@mutmutco/cli 4.5.56 → 4.5.58

package/dist/main.cjs

@@ -7130,12 +7130,37 @@ function extractOnBlock(yaml) {
   }
   return block.length ? block.join("\n") : null;
 }
-function collectPullRequestWorkflowContexts(workflows) {
+function jobUsesWorkflow(job) {
+  const match = job.body.match(/^\s+uses:\s*['"]?([^'"\s#]*\.github\/workflows\/[^'"\s#@]+\.ya?ml(?:@[^'"\s#]+)?)['"]?\s*(?:#.*)?$/m);
+  return match ? match[1] : null;
+}
+function reusableWorkflowRefs(workflows) {
+  const refs = /* @__PURE__ */ new Set();
+  for (const wf of workflows) {
+    if (!workflowTriggersPullRequest(wf.body)) continue;
+    for (const job of parseWorkflowJobs(wf.body)) {
+      const uses = jobUsesWorkflow(job);
+      if (uses && jobReportsPullRequestCheck(job)) refs.add(uses);
+    }
+  }
+  return [...refs];
+}
+function parseReusableWorkflowRef(uses) {
+  const local = uses.match(/^\.\/(\.github\/workflows\/[^@]+)$/);
+  if (local) return { path: local[1] };
+  const remote = uses.match(/^([^/]+\/[^/]+)\/(\.github\/workflows\/[^@]+)@(.+)$/);
+  return remote ? { repo: remote[1], path: remote[2], ref: remote[3] } : null;
+}
+function collectPullRequestWorkflowContexts(workflows, called = {}) {
   const contexts = /* @__PURE__ */ new Set();
   for (const wf of workflows) {
     if (!workflowTriggersPullRequest(wf.body)) continue;
     for (const job of parseWorkflowJobs(wf.body)) {
-      if (jobReportsPullRequestCheck(job)) contexts.add(job.id);
+      if (!jobReportsPullRequestCheck(job)) continue;
+      const uses = jobUsesWorkflow(job);
+      const body = uses ? called[uses] : void 0;
+      if (body) for (const inner of parseWorkflowJobs(body)) contexts.add(`${job.id} / ${inner.id}`);
+      else contexts.add(job.id);
     }
   }
   return [...contexts].sort((a, b) => a.localeCompare(b));
@@ -15672,11 +15697,12 @@ function planBootstrapLabels(labels, live) {
     ...labelsToPrune(labels.map((label) => label.name)).filter((name) => existing.has(name)).map((name) => ({ name, action: "DELETE" }))
   ];
 }
-function renderBootstrapAncillaryPlan(labels, environments) {
+function renderBootstrapAncillaryPlan(labels, environments, exceptions = []) {
   return [
     "bootstrap apply \u2014 labels and environments (dry-run; no mutations):",
     ...labels.map(({ action, name }) => `  ${action} label ${name}`),
-    ...environments.map(({ action, environment, reason }) => `  ${action} environment ${environment} (${reason})`)
+    ...environments.map(({ action, environment, reason }) => `  ${action} environment ${environment} (${reason})`),
+    ...exceptions.map(({ name, detail }) => `  OK environment ${name} (${detail})`)
   ].join("\n");
 }
 function resolveSeedContent(seed, vars, readFile9) {
@@ -17044,10 +17070,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.56",
-    tag: "v4.5.56",
-    commit: "7502269d51cd",
-    npm: "@mutmutco/cli@4.5.56"
+    version: "4.5.58",
+    tag: "v4.5.58",
+    commit: "05d087d1fcb7",
+    npm: "@mutmutco/cli@4.5.58"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17064,14 +17090,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.56"
+          v3Target: "v4.5.58"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.56 and redeploy the Hub Lambda from tag v4.5.56 (7502269d51cd); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.56 (@mutmutco/cli@4.5.56, tag commit 7502269d51cd \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.58 and redeploy the Hub Lambda from tag v4.5.58 (05d087d1fcb7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.58 (@mutmutco/cli@4.5.58, tag commit 05d087d1fcb7 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20069,9 +20095,14 @@ function validSuiteCutContext(repo, context) {
 function authorisedSuiteCut(repo, meta, context) {
   return validSuiteCutContext(repo, context) && !!meta?.suite && context.lead.toLowerCase() === suiteLeadRepo(repo, meta.suite).toLowerCase();
 }
+var BUNDLE_ONLY_RC_EXCEPTION = "suite member: rc is bundle-only (no rc runtime)";
+function isBundleOnlySuiteMember(repo, suite) {
+  if (!suite) return false;
+  return repo.split("/")[1]?.toLowerCase() !== suite.toLowerCase();
+}
 function suiteMemberRefusal(repo, meta, lane, solo = false, cut) {
   const suite = meta?.suite;
-  if (!suite || repo.split("/")[1]?.toLowerCase() === suite.toLowerCase()) return null;
+  if (!suite || !isBundleOnlySuiteMember(repo, suite)) return null;
   if (authorisedSuiteCut(repo, meta, cut)) return null;
   if (lane !== "rcand" && solo) return null;
   return `${repo} is part of the ${suite} suite; run the suite cut/release from ${suiteLeadRepo(repo, suite)} (mmi-cli devops suite rcand|release). A solo backend release needs --suite-solo --owner-go.`;
@@ -20676,7 +20707,7 @@ async function appendServedChannelLegs(deps, input, dispatch) {
   const publishStatus = input.publish?.state === "complete" ? "success" : "failure";
   const prepared = await (input.prepared ?? prepareServedChannel(deps, input));
   if (!isHubControlRepo(input.repo)) {
-    const bundleOnly = validSuiteCutContext(input.repo, deps.suiteCut) && input.repo.split("/")[1]?.toLowerCase() !== "mmi-katip";
+    const bundleOnly = validSuiteCutContext(input.repo, deps.suiteCut);
     const [home2, proof2] = await Promise.all([
