@mutmutco/cli 4.5.76 → 4.5.78

package/dist/main.cjs

@@ -6986,6 +6986,24 @@ function findClaimedButUnregisteredClosings(text, closing, alreadyClosed = []) {
   }
   return [...claimed].filter((n) => !registered.has(n) && !closed.has(n));
 }
+function findLineStartClosings(text, repo) {
+  const found = /* @__PURE__ */ new Set();
+  let inFence = false;
+  for (const line of text.split(/\r?\n/)) {
+    if (FENCE_LINE_RE.test(line)) {
+      inFence = !inFence;
+      continue;
+    }
+    if (inFence || !LINE_START_CLOSING_RE.test(line)) continue;
+    const m = findClosingMentions(line)[0];
+    if (!m || m.negated || !Number.isInteger(m.issue) || m.issue <= 0) continue;
+    const link = /\[#\d+\]\(([^)\s]+)\)/.exec(line);
+    if (link && !(link[1] ?? "").toLowerCase().includes(`github.com/${repo.toLowerCase()}/issues/${m.issue}`)) continue;
+    found.add(m.issue);
+  }
+  const ambiguous = new Set(findCrossRepoAmbiguousClosings(text, [...found], repo));
+  return [...found].filter((n) => !ambiguous.has(n));
+}
 function claimedClosingWarning(unregistered, context = "pr merge") {
   const named = unregistered.map((n) => `#${n}`).join(", ");
   const first = `#${unregistered[0] ?? "N"}`;
@@ -7435,6 +7453,9 @@ var DECLARED_ENTRIES = [
   // archived stage (including a stage whose containers are down) into scratch Postgres and compare
   // row counts, and read-verify every storage archive against its listing; per-stage PASS/FAIL.
   { name: "mmi-backup-restore-check (mm-central, mm-work, mmi-oguz)", cadence: "0 3 1 * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mmi-backup-restore-check \u2192 /opt/mmi-control/nightly-backup-restore-check.sh; monthly restore proof for every archived stage (#7148; source scripts/nightly-backup-restore-check.sh); zuber (46.225.58.31) is gone: deleted 2026-09-18 by the owner-approved ZuberShade decommission (MMC-ZuberShade#1838, snapshot kept); Hetzner has since reassigned that IP to another machine (#7351)" },
+  // #7662 (MM-Work#1520): Vercel Cron's 15-minute central mail call, moved to the box with MM-Work. The app
+  // calls its own endpoint with its own CRON_SECRET via docker exec, so the secret stays in the container.
+  { name: "mm-work-mail-tick (mm-work)", cadence: "*/15 * * * *", executor: "box cron.d", llm: "no", resolved: "declared", source: "/etc/cron.d/mm-work-mail-tick \u2192 /opt/mmi-control/mm-work-mail-tick.sh; GET /api/internal/mail per stage listed in MM_WORK_MAIL_STAGES (source scripts/mm-work-mail-tick.sh; log /var/log/mm-work-mail-tick.log)" },
   // #3370/#6270: the one runner hygiene layer (runner-hygiene.yml was folded in and deleted). A workflow ran ON the runner and needed checkout +
   // setup-node before it can prune, so at 100% it dies at checkout and never prunes — the cleanup is
   // unavailable exactly when it is needed. This one is root cron on the box: no checkout, no node, and
@@ -8560,7 +8581,6 @@ function attributionFields(attr) {
 // src/secrets-transport.ts
 var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
-var PROJECT_TIER_SEGMENT = "dev";
 var ORG_INFRA_SLUG = "_org";
 var MMI_VAULT_GUIDANCE = 'Check MMI access with `mmi-cli oracle org access capabilities`; a master can locate credentials with `mmi-cli vault secrets find "<what it is for>"`.';
 var KEY_MAX_PATH_SEGMENTS = 4;
@@ -8573,10 +8593,9 @@ function isValidSecretKey(key) {
 function stripTrailingCRLF(value) {
   return value.replace(/\r\n$|\r$|\n$/, "");
 }
-function classifyTier(_slug, key) {
-  const slash2 = key.indexOf("/");
-  if (slash2 === -1) return "project";
-  return key.slice(0, slash2) === PROJECT_TIER_SEGMENT ? "project" : "org";
