@mutmutco/cli 4.5.60 → 4.5.62

package/dist/main.cjs

@@ -11949,6 +11949,9 @@ function describeSessionIdentity(env = process.env) {
     host: (0, import_node_os8.hostname)()
   };
 }
+function formatSessionIdentity(identity) {
+  return `${identity.surface ?? "unknown-surface"}/${identity.session ?? "no-session"}@${identity.host ?? "unknown-host"}`;
+}
 
 // src/board-doctor-config.ts
 init_github_client();
@@ -13201,7 +13204,7 @@ function formatClaimAge(ageMs) {
   return `${Math.floor(hours / 24)}d`;
 }
 function describeClaimMarker(marker) {
-  return `${marker.surface ?? "unknown-surface"}/${marker.session ?? "no-session"}@${marker.host ?? "unknown-host"}`;
+  return formatSessionIdentity(marker);
 }
 function boardItemClaim(item) {
   const marker = item.details ? latestClaimMarker(item.details.comments) : void 0;
@@ -14266,6 +14269,7 @@ function encodeGitHubContents(content) {
 // src/bootstrap-ruleset.ts
 init_github_client();
 var PRODUCT_RULESET_NAME = "mmi-product-required-checks";
+var PRODUCT_PENDING_RULESET_PREFIX = "mmi-product-required-checks-pending-";
 var PRODUCT_GATE_CONTEXT = "gate";
 var PRODUCT_RULESET_PATH = ".github/rulesets/mmi-product-required-checks.json";
 function reseedProductRulesetStrictness(current, seed, declared = {}) {
@@ -14441,7 +14445,8 @@ async function activateProductRuleset(repo, rulesetBody, client, enforcement = "
   const wantStrict = rulesetStrictPolicy({ rules: rulesetBody.rules });
   const wantBranches = rulesetBranchIncludes(rulesetBody);
   const list = await client.rest("GET", `repos/${repo}/rulesets`, { timeoutMs: 2e4 });
-  const existing = findProductRuleset(list ?? []);
+  const wantName = rulesetBody.name ?? PRODUCT_RULESET_NAME;
+  const existing = (list ?? []).find((r) => r.name === wantName);
   if (existing?.id != null) {
     const detail = await client.rest("GET", `repos/${repo}/rulesets/${existing.id}`, { timeoutMs: 2e4 });
     const keepActive = detail.enforcement === "active" && enforcement === "disabled";
@@ -17151,10 +17156,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.60",
-    tag: "v4.5.60",
-    commit: "18fb882893af",
-    npm: "@mutmutco/cli@4.5.60"
+    version: "4.5.62",
+    tag: "v4.5.62",
+    commit: "5328997bb80a",
+    npm: "@mutmutco/cli@4.5.62"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17171,14 +17176,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.60"
+          v3Target: "v4.5.62"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.60 and redeploy the Hub Lambda from tag v4.5.60 (18fb882893af); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.60 (@mutmutco/cli@4.5.60, tag commit 18fb882893af \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.62 and redeploy the Hub Lambda from tag v4.5.62 (5328997bb80a); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.62 (@mutmutco/cli@4.5.62, tag commit 5328997bb80a \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -22752,6 +22757,10 @@ function parseReleaseLedger(raw) {
   if (lane !== void 0 && (typeof lane !== "string" || !LANE_SET.has(lane))) {
     throw new ReleaseLedgerError("invalid-record", `release ledger has an unknown lane ${JSON.stringify(lane)}`);
   }
+  const cutBy = obj.cutBy;
+  if (cutBy !== void 0 && (typeof cutBy !== "object" || cutBy === null || Array.isArray(cutBy) || ["surface", "session", "host"].some((key) => typeof cutBy[key] !== "string" || !cutBy[key].trim()))) {
+    throw new ReleaseLedgerError("invalid-record", "release ledger has a malformed cutBy identity");
+  }
   const phasesRaw = obj.phases;
   if (typeof phasesRaw !== "object" || phasesRaw === null || Array.isArray(phasesRaw)) {
     throw new ReleaseLedgerError("unreadable", "release ledger phases block is not an object");
@@ -22761,7 +22770,7 @@ function parseReleaseLedger(raw) {
     if (!PHASE_SET.has(phase)) continue;