       appendInstallHomePublish(deps, { repo: input.repo, installer: input.installer, publishStatus, watch: input.watch }, dispatch),
       bundleOnly && servedChannelFor(input.repo, input.installer) ? Promise.resolve({ ...dispatch, note: `${dispatch.note}; served channel not probed: a suite bundle-only release does not deploy the backend that serves it (#7468)` }) : appendServedChannelProof(deps, { repo: input.repo, tag: input.tag, shipped: shipLegsGreen(input.deploy, input.publish), installer: input.installer }, dispatch)
@@ -20946,7 +20977,7 @@ async function discoverShaWorkflowRuns(deps, repo, headSha, seenRunIds) {
   return extra;
 }
 async function dispatchDeploy(deps, ctx, stage, ref, model, watch, autoRunSince, autoRunHeadSha, dispatchFailure = "throw", publishDir) {
-  if (validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip" && stage !== "dev") {
+  if (validSuiteCutContext(ctx.repo, deps.suiteCut) && stage !== "dev") {
     return { note: "suite bundle-only: live backend not deployed", deployStatus: "success" };
   }
   if (isCentralDispatchModel(model)) {
@@ -21073,7 +21104,7 @@ async function attemptRetire(deps, ctx) {
   return { status: "failed", category: r.category ?? "transport-failed", note: r.note };
 }
 async function retireRcRuntime(deps, ctx, model, deployStatus, releasedRcSha) {
-  if (validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip")
+  if (validSuiteCutContext(ctx.repo, deps.suiteCut))
     return { status: "not-applicable", note: "bundle-only suite member has no rc runtime to retire" };
   if (model !== "tenant-container") {
     return { status: "not-applicable", note: `${model} has no co-resident rc runtime to retire` };
@@ -24693,7 +24724,7 @@ async function runTrainDoctor(input) {
     }
   }
   let preflightTimeouts = 0;
-  if (!(repo.split("/")[1]?.toLowerCase() !== "mmi-katip" && authorisedSuiteCut(repo, meta, input.suiteCut))) for (; ; ) {
+  if (!authorisedSuiteCut(repo, meta, input.suiteCut)) for (; ; ) {
     try {
       await train.runSelf(["secrets", "preflight", "--stage", stage, "--repo", repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
       break;
@@ -25136,7 +25167,7 @@ async function preflight(deps, ctx, stage, meta, lane) {
   if (model === "none") {
     throw new Error(`${ctx.repo} is not Hub-deployed (deployModel=none) \u2014 the release train does not apply; use the project's own release path`);
   }
-  if (!(ctx.slug !== "mmi-katip" && authorisedSuiteCut(ctx.repo, meta, deps.suiteCut)))
+  if (!authorisedSuiteCut(ctx.repo, meta, deps.suiteCut))
     await deps.runSelf(["secrets", "preflight", "--stage", stage, "--repo", ctx.repo, ...lane === "hotfix" ? ["--lane", "hotfix"] : []]);
   await assertNpmMajorPreflightFromWorkflows(deps, ctx.repo);
   await assertActionsJobsCanStart(deps, ctx.repo);
@@ -25735,7 +25766,7 @@ async function recordRcandDeployLegs(ledger, deps, anchors, deployModel, d, opts
   );
   const dispatch = recovered.deployStatus === "failure" && !recovered.note.includes(RCAND_RETRY_DEPLOY_COMMAND) ? { ...recovered, note: `once the cause is fixed, retry this rc deploy with \`${RCAND_RETRY_DEPLOY_COMMAND}\` (same tag and SHA, never re-cut): ${recovered.note}` } : recovered;
   const unverifiable = !isCentralDispatchModel(deployModel) && dispatch.deployStatus === "pending" && dispatch.runId == null && !dispatch.workflowRuns?.length;
-  const deployEntry = validSuiteCutContext(anchors.repo, deps.suiteCut) && anchors.repo.split("/")[1]?.toLowerCase() !== "mmi-katip" ? { state: "skipped", sha, note: "suite bundle-only: rc backend not deployed (#7262)" } : unverifiable ? { state: "skipped", sha, note: `${dispatch.note} \u2014 no run to verify on rc; recorded skipped, never pending (#6068)` } : deployPhaseInput(deployModel, dispatch, { releaseSha: sha });
+  const deployEntry = validSuiteCutContext(anchors.repo, deps.suiteCut) ? { state: "skipped", sha, note: "suite bundle-only: rc backend not deployed (#7262)" } : unverifiable ? { state: "skipped", sha, note: `${dispatch.note} \u2014 no run to verify on rc; recorded skipped, never pending (#6068)` } : deployPhaseInput(deployModel, dispatch, { releaseSha: sha });
   await recordPhase(ledger, deps, anchors, "deploy", phaseEntry(deployEntry), { ...opts, landed: "the immutable rc tag, the green wall, and origin/rc" });
   await recordPhase(ledger, deps, anchors, "publish", phaseEntry({ state: "skipped", sha, note: "rcand publishes nothing \u2014 the publish leg rides the release" }), { ...opts, landed });
   await recordPhase(ledger, deps, anchors, "alignment", phaseEntry({ state: "skipped", sha, note: "rcand aligns no branch \u2014 alignment rides the release" }), { ...opts, landed });
@@ -25898,7 +25929,7 @@ ${recovery.note}`), recoveryInput);
     }
   );
   const deployDispatch = annotateVersionEnvDispatch(await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, releaseSha, recoveredDeployDispatch), versionEnv);
-  const deployLeg = phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip" ? { state: "skipped", sha: releaseSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha }));
+  const deployLeg = phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) ? { state: "skipped", sha: releaseSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha }));
   await recordPhase(ledger, deps, ledgerAnchors, "deploy", deployLeg, {