+var ORG_WIDE_SLUGS = /* @__PURE__ */ new Set([ORG_INFRA_SLUG, "shared", "cloudflare", "docs", "mmi-hub"]);
+function classifyTier(slug, _key) {
+  return ORG_WIDE_SLUGS.has(slug) ? "org" : "project";
 }
 function secretParamName(slug, key) {
   return `${SSM_ROOT}/${slug}/${key}`;
@@ -17230,10 +17249,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.76",
-    tag: "v4.5.76",
-    commit: "9a7afd53566b",
-    npm: "@mutmutco/cli@4.5.76"
+    version: "4.5.78",
+    tag: "v4.5.78",
+    commit: "55782d939329",
+    npm: "@mutmutco/cli@4.5.78"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17250,14 +17269,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.76"
+          v3Target: "v4.5.78"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.76 and redeploy the Hub Lambda from tag v4.5.76 (9a7afd53566b); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.76 (@mutmutco/cli@4.5.76, tag commit 9a7afd53566b \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.78 and redeploy the Hub Lambda from tag v4.5.78 (55782d939329); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.78 (@mutmutco/cli@4.5.78, tag commit 55782d939329 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -20071,10 +20090,10 @@ async function listRemoteReleaseTags(deps) {
   }
   return [...tags].sort(cmpReleaseTag);
 }
-async function assertComputedReleaseTagStillNext(deps, tag) {
+async function assertComputedReleaseTagStillNext(deps, tag, preOneZero = false) {
   if (!/^v\d+\.\d+\.\d+$/.test(tag)) return;
   const remote = await listRemoteReleaseTags(deps);
-  const newer = remote.filter((t) => cmpReleaseTag(t, tag) > 0);
+  const newer = remote.filter((t) => cmpReleaseTag(t, tag) > 0 && !(preOneZero && !t.startsWith("v0.")));
   if (newer.length === 0) return;
   const latest = newer[newer.length - 1];
   throw new Error(
@@ -21696,6 +21715,17 @@ Resume it:  ${resumeCommand}
   );
 }
 
+// src/pre-one-zero.ts
+function preOneZeroInForce(meta) {
+  return !!meta?.suite && meta.preOneZero !== false;
+}
+function assertPreOneZero(repo, meta, tag) {
+  if (preOneZeroInForce(meta) && /^v?[1-9]\d*\./.test(tag)) {
+    throw new Error(`${repo} is a ${meta.suite} suite member held on 0.x.y; ${tag} would be major >= 1. Only the owner lifts this: set registry META preOneZero to false. If the tag came from a stale scripts/next-version.mjs, propagate the current seed first (#7699).`);
+  }
+  return tag;
+}
+
 // src/train-doctor.ts
 var import_node_child_process9 = require("node:child_process");
 var import_node_fs23 = require("node:fs");
@@ -24832,7 +24862,7 @@ async function runTrainDoctor(input) {
   let newestRemoteReleaseTag;
   try {
     remoteTags = tagNames(await runGitRemoteRead(train, ["ls-remote", "--tags", "origin", "refs/tags/v*"]));
-    const releaseTags = await listRemoteReleaseTags(train);
+    const releaseTags = (await listRemoteReleaseTags(train)).filter((t) => !preOneZeroInForce(meta) || t.startsWith("v0."));
     const latest = releaseTags[releaseTags.length - 1];
     newestRemoteReleaseTag = latest;
     if (latest) {
@@ -26054,7 +26084,7 @@ async function completeMainRelease(deps, ctx, meta, deployModel, watch, options,
   let tagLedgerStarted = false;
   const recoveryInput = { repo: ctx.repo, tag, stage: "main", deployModel, meta, branchHints };
   try {
-    await assertComputedReleaseTagStillNext(deps, tag);
+    await assertComputedReleaseTagStillNext(deps, tag, preOneZeroInForce(meta));
     if (deployModel === "hub-serverless") {
       await deps.run("node", ["scripts/release-distribution.mjs", "assert-release-lineage", tag.replace(/^v/, ""), "--release-commit", releaseSha]);