     phases[phase] = validatePhaseRecord(phase, rec);
   }
-  return { schema: RELEASE_LEDGER_SCHEMA, repo, tag, tagSha, ...lane !== void 0 ? { lane } : {}, phases, updatedAt: obj.updatedAt };
+  return { schema: RELEASE_LEDGER_SCHEMA, repo, tag, tagSha, ...lane !== void 0 ? { lane } : {}, ...cutBy !== void 0 ? { cutBy } : {}, phases, updatedAt: obj.updatedAt };
 }
 function validateLedgerAnchors(ledger, expected) {
   const anchors = normalizeAnchorsForCompare(expected);
@@ -23042,6 +23051,7 @@ function safeRunAction(runId, runRepo, state) {
 }
 function formatReleaseLedgerReport(report) {
   const lines2 = [`release phase ledger${report.lane ? ` [${report.lane}]` : ""}: ${report.phaseStatus.toUpperCase()} (${report.path}) \u2014 phase status of the recorded boundaries, NOT the release verdict`];
+  if (report.cutBy) lines2.push(`  cut by: ${formatSessionIdentity(report.cutBy)}`);
   for (const leg of report.legs) {
     const detail = leg.error ?? leg.note;
     const run = [leg.workflow, leg.event ? `(${leg.event})` : void 0, leg.runId != null ? `run ${leg.runId}` : void 0, leg.runRepo ? `in ${leg.runRepo}` : void 0].filter(Boolean).join(" ");
@@ -23055,7 +23065,7 @@ function formatReleaseLedgerReport(report) {
 function releaseLedgerReport(ledger, path2) {
   if (!ledger) return void 0;
   const derived = deriveReleasePhaseStatus(ledger);
-  return { path: path2, ...ledger.lane ? { lane: ledger.lane } : {}, phases: ledger.phases, phaseStatus: derived.phaseStatus, legs: derived.legs };
+  return { path: path2, ...ledger.lane ? { lane: ledger.lane } : {}, ...ledger.cutBy ? { cutBy: ledger.cutBy } : {}, phases: ledger.phases, phaseStatus: derived.phaseStatus, legs: derived.legs };
 }
 var TRANSIENT_TRANSPORT_MARKERS = [
   /connection (?:reset|refused|aborted|timed? ?out)/i,
@@ -23660,6 +23670,7 @@ async function startReleaseLedger(ledger, anchors, opts = {}) {
           tag: normalized.tag,
           tagSha: normalized.tagSha,
           ...opts.lane ? { lane: opts.lane } : {},
+          cutBy: opts.cutBy ?? describeSessionIdentity(),
           phases: emptyPhases(),
           updatedAt: now().toISOString()
         };
@@ -25054,6 +25065,11 @@ function formatTrainDoctor(v) {
 
 // src/release-plain-words.ts
 var import_promises3 = require("node:fs/promises");
+function releaseCutByNotes(cutBy) {
+  return `## Internal
+Cut by ${formatSessionIdentity(cutBy)}
+`;
+}
 var PLAIN_WORDS_HEADING = "## In plain words";
 var PLAIN_WORDS_MARKER = "<!-- mmi:big -->";
 function buildPlainWordsSection(lines2, big) {
@@ -26038,7 +26054,8 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "promotion", phaseEntry({ state: "complete", sha: releaseSha, note: `immutable ${tag} pushed at ${releaseSha.slice(0, 12)}; origin/main fast-forwarded to it` }), { landed: "the immutable tag and the green required-check wall" });
   deps.warn?.("Release: Creating the GitHub Release");
   const autoRunSince = (deps.now ?? Date.now)();
-  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+  const cutBy = (await ledger?.load(ledgerAnchors))?.cutBy ?? describeSessionIdentity();
+  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--notes", releaseCutByNotes(cutBy), "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   await writePlainWordsSection(deps, options, ctx.repo, meta, tag);
   await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
@@ -26252,7 +26269,7 @@ Nothing was written. Inspect ${ledger.path} before retrying.`);
         runUrl: dispatch2.runUrl,
         workflowRuns: dispatch2.workflowRuns,
         deployStatus: dispatch2.deployStatus,
-        ...ledgerReport2 ? { ledger: ledgerReport2 } : {},
+        ...ledgerReport2 ? { cutBy: ledgerReport2.cutBy, ledger: ledgerReport2 } : {},