     landed: "the immutable tag, the green required-check wall, the origin/main fast-forward, and the verified GitHub Release"
   });
@@ -26321,7 +26352,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       dispatch2.deployStatus = "success";
       dispatch2.note = `historical ${deployModel} deploy/publish status: success (re-verified by the recorded run)`;
     }
-    if (validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip") {
+    if (validSuiteCutContext(ctx.repo, deps.suiteCut)) {
       phaseInputs.deploy = { state: "skipped", sha: tagSha, note: "suite bundle-only: live backend not deployed (#7263)" };
       if (dispatch2.deployStatus !== "failure" && (phaseInputs.publish.state === "complete" || phaseInputs.publish.state === "skipped")) {
         dispatch2.deployStatus = "success";
@@ -26456,7 +26487,7 @@ ${recovery.note}`), recoveryInput);
   );
   const deployDispatch = annotateVersionEnvDispatch(await appendJervGatewayReleaseDeploy(deps, ctx.repo, tag, tagSha, recoveredDeployDispatch), versionEnv);
   steps.push(`dispatched the ${deployModel} deploy path`);
-  const deployLeg = persisted?.phases.deploy.superseded === true ? persisted.phases.deploy : phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) && ctx.slug !== "mmi-katip" ? { state: "skipped", sha: tagSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
+  const deployLeg = persisted?.phases.deploy.superseded === true ? persisted.phases.deploy : phaseEntry(validSuiteCutContext(ctx.repo, deps.suiteCut) ? { state: "skipped", sha: tagSha, note: "suite bundle-only: live backend not deployed (#7263)" } : deployPhaseInput(deployModel, deployDispatch, { releaseSha: tagSha }));
   if (persisted?.phases.deploy.superseded !== true) {
     await recordPhase(ledger, deps, anchors, "deploy", deployLeg, {
       strict: ledgerMode === "strict",
@@ -27279,7 +27310,17 @@ function gateWorkflowFiles(prWorkflowPaths) {
 }
 async function resolveEmittedPrContexts(deps, repo, branch) {
   const workflows = await resolveBranchWorkflows(deps, repo, branch);
-  return workflows === void 0 ? void 0 : collectPullRequestWorkflowContexts(workflows);
+  return workflows === void 0 ? void 0 : collectPullRequestWorkflowContexts(workflows, await resolveCalledWorkflows(deps, repo, branch, workflows));
+}
+async function resolveCalledWorkflows(deps, repo, branch, workflows) {
+  const called = {};
+  for (const uses of reusableWorkflowRefs(workflows)) {
+    const ref = parseReusableWorkflowRef(uses);
+    if (!ref) continue;
+    const body = await fetchFileContent(deps, ref.repo ?? repo, ref.ref ?? branch, ref.path);
+    if (body) called[uses] = body;
+  }
+  return called;
 }
 async function resolveBranchWorkflows(deps, repo, branch) {
   const paths = await listWorkflowPaths(deps, repo, branch);
@@ -27527,7 +27568,7 @@ async function auditRepoCi(repo, deps) {
   };
   const getEmittedPrContexts = async () => {
     const workflows = await getBranchWorkflows();
-    return workflows === void 0 ? void 0 : collectPullRequestWorkflowContexts(workflows);
+    return workflows === void 0 ? void 0 : collectPullRequestWorkflowContexts(workflows, await resolveCalledWorkflows(deps, repo, baseBranch, workflows));
   };
   const committedReferenceRaw = deployableGated ? await fetchFileContent(deps, repo, baseBranch, PRODUCT_RULESET_REF) : null;
   let authoritativeRuleset = null;
@@ -32321,11 +32362,12 @@ function environmentNamesForTrack(track) {
   const branches = new Set(branchesForTrack(track));
   return REPO_ENVIRONMENTS.filter((environment) => branches.has(ENVIRONMENT_BRANCHES[environment]));
 }
-function repoEnvironmentSpecs(_repo, releaseTrack = "full") {
+function repoEnvironmentSpecs(repo, releaseTrack = "full", suite) {
   const included = new Set(environmentNamesForTrack(releaseTrack));
   const trackExceptions = releaseTrack === "full" ? void 0 : TRACK_ENVIRONMENT_EXCEPTIONS[releaseTrack];
+  const bundleOnlyRc = isBundleOnlySuiteMember(repo, suite);
   return REPO_ENVIRONMENTS.map((name) => {
-    const exception = name in included ? void 0 : trackExceptions?.[name];
+    const exception = !included.has(name) ? trackExceptions?.[name] : name === "rc" && bundleOnlyRc ? BUNDLE_ONLY_RC_EXCEPTION : void 0;
     return {
       name,
       branch: ENVIRONMENT_BRANCHES[name],
@@ -32336,8 +32378,8 @@ function repoEnvironmentSpecs(_repo, releaseTrack = "full") {
     };
   });
 }
-function provisionedEnvironmentSpecs(repo, releaseTrack = "full") {
-  return repoEnvironmentSpecs(repo, releaseTrack).filter((spec) => spec.exception == null);
+function provisionedEnvironmentSpecs(repo, releaseTrack = "full", suite) {
+  return repoEnvironmentSpecs(repo, releaseTrack, suite).filter((spec) => spec.exception == null);
 }
 function asEnvironmentList(value) {
   if (Array.isArray(value)) return value;
@@ -32377,10 +32419,10 @@ var PLAN_GATED_PROTECTION_RE = /billing plan/i;
 function isPlanGatedProtectionError(error) {
   return PLAN_GATED_PROTECTION_RE.test(String(error?.message ?? error));
 }
-async function reconcileRepoEnvironments(repo, releaseTrack, client) {
+async function reconcileRepoEnvironments(repo, releaseTrack, client, suite) {
   const raw = await client.rest("GET", `repos/${repo}/environments`);