     }
@@ -26478,7 +26508,7 @@ Nothing was written. Inspect ${ledger.path} before retrying.`);
 async function runReleaseResumePipeline(deps, options, prepared) {
   const watch = options.watch ?? false;
   const { ctx, meta, branchHints, directTrack, deployModel } = prepared;
-  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((t) => t.trim()).filter((t) => /^v\d+\.\d+\.\d+$/.test(t));
+  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((t) => t.trim()).filter((t) => (preOneZeroInForce(meta) ? /^v0\.\d+\.\d+$/ : /^v\d+\.\d+\.\d+$/).test(t));
   const tag = tags[0];
   if (!tag) throw new Error("release --resume: no final v* release tag found \u2014 there is no release to resume");
   const tagSha = await probeRemoteTag(deps, tag);
@@ -26838,7 +26868,7 @@ async function runReleaseAbortLocked(deps, options) {
     throw new Error("release --abort must run from the primary checkout left on main by the failed train; nothing was written");
   }
   await runGitRemoteRead(deps, ["fetch", "origin", "--tags"]);
-  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((tag2) => tag2.trim()).filter((tag2) => /^v\d+\.\d+\.\d+$/.test(tag2));
+  const tags = clean2(await deps.run("git", ["tag", "--list", "v[0-9]*.[0-9]*.[0-9]*", "--sort=-v:refname"])).split("\n").map((tag2) => tag2.trim()).filter((tag2) => (preOneZeroInForce(meta) ? /^v0\.\d+\.\d+$/ : /^v\d+\.\d+\.\d+$/).test(tag2));
   const tag = tags[0];
   if (!tag) throw new Error("release --abort found no final v* tag; nothing was written");
   const tagSha = await probeRemoteTag(deps, tag);
@@ -27023,7 +27053,7 @@ async function runTrainApplyPipeline(mode, input) {
       "nothing to promote: origin/development is not ahead of origin/rc"
     );
     const deployModel2 = await preflight(deps, ctx, "rc", meta);
-    const releaseBase = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release base");
+    const releaseBase = requireValue(clean2(await nextVersion(deps, ctx, meta, "cycle")), "release base");
     const { tolerated: tolerated2, predicted: predicted2 } = await preflightMergeToMain(
       deps,
       deployModel2,
@@ -27048,7 +27078,7 @@ async function runTrainApplyPipeline(mode, input) {
       else await mergeWithToleratedResolution(deps, "development", "development -> rc", "theirs", tolerated2);
       rcSha = requireValue(clean2(await deps.run("git", ["rev-parse", "rc"])), "rc sha");
       resume = await resolveRcResumeTag(deps, releaseBase, rcSha, rcTagProbe);
-      tag2 = resume.tag ?? requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "rc"])), "rc tag");
+      tag2 = resume.tag ?? requireValue(clean2(await nextVersion(deps, ctx, meta, "rc")), "rc tag");
       requiredChecks = await discoverRequiredCheckContexts(deps, ctx, "rc");
       assertTagAddressableRequiredContexts(deps, requiredChecks, ctx.repo);
       const anchors2 = { repo: ctx.repo, tag: tag2, tagSha: rcSha };
@@ -27128,7 +27158,7 @@ ${spent.note}`), rcandRecovery(tag2));
       "nothing to release: origin/development is not ahead of origin/main"
     );
     const deployModel2 = await preflight(deps, ctx, "main", meta);
-    const tag2 = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "cycle"])), "release tag");
+    const tag2 = requireValue(clean2(await nextVersion(deps, ctx, meta, "cycle")), "release tag");
     const rcShaAtRelease = !directTrack && hasRcBranch ? clean2(await deps.run("git", ["rev-parse", "origin/rc"])) : "";
     const { foldPaths: foldPaths2, tolerated: tolerated2, predicted: predicted2 } = await preflightMergeToMain(
       deps,