         note: terminal ? `reused immutable ${tag} and existing origin/rc promotion; the ledger-owned rc deploy is ${deployLeg.state} \u2014 candidate complete, nothing re-pushed or re-dispatched` : `reused immutable ${tag} and existing origin/rc promotion; terminalized the ledger-owned rc deploy without re-pushing the branch`
       };
     }
@@ -26322,7 +26339,7 @@ ${spent.note}`);
     runUrl: dispatch.runUrl,
     workflowRuns: dispatch.workflowRuns,
     deployStatus: dispatch.deployStatus,
-    ...ledgerReport ? { ledger: ledgerReport } : {},
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {},
     note: `reused immutable ${tag}; pushed its exact SHA to rc and dispatched the rc deploy`
   };
 }
@@ -26380,7 +26397,7 @@ Nothing was written. Inspect ${ledger.path} before retrying.`);
     runUrl: dispatch.runUrl,
     workflowRuns: dispatch.workflowRuns,
     deployStatus: dispatch.deployStatus,
-    ...ledgerReport ? { ledger: ledgerReport } : {},
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {},
     note: `re-dispatched the failed rc deploy of immutable ${tag} at ${tagSha.slice(0, 12)}; nothing re-cut, re-tagged or re-pushed`
   };
 }
@@ -26541,7 +26558,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       devRollForward: devRollForward2,
       rcAlignment: rcAlignment2,
       dispatch: dispatch2,
-      ...ledgerReport2 ? { ledger: ledgerReport2 } : {},
+      ...ledgerReport2 ? { cutBy: ledgerReport2.cutBy, ledger: ledgerReport2 } : {},
       note: state2 === "failed" ? `release ${tag} was already published, but its deploy/publish on the release SHA FAILED \u2014 re-run the failed job (do NOT re-tag); the protected alignment PRs were reused` : state2 === "pending" ? `release ${tag} was already published; reused its protected alignment PRs, but a deploy/publish or alignment follow-up is unresolved \u2014 watch it to completion` : `release ${tag} was already published; alignment is complete and the deploy on the release SHA is proven green`
     };
   }
@@ -26596,7 +26613,8 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
   deps.warn?.("Release: Creating the GitHub Release");
   const autoRunSince = (deps.now ?? Date.now)();
-  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+  const cutBy = (await ledger.load(anchors))?.cutBy ?? describeSessionIdentity();
+  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--notes", releaseCutByNotes(cutBy), "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   steps.push(`created the GitHub Release for ${tag}`);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
   steps.push("verified the Release published against the tagged commit");
@@ -26687,7 +26705,7 @@ ${recovery.note}`), recoveryInput);
     dispatch,
     devRollForward,
     rcAlignment,
-    ...ledgerReport ? { ledger: ledgerReport } : {},
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {},
     note: followUp === "failed" ? `resumed ${tag} (version preserved, not re-cut) \u2014 but a watched deploy/publish run FAILED; the Release stands, re-run the failed job (do NOT re-tag)` : followUp === "pending" ? `resumed ${tag} (version preserved, not re-cut) \u2014 a deploy/publish or alignment follow-up is unresolved; watch it to completion` : `resumed and completed ${tag} \u2014 the original version was preserved, not re-cut`
   };
 }
@@ -27015,7 +27033,7 @@ ${spent.note}`), rcandRecovery(tag2));
     const d0 = annotateVersionEnvDispatch(await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha, "report"), versionEnv);
     const d2 = await recordRcandDeployLegs(ledger, deps, anchors, deployModel2, d0);
     const rcLedgerReport = releaseLedgerReport(await ledger?.load(anchors).catch(() => void 0), ledger?.path ?? "(no ledger)");
-    return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, bumpIntent, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus, ...rcLedgerReport ? { ledger: rcLedgerReport } : {} };
