@mutmutco/cli 4.5.61 → 4.5.63

package/dist/main.cjs

@@ -8489,6 +8489,22 @@ function shouldWithdrawSurfaceFlag(result) {
 
 // src/secrets-transport.ts
 init_client_version();
+
+// ../shared/quota-attribution.ts
+var ATTRIBUTION_MAX = 120;
+function sanitizeAttribution(value, max = ATTRIBUTION_MAX) {
+  if (typeof value !== "string" || !Number.isInteger(max) || max < 1) return void 0;
+  const cleaned = value.replace(/[^A-Za-z0-9 ._/@:-]/g, "").replace(/\s+/g, " ").trim().slice(0, max);
+  return cleaned.length > 0 ? cleaned : void 0;
+}
+function attributionFields(attr) {
+  if (!attr) return {};
+  const command = sanitizeAttribution(attr.command);
+  const via = sanitizeAttribution(attr.via);
+  return { ...command ? { for: command } : {}, ...via ? { via } : {} };
+}
+
+// src/secrets-transport.ts
 var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
@@ -8664,7 +8680,7 @@ async function fetchSecretValue(deps, key, opts, diagnose = false) {
     const res = await fetchVaultRead(deps, `${deps.apiUrl}/secrets/get`, {
       method: "POST",
       headers: await deps.headers({ "content-type": "application/json" }),
-      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {} })
+      body: JSON.stringify({ repo, key, use: true, ...slug ? { slug } : {}, ...attributionFields(opts.attribution) })
     });
     if (!res.ok) {
       if (diagnose) {
@@ -11949,6 +11965,9 @@ function describeSessionIdentity(env = process.env) {
     host: (0, import_node_os8.hostname)()
   };
 }
+function formatSessionIdentity(identity) {
+  return `${identity.surface ?? "unknown-surface"}/${identity.session ?? "no-session"}@${identity.host ?? "unknown-host"}`;
+}
 
 // src/board-doctor-config.ts
 init_github_client();
@@ -13201,7 +13220,7 @@ function formatClaimAge(ageMs) {
   return `${Math.floor(hours / 24)}d`;
 }
 function describeClaimMarker(marker) {
-  return `${marker.surface ?? "unknown-surface"}/${marker.session ?? "no-session"}@${marker.host ?? "unknown-host"}`;
+  return formatSessionIdentity(marker);
 }
 function boardItemClaim(item) {
   const marker = item.details ? latestClaimMarker(item.details.comments) : void 0;
@@ -14266,6 +14285,7 @@ function encodeGitHubContents(content) {
 // src/bootstrap-ruleset.ts
 init_github_client();
 var PRODUCT_RULESET_NAME = "mmi-product-required-checks";
+var PRODUCT_PENDING_RULESET_PREFIX = "mmi-product-required-checks-pending-";
 var PRODUCT_GATE_CONTEXT = "gate";
 var PRODUCT_RULESET_PATH = ".github/rulesets/mmi-product-required-checks.json";
 function reseedProductRulesetStrictness(current, seed, declared = {}) {
@@ -14441,7 +14461,8 @@ async function activateProductRuleset(repo, rulesetBody, client, enforcement = "
   const wantStrict = rulesetStrictPolicy({ rules: rulesetBody.rules });
   const wantBranches = rulesetBranchIncludes(rulesetBody);
   const list = await client.rest("GET", `repos/${repo}/rulesets`, { timeoutMs: 2e4 });
-  const existing = findProductRuleset(list ?? []);
+  const wantName = rulesetBody.name ?? PRODUCT_RULESET_NAME;
+  const existing = (list ?? []).find((r) => r.name === wantName);
   if (existing?.id != null) {
     const detail = await client.rest("GET", `repos/${repo}/rulesets/${existing.id}`, { timeoutMs: 2e4 });
     const keepActive = detail.enforcement === "active" && enforcement === "disabled";
@@ -17151,10 +17172,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.61",
-    tag: "v4.5.61",
-    commit: "72f52b1d5bbb",
-    npm: "@mutmutco/cli@4.5.61"
+    version: "4.5.63",
+    tag: "v4.5.63",
+    commit: "89c6b4bfae7e",
+    npm: "@mutmutco/cli@4.5.63"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17171,14 +17192,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.61"
+          v3Target: "v4.5.63"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.61 and redeploy the Hub Lambda from tag v4.5.61 (72f52b1d5bbb); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.61 (@mutmutco/cli@4.5.61, tag commit 72f52b1d5bbb \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.63 and redeploy the Hub Lambda from tag v4.5.63 (89c6b4bfae7e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.63 (@mutmutco/cli@4.5.63, tag commit 89c6b4bfae7e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -22752,6 +22773,10 @@ function parseReleaseLedger(raw) {
   if (lane !== void 0 && (typeof lane !== "string" || !LANE_SET.has(lane))) {
     throw new ReleaseLedgerError("invalid-record", `release ledger has an unknown lane ${JSON.stringify(lane)}`);
   }
+  const cutBy = obj.cutBy;
+  if (cutBy !== void 0 && (typeof cutBy !== "object" || cutBy === null || Array.isArray(cutBy) || ["surface", "session", "host"].some((key) => typeof cutBy[key] !== "string" || !cutBy[key].trim()))) {
+    throw new ReleaseLedgerError("invalid-record", "release ledger has a malformed cutBy identity");
+  }
   const phasesRaw = obj.phases;
   if (typeof phasesRaw !== "object" || phasesRaw === null || Array.isArray(phasesRaw)) {
     throw new ReleaseLedgerError("unreadable", "release ledger phases block is not an object");