@@ -27246,7 +27276,7 @@ ${spent.note}`), rcandRecovery(tag2));
     );
   }
   const releasedRcSha = clean2(await deps.run("git", ["rev-parse", "origin/rc"]));
-  const tag = requireValue(clean2(await deps.run("node", ["scripts/next-version.mjs", "release"])), "release tag");
+  const tag = requireValue(clean2(await nextVersion(deps, ctx, meta, "release")), "release tag");
   const tagProbe = { remoteSha: await probeRemoteTag(deps, tag) };
   const preFold = {};
   const { versionFold, releaseSha } = await runFoldStage(deps, "rc", preFold, "mmi-cli devops release --apply", async () => {
@@ -27305,19 +27335,23 @@ ${spent.note}`), rcandRecovery(tag2));
     ...ledgerReport ? { cutBy: ledgerReport.cutBy, ledger: ledgerReport } : {}
   };
 }
-async function latestLocalReleaseTag(deps, mergedInto) {
+async function nextVersion(deps, ctx, meta, mode) {
+  const held = preOneZeroInForce(meta);
+  return assertPreOneZero(ctx.repo, meta, clean2(await deps.run("node", ["scripts/next-version.mjs", mode, ...held ? ["--pre-one-zero"] : []])));
+}
+async function latestLocalReleaseTag(deps, mergedInto, preOneZero = false) {
   const tags = clean2(await deps.run("git", ["tag", "--list", "v*", ...mergedInto ? ["--merged", mergedInto] : []])).split("\n");
   let latest = { major: 0, minor: 0, patch: 0 };
   for (const tag of tags) {
     const m = /^v(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
-    if (!m) continue;
+    if (!m || preOneZero && m[1] !== "0") continue;
     const v = { major: +m[1], minor: +m[2], patch: +m[3] };
     const delta = v.major - latest.major || v.minor - latest.minor || v.patch - latest.patch;
     if (delta > 0) latest = v;
   }
   return latest;
 }
-async function resolveTrainBumpIntent(deps, env = process.env, latestRelease) {
+async function resolveTrainBumpIntent(deps, env = process.env, latestRelease, preOneZero = false) {
   const explicitIntent = (env.MMI_BUMP_INTENT ?? "").trim();
   if (explicitIntent) {
     if (!TRAIN_BUMP_INTENTS.includes(explicitIntent)) {
@@ -27330,7 +27364,8 @@ async function resolveTrainBumpIntent(deps, env = process.env, latestRelease) {
     const m = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(explicitVersion);
     if (!m) throw new Error(`MMI_RELEASE_VERSION must be X.Y.Z (got ${explicitVersion})`);
     const explicit = { major: +m[1], minor: +m[2], patch: +m[3] };
-    const latest = latestRelease ?? await latestLocalReleaseTag(deps);
+    if (preOneZero && explicit.major >= 1) throw new Error(`MMI_RELEASE_VERSION ${explicitVersion} is major >= 1 but this suite member is held on 0.x.y; only the owner lifts it (registry META preOneZero=false) (#7699)`);
+    const latest = latestRelease ?? await latestLocalReleaseTag(deps, void 0, preOneZero);
     const delta = explicit.major - latest.major || explicit.minor - latest.minor || explicit.patch - latest.patch;
     if (delta <= 0) {
       throw new Error(
@@ -27341,8 +27376,8 @@ async function resolveTrainBumpIntent(deps, env = process.env, latestRelease) {
   }
   return "patch";
 }
-async function resolveHotfixVersion(deps, env = process.env) {
-  const latest = await latestLocalReleaseTag(deps, "origin/main");
+async function resolveHotfixVersion(deps, env = process.env, preOneZero = false) {
+  const latest = await latestLocalReleaseTag(deps, "origin/main", preOneZero);
   if (latest.major === 0 && latest.minor === 0 && latest.patch === 0) {
     throw new Error("no vX.Y.Z release tag found on origin/main \u2014 cannot derive the hotfix PATCH version");
   }
@@ -27354,14 +27389,14 @@ async function resolveHotfixVersion(deps, env = process.env) {
     declared.push({