+    return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, bumpIntent, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus, ...rcLedgerReport ? { cutBy: rcLedgerReport.cutBy, ledger: rcLedgerReport } : {} };
   }
   if (mode === "release-dev") {
     await requireBranch(deps, "development");
@@ -27097,7 +27115,7 @@ ${spent.note}`), rcandRecovery(tag2));
         announceNote: announceNote2,
         devNote: options.dev ? "--dev is a no-op on a direct-track repo \u2014 it already releases development -> main" : void 0,
         release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 },
-        ...ledgerReport2 ? { ledger: ledgerReport2 } : {}
+        ...ledgerReport2 ? { cutBy: ledgerReport2.cutBy, ledger: ledgerReport2 } : {}
       };
     }
     const retirement2 = hasRcBranch ? await retireRcRuntime(deps, ctx, deployModel2, d2.deployStatus, rcShaAtRelease) : { status: "not-applicable", note: "no origin/rc branch \u2014 rc runtime retirement skipped" };
@@ -27129,7 +27147,7 @@ ${spent.note}`), rcandRecovery(tag2));
       devNote: "released development -> main (--dev), skipping the rc candidate",
       release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 },
       environments: environments2,
-      ...fullLedgerReport ? { ledger: fullLedgerReport } : {}
+      ...fullLedgerReport ? { cutBy: fullLedgerReport.cutBy, ledger: fullLedgerReport } : {}
     };
   }
   await requireBranch(deps, "rc");
@@ -27210,7 +27228,7 @@ ${spent.note}`), rcandRecovery(tag2));
     announceNote,
     release: { tag, url: releaseUrl, targetSha: releaseSha },
     environments,
-    ...ledgerReport ? { ledger: ledgerReport } : {}
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {}
   };
 }
 async function latestLocalReleaseTag(deps, mergedInto) {
@@ -27597,6 +27615,41 @@ function parseAuthoritativeRuleset(raw, meta, repo) {
     coversReleaseBranches: rulesetCoversReleaseBranches(apiPayload, resolveReleaseTrack(meta, void 0, repo))
   };
 }
+function planBranchRequiredContexts(input) {
+  const contexts = sortedUnique([...input.contexts]);
+  const branches = [...new Set(input.branches.map((b) => b.replace(/^refs\/heads\//, "")))];
+  const common = contexts.filter((context) => branches.every((branch) => input.emittedByBranch[branch]?.includes(context) === true));
+  const pending = branches.map((branch) => ({
+    branch,
+    contexts: contexts.filter((context) => !common.includes(context) && input.emittedByBranch[branch]?.includes(context) === true)
+  })).filter((entry) => entry.contexts.length > 0);
+  const waiting = branches.map((branch) => ({
+    branch,
+    contexts: contexts.filter((context) => input.emittedByBranch[branch]?.includes(context) !== true)
+  })).filter((entry) => entry.contexts.length > 0);
+  return { common, pending, waiting };
+}
+async function branchContextPlan(deps, repo, authority, meta) {
+  const branches = resolveRequiredCheckBranches(meta, repo);
+  const emittedByBranch = {};
+  const unreadable = [];
+  for (const branch of branches) {
+    const presence = await branchPresence(deps, repo, branch);
+    if (presence === false) continue;
+    emittedByBranch[branch] = await resolveEmittedPrContexts(deps, repo, branch);
+    if (presence === void 0 || emittedByBranch[branch] === void 0) unreadable.push(branch);
+  }
+  return { ...planBranchRequiredContexts({ contexts: authority.contexts, branches, emittedByBranch }), unreadable };
+}
+function projectCommonAuthority(authority, common) {
+  const apiPayload = patchRulesetRequiredContexts(authority.apiPayload, common);
+  return {
+    ...authority,
+    contexts: common,
+    apiPayload,
+    filePayload: { ...authority.filePayload, rules: apiPayload.rules }
+  };
+}
 function sameContexts(left, right) {