   const live = new Map(asEnvironmentList(raw).flatMap((entry) => entry.name ? [[entry.name, entry]] : []));
-  const planned = provisionedEnvironmentSpecs(repo, releaseTrack);
+  const planned = provisionedEnvironmentSpecs(repo, releaseTrack, suite);
   const created = [];
   const updated = [];
   const skipped = [];
@@ -32413,10 +32455,10 @@ async function reconcileRepoEnvironments(repo, releaseTrack, client) {
   }
   return { repo, planned, created, updated, skipped, planGated };
 }
-async function verifyRepoEnvironments(repo, releaseTrack, client) {
+async function verifyRepoEnvironments(repo, releaseTrack, client, suite) {
   const raw = await client.rest("GET", `repos/${repo}/environments`);
   const live = new Map(asEnvironmentList(raw).flatMap((entry) => entry.name ? [[entry.name, entry]] : []));
-  return provisionedEnvironmentSpecs(repo, releaseTrack).map((spec) => {
+  return provisionedEnvironmentSpecs(repo, releaseTrack, suite).map((spec) => {
     const drift = environmentDrift(live.get(spec.name), spec);
     return { environment: spec.name, missing: !live.has(spec.name), problems: drift.problems, notes: drift.notes };
   });
@@ -32534,7 +32576,17 @@ function planBootstrapControlPlane(input) {
     }
   }
   const deployStages = deployStagesForBootstrap(input.deployModel, input.releaseTrack);
+  const bundleOnlyRc = isBundleOnlySuiteMember(input.repo, input.suite);
   for (const stage of deployStages) {
+    if (stage === "rc" && bundleOnlyRc) {
+      rows.push({
+        kind: "deploy-row",
+        target: "DEPLOY#rc",
+        action: "skip",
+        detail: BUNDLE_ONLY_RC_EXCEPTION
+      });
+      continue;
+    }
     const present = input.deployFacts?.stages?.[stage]?.present === true;
     const command = bootstrapSetDeployCommand(input.repo, stage, input.deployModel);
     rows.push(present && stage === "main" ? {
@@ -32924,10 +32976,13 @@ function centralContainerPortRangeCheck(deployModel, portRange, repo) {
     detail: ok ? void 0 : `${deployModel} needs PROJECT# META.portRange for mmi-cli stage \u2014 assign with: mmi-cli stage port-range ${repo}`
   };
 }
-function deployRowChecks(repo, deployModel, releaseTrack, facts, factsRead) {
+function deployRowChecks(repo, deployModel, releaseTrack, facts, factsRead, suite) {
   const stages = deployStagesForBootstrap(deployModel, releaseTrack);
   if (!stages.length) return [];
   return stages.map((stage) => {
+    if (stage === "rc" && isBundleOnlySuiteMember(repo, suite)) {
+      return { ok: true, label: "DEPLOY#rc row exception", detail: BUNDLE_ONLY_RC_EXCEPTION };
+    }
     const ok = factsRead && facts?.stages?.[stage]?.present === true;
     return {
       ok,
@@ -32988,7 +33043,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   }
   let environmentDrift2 = [];
   try {
-    environmentDrift2 = await verifyRepoEnvironments(repo, effectiveTrack, deps.client);
+    environmentDrift2 = await verifyRepoEnvironments(repo, effectiveTrack, deps.client, deps.projectMeta?.suite);
   } catch (e) {
     checks.push({
       ok: false,
@@ -33003,7 +33058,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: drift.problems.length ? drift.problems.join("; ") : drift.notes.length ? `advisory: ${drift.notes.join("; ")}` : void 0
     });
   }
-  for (const spec of repoEnvironmentSpecs(repo, releaseTrack ?? (repoClass === "content" ? "trunk" : "full")).filter((entry) => entry.exception)) {
+  for (const spec of repoEnvironmentSpecs(repo, releaseTrack ?? (repoClass === "content" ? "trunk" : "full"), deps.projectMeta?.suite).filter((entry) => entry.exception)) {
     checks.push({ ok: true, label: `repository environment exception: ${spec.name}`, detail: spec.exception });
   }
   const strayTrainBranches = TRAIN_BRANCHES2.filter((b) => !branchesWanted.includes(b) && branchNames.has(b));
@@ -33077,7 +33132,8 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     deps.deployModel,
     effectiveTrack,
     deps.deployFacts,
-    deps.deployFactsRead === true
+    deps.deployFactsRead === true,
+    deps.projectMeta?.suite
   ));
   const readme = await contentText(deps, repo, baseBranch, "README.md");
   checks.push({
@@ -33672,6 +33728,7 @@ function registerBootstrapCommands(program3) {
         requiredCheckBranches: resolveRequiredCheckBranches(metaWithDeclaredClass(meta, cls), repo),
         requiredChecks: meta?.requiredChecks ?? void 0,
         deployModel: meta?.deployModel,
+        suite: meta?.suite,
         owners: controlOwners,
         github,
         deployFacts,
@@ -33738,31 +33795,39 @@ function registerBootstrapCommands(program3) {
       return fail(`bootstrap apply: ${e.message}`);
     }
     let effectiveTrack = bootstrapReleaseTrack;
+    let suiteSlug;
     if (!o.releaseTrack) {
       const read = await fetchProjectBySlugChecked(parsedRepo.slug, registryClientDeps(await loadConfig()));
       if (read.ok) {
         effectiveTrack = resolveReleaseTrack(metaWithDeclaredClass(read.project, o.class), void 0, repo);
+        suiteSlug = read.project?.suite;
       } else if (o.execute) {
         return failGraceful(`bootstrap apply: registry META unreadable (${read.error}) and no --release-track given \u2014 refusing to assume the ${bootstrapReleaseTrack} track for live writes`);
       } else {