@@ -22761,7 +22786,7 @@ function parseReleaseLedger(raw) {
     if (!PHASE_SET.has(phase)) continue;
     phases[phase] = validatePhaseRecord(phase, rec);
   }
-  return { schema: RELEASE_LEDGER_SCHEMA, repo, tag, tagSha, ...lane !== void 0 ? { lane } : {}, phases, updatedAt: obj.updatedAt };
+  return { schema: RELEASE_LEDGER_SCHEMA, repo, tag, tagSha, ...lane !== void 0 ? { lane } : {}, ...cutBy !== void 0 ? { cutBy } : {}, phases, updatedAt: obj.updatedAt };
 }
 function validateLedgerAnchors(ledger, expected) {
   const anchors = normalizeAnchorsForCompare(expected);
@@ -23042,6 +23067,7 @@ function safeRunAction(runId, runRepo, state) {
 }
 function formatReleaseLedgerReport(report) {
   const lines2 = [`release phase ledger${report.lane ? ` [${report.lane}]` : ""}: ${report.phaseStatus.toUpperCase()} (${report.path}) \u2014 phase status of the recorded boundaries, NOT the release verdict`];
+  if (report.cutBy) lines2.push(`  cut by: ${formatSessionIdentity(report.cutBy)}`);
   for (const leg of report.legs) {
     const detail = leg.error ?? leg.note;
     const run = [leg.workflow, leg.event ? `(${leg.event})` : void 0, leg.runId != null ? `run ${leg.runId}` : void 0, leg.runRepo ? `in ${leg.runRepo}` : void 0].filter(Boolean).join(" ");
@@ -23055,7 +23081,7 @@ function formatReleaseLedgerReport(report) {
 function releaseLedgerReport(ledger, path2) {
   if (!ledger) return void 0;
   const derived = deriveReleasePhaseStatus(ledger);
-  return { path: path2, ...ledger.lane ? { lane: ledger.lane } : {}, phases: ledger.phases, phaseStatus: derived.phaseStatus, legs: derived.legs };
+  return { path: path2, ...ledger.lane ? { lane: ledger.lane } : {}, ...ledger.cutBy ? { cutBy: ledger.cutBy } : {}, phases: ledger.phases, phaseStatus: derived.phaseStatus, legs: derived.legs };
 }
 var TRANSIENT_TRANSPORT_MARKERS = [
   /connection (?:reset|refused|aborted|timed? ?out)/i,
@@ -23660,6 +23686,7 @@ async function startReleaseLedger(ledger, anchors, opts = {}) {
           tag: normalized.tag,
           tagSha: normalized.tagSha,
           ...opts.lane ? { lane: opts.lane } : {},
+          cutBy: opts.cutBy ?? describeSessionIdentity(),
           phases: emptyPhases(),
           updatedAt: now().toISOString()
         };
@@ -25054,6 +25081,11 @@ function formatTrainDoctor(v) {
 
 // src/release-plain-words.ts
 var import_promises3 = require("node:fs/promises");
+function releaseCutByNotes(cutBy) {
+  return `## Internal
+Cut by ${formatSessionIdentity(cutBy)}
+`;
+}
 var PLAIN_WORDS_HEADING = "## In plain words";
 var PLAIN_WORDS_MARKER = "<!-- mmi:big -->";
 function buildPlainWordsSection(lines2, big) {
@@ -26038,7 +26070,8 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, ledgerAnchors, "promotion", phaseEntry({ state: "complete", sha: releaseSha, note: `immutable ${tag} pushed at ${releaseSha.slice(0, 12)}; origin/main fast-forwarded to it` }), { landed: "the immutable tag and the green required-check wall" });
   deps.warn?.("Release: Creating the GitHub Release");
   const autoRunSince = (deps.now ?? Date.now)();
-  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+  const cutBy = (await ledger?.load(ledgerAnchors))?.cutBy ?? describeSessionIdentity();
+  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--notes", releaseCutByNotes(cutBy), "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", releaseSha);
   await writePlainWordsSection(deps, options, ctx.repo, meta, tag);
   await recordPhase(ledger, deps, ledgerAnchors, "githubRelease", phaseEntry({ state: "complete", sha: releaseSha, runUrl: releaseUrl, note: `verified GitHub Release ${tag} against ${releaseSha.slice(0, 12)}` }), { landed: "the immutable tag, the green required-check wall, and the origin/main fast-forward" });
@@ -26252,7 +26285,7 @@ Nothing was written. Inspect ${ledger.path} before retrying.`);
         runUrl: dispatch2.runUrl,
         workflowRuns: dispatch2.workflowRuns,
         deployStatus: dispatch2.deployStatus,
-        ...ledgerReport2 ? { ledger: ledgerReport2 } : {},
+        ...ledgerReport2 ? { cutBy: ledgerReport2.cutBy, ledger: ledgerReport2 } : {},
         note: terminal ? `reused immutable ${tag} and existing origin/rc promotion; the ledger-owned rc deploy is ${deployLeg.state} \u2014 candidate complete, nothing re-pushed or re-dispatched` : `reused immutable ${tag} and existing origin/rc promotion; terminalized the ledger-owned rc deploy without re-pushing the branch`
       };
     }
@@ -26322,7 +26355,7 @@ ${spent.note}`);
     runUrl: dispatch.runUrl,
     workflowRuns: dispatch.workflowRuns,
     deployStatus: dispatch.deployStatus,
-    ...ledgerReport ? { ledger: ledgerReport } : {},
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {},
     note: `reused immutable ${tag}; pushed its exact SHA to rc and dispatched the rc deploy`
   };
 }
@@ -26380,7 +26413,7 @@ Nothing was written. Inspect ${ledger.path} before retrying.`);
     runUrl: dispatch.runUrl,
     workflowRuns: dispatch.workflowRuns,