       name: "MMI_BUMP_INTENT",
       value: explicitIntent,
-      intent: await resolveTrainBumpIntent(deps, { MMI_BUMP_INTENT: explicitIntent }, latest)
+      intent: await resolveTrainBumpIntent(deps, { MMI_BUMP_INTENT: explicitIntent }, latest, preOneZero)
     });
   }
   if (explicitVersion) {
     declared.push({
       name: "MMI_RELEASE_VERSION",
       value: explicitVersion,
-      intent: await resolveTrainBumpIntent(deps, { MMI_RELEASE_VERSION: explicitVersion }, latest)
+      intent: await resolveTrainBumpIntent(deps, { MMI_RELEASE_VERSION: explicitVersion }, latest, preOneZero)
     });
   }
   const nonPatch = declared.find((d) => d.intent !== "patch");
@@ -27385,8 +27420,8 @@ async function runTrainApplyLocked(command, deps, options = {}) {
   const ctx = await buildTrainApplyContext(deps);
   await requireCleanTree(deps);
   await runGitRemoteRead(deps, ["fetch", "origin"]);
-  const bumpIntent = await resolveTrainBumpIntent(deps);
   const meta = requireProjectMetaForTrain(await loadProjectMeta(deps, ctx), ctx.repo);
+  const bumpIntent = await resolveTrainBumpIntent(deps, process.env, void 0, preOneZeroInForce(meta));
   const branchHints = await loadReleaseTrackBranchHints(deps);
   const directTrack = isHubControlRepo(ctx.repo) || resolveReleaseTrack(meta, branchHints) === "direct";
   const pipelineInput = { deps, ctx, command, meta, branchHints, watch, options, bumpIntent };
@@ -30683,7 +30718,7 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "suiteHold"];
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -31063,6 +31098,27 @@ function parseVercelVersionEnvVar(raw) {
   }
   return { project: row.project, key: row.key, ...typeof row.team === "string" ? { team: row.team } : {} };
 }
+function parseStageAllowlistVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error('org project set: stageAllowlist must be JSON, e.g. {"key":"MMW_STAGE_ALLOWLIST","stages":["dev"]}');
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("org project set: stageAllowlist must be a JSON object { key, stages }");
+  }
+  const row = parsed;
+  const unknown = Object.keys(row).filter((key) => key !== "key" && key !== "stages");
+  if (unknown.length > 0) throw new Error(`org project set: stageAllowlist has unknown field(s): ${unknown.join(", ")}`);
+  if (typeof row.key !== "string" || !VERCEL_VERSION_ENV_NAME_RE.test(row.key)) {
+    throw new Error("org project set: stageAllowlist.key must be an env name (e.g. MMW_STAGE_ALLOWLIST)");
+  }
+  if (!Array.isArray(row.stages) || row.stages.length === 0 || new Set(row.stages).size !== row.stages.length || !row.stages.every((s) => s === "dev" || s === "rc" || s === "main")) {
+    throw new Error("org project set: stageAllowlist.stages must be a non-empty unique array of: dev, rc, main");
+  }
+  return { key: row.key, stages: row.stages };
+}
 function parseCiExemptReasonVar(raw) {
   const trimmed = raw.trim();
   if (!trimmed) throw new Error("org project set: ciExemptReason must be a non-empty reason (or use --unset ciExemptReason to clear it)");
@@ -31212,7 +31268,8 @@ var SETTABLE_VAR_KEYS = [
   "seedCanary",
   "installer",
   "notifyOnDeploy",
-  "vercelVersionEnv"
+  "vercelVersionEnv",
+  "stageAllowlist"
 ];
 var SETTABLE_VAR_KEY_SET = new Set(SETTABLE_VAR_KEYS);
 var SETTABLE_VAR_HINTS = {
@@ -31244,6 +31301,7 @@ var SETTABLE_VAR_HINTS = {
   requiredCheckBranches: "non-empty JSON branch-name array; exact product-ruleset scope (#5210)",
   notifyOnDeploy: 'JSON stage array, e.g. ["dev"] \u2014 successful tenant-deploy sends <stage>-deployed to the project repo (#7358)',