         console.error(`bootstrap apply: registry META unreadable (${read.error}) \u2014 release track ${bootstrapReleaseTrack} is ASSUMED from the class default for this dry-run; --execute will refuse`);
       }
+    } else {
+      const read = await fetchProjectBySlugChecked(parsedRepo.slug, registryClientDeps(await loadConfig()));
+      if (read.ok) suiteSlug = read.project?.suite;
     }
     if (o.only.trim() === "environments") {
       const client = defaultGitHubClient();
       const envJson = { repo, track: effectiveTrack };
       if (!o.execute) {
-        const drift = await verifyRepoEnvironments(repo, effectiveTrack, client);
+        const drift = await verifyRepoEnvironments(repo, effectiveTrack, client, suiteSlug);
         const classified = drift.map(classifyEnvironmentDrift);
         envJson.plan = classified;
         if (o.json) console.log(JSON.stringify(envJson, null, 2));
         else {
           console.log(`bootstrap apply --only environments \u2014 dry-run (${repo}, track ${effectiveTrack}); no writes:`);
           for (const c of classified) console.log(`  ${c.action} ${c.environment} \u2014 ${c.reason}`);
+          for (const spec of repoEnvironmentSpecs(repo, effectiveTrack, suiteSlug)) {
+            if (spec.exception) console.log(`  OK environment ${spec.name} (${spec.exception})`);
+          }
           console.log("  (plan-gated protections \u2014 wait_timer/reviewers the org plan rejects \u2014 are reported at --execute)");
         }
       } else {
-        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, client);
+        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, client, suiteSlug);
         const lines2 = [];
         if (envResult.created.length) lines2.push(`environments created: ${envResult.created.join(", ")}`);
         if (envResult.updated.length) lines2.push(`environments updated: ${envResult.updated.join(", ")}`);
@@ -33770,6 +33835,9 @@ function registerBootstrapCommands(program3) {
         for (const gated of envResult.planGated) {
           lines2.push(`environment ${gated.environment}: plan-gated protections (${gated.protections.join(", ")} not settable on this org plan \u2014 policy-only provisioned)`);
         }
+        for (const spec of repoEnvironmentSpecs(repo, effectiveTrack, suiteSlug)) {
+          if (spec.exception) lines2.push(`OK environment ${spec.name} (${spec.exception})`);
+        }
         envJson.result = { created: envResult.created, updated: envResult.updated, skipped: envResult.skipped, planGated: envResult.planGated };
         if (o.json) console.log(JSON.stringify(envJson, null, 2));
         else {
@@ -33891,6 +33959,7 @@ function registerBootstrapCommands(program3) {
         requiredCheckBranches: resolveRequiredCheckBranches(metaWithDeclaredClass(registryMeta, o.class), repo),
         requiredChecks: registryMeta?.requiredChecks ?? void 0,
         deployModel: applyDeployModel,
+        suite: suiteSlug,
         owners: controlOwners,
         github,
         deployFacts: controlDeployFacts,
@@ -34235,7 +34304,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
     }
     if (o.execute && !onlyTarget) {
       try {
-        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, defaultGitHubClient());
+        const envResult = await reconcileRepoEnvironments(repo, effectiveTrack, defaultGitHubClient(), suiteSlug);
         if (envResult.created.length) applied.push(`environments created: ${envResult.created.join(", ")}`);
         if (envResult.updated.length) applied.push(`environments updated: ${envResult.updated.join(", ")}`);
         if (envResult.skipped.length) applied.push(`environments current: ${envResult.skipped.join(", ")}`);
@@ -34332,6 +34401,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         requiredCheckBranches: resolveRequiredCheckBranches(metaWithDeclaredClass(registryMeta, o.class), repo),
         requiredChecks: registryMeta?.requiredChecks ?? void 0,
         deployModel: applyDeployModel,
+        suite: suiteSlug,
         owners: controlOwners,
         github,
         deployFacts: controlDeployFacts,
@@ -34375,7 +34445,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         const liveLabels = JSON.parse((await gh2(["label", "list", "-R", repo, "--limit", "1000", "--json", "name"])).stdout);
         if (!Array.isArray(liveLabels)) throw new Error("label list is not an array");
         ancillaryPlan = planBootstrapLabels(manifest.labels, liveLabels);
-        environmentPlan = (await verifyRepoEnvironments(repo, effectiveTrack, controlClient)).map(classifyEnvironmentDrift);
+        environmentPlan = (await verifyRepoEnvironments(repo, effectiveTrack, controlClient, suiteSlug)).map(classifyEnvironmentDrift);
       } catch (e) {
         return failGraceful(`bootstrap apply: cannot plan labels/environments; no writes made: ${e.message}`);
       }
@@ -34386,7 +34456,7 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
       if (controlRows.length) console.log(`
 ${renderBootstrapControlPlan(controlRows)}`);
       if (ancillaryPlan && environmentPlan) console.log(`
-${renderBootstrapAncillaryPlan(ancillaryPlan, environmentPlan)}`);
+${renderBootstrapAncillaryPlan(ancillaryPlan, environmentPlan, repoEnvironmentSpecs(repo, effectiveTrack, suiteSlug).filter((spec) => spec.exception).map((spec) => ({ name: spec.name, detail: spec.exception })))}`);