   return left.length === right.length && left.every((context, index) => context === right[index]);
 }
@@ -27771,6 +27824,7 @@ async function auditRepoCi(repo, callerDeps) {
   };
   const committedReferenceRaw = deployableGated ? await fetchFileContent(deps, repo, baseBranch, PRODUCT_RULESET_REF) : null;
   let authoritativeRuleset = null;
+  let branchPlan = null;
   let authoritativeRulesetParseError = null;
   if (committedReferenceRaw != null) {
     try {
@@ -27818,6 +27872,33 @@ async function auditRepoCi(repo, callerDeps) {
     });
   } else if (deployableGated) {
     const productRuleset = rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
+    if (authoritativeRuleset && authoritativeRuleset.source === "registry META requiredChecks") {
+      branchPlan = await branchContextPlan(deps, repo, authoritativeRuleset, meta);
+      if (branchPlan.unreadable.length) {
+        checks.push({ ok: true, label: "branch-specific required checks cannot audit", detail: `workflow emitters unreadable on [${branchPlan.unreadable.join(", ")}] \u2014 no propagation conclusion` });
+        branchPlan = null;
+      }
+      if (branchPlan) authoritativeRuleset = projectCommonAuthority(authoritativeRuleset, branchPlan.common);
+      if (branchPlan?.waiting.length) checks.push({
+        ok: true,
+        label: "required checks pending branch propagation",
+        detail: `warning: ${branchPlan.waiting.map((entry) => `${entry.branch} waits for workflow emitter(s) [${entry.contexts.join(", ")}]`).join("; ")} \u2014 reconcile enforces these only where the branch workflows emit them`
+      });
+      if (branchPlan) {
+        const expectedPending = new Set(branchPlan.pending.map((entry) => PRODUCT_PENDING_RULESET_PREFIX + entry.branch));
+        const livePending = rulesets.filter((r) => r.name?.startsWith(PRODUCT_PENDING_RULESET_PREFIX));
+        const pendingAligned = branchPlan.pending.every((entry) => {
+          const live = livePending.find((r) => r.name === PRODUCT_PENDING_RULESET_PREFIX + entry.branch);
+          return live?.enforcement === "active" && sameContexts(sortedUnique(rulesetRequiredContexts(live)), entry.contexts) && sameContexts(rulesetBranchIncludes(live), [`refs/heads/${entry.branch}`]) && rulesetStrictPolicy(live) === authoritativeRuleset?.committedStrict;
+        }) && livePending.every((r) => expectedPending.has(r.name ?? ""));
+        checks.push({
+          ok: pendingAligned,
+          label: "branch-specific required checks match workflow emitters",
+          detail: pendingAligned ? void 0 : "pending ruleset contexts or branch conditions have not converged to the emitted registry requirements",
+          remediation: pendingAligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
+        });
+      }
+    }
     const liveContexts = productRuleset == null ? [] : sortedUnique(rulesetRequiredContexts(productRuleset));
     const liveBranchIncludes = productRuleset == null ? [] : rulesetBranchIncludes(productRuleset);
     const liveStrict = productRuleset != null && rulesetStrictPolicy(productRuleset);
@@ -27870,21 +27951,22 @@ async function auditRepoCi(repo, callerDeps) {
     }
     const contextAuthority = authoritativeRuleset ?? registryAuthorityWithoutReference(meta, repo);
     if (contextAuthority != null) {
+      const declaredPolicy = registryAuthorityWithoutReference(meta, repo) ?? contextAuthority;
       const emitted = await getEmittedPrContexts();
       if (emitted !== void 0) {
         const emittedSet = new Set(emitted);
-        const missingEmitters = contextAuthority.contexts.filter((context) => !emittedSet.has(context));
+        const missingEmitters = declaredPolicy.contexts.filter((context) => !emittedSet.has(context));
         checks.push({
           ok: missingEmitters.length === 0,