   vercelVersionEnv: "JSON {project,key,team?} \u2014 train sets this Vercel env to the release tag before the main/rc push (#7362)",
+  stageAllowlist: "JSON {key,stages[]} \u2014 `org access sync` writes the developer/admin company-email allowlist to <stage>/<key> for each listed stage (#7678)",
   ciExemptReason: "non-empty string \u2014 declares this deployable repo has no CI surface (#4265)",
   gate: "JSON {runtime,cmd,affectedCmd,workdir,cacheDepPath,pyVersion}"
 };
@@ -31407,6 +31465,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseNotifyOnDeployVar(raw);
     } else if (key === "vercelVersionEnv") {
       patch[key] = parseVercelVersionEnvVar(raw);
+    } else if (key === "stageAllowlist") {
+      patch[key] = parseStageAllowlistVar(raw);
     } else if (key === "ciExemptReason") {
       patch[key] = parseCiExemptReasonVar(raw);
     } else if (key === "gate") {
@@ -36017,6 +36077,12 @@ async function runRcDataSwitch(deps, opts) {
   if (opts.apply && !opts.ownerGo) {
     throw new Error("--apply requires --owner-go (it touches the live data key); nothing was written");
   }
+  const rcSubstrate = await deps.readLeadRcSubstrate();
+  if (rcSubstrate) {
+    throw new Error(
+      `suite rc-data applies only while rc is served by Vercel (the lead's DEPLOY#rc runs on ${rcSubstrate}); rc data now follows the tenant runtime, not Vercel Preview envs; nothing was written`
+    );
+  }
   const secrets = [];
   const token = await deps.readToken();
   secrets.push(token);
@@ -36342,9 +36408,49 @@ function parseCherryPickBlockingPaths(message2) {
   if (!m) return [];
   return m[1].split(",").map((s) => s.trim()).filter(Boolean);
 }
-function formatHotfixBatchPreflightRefusal(failures, fromSpecs) {
+async function classifyHotfixPortLanePicks(deps, failures) {
+  const exists = async (ref, path2) => {
+    try {
+      await deps.run("git", ["cat-file", "-e", `${ref}:${path2}`]);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const portable = /* @__PURE__ */ new Map();
+  for (const f of failures) {
+    if (f.blocking.length === 0) continue;
+    let fits = false;
+    const bothSides = [];
+    for (const path2 of f.blocking) {
+      const onMain = await exists("origin/main", path2);
+      if (!onMain && await exists("origin/development", path2)) fits = true;
+      else if (onMain) bothSides.push(path2);
+    }
+    if (fits) portable.set(f.sha, bothSides);
+  }
+  return portable;
+}
+function bothSidesText(portFailures, portLaneShas) {
+  const rows = portFailures.map((f) => ({ label: f.label, paths: portLaneShas.get(f.sha) ?? [] })).filter((r) => r.paths.length > 0);
+  if (rows.length === 0) return "";
+  return `BEFORE that --ack: ${rows.map((r) => `${r.label} also conflicts on ${r.paths.join(", ")}`).join("; ")}, which exist on both branches \u2014 the port resolves them by hand for main, so land the SAME resolution on development first (the --ack covers the whole commit, and the next release would otherwise overwrite or clash with the main-only content). `;
+}
+function formatHotfixBatchPreflightRefusal(failures, fromSpecs, portLaneShas = /* @__PURE__ */ new Map()) {
   const lines2 = failures.map((f) => `  - ${f.label}: ${f.blocking.join(", ")}`);
+  const portFailures = failures.filter((f) => portLaneShas.has(f.sha));
+  const synthFailures = failures.filter((f) => !portLaneShas.has(f.sha));
+  const head = `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
+${lines2.join("\n")}
+`;
   const batchFrom = fromSpecs.join(",");
+  const guide = "https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused";
+  if (portFailures.length > 0) {