       if (o.execute) console.log(`
 LIVE apply to ${repo}:
   ${applied.join("\n  ")}`);
@@ -35051,13 +35121,15 @@ var RELEASE_TAG = /^v\d+\.\d+\.\d+$/;
 function suitePins(record, bundles) {
   return record.members.map((m) => m.carried ? { module: m.id, rc: m.rcPin, main: m.mainPin } : {
     module: m.id,
-    rc: `https://${m.id === "katip" ? m.rcHost ?? m.host : m.host}/${m.id === "katip" ? "" : "rc/"}module.js?v=${m.tag}`,
+    rc: `https://${m.host}/rc/module.js?v=${m.tag}`,
     main: mainPinFor(m.host, bundles[m.id], suiteReleaseTag(m.tag))
   });
 }
 function mainPinFor(host, bundles, tag) {
-  const path2 = [bundles?.dev, bundles?.main].map(pathOf).find(Boolean) ?? "/module.js";
-  return `https://${host}${path2}?v=${tag}`;
+  return `https://${host}${mainBundlePath(bundles)}?v=${tag}`;
+}
+function mainBundlePath(bundles) {
+  return [bundles?.dev, bundles?.main].map(pathOf).find(Boolean) ?? "/module.js";
 }
 function pathOf(url) {
   try {
@@ -35085,7 +35157,7 @@ function readSuiteCut(path2) {
   } catch {
     throw new Error(`suite cut record unreadable at ${path2}; repair it, never recut`);
   }
-  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent"].includes(record.announcement) || !record.leadReleased) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
+  if (record.schema !== SCHEMA || record.lead !== SUITE_REPO || !SHA2.test(record.leadDevelopment) || !SHA2.test(record.leadPreviousRc) || !Array.isArray(record.members) || record.members.length === 0 || record.pinPr !== void 0 && (typeof record.pinPr !== "string" || !record.pinPr.startsWith("https://github.com/mutmutco/MM-Work/pull/")) || record.pinMerged !== void 0 && (record.pinMerged !== true && record.pinMerged !== false || !record.pinPr) || record.leadRcTag !== void 0 && (!RC_TAG.test(record.leadRcTag) || !SHA2.test(record.leadRcSha ?? "") || !record.pinMerged) || record.leadReleased !== void 0 && (record.leadReleased !== true || !record.leadRcTag) || record.announcement !== void 0 && (!["pending", "sent", "skipped"].includes(record.announcement) || !record.leadReleased) || record.members.some((m) => !m.id || !m.repo || !m.backend || !m.host || !SHA2.test(m.development) || !SHA2.test(m.previousRc) || m.rcWasAbsent !== void 0 && m.rcWasAbsent !== true || m.tag !== void 0 && (!RC_TAG.test(m.tag) || !SHA2.test(m.sha ?? "")) || m.published !== void 0 && (m.published !== true || !m.tag) || m.released !== void 0 && (m.released !== true || !m.published) || m.mainPublished !== void 0 && (m.mainPublished !== true || !m.released || !!m.carried) || m.backendAfterRelease !== void 0 && (!m.released || typeof m.backendAfterRelease !== "string") || m.carried !== void 0 && (m.carried !== true || m.tag !== void 0 || m.published !== void 0 || !isPin(m.rcPin) || !isPin(m.mainPin)) || m.carried === void 0 && (m.rcPin !== void 0 || m.mainPin !== void 0)))
     throw new Error(`suite cut record has unknown or invalid state at ${path2}; repair it, never recut`);
   return record;
 }
@@ -35141,13 +35213,13 @@ async function suiteRcand(deps, opts) {
   const members = suiteMembers(await deps.registry());
   const modules = members.filter((m) => m.repo !== SUITE_REPO);
   const plan = [
-    ...modules.map((m) => `${m.repo}: normal rcand${m.id === "katip" ? " + rc server" : " + module-rc-publish.yml"} (once)`),
+    ...modules.map((m) => `${m.repo}: normal rcand + module-rc-publish.yml (once)`),
     `${SUITE_REPO}: one PR for both rc/main pins, wait for merge`,
     `${SUITE_REPO}: rcand`
   ];
   if (opts.dryRun) return { plan };
   let record = readSuiteCut(deps.recordPath);
-  if (record?.announcement === "sent" && record.leadReleased) {
+  if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
     if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
     (0, import_node_fs29.renameSync)(deps.recordPath, archive);
@@ -35165,7 +35237,7 @@ async function suiteRcand(deps, opts) {
         const [backend, development, rcHead] = await Promise.all([deps.backend(m), deps.head(m.repo, "development"), deps.head(m.repo, "rc")]);
         const previousRc = rcHead ?? await deps.head(m.repo, "main");
         if (!backend.version || !backend.host || !development || !SHA2.test(development) || !previousRc || !SHA2.test(previousRc)) throw new Error(`${m.repo}: live backend or branch snapshot is unproven; no cut started`);
-        return { repo: m.repo, id: m.id, backend: backend.version, host: backend.host, rcHost: backend.rcHost, development, previousRc, ...rcHead === null ? { rcWasAbsent: true } : {} };
+        return { repo: m.repo, id: m.id, backend: backend.version, host: backend.host, development, previousRc, ...rcHead === null ? { rcWasAbsent: true } : {} };
       }))
     ]);
     if (!leadDevelopment || !leadPreviousRc || !SHA2.test(leadDevelopment) || !SHA2.test(leadPreviousRc)) throw new Error("MM-Work development/rc SHA unproven; no cut started");
@@ -35198,7 +35270,7 @@ async function suiteRcand(deps, opts) {
   }
   const refusals = [];
   for (const member of record.members) {
-    if (member.published || member.id === "katip") continue;
+    if (member.published) continue;
     try {
       await deps.preflight(member.repo);