     deployStatus: dispatch.deployStatus,
-    ...ledgerReport ? { ledger: ledgerReport } : {},
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {},
     note: `re-dispatched the failed rc deploy of immutable ${tag} at ${tagSha.slice(0, 12)}; nothing re-cut, re-tagged or re-pushed`
   };
 }
@@ -26541,7 +26574,7 @@ Nothing was written. Inspect ${ledger.path} (or clear it only after proving the
       devRollForward: devRollForward2,
       rcAlignment: rcAlignment2,
       dispatch: dispatch2,
-      ...ledgerReport2 ? { ledger: ledgerReport2 } : {},
+      ...ledgerReport2 ? { cutBy: ledgerReport2.cutBy, ledger: ledgerReport2 } : {},
       note: state2 === "failed" ? `release ${tag} was already published, but its deploy/publish on the release SHA FAILED \u2014 re-run the failed job (do NOT re-tag); the protected alignment PRs were reused` : state2 === "pending" ? `release ${tag} was already published; reused its protected alignment PRs, but a deploy/publish or alignment follow-up is unresolved \u2014 watch it to completion` : `release ${tag} was already published; alignment is complete and the deploy on the release SHA is proven green`
     };
   }
@@ -26596,7 +26629,8 @@ ${recovery.note}`), recoveryInput);
   await recordPhase(ledger, deps, anchors, "promotion", phaseEntry({ state: "complete", sha: tagSha, note: `resumed: ${tagSha.slice(0, 12)} pushed to origin/main (tag preserved, never re-cut)` }), { strict: ledgerMode === "strict", landed: "the immutable tag and the re-proven required-check wall" });
   deps.warn?.("Release: Creating the GitHub Release");
   const autoRunSince = (deps.now ?? Date.now)();
-  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
+  const cutBy = (await ledger.load(anchors))?.cutBy ?? describeSessionIdentity();
+  const releaseUrl = clean2(await deps.run("gh", ["release", "create", tag, "--target", "main", "--notes", releaseCutByNotes(cutBy), "--generate-notes", "--latest", "--repo", ctx.repo])) || void 0;
   steps.push(`created the GitHub Release for ${tag}`);
   await verifyPublishedRelease(deps, ctx.repo, tag, "main", tagSha);
   steps.push("verified the Release published against the tagged commit");
@@ -26687,7 +26721,7 @@ ${recovery.note}`), recoveryInput);
     dispatch,
     devRollForward,
     rcAlignment,
-    ...ledgerReport ? { ledger: ledgerReport } : {},
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {},
     note: followUp === "failed" ? `resumed ${tag} (version preserved, not re-cut) \u2014 but a watched deploy/publish run FAILED; the Release stands, re-run the failed job (do NOT re-tag)` : followUp === "pending" ? `resumed ${tag} (version preserved, not re-cut) \u2014 a deploy/publish or alignment follow-up is unresolved; watch it to completion` : `resumed and completed ${tag} \u2014 the original version was preserved, not re-cut`
   };
 }
@@ -27015,7 +27049,7 @@ ${spent.note}`), rcandRecovery(tag2));
     const d0 = annotateVersionEnvDispatch(await dispatchDeploy(deps, ctx, "rc", "rc", deployModel2, watch, autoRunSince, rcSha, "report"), versionEnv);
     const d2 = await recordRcandDeployLegs(ledger, deps, anchors, deployModel2, d0);
     const rcLedgerReport = releaseLedgerReport(await ledger?.load(anchors).catch(() => void 0), ledger?.path ?? "(no ledger)");
-    return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, bumpIntent, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus, ...rcLedgerReport ? { ledger: rcLedgerReport } : {} };
+    return { ...ctx, command, stage: "rc", ref: "rc", tag: tag2, bumpIntent, deployModel: deployModel2, promoted: true, checks: checks2, resumeNote, dispatch: d2.note, runId: d2.runId, runUrl: d2.runUrl, workflowRuns: d2.workflowRuns, deployStatus: d2.deployStatus, ...rcLedgerReport ? { cutBy: rcLedgerReport.cutBy, ledger: rcLedgerReport } : {} };
   }
   if (mode === "release-dev") {
     await requireBranch(deps, "development");
@@ -27097,7 +27131,7 @@ ${spent.note}`), rcandRecovery(tag2));
         announceNote: announceNote2,
         devNote: options.dev ? "--dev is a no-op on a direct-track repo \u2014 it already releases development -> main" : void 0,
         release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 },
-        ...ledgerReport2 ? { ledger: ledgerReport2 } : {}
+        ...ledgerReport2 ? { cutBy: ledgerReport2.cutBy, ledger: ledgerReport2 } : {}
       };
     }
     const retirement2 = hasRcBranch ? await retireRcRuntime(deps, ctx, deployModel2, d2.deployStatus, rcShaAtRelease) : { status: "not-applicable", note: "no origin/rc branch \u2014 rc runtime retirement skipped" };
@@ -27129,7 +27163,7 @@ ${spent.note}`), rcandRecovery(tag2));
       devNote: "released development -> main (--dev), skipping the rc candidate",
       release: { tag: tag2, url: releaseUrl2, targetSha: releaseSha2 },
       environments: environments2,
-      ...fullLedgerReport ? { ledger: fullLedgerReport } : {}
+      ...fullLedgerReport ? { cutBy: fullLedgerReport.cutBy, ledger: fullLedgerReport } : {}
     };
   }
   await requireBranch(deps, "rc");