+    const originals = portFailures.map((f) => f.sha.slice(0, 7)).join(",");
+    const portText = `${portFailures.length === failures.length ? "Every failing pick" : `Pick(s) ${portFailures.map((f) => f.label).join(", ")}`} fail on path(s) ABSENT on origin/main but present on origin/development, so a development-based cite-only synthesis PR cannot carry them (a new development commit cannot add files development already has \u2014 its cherry-pick onto main carries nothing, #7669). Use the main-based PORT-COMMIT lane: cut a branch FROM origin/main, add ONE port commit that brings the listed path(s) and the fix onto main-lineage (e.g. \`git checkout origin/development -- <paths>\` then the fix), push it and keep it pushed until the release \u2014 never merge it into development \u2014 then run \`mmi-cli devops hotfix start --from <portSHA> --ack ${originals}\` (a bare SHA is accepted; the originals are the acked development fixes the port replaces), and record the port SHA in the hotfix PR body. The port commit never reaches development and will not patch-id match, so the NEXT rc\u2192main release must pass \`--ack <the hotfix's main commit>\` (hotfix-coverage). ` + bothSidesText(portFailures, portLaneShas);
+    if (synthFailures.length === 0) return `${head}${portText}Never hand-resolve onto main; see ${guide}`;
+    return `${head}Mixed batch \u2014 two lanes. ${portText}Pick(s) ${synthFailures.map((f) => f.label).join(", ")} fit the development-based cite-only synthesis lane instead: cut the branch FROM origin/development, regenerate the conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the #5096 flow). Then rerun \`mmi-cli devops hotfix start --from <synthesis merge SHA(s)>,<portSHA> --ack ${originals}\` (the original --from was ${batchFrom}) \u2014 never hand-resolve onto main; never a main-parented branch into development; see ${guide}`;
+  }
   return `hotfix start batch preflight refused: ${failures.length} pick(s) would hard-stop on origin/main:
 ${lines2.join("\n")}
 Land ONE development-based cite-only synthesis PR for the whole batch (#4643 supersedes the old cut-from-origin/main wording, which produced main-lineage PRs into development \u2014 the shape portFoldToDevelopment forbids, #4365/#4371): cut the branch FROM origin/development, regenerate the listed conflict content so it cherry-picks cleanly onto current origin/main, and land that development-parented PR with the cite-only marker (the proven #5096 flow), then rerun \`mmi-cli devops hotfix start --from ${batchFrom}\` with the port merge SHA(s) \u2014 never hand-resolve onto main; never a main-parented branch into development; never N serial ports (#3167) \u2014 see https://github.com/mutmutco/MMI-Hub/blob/development/docs/Guides/train-troubleshooting.md#hotfix-pick-refused`;
@@ -36538,7 +36644,7 @@ async function runHotfixStartLocked(deps, options, doctor) {
   await deps.run("git", ["fetch", "origin", "--tags"]);
   const { deployModel, meta } = await hotfixPreflight(deps, ctx, "start");
   const bumpNotes = [];
-  let resolved = await resolveHotfixVersion(deps);
+  let resolved = await resolveHotfixVersion(deps, process.env, preOneZeroInForce(meta));
   for (; ; ) {
     const priorPr = await findHotfixPr(deps, ctx, resolved.tag);
     if ((priorPr?.state ?? "").toUpperCase() !== "MERGED") break;
@@ -36608,7 +36714,8 @@ async function runHotfixStartLocked(deps, options, doctor) {
   } else {
     const preflight2 = await preflightHotfixBatchPicks(deps, sources, pickTolerated);
     if (preflight2.failures.length > 0) {
-      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs));
+      