@ function pinVersion(url) {
 async function carriedPins(deps, member, bundles) {
   const main = bundles.main;
   if (!main || !RELEASE_TAG.test(pinVersion(main))) throw new Error(`${member.repo}: nothing new since rc, but its MM-Work main pin ${main ?? "(none)"} has no ?v=vX.Y.Z release; pin it before the suite cut`);
+  if (!await deps.tagSha(member.repo, pinVersion(main))) throw new Error(`${member.repo}: nothing new since rc, but its MM-Work main pin names ${pinVersion(main)}, which was never released; release it or pin its live release before the suite cut`);
+  const mainPin = mainPinFor(new URL(main).host, bundles, pinVersion(main));
   for (const url of [bundles.rc, main]) {
     const tag = pinVersion(url);
     if (!RC_TAG.test(tag) && !RELEASE_TAG.test(tag)) continue;
     const sha = await deps.tagSha(member.repo, tag);
-    if (sha && await deps.contains(member.repo, member.development, sha)) return { rcPin: url, mainPin: main };
+    if (sha && await deps.contains(member.repo, member.development, sha)) return { rcPin: url === main ? mainPin : url, mainPin };
   }
   throw new Error(`${member.repo}: nothing new since rc, but no pinned MM-Work bundle carries development ${member.development.slice(0, 12)}; pin it before the suite cut`);
 }
-function suiteAbandon(recordPath) {
+function suiteAbandon(recordPath, ownerGo = false) {
   const record = readSuiteCut(recordPath);
   if (!record) throw new Error("no suite cut record to abandon");
-  if (record.pinPr) {
-    throw new Error(`the cut already opened pin PR ${record.pinPr}; its pins may be visible, so resume it (suite rcand --owner-go) or release it (suite release) instead`);
+  if (record.leadReleased || record.members.some((m) => m.released)) {
+    throw new Error("the cut already released a member or the lead; finish it with suite release --owner-go, never abandon it");
+  }
+  if (record.pinPr && !ownerGo) {
+    throw new Error(`the cut already opened pin PR ${record.pinPr}; its pins may be visible, so resume it (suite rcand --owner-go), release it (suite release), or retire it with suite abandon --owner-go`);
   }
   const archive = `${recordPath}.abandoned-${record.leadDevelopment.slice(0, 12)}.json`;
   if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`abandoned-cut archive already exists at ${archive}; inspect before abandoning again`);
@@ -35064,7 +35169,15 @@ async function suiteRcand(deps, opts) {
     throw new Error("suite roster changed since cut began; refuse to omit or add a member");
   const quiet = [];
   for (const member of record.members) {
-    if (!member.tag && !member.carried && await deps.contains(member.repo, member.development, member.previousRc)) quiet.push(member);
+    if (member.tag || member.carried || !await deps.contains(member.repo, member.development, member.previousRc)) continue;
+    const rcTag = pinVersion(modules.find((m) => m.repo === member.repo).bundles.rc);
+    if (RC_TAG.test(rcTag) && (await deps.tagSha(member.repo, rcTag))?.toLowerCase() === member.previousRc.toLowerCase() && !await deps.tagSha(member.repo, suiteReleaseTag(rcTag))) {
+      member.tag = rcTag;
+      member.sha = member.previousRc;
+      writeSuiteCut(deps.recordPath, record);
+      continue;
+    }
+    quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m))) {
     (0, import_node_fs29.rmSync)(deps.recordPath, { force: true });
@@ -35076,7 +35189,7 @@ async function suiteRcand(deps, opts) {
   }
   const refusals = [];
   for (const member of record.members) {
-    if (member.carried || member.published || member.id === "katip") continue;
+    if (member.published || member.id === "katip") continue;
     try {
       await deps.preflight(member.repo);
     } catch (e) {
@@ -35093,7 +35206,10 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
   for (const member of record.members) {
     if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
       throw new Error(`${member.repo}: development moved after the cut snapshot; refuse to add untested code`);
-    if (member.carried) continue;
+    if (member.carried) {