@@ -27210,7 +27244,7 @@ ${spent.note}`), rcandRecovery(tag2));
     announceNote,
     release: { tag, url: releaseUrl, targetSha: releaseSha },
     environments,
-    ...ledgerReport ? { ledger: ledgerReport } : {}
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {}
   };
 }
 async function latestLocalReleaseTag(deps, mergedInto) {
@@ -27597,6 +27631,41 @@ function parseAuthoritativeRuleset(raw, meta, repo) {
     coversReleaseBranches: rulesetCoversReleaseBranches(apiPayload, resolveReleaseTrack(meta, void 0, repo))
   };
 }
+function planBranchRequiredContexts(input) {
+  const contexts = sortedUnique([...input.contexts]);
+  const branches = [...new Set(input.branches.map((b) => b.replace(/^refs\/heads\//, "")))];
+  const common = contexts.filter((context) => branches.every((branch) => input.emittedByBranch[branch]?.includes(context) === true));
+  const pending = branches.map((branch) => ({
+    branch,
+    contexts: contexts.filter((context) => !common.includes(context) && input.emittedByBranch[branch]?.includes(context) === true)
+  })).filter((entry) => entry.contexts.length > 0);
+  const waiting = branches.map((branch) => ({
+    branch,
+    contexts: contexts.filter((context) => input.emittedByBranch[branch]?.includes(context) !== true)
+  })).filter((entry) => entry.contexts.length > 0);
+  return { common, pending, waiting };
+}
+async function branchContextPlan(deps, repo, authority, meta) {
+  const branches = resolveRequiredCheckBranches(meta, repo);
+  const emittedByBranch = {};
+  const unreadable = [];
+  for (const branch of branches) {
+    const presence = await branchPresence(deps, repo, branch);
+    if (presence === false) continue;
+    emittedByBranch[branch] = await resolveEmittedPrContexts(deps, repo, branch);
+    if (presence === void 0 || emittedByBranch[branch] === void 0) unreadable.push(branch);
+  }
+  return { ...planBranchRequiredContexts({ contexts: authority.contexts, branches, emittedByBranch }), unreadable };
+}
+function projectCommonAuthority(authority, common) {
+  const apiPayload = patchRulesetRequiredContexts(authority.apiPayload, common);
+  return {
+    ...authority,
+    contexts: common,
+    apiPayload,
+    filePayload: { ...authority.filePayload, rules: apiPayload.rules }
+  };
+}
 function sameContexts(left, right) {
   return left.length === right.length && left.every((context, index) => context === right[index]);
 }
@@ -27771,6 +27840,7 @@ async function auditRepoCi(repo, callerDeps) {
   };
   const committedReferenceRaw = deployableGated ? await fetchFileContent(deps, repo, baseBranch, PRODUCT_RULESET_REF) : null;
   let authoritativeRuleset = null;
+  let branchPlan = null;
   let authoritativeRulesetParseError = null;
   if (committedReferenceRaw != null) {
     try {
@@ -27818,6 +27888,33 @@ async function auditRepoCi(repo, callerDeps) {
     });
   } else if (deployableGated) {
     const productRuleset = rulesets.find((r) => r.name === PRODUCT_RULESET_NAME);
+    if (authoritativeRuleset && authoritativeRuleset.source === "registry META requiredChecks") {
+      branchPlan = await branchContextPlan(deps, repo, authoritativeRuleset, meta);
+      if (branchPlan.unreadable.length) {
+        checks.push({ ok: true, label: "branch-specific required checks cannot audit", detail: `workflow emitters unreadable on [${branchPlan.unreadable.join(", ")}] \u2014 no propagation conclusion` });
+        branchPlan = null;
+      }
+      if (branchPlan) authoritativeRuleset = projectCommonAuthority(authoritativeRuleset, branchPlan.common);
+      if (branchPlan?.waiting.length) checks.push({
+        ok: true,
+        label: "required checks pending branch propagation",
+        detail: `warning: ${branchPlan.waiting.map((entry) => `${entry.branch} waits for workflow emitter(s) [${entry.contexts.join(", ")}]`).join("; ")} \u2014 reconcile enforces these only where the branch workflows emit them`
+      });
+      if (branchPlan) {
+        const expectedPending = new Set(branchPlan.pending.map((entry) => PRODUCT_PENDING_RULESET_PREFIX + entry.branch));
+        const livePending = rulesets.filter((r) => r.name?.startsWith(PRODUCT_PENDING_RULESET_PREFIX));
+        const pendingAligned = branchPlan.pending.every((entry) => {
+          const live = livePending.find((r) => r.name === PRODUCT_PENDING_RULESET_PREFIX + entry.branch);
+          return live?.enforcement === "active" && sameContexts(sortedUnique(rulesetRequiredContexts(live)), entry.contexts) && sameContexts(rulesetBranchIncludes(live), [`refs/heads/${entry.branch}`]) && rulesetStrictPolicy(live) === authoritativeRuleset?.committedStrict;
+        }) && livePending.every((r) => expectedPending.has(r.name ?? ""));
+        checks.push({
+          ok: pendingAligned,
+          label: "branch-specific required checks match workflow emitters",
+          detail: pendingAligned ? void 0 : "pending ruleset contexts or branch conditions have not converged to the emitted registry requirements",