     } catch (e) {
@@ -35216,7 +35288,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
     if ((await deps.head(member.repo, "development"))?.toLowerCase() !== member.development.toLowerCase())
       throw new Error(`${member.repo}: development moved after the cut snapshot; refuse to add untested code`);
     if (member.carried) {
-      if (member.id !== "katip") await deps.publish(member.repo, pinVersion(member.rcPin));
+      await deps.publish(member.repo, pinVersion(member.rcPin));
       continue;
     }
     if (!member.tag) {
@@ -35229,7 +35301,7 @@ Each module must ship a live release that bind-mounts <deployPath>/data read-onl
     }
     if ((await deps.tagSha(member.repo, member.tag))?.toLowerCase() !== member.sha.toLowerCase()) throw new Error(`${member.repo}: rc tag ${member.tag} moved or is unreadable; stop`);
     if (!member.published) {
-      if (member.id !== "katip") await deps.publish(member.repo, member.tag);
+      await deps.publish(member.repo, member.tag);
       member.published = true;
       writeSuiteCut(deps.recordPath, record);
     }
@@ -35288,43 +35360,59 @@ async function suiteRelease(deps, ownerGo) {
       if (hotfix) member.hotfixedTo = hotfix;
     }
     if (member.hotfixedTo && !member.released) continue;
-    const katipReleaseSha = member.id === "katip" ? await deps.tagSha(member.repo, planned) : void 0;
-    const expectedBackend = member.id === "katip" && member.released ? member.backendAfterRelease ?? katipReleaseSha : member.backend;
-    if (live.version !== expectedBackend && !(member.id === "katip" && !member.released && katipReleaseSha && live.version === katipReleaseSha))
-      throw new Error(`${member.repo}: live backend changed after the cut (${expectedBackend} \u2192 ${live.version}); release refused`);
+    if (live.version !== member.backend && !(member.hotfixedTo && await deps.hotfixOver(member.repo, planned, live.version) === member.hotfixedTo))
+      throw new Error(`${member.repo}: live backend changed after the cut (${member.backend} \u2192 ${live.version}); release refused`);
   }
   if ((await deps.tagSha(SUITE_REPO, record.leadRcTag))?.toLowerCase() !== record.leadRcSha?.toLowerCase()) throw new Error("MM-Work rc tag changed after the cut; release refused");
+  const publishesMain = !record.leadReleased;
+  const refusals = [];
   for (const member of record.members) {
-    if (member.released || member.carried) continue;
-    if (member.hotfixedTo) {
-      console.warn(`${member.repo}: released as ${member.releasedAs ?? suiteReleaseTag(member.tag)} and hotfixed to ${member.hotfixedTo}, which is live; recorded as released (#7482)`);
-      member.backendAfterRelease = (await deps.backend({ repo: member.repo, id: member.id, bundles: {} })).version;
+    if (!publishesMain || member.carried || member.released) continue;
+    try {
+      await deps.preflightMain(member.repo, mainBundlePath(members.find((m) => m.repo === member.repo)?.bundles));
+    } catch (e) {
+      refusals.push(`${member.repo}: ${e.message}`);
+    }
+  }
+  if (refusals.length) throw new Error(`module main serving is not ready; no member was released:
+${refusals.join("\n")}
+Each member's live release must serve <data>/main/module.js at its main pin path when <data>/main exists.`);
+  for (const member of record.members) {
+    if (member.carried) continue;
+    if (!member.released) {
+      if (member.hotfixedTo) {
+        console.warn(`${member.repo}: released as ${member.releasedAs ?? suiteReleaseTag(member.tag)} and hotfixed to ${member.hotfixedTo}, which is live; recorded as released (#7482)`);
+      } else {
+        if (member.releasedAs && member.releasedAs !== suiteReleaseTag(member.tag)) console.warn(`${member.repo}: its rc already shipped as ${member.releasedAs}, not ${suiteReleaseTag(member.tag)}; finishing that release (#7464)`);
+        await deps.release(member.repo, member.releasedAs ?? suiteReleaseTag(member.tag), member.sha);
+      }
       member.released = true;
       writeSuiteCut(deps.recordPath, record);
-      continue;
     }
-    if (member.releasedAs && member.releasedAs !== suiteReleaseTag(member.tag)) console.warn(`${member.repo}: its rc already shipped as ${member.releasedAs}, not ${suiteReleaseTag(member.tag)}; finishing that release (#7464)`);
-    await deps.release(member.repo, member.releasedAs ?? suiteReleaseTag(member.tag), member.sha);
-    if (member.id === "katip") {
-      const expected = await deps.tagSha(member.repo, member.releasedAs ?? suiteReleaseTag(member.tag));
-      const live = await deps.backend({ repo: member.repo, id: member.id, bundles: {} });
-      if (!expected || live.version !== expected) throw new Error(`${member.repo}: normal main deploy not stamped at released tag SHA; resume after verifying live backend`);
-      member.backendAfterRelease = live.version;
+    if (publishesMain && !member.mainPublished) {
+      await deps.publishMain(member.repo, member.hotfixedTo ?? member.releasedAs ?? suiteReleaseTag(member.tag), mainBundlePath(members.find((m) => m.repo === member.repo)?.bundles));
+      member.mainPublished = true;
+      writeSuiteCut(deps.recordPath, record);
     }
-    member.released = true;
-    writeSuiteCut(deps.recordPath, record);
   }
   if (!record.leadReleased) {