           label: REQUIRED_CONTEXTS_EMITTED_LABEL,
-          detail: missingEmitters.length ? `${contextAuthority.source} requires [${contextAuthority.contexts.join(", ")}] but pull_request workflows do not emit [${missingEmitters.join(", ")}]` : void 0,
+          detail: missingEmitters.length ? `${declaredPolicy.source} requires [${declaredPolicy.contexts.join(", ")}] but pull_request workflows do not emit [${missingEmitters.join(", ")}]` : void 0,
           remediation: missingEmitters.length ? `Fix the pull_request workflows or ${contextAuthority.source} before reconciling` : void 0
         });
       }
       if (hasRequiredChecks) {
         const gateFiles = new Set(gateWorkflowFiles(prWorkflowPaths));
         const gateWorkflows = (await getBranchWorkflows() ?? []).filter((wf) => gateFiles.has(wf.path.slice(wf.path.lastIndexOf("/") + 1)));
-        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job));
+        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job) && !branchPlan?.pending.some((entry) => entry.branch === baseBranch && entry.contexts.includes(job)));
         checks.push({
           ok: unblocking.length === 0,
           label: UNBLOCKING_GATE_JOBS_LABEL,
@@ -27892,8 +27974,8 @@ async function auditRepoCi(repo, callerDeps) {
           remediation: unblocking.length ? `mmi-cli oracle org project set ${repo} --var requiredChecks=${JSON.stringify(sortedUnique([...liveContexts, ...unblocking]))} then mmi-cli devops ci reconcile --repo ${repo} --apply \u2014 or make a required job \`needs:\` them` : void 0
         });
       }
-      const prOnly = contextAuthority.coversReleaseBranches ? contextAuthority.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context)) : [];
-      const tagBlind = contextAuthority.coversReleaseBranches ? contextsUnreachableOnTagPush(contextAuthority.contexts, await getBranchWorkflows() ?? [], TRAIN_PR_ONLY_CONTEXTS) : [];
+      const prOnly = declaredPolicy.coversReleaseBranches ? declaredPolicy.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context)) : [];
+      const tagBlind = declaredPolicy.coversReleaseBranches ? contextsUnreachableOnTagPush(declaredPolicy.contexts, await getBranchWorkflows() ?? [], TRAIN_PR_ONLY_CONTEXTS) : [];
       checks.push({
         ok: prOnly.length === 0 && tagBlind.length === 0,
         label: TAG_ADDRESSABLE_CONTEXTS_LABEL,
@@ -28312,7 +28394,7 @@ async function parkProductRuleset(repo, deps) {
   return result;
 }
 function reconcileOwnedFailures(report) {
-  return report.checks.filter((check) => !check.ok).filter((check) => check.label.startsWith("allow_") || check.label.startsWith("delete_branch") || check.label.startsWith("has_wiki") || check.label.startsWith("gate workflow committed on ") || check.label.startsWith("product ruleset reference committed on ") || check.label === "product required status checks active" || check.label === RULESET_REFERENCE_MATCH_LABEL || check.label === REQUIRED_CONTEXTS_EMITTED_LABEL || check.label === TAG_ADDRESSABLE_CONTEXTS_LABEL).map((check) => check.label);
+  return report.checks.filter((check) => !check.ok).filter((check) => check.label.startsWith("allow_") || check.label.startsWith("delete_branch") || check.label.startsWith("has_wiki") || check.label.startsWith("gate workflow committed on ") || check.label.startsWith("product ruleset reference committed on ") || check.label === "product required status checks active" || check.label === RULESET_REFERENCE_MATCH_LABEL || check.label === "branch-specific required checks match workflow emitters" || check.label === REQUIRED_CONTEXTS_EMITTED_LABEL || check.label === TAG_ADDRESSABLE_CONTEXTS_LABEL).map((check) => check.label);
 }
 async function finalizeCiReconcile(repo, deps, result, before, pendingReason) {
   if (result.errors.length > 0) {