+          remediation: pendingAligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
+        });
+      }
+    }
     const liveContexts = productRuleset == null ? [] : sortedUnique(rulesetRequiredContexts(productRuleset));
     const liveBranchIncludes = productRuleset == null ? [] : rulesetBranchIncludes(productRuleset);
     const liveStrict = productRuleset != null && rulesetStrictPolicy(productRuleset);
@@ -27870,21 +27967,22 @@ async function auditRepoCi(repo, callerDeps) {
     }
     const contextAuthority = authoritativeRuleset ?? registryAuthorityWithoutReference(meta, repo);
     if (contextAuthority != null) {
+      const declaredPolicy = registryAuthorityWithoutReference(meta, repo) ?? contextAuthority;
       const emitted = await getEmittedPrContexts();
       if (emitted !== void 0) {
         const emittedSet = new Set(emitted);
-        const missingEmitters = contextAuthority.contexts.filter((context) => !emittedSet.has(context));
+        const missingEmitters = declaredPolicy.contexts.filter((context) => !emittedSet.has(context));
         checks.push({
           ok: missingEmitters.length === 0,
           label: REQUIRED_CONTEXTS_EMITTED_LABEL,
-          detail: missingEmitters.length ? `${contextAuthority.source} requires [${contextAuthority.contexts.join(", ")}] but pull_request workflows do not emit [${missingEmitters.join(", ")}]` : void 0,
+          detail: missingEmitters.length ? `${declaredPolicy.source} requires [${declaredPolicy.contexts.join(", ")}] but pull_request workflows do not emit [${missingEmitters.join(", ")}]` : void 0,
           remediation: missingEmitters.length ? `Fix the pull_request workflows or ${contextAuthority.source} before reconciling` : void 0
         });
       }
       if (hasRequiredChecks) {
         const gateFiles = new Set(gateWorkflowFiles(prWorkflowPaths));
         const gateWorkflows = (await getBranchWorkflows() ?? []).filter((wf) => gateFiles.has(wf.path.slice(wf.path.lastIndexOf("/") + 1)));
-        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job));
+        const unblocking = unblockingGateJobs(gateWorkflows, new Set(liveContexts)).filter((job) => !AGENT_PR_BOOKKEEPING_CONTEXTS.has(job) && !branchPlan?.pending.some((entry) => entry.branch === baseBranch && entry.contexts.includes(job)));
         checks.push({
           ok: unblocking.length === 0,
           label: UNBLOCKING_GATE_JOBS_LABEL,
@@ -27892,8 +27990,8 @@ async function auditRepoCi(repo, callerDeps) {
           remediation: unblocking.length ? `mmi-cli oracle org project set ${repo} --var requiredChecks=${JSON.stringify(sortedUnique([...liveContexts, ...unblocking]))} then mmi-cli devops ci reconcile --repo ${repo} --apply \u2014 or make a required job \`needs:\` them` : void 0
         });
       }
-      const prOnly = contextAuthority.coversReleaseBranches ? contextAuthority.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context)) : [];
-      const tagBlind = contextAuthority.coversReleaseBranches ? contextsUnreachableOnTagPush(contextAuthority.contexts, await getBranchWorkflows() ?? [], TRAIN_PR_ONLY_CONTEXTS) : [];
+      const prOnly = declaredPolicy.coversReleaseBranches ? declaredPolicy.contexts.filter((context) => TRAIN_PR_ONLY_CONTEXTS.has(context)) : [];
+      const tagBlind = declaredPolicy.coversReleaseBranches ? contextsUnreachableOnTagPush(declaredPolicy.contexts, await getBranchWorkflows() ?? [], TRAIN_PR_ONLY_CONTEXTS) : [];
       checks.push({
         ok: prOnly.length === 0 && tagBlind.length === 0,
         label: TAG_ADDRESSABLE_CONTEXTS_LABEL,
@@ -28312,7 +28410,7 @@ async function parkProductRuleset(repo, deps) {
   return result;
 }
 function reconcileOwnedFailures(report) {
-  return report.checks.filter((check) => !check.ok).filter((check) => check.label.startsWith("allow_") || check.label.startsWith("delete_branch") || check.label.startsWith("has_wiki") || check.label.startsWith("gate workflow committed on ") || check.label.startsWith("product ruleset reference committed on ") || check.label === "product required status checks active" || check.label === RULESET_REFERENCE_MATCH_LABEL || check.label === REQUIRED_CONTEXTS_EMITTED_LABEL || check.label === TAG_ADDRESSABLE_CONTEXTS_LABEL).map((check) => check.label);
+  return report.checks.filter((check) => !check.ok).filter((check) => check.label.startsWith("allow_") || check.label.startsWith("delete_branch") || check.label.startsWith("has_wiki") || check.label.startsWith("gate workflow committed on ") || check.label.startsWith("product ruleset reference committed on ") || check.label === "product required status checks active" || check.label === RULESET_REFERENCE_MATCH_LABEL || check.label === "branch-specific required checks match workflow emitters" || check.label === REQUIRED_CONTEXTS_EMITTED_LABEL || check.label === TAG_ADDRESSABLE_CONTEXTS_LABEL).map((check) => check.label);
 }
 async function finalizeCiReconcile(repo, deps, result, before, pendingReason) {
   if (result.errors.length > 0) {