     await deps.release(SUITE_REPO, suiteReleaseTag(record.leadRcTag), record.leadRcSha);
     record.leadReleased = true;
     writeSuiteCut(deps.recordPath, record);
   }
-  if (record.announcement === "pending") throw new Error("suite announcement outcome ambiguous; verify it before retrying (never post twice)");
+  if (record.announcement === "pending") {
+    const reason = await deps.announceSkipReason(record);
+    if (!reason) throw new Error("suite announcement outcome ambiguous; verify it before retrying (never post twice)");
+    record.announcement = "skipped";
+    record.announcementNote = reason;
+    writeSuiteCut(deps.recordPath, record);
+  }
   if (!record.announcement) {
     record.announcement = "pending";
     writeSuiteCut(deps.recordPath, record);
-    await deps.announce(record);
-    record.announcement = "sent";
+    const { skipped } = await deps.announce(record);
+    record.announcement = skipped ? "skipped" : "sent";
+    if (skipped) record.announcementNote = skipped;
     writeSuiteCut(deps.recordPath, record);
   }
   return record;
@@ -45296,10 +45384,7 @@ function suiteTrainIo(root, summaryFile) {
       throw new Error(`${member.repo}: healthy live backend stamp and edgeDomains.main must agree with DEPLOY#main; stop`);
     const health = await probePublicHealth(url);
     if (!health.ok) throw new Error(`${member.repo}: live backend health could not be proved at ${url}; stop`);
-    const rcHost = edgeDomains?.rc;
-    if (member.id === "katip" && (!rcHost || facts?.stages.rc?.domain !== rcHost))
-      throw new Error(`${member.repo}: normal Katip rc host must agree with DEPLOY#rc; stop`);
-    return { version: live.deployedTag, host, ...rcHost ? { rcHost } : {} };
+    return { version: live.deployedTag, host };
   };
   const tagSha = async (repo, tag) => {
     try {
@@ -45414,10 +45499,22 @@ function suiteTrainIo(root, summaryFile) {
     const run = await watchRcRun(title, [`repo=${repo}`, `tag=${tag}`], existing[0]);
     if (run.conclusion !== "success") throw new Error(`${repo}: module rc publish run ${run.id} not green${await rcRunCause(run.id)}`);
   };
+  const publishMain = async (repo, tag, path2) => {
+    const title = `module-main-publish ${repo} @ ${tag}`;
+    const existing = (await rcRuns()).filter((r) => r.displayTitle === title).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+    if (existing[0]?.conclusion === "success") return;
+    if (existing[0]?.conclusion === "failure") throw new Error(`${repo}: prior module-main-publish ${tag} failed; inspect the run and retry it explicitly before continuing`);
+    const run = await watchRcRun(title, [`repo=${repo}`, `tag=${tag}`, "channel=main", `path=${path2}`], existing[0]);
+    if (run.conclusion !== "success") throw new Error(`${repo}: module main publish run ${run.id} not green${await rcRunCause(run.id)}`);
+  };
   const preflight2 = async (repo) => {
     const run = await watchRcRun(`module-rc-preflight ${repo}`, [`repo=${repo}`, "preflight=true"], void 0);
     if (run.conclusion !== "success") throw new Error(`rc serving preflight run ${run.id} failed${await rcRunCause(run.id)}`);
   };
+  const preflightMain = async (repo, path2) => {
+    const run = await watchRcRun(`module-main-preflight ${repo}`, [`repo=${repo}`, "channel=main", `path=${path2}`, "preflight=true"], void 0);
+    if (run.conclusion !== "success") throw new Error(`main serving preflight run ${run.id} failed${await rcRunCause(run.id)}`);
+  };
   const rcRunCause = async (id) => {
     try {
       return rcRunCauseFromLog(await exec("gh", ["run", "view", String(id), "--repo", "mutmutco/MMI-Hub", "--log-failed"]));
@@ -45458,6 +45555,8 @@ function suiteTrainIo(root, summaryFile) {
     rcand: runRcand,
     publish,
     preflight: preflight2,
+    publishMain,
+    preflightMain,
     pin: (input) => openSuiteCutPinPr({ root, run: (file, args, cwd) => exec(file, args, cwd, GIT_TIMEOUT_MS) }, input),
     verifyLeadCut: async (sha) => {
       const current = await gh(["api", `repos/${SUITE_REPO}/git/ref/heads/development`, "--jq", ".object.sha"]);
@@ -45481,7 +45580,15 @@ function suiteTrainIo(root, summaryFile) {
     announce: async (record) => {
       if (!summaryFile) throw new Error("suite announcement requires --announce-summary-file; outcome was not posted");
       const result = await trainApplyDeps().announce?.({ repo: SUITE_REPO, tag: record.leadRcTag.replace(/-rc\.\d+$/, ""), summaryFile });
+      if (result?.status === "skipped") return { skipped: result.note };
       if (result?.status !== "announced") throw new Error(`suite announcement unverified: ${result?.note ?? "no announcement seam"}`);
+      return {};
+    },
+    announceSkipReason: async () => {
+      const slug = slugOf(SUITE_REPO);
+      const read = await fetchProjectBySlugChecked(slug, registryClientDeps(await loadConfig()));
+      if (!read.ok) throw new Error(`suite announcement: registry read failed for ${slug} (${read.error}); outcome stays ambiguous`);
+      return read.project?.releaseChannel?.trim() ? null : `no releaseChannel configured for ${slug}; nothing could have been posted`;
     }
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.56",
+  "version": "4.5.58",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",