@@ -28372,7 +28454,7 @@ async function authoritativeSafetyHold(authority, deps, repo, baseBranch, meta)
   if (missing.length > 0) {
     return `${authority.source} requires context(s) with no pull_request workflow emitter [${missing.join(", ")}]; no source or live mutation was made`;
   }
-  if (authority.coversReleaseBranches) {
+  if (authority.coversReleaseBranches && authority.source !== "registry META requiredChecks") {
     const track = resolveReleaseTrack(meta, void 0, repo);
     const releaseBranches = branchesForTrack(track).filter((b) => b !== baseBranch);
     const ignore = /* @__PURE__ */ new Set([...AGENT_PR_BOOKKEEPING_CONTEXTS, ...TRAIN_PR_ONLY_CONTEXTS]);
@@ -28451,6 +28533,21 @@ async function applyCiReconcileRepo(repo, deps) {
     result.errors.push(`${authority.source} declares no required contexts`);
     return finalizeCiReconcile(repo, deps, result, report);
   }
+  let pendingPlan = null;
+  const declaredContexts = authority.contexts;
+  if (authority.source === "registry META requiredChecks") {
+    pendingPlan = await branchContextPlan(deps, repo, authority, meta);
+    if (pendingPlan.unreadable.length) {
+      const reason = `required branch workflow emitters unreadable on [${pendingPlan.unreadable.join(", ")}] \u2014 ruleset convergence deferred`;
+      result.skipped.push(reason);
+      return finalizeCiReconcile(repo, deps, result, report, reason);
+    }
+    if (pendingPlan.common.length === 0) {
+      result.errors.push("no common required context is emitted by every required branch \u2014 ruleset convergence deferred");
+      return finalizeCiReconcile(repo, deps, result, report);
+    }
+    authority = projectCommonAuthority(authority, pendingPlan.common);
+  }
   const sourceNeedsConvergence = !sameContexts(authority.committedContexts, authority.contexts) || !sameContexts(authority.committedBranchIncludes, authority.branchIncludes) || !authority.committedStrict;
   if (sourceNeedsConvergence) {
     try {
@@ -28499,7 +28596,13 @@ async function applyCiReconcileRepo(repo, deps) {
   }
   const filteredPaths = new Set(pathFilteredPullRequestWorkflows(bodies).filter((p) => !p.endsWith("/agent-pr.yml")));
   const safeContexts = new Set(collectPullRequestWorkflowContexts(bodies.filter((b) => !filteredPaths.has(b.path))));
-  const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => authority.contexts.includes(c) && !safeContexts.has(c));
+  const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => declaredContexts.includes(c) && !safeContexts.has(c));
+  if (pendingPlan?.pending.some((entry) => entry.contexts.some((context) => unsafe.includes(context)))) {
+    const reason = `pending required-check rulesets left non-enforcing \u2014 [${unsafe.join(", ")}] emitted only by path-filtered workflows`;
+    result.skipped.push(reason);
+    return finalizeCiReconcile(repo, deps, result, report, reason);
+  }
+  const gateProvenGreen = await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles);
   const plan = resolveProductRulesetReconcilePlan({
     liveEnforcement: live?.enforcement,
     liveContexts,
@@ -28508,7 +28611,7 @@ async function applyCiReconcileRepo(repo, deps) {
     authorityBranchIncludes: authority.branchIncludes,
     liveStrict: live == null ? void 0 : rulesetStrictPolicy(live),
     authorityStrict: authority.committedStrict,
-    gateProvenGreen: await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles),
+    gateProvenGreen,
     unsafeContexts: unsafe
   });
   if (!plan.shouldActivate) {
@@ -28517,15 +28620,49 @@ async function applyCiReconcileRepo(repo, deps) {
       return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
     }
     result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts, branches and up-to-date policy already match declared authority`);
-    return finalizeCiReconcile(repo, deps, result, report);