@@ -28372,7 +28470,7 @@ async function authoritativeSafetyHold(authority, deps, repo, baseBranch, meta)
   if (missing.length > 0) {
     return `${authority.source} requires context(s) with no pull_request workflow emitter [${missing.join(", ")}]; no source or live mutation was made`;
   }
-  if (authority.coversReleaseBranches) {
+  if (authority.coversReleaseBranches && authority.source !== "registry META requiredChecks") {
     const track = resolveReleaseTrack(meta, void 0, repo);
     const releaseBranches = branchesForTrack(track).filter((b) => b !== baseBranch);
     const ignore = /* @__PURE__ */ new Set([...AGENT_PR_BOOKKEEPING_CONTEXTS, ...TRAIN_PR_ONLY_CONTEXTS]);
@@ -28451,6 +28549,21 @@ async function applyCiReconcileRepo(repo, deps) {
     result.errors.push(`${authority.source} declares no required contexts`);
     return finalizeCiReconcile(repo, deps, result, report);
   }
+  let pendingPlan = null;
+  const declaredContexts = authority.contexts;
+  if (authority.source === "registry META requiredChecks") {
+    pendingPlan = await branchContextPlan(deps, repo, authority, meta);
+    if (pendingPlan.unreadable.length) {
+      const reason = `required branch workflow emitters unreadable on [${pendingPlan.unreadable.join(", ")}] \u2014 ruleset convergence deferred`;
+      result.skipped.push(reason);
+      return finalizeCiReconcile(repo, deps, result, report, reason);
+    }
+    if (pendingPlan.common.length === 0) {
+      result.errors.push("no common required context is emitted by every required branch \u2014 ruleset convergence deferred");
+      return finalizeCiReconcile(repo, deps, result, report);
+    }
+    authority = projectCommonAuthority(authority, pendingPlan.common);
+  }
   const sourceNeedsConvergence = !sameContexts(authority.committedContexts, authority.contexts) || !sameContexts(authority.committedBranchIncludes, authority.branchIncludes) || !authority.committedStrict;
   if (sourceNeedsConvergence) {
     try {
@@ -28499,7 +28612,13 @@ async function applyCiReconcileRepo(repo, deps) {
   }
   const filteredPaths = new Set(pathFilteredPullRequestWorkflows(bodies).filter((p) => !p.endsWith("/agent-pr.yml")));
   const safeContexts = new Set(collectPullRequestWorkflowContexts(bodies.filter((b) => !filteredPaths.has(b.path))));
-  const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => authority.contexts.includes(c) && !safeContexts.has(c));
+  const unsafe = collectPullRequestWorkflowContexts(bodies.filter((b) => filteredPaths.has(b.path))).filter((c) => declaredContexts.includes(c) && !safeContexts.has(c));
+  if (pendingPlan?.pending.some((entry) => entry.contexts.some((context) => unsafe.includes(context)))) {
+    const reason = `pending required-check rulesets left non-enforcing \u2014 [${unsafe.join(", ")}] emitted only by path-filtered workflows`;
+    result.skipped.push(reason);
+    return finalizeCiReconcile(repo, deps, result, report, reason);
+  }
+  const gateProvenGreen = await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles);
   const plan = resolveProductRulesetReconcilePlan({
     liveEnforcement: live?.enforcement,
     liveContexts,
@@ -28508,7 +28627,7 @@ async function applyCiReconcileRepo(repo, deps) {
     authorityBranchIncludes: authority.branchIncludes,
     liveStrict: live == null ? void 0 : rulesetStrictPolicy(live),
     authorityStrict: authority.committedStrict,
-    gateProvenGreen: await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles),
+    gateProvenGreen,
     unsafeContexts: unsafe
   });
   if (!plan.shouldActivate) {
@@ -28517,15 +28636,49 @@ async function applyCiReconcileRepo(repo, deps) {
       return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
     }
     result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts, branches and up-to-date policy already match declared authority`);
-    return finalizeCiReconcile(repo, deps, result, report);
   }
-  try {
-    const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
-    if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
-    else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
-  } catch (e) {
-    result.errors.push(e.message);
-    return finalizeCiReconcile(repo, deps, result, report);
+  if (plan.shouldActivate) {
+    try {
+      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
+      if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
+      else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+    } catch (e) {
+      result.errors.push(e.message);
+      return finalizeCiReconcile(repo, deps, result, report);
+    }
+  }
+  if (pendingPlan) {
+    if (pendingPlan.pending.length > 0 && !gateProvenGreen) {
+      const reason = "pending required-check rulesets left non-enforcing \u2014 the gate is not green on development";
+      result.skipped.push(reason);
+      return finalizeCiReconcile(repo, deps, result, report, reason);
+    }
+    try {
+      const desired = /* @__PURE__ */ new Set();
+      for (const entry of pendingPlan.pending) {
+        const name = PRODUCT_PENDING_RULESET_PREFIX + entry.branch;