+      if (member.id !== "katip") await deps.publish(member.repo, pinVersion(member.rcPin));
+      continue;
+    }
     if (!member.tag) {
       const cut = await deps.rcand(member.repo, member.previousRc, member.rcWasAbsent);
       if (!RC_TAG.test(cut.tag) || !SHA2.test(cut.sha) || cut.sha.toLowerCase() === member.previousRc.toLowerCase()) throw new Error(`${member.repo}: rcand did not return a new immutable rc tag/SHA`);
@@ -35117,7 +35233,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
     if (live.version !== member.backend || devHead?.toLowerCase() !== member.development.toLowerCase())
       throw new Error(`${member.repo}: live backend or development changed during the cut; pins unchanged`);
   }
-  const pins = suitePins(record);
+  const pins = suitePins(record, bundlesOf(modules));
   await deps.verifyLeadCut(record.leadDevelopment);
   const pr = await deps.pin({ cut: record.leadDevelopment, pins });
   await deps.verifyLeadCut(record.leadDevelopment);
@@ -35142,7 +35258,7 @@ async function suiteRelease(deps, ownerGo) {
   if (!record?.pinMerged || !record.leadRcTag) throw new Error("no completed suite rc cut and merged pin PR; release refused");
   const members = suiteMembers(await deps.registry()).filter((m) => m.repo !== SUITE_REPO);
   if (members.length !== record.members.length || members.some((m) => !record.members.some((r) => r.repo === m.repo && r.id === m.id))) throw new Error("suite roster changed after the cut; release refused");
-  await deps.verifyPins(suitePins(record));
+  await deps.verifyPins(suitePins(record, bundlesOf(members)), record.leadRcTag);
   for (const member of record.members) {
     if (member.carried) {
       const live2 = await deps.backend({ repo: member.repo, id: member.id, bundles: {} });
@@ -38498,8 +38614,8 @@ async function openSuiteCutPinPr(deps, input) {
   const ids = input.pins.map((p) => p.module);
   if (new Set(ids).size !== ids.length) throw new Error("suite pin PR contains a duplicate module");
   const branch = `suite-pin/cut-${input.cut.slice(0, 16)}`;
-  const registry2 = async () => {
-    const get = JSON.parse(await deps.run("gh", ["api", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=development`]));
+  const registry2 = async (ref = "development") => {
+    const get = JSON.parse(await deps.run("gh", ["api", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=${encodeURIComponent(ref)}`]));
     if (!get.content) throw new Error("MM-Work seed/modules.json is unreadable");
     return JSON.parse(Buffer.from(get.content, "base64").toString("utf8"));
   };
@@ -38523,25 +38639,35 @@ async function openSuiteCutPinPr(deps, input) {
       })) throw new Error(`${branch} merged but development pins differ from this cut`);
       return { status: "merged", pr: prs[0].url };
     }
-    if (prs.length) return { status: "pending", pr: prs[0].url };
-    if (input.pins.every((p) => {
-      const row = rows.find((r) => r.id === p.module);
+    const matches = (r) => input.pins.every((p) => {
+      const row = r.find((x) => x.id === p.module);
       return row?.bundles.rc === p.rc && row?.bundles.main === p.main;
-    })) throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
+    });
+    if (prs.length && matches(await registry2(branch))) return { status: "pending", pr: prs[0].url };
+    if (!prs.length && matches(rows)) throw new Error("pins already match without a merged cut PR \u2014 provenance unverified");
     await (0, import_promises5.mkdir)((0, import_node_path34.join)(deps.root, "tmp"), { recursive: true });
     scratch = await (0, import_promises5.mkdtemp)((0, import_node_path34.join)(deps.root, "tmp", "suite-pin-"));
     const run = (file, args) => deps.run(file, args, scratch);
-    await run("git", ["clone", "--quiet", "--branch", "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
-    if ((await run("git", ["rev-parse", "HEAD"])).trim().toLowerCase() !== input.cut.toLowerCase())
-      throw new Error("MM-Work development moved after the suite snapshot; no pin PR opened");
-    await run("git", ["switch", "-c", branch]);