   }
-  try {
-    const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
-    if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
-    else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
-  } catch (e) {
-    result.errors.push(e.message);
-    return finalizeCiReconcile(repo, deps, result, report);
+  if (plan.shouldActivate) {
+    try {
+      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
+      if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
+      else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+    } catch (e) {
+      result.errors.push(e.message);
+      return finalizeCiReconcile(repo, deps, result, report);
+    }
+  }
+  if (pendingPlan) {
+    if (pendingPlan.pending.length > 0 && !gateProvenGreen) {
+      const reason = "pending required-check rulesets left non-enforcing \u2014 the gate is not green on development";
+      result.skipped.push(reason);
+      return finalizeCiReconcile(repo, deps, result, report, reason);
+    }
+    try {
+      const desired = /* @__PURE__ */ new Set();
+      for (const entry of pendingPlan.pending) {
+        const name = PRODUCT_PENDING_RULESET_PREFIX + entry.branch;
+        desired.add(name);
+        const statusOnly = {
+          ...authority.apiPayload,
+          name,
+          rules: authority.apiPayload.rules.filter((rule) => rule.type === "required_status_checks")
+        };
+        const payload = patchRulesetBranchIncludes(
+          patchRulesetRequiredContexts(statusOnly, entry.contexts),
+          [entry.branch]
+        );
+        const activation = await activateProductRuleset(repo, payload, deps.client);
+        (activation.action === "skipped" ? result.skipped : result.applied).push(`${name}: ${activation.action}`);
+      }
+      const list = await deps.client.rest("GET", `repos/${repo}/rulesets`);
+      for (const stale of list ?? []) {
+        if (!stale.name?.startsWith(PRODUCT_PENDING_RULESET_PREFIX) || desired.has(stale.name) || stale.id == null) continue;
+        await deps.client.rest("DELETE", `repos/${repo}/rulesets/${stale.id}`);
+        result.applied.push(`deleted converged ${stale.name}`);
+      }
+    } catch (e) {
+      result.errors.push(`pending ruleset convergence failed: ${e.message}`);
+    }
   }
   return finalizeCiReconcile(repo, deps, result, report);
 }
@@ -36704,7 +36841,8 @@ ${decision.note}`);
   if (releaseExists) {
     releaseNote = `Release ${tag} already exists \u2014 resumed without recreating`;
   } else {
-    await deps.run("gh", ["release", "create", tag, "--repo", ctx.repo, "--target", "main", "--generate-notes", "--latest"]);
+    const cutBy = (await ledger.load(anchors))?.cutBy ?? describeSessionIdentity();
+    await deps.run("gh", ["release", "create", tag, "--repo", ctx.repo, "--target", "main", "--notes", releaseCutByNotes(cutBy), "--generate-notes", "--latest"]);
     releaseNote = `Release ${tag} created (target main)`;
   }
   await writePlainWordsSection(deps, options, ctx.repo, meta, tag);
@@ -36828,7 +36966,7 @@ ${decision.note}`);
     foldNote,
     foldStatus,
     announceNote,
-    ...ledgerReport ? { ledger: ledgerReport } : {}
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {}
   };
   if (TRAIN_BRANCHES.includes(startBranch)) {
     return withCheckoutRestoredAfterRelease(deps, result, startBranch);
@@ -36878,7 +37016,7 @@ async function runHotfixRetryDeployLocked(deps, versionInput) {
     ...foldNote ? { foldNote } : {},
     ...foldStatus ? { foldStatus } : {},
     ...runs ? { runs } : {},
-    ...report ? { ledger: report } : {}
+    ...report ? { cutBy: report.cutBy, ledger: report } : {}
   };
 }
 function deriveHotfixState(f) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.60",
+  "version": "4.5.62",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",