+        desired.add(name);
+        const statusOnly = {
+          ...authority.apiPayload,
+          name,
+          rules: authority.apiPayload.rules.filter((rule) => rule.type === "required_status_checks")
+        };
+        const payload = patchRulesetBranchIncludes(
+          patchRulesetRequiredContexts(statusOnly, entry.contexts),
+          [entry.branch]
+        );
+        const activation = await activateProductRuleset(repo, payload, deps.client);
+        (activation.action === "skipped" ? result.skipped : result.applied).push(`${name}: ${activation.action}`);
+      }
+      const list = await deps.client.rest("GET", `repos/${repo}/rulesets`);
+      for (const stale of list ?? []) {
+        if (!stale.name?.startsWith(PRODUCT_PENDING_RULESET_PREFIX) || desired.has(stale.name) || stale.id == null) continue;
+        await deps.client.rest("DELETE", `repos/${repo}/rulesets/${stale.id}`);
+        result.applied.push(`deleted converged ${stale.name}`);
+      }
+    } catch (e) {
+      result.errors.push(`pending ruleset convergence failed: ${e.message}`);
+    }
   }
   return finalizeCiReconcile(repo, deps, result, report);
 }
@@ -35471,6 +35624,16 @@ async function suiteRcand(deps, opts) {
   ];
   if (opts.dryRun) return { plan };
   let record = readSuiteCut(deps.recordPath);
+  if (record?.leadReleased && record.announcement === "pending") {
+    const reason = await deps.announceSkipReason(record);
+    if (!reason) throw new Error(`the finished cut ${record.leadRcTag} has an unverified announcement (pending); verify whether it was posted, then finish it with suite release --owner-go before a new cut (never post twice)`);
+    record.announcement = "skipped";
+    record.announcementNote = reason;
+    writeSuiteCut(deps.recordPath, record);
+  }
+  if (record?.leadReleased && !record.announcement) {
+    throw new Error(`the cut ${record.leadRcTag} already released the lead but never announced; finish it with suite release --owner-go before a new cut`);
+  }
   if ((record?.announcement === "sent" || record?.announcement === "skipped") && record.leadReleased) {
     const archive = `${deps.recordPath}.${record.leadRcTag}.json`;
     if ((0, import_node_fs29.existsSync)(archive)) throw new Error(`suite cut archive already exists at ${archive}; inspect before a new cut`);
@@ -35512,6 +35675,17 @@ async function suiteRcand(deps, opts) {
       writeSuiteCut(deps.recordPath, record);
       continue;
     }
+    const onHead = [];
+    for (const tag of (await deps.rcTagsAt(member.repo, member.previousRc)).filter((t) => RC_TAG.test(t))) {
+      if (!await deps.tagSha(member.repo, suiteReleaseTag(tag))) onHead.push(tag);
+    }
+    if (onHead.length > 1) throw new Error(`${member.repo}: several unreleased rc tags sit on its rc head (${onHead.join(", ")}); pin the one to reuse before the suite cut`);
+    if (onHead.length === 1) {
+      member.tag = onHead[0];
+      member.sha = member.previousRc;
+      writeSuiteCut(deps.recordPath, record);
+      continue;
+    }
     quiet.push(member);
   }
   if (record.members.every((m) => m.carried || quiet.includes(m))) {
@@ -36704,7 +36878,8 @@ ${decision.note}`);
   if (releaseExists) {
     releaseNote = `Release ${tag} already exists \u2014 resumed without recreating`;
   } else {
-    await deps.run("gh", ["release", "create", tag, "--repo", ctx.repo, "--target", "main", "--generate-notes", "--latest"]);
+    const cutBy = (await ledger.load(anchors))?.cutBy ?? describeSessionIdentity();
+    await deps.run("gh", ["release", "create", tag, "--repo", ctx.repo, "--target", "main", "--notes", releaseCutByNotes(cutBy), "--generate-notes", "--latest"]);
     releaseNote = `Release ${tag} created (target main)`;
   }
   await writePlainWordsSection(deps, options, ctx.repo, meta, tag);
@@ -36828,7 +37003,7 @@ ${decision.note}`);
     foldNote,
     foldStatus,
     announceNote,
-    ...ledgerReport ? { ledger: ledgerReport } : {}
+    ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {}
   };
   if (TRAIN_BRANCHES.includes(startBranch)) {
     return withCheckoutRestoredAfterRelease(deps, result, startBranch);
@@ -36878,7 +37053,7 @@ async function runHotfixRetryDeployLocked(deps, versionInput) {
     ...foldNote ? { foldNote } : {},
     ...foldStatus ? { foldStatus } : {},
     ...runs ? { runs } : {},
-    ...report ? { ledger: report } : {}
+    ...report ? { cutBy: report.cutBy, ledger: report } : {}
   };
 }
 function deriveHotfixState(f) {
@@ -44630,6 +44805,16 @@ var GIT_COMMIT_TIMEOUT_MS = 6e4;
 function trainGitArgs(args) {
   return ["-c", "gc.auto=0", "-c", "maintenance.auto=false", ...args];
 }
+async function announceSummaryLineCountRefusal(path2) {
+  let content;
+  try {
+    content = await (0, import_promises9.readFile)(path2, "utf8");
+  } catch (e) {
+    return `release: could not read --announce-summary-file ${path2}: ${e.message} \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing`;
+  }
+  const lines2 = summaryFileLines(content);