+    await run("git", ["clone", "--quiet", "--branch", prs.length ? branch : "development", "--single-branch", `https://github.com/${SUITE_REPO}.git`, "."]);
+    if (prs.length) {
+      if ((await run("git", ["merge-base", "HEAD", `${input.cut}`]).catch(() => "")).trim().toLowerCase() !== input.cut.toLowerCase())
+        throw new Error(`${branch} no longer builds on the cut ${input.cut.slice(0, 12)}; pin PR left unchanged`);
+    } else {
+      if ((await run("git", ["rev-parse", "HEAD"])).trim().toLowerCase() !== input.cut.toLowerCase())
+        throw new Error("MM-Work development moved after the suite snapshot; no pin PR opened");
+      await run("git", ["switch", "-c", branch]);
+    }
     for (const stage of ["rc", "main"]) {
       const path2 = (0, import_node_path34.join)(scratch, `${stage}-pins.json`);
       await (0, import_promises5.writeFile)(path2, JSON.stringify(input.pins.map((p) => ({ module: p.module, url: p[stage] }))));
       await run("node", ["scripts/pin-modules.mjs", "--stage", stage, "--pins", path2]);
     }
     await run("git", ["add", "seed/modules.json"]);
-    await run("git", ["commit", "-m", `Pin MM-Work suite candidate ${input.cut.slice(0, 12)} (#7262)`]);
+    await run("git", ["commit", "-m", prs.length ? `Correct MM-Work suite candidate pins ${input.cut.slice(0, 12)} (#7450)` : `Pin MM-Work suite candidate ${input.cut.slice(0, 12)} (#7262)`]);
+    if (prs.length) {
+      await run("git", ["push", "origin", branch]);
+      return { status: "pending", pr: prs[0].url };
+    }
     await run("git", ["push", "origin", branch]);
     const pr = (await run("gh", [
       "pr",
@@ -38761,7 +38887,7 @@ init_github_client();
 
 // src/issue-commands.ts
 var import_node_fs34 = require("node:fs");
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 init_cli_shared();
 init_clean_exit();
 init_error_codes();
@@ -39234,7 +39360,7 @@ function rowIdempotencyKey(batchKey, spec) {
   const identity = `${spec.type}
 ${spec.title.trim()}
 ${spec.body ?? ""}`;
-  const hash = (0, import_node_crypto13.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
+  const hash = (0, import_node_crypto14.createHash)("sha256").update(identity).digest("hex").slice(0, 16);
   return `${batchKey}:${hash}`;
 }
 var BATCH_SPEC_KEYS = /* @__PURE__ */ new Set(["type", "title", "body", "priority", "labels", "label", "parent", "repo", "surface"]);
@@ -45215,8 +45341,8 @@ function suiteTrainIo(root, summaryFile) {
       return "";
     }
   };
-  const registry2 = async () => {
-    const file = await defaultGitHubClient().rest("GET", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=development`);
+  const registry2 = async (ref = "development") => {
+    const file = await defaultGitHubClient().rest("GET", `repos/${SUITE_REPO}/contents/seed/modules.json?ref=${encodeURIComponent(ref)}`);
     if (!file?.content) throw new Error("MM-Work registry unreadable");
     const parsed = JSON.parse(decodeGitHubContents(file.content));
     suiteMembers(parsed);
@@ -45256,12 +45382,12 @@ function suiteTrainIo(root, summaryFile) {
       if (delta.ahead_by !== 1 || delta.behind_by !== 0 || delta.files?.length !== 1 || delta.files[0] !== "seed/modules.json")
         throw new Error("MM-Work development changed outside the one suite pin commit after the cut snapshot; refuse to cut an untested lead");
     },
-    verifyPins: async (pins) => {
-      const rows = await registry2();
+    verifyPins: async (pins, ref) => {
+      const rows = await registry2(ref);
       for (const pin of pins) {
         const row = rows.find((r) => r.id === pin.module);
         if (row?.bundles.rc !== pin.rc || row?.bundles.main !== pin.main)
-          throw new Error(`${pin.module}: MM-Work development pins no longer equal the tested cut; release refused`);
+          throw new Error(`${pin.module}: MM-Work ${ref} pins do not equal the tested cut (${row?.bundles.main ?? "no main pin"} vs ${pin.main}); release refused`);
       }
     },
     release,
@@ -45304,19 +45430,19 @@ function registerSuiteCommands(program3) {
       return fail(`suite rcand: ${e.message}`);
     }
   });
-  suite.command("abandon").description("retire an unfinished cut that opened no pin PR: archive the record; member rc tags stay (#7396)").option("--json", "structured receipt").action(async (o) => {
+  suite.command("abandon").description("retire an unfinished cut: archive the record; member rc tags stay (#7396). A cut whose pin PR landed but released nothing needs --owner-go (#7450)").option("--owner-go", "explicit owner approval to retire a cut whose pin PR already landed").option("--json", "structured receipt").action(async (o) => {
     try {
       const root = await leadRoot();
       const unlock = await acquireTrainWriterLock(root, "suite abandon");
       let result;
       try {
-        result = suiteAbandon(suiteTrainIo(root).recordPath);
+        result = suiteAbandon(suiteTrainIo(root).recordPath, o.ownerGo === true);
       } finally {
         await unlock();
       }
       console.log(o.json ? JSON.stringify(result, null, 2) : [
         `suite abandon: archived the cut record to ${result.archive}`,
-        ...result.orphanTags.length ? ["  member rc tags left in place (immutable; the next rc supersedes them):", ...result.orphanTags.map((t) => `  - ${t}`)] : ["  no member rc tag was minted"],
+        ...result.orphanTags.length ? ["  member rc tags left in place (immutable; the next cut reuses one still unreleased on its rc head, #7450):", ...result.orphanTags.map((t) => `  - ${t}`)] : ["  no member rc tag was minted"],
         "  the next suite rcand --owner-go re-snapshots every member"
       ].join("\n"));
     } catch (e) {
@@ -49303,14 +49429,14 @@ vercel preview (${preview.branch}): ${d.state}${d.url ? ` \u2014 ${d.url}` : ""}
 }
 
 // src/tenant-artifact.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var import_node_fs48 = require("node:fs");
 var import_promises10 = require("node:fs/promises");
 var import_node_path46 = require("node:path");
 var ARTIFACT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var MAX_BYTES = 5 * 1024 * 1024 * 1024;
 async function sha256File(path2) {
-  const hash = (0, import_node_crypto14.createHash)("sha256");
+  const hash = (0, import_node_crypto15.createHash)("sha256");
   for await (const chunk of (0, import_node_fs48.createReadStream)(path2)) hash.update(chunk);
   return hash.digest("hex");
 }
@@ -49540,13 +49666,13 @@ async function executeWaveLand(plan, deps) {
 
 // src/dist-drift.ts
 var import_node_child_process18 = require("node:child_process");
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var import_node_fs50 = require("node:fs");
 var import_node_os22 = require("node:os");
 var import_node_path48 = require("node:path");
 
 // ../scripts/distribution-digest.mjs
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var import_node_fs49 = require("node:fs");
 var import_node_path47 = require("node:path");
 var slash = (value) => value.replaceAll("\\", "/");
@@ -49559,7 +49685,7 @@ function repoPath(root, declaredPath, label) {
   return target;
 }
 function digestFiles(files) {
-  const hash = (0, import_node_crypto15.createHash)("sha256");
+  const hash = (0, import_node_crypto16.createHash)("sha256");
   for (const file of [...files].sort((a, b) => a.relative.localeCompare(b.relative))) {
     const content = file.stat.isSymbolicLink() ? Buffer.from((0, import_node_fs49.readlinkSync)(file.absolute), "utf8") : (0, import_node_fs49.readFileSync)(file.absolute);
     hash.update(file.relative, "utf8");
@@ -49589,7 +49715,7 @@ var DIST_ARTIFACTS = [
 ];
 var BOM_DIST_TREE_ID = "mmi-cli-dist";
 var ABSENT = "absent";
-var sha256 = (bytes) => `sha256:${(0, import_node_crypto16.createHash)("sha256").update(bytes).digest("hex")}`;
+var sha256 = (bytes) => `sha256:${(0, import_node_crypto17.createHash)("sha256").update(bytes).digest("hex")}`;
 function artifactDrift(path2, committedBytes, rebuiltBytes) {
   const committed = committedBytes ? sha256(committedBytes) : ABSENT;
   const rebuiltExpected = rebuiltBytes ? sha256(rebuiltBytes) : ABSENT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.46",
+  "version": "4.5.48",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",