+  return lines2.length < 3 || lines2.length > 6 ? `release: --announce-summary-file must contain 3-6 non-empty LLM-curated lines (found ${lines2.length}) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#announce-summary-missing` : null;
+}
 async function announceSummaryRefusal(path2, isHub = false) {
   let lines2;
   try {
@@ -45083,6 +45268,10 @@ function registerTrainOperationsCommands(program3, runProjectInfoSyncCallback) {
     const retryDeploy = new Option("--retry-deploy", "re-dispatch the FAILED rc deploy of the promoted candidate in the active rcand ledger \u2014 same tag and SHA, never re-cut or re-pushed (#7053)");
     trainCmd.addOption(commandName === "rcand" ? retryDeploy : retryDeploy.hideHelp());
     trainCmd.option("--repo <owner/repo>", "dry-run plan for a target repo without relying on the current checkout; --apply still uses the current checkout").action(async (o) => {
+      if (commandName === "release" && o.announceSummaryFile) {
+        const refusal = await announceSummaryLineCountRefusal(o.announceSummaryFile);
+        if (refusal) return fail(refusal);
+      }
       try {
         await requireFreshTrainCli(commandName);
       } catch (e) {
@@ -45555,12 +45744,18 @@ async function withEnv(name, value, fn) {
   }
 }
 async function prepareRcCheckout(git3, repo) {
-  if ((await git3(["status", "--porcelain"])).trim()) throw new Error(`${repo}: checkout has uncommitted changes; refuse to switch it to rc for release`);
+  await prepareLaneCheckout(git3, repo, "rc", "release");
+}
+async function prepareDevelopmentCheckout(git3, repo) {
+  await prepareLaneCheckout(git3, repo, "development", "rcand");
+}
+async function prepareLaneCheckout(git3, repo, branch, lane) {
+  if ((await git3(["status", "--porcelain"])).trim()) throw new Error(`${repo}: checkout has uncommitted changes; refuse to switch it to ${branch} for ${lane}`);
   await git3(["fetch", "origin", "--tags"]);
-  await git3(["switch", "rc"]);
-  await git3(["merge", "--ff-only", "origin/rc"]);
-  const [head, origin] = (await git3(["rev-parse", "HEAD", "origin/rc"])).trim().split(/\s+/);
-  if (!head || head !== origin) throw new Error(`${repo}: local rc ${head?.slice(0, 12)} is not origin/rc ${origin?.slice(0, 12)}; stop`);
+  await git3(["switch", branch]);
+  await git3(["merge", "--ff-only", `origin/${branch}`]);
+  const [head, origin] = (await git3(["rev-parse", "HEAD", `origin/${branch}`])).trim().split(/\s+/);
+  if (!head || head !== origin) throw new Error(`${repo}: local ${branch} ${head?.slice(0, 12)} is not origin/${branch} ${origin?.slice(0, 12)}; stop`);
 }
 function rcRunCauseFromLog(log) {
   const causes = [...new Set([...log.matchAll(/##\[error\](?!Process completed with exit code)([^\r\n]+)/g)].map((m) => m[1].trim()).filter(Boolean))];
@@ -45637,6 +45832,7 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
     }
   };
   const runRcand = async (repo, previousRc, rcWasAbsent) => inTrain(repo, async (deps) => {
+    if (repo !== SUITE_REPO) await prepareDevelopmentCheckout((args) => deps.run("git", args), repo);
     await deps.run("git", ["fetch", "origin", "--tags"]);
     let rcNow;
     try {
@@ -45786,6 +45982,12 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
       }
     },
     tagSha,
+    rcTagsAt: async (repo, sha) => {
+      if (!/^[0-9a-f]{40}$/i.test(sha)) return [];
+      const target = await checkout(repo);
+      await exec("git", ["fetch", "--quiet", "origin", "--tags"], target, WATCH_TIMEOUT);
+      return (await exec("git", ["tag", "--points-at", sha, "--list", "v*-rc.*"], target)).split("\n").map((t) => t.trim()).filter(Boolean);
+    },
     contains: async (repo, ancestor, descendant) => {
       const target = await checkout(repo);
       await exec("git", ["fetch", "origin", "--tags"], target);
@@ -51396,9 +51598,13 @@ program2.addHelpText(
   \`mmi-cli commands\` shows the agentic map; \`mmi-cli <house> --help\` lists one house.
 `
 );
+var appActorCommand = "poll";
 function appActorDeps() {
   return {
-    fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, { repo: APP_VAULT_REPO }),
+    fetchSecret: async (key) => fetchSecretValue(makeSecretsDeps(await loadConfig()), key, {
+      repo: APP_VAULT_REPO,
+      attribution: { command: appActorCommand, via: formatSessionIdentity(describeSessionIdentity()) }
+    }),
     fetch: (url, init) => fetch(url, init)
   };
 }
@@ -51406,6 +51612,7 @@ setPollTokenProvider(() => pollTokenOrUndefined(appActorDeps()));
 var registerPreAction = Reflect.get(program2, ["h", "ook"].join(""));
 registerPreAction.call(program2, "preAction", async (_thisCommand, actionCommand) => {
   const commandPath3 = commandPathOf(actionCommand);
+  appActorCommand = commandPath3;
   emitCliCallTelemetry(commandPath3);
   try {
     await activateAppActor(commandPath3, process.env, () => mintInstallationToken(appActorDeps()));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.61",
+  "version": "4.5.63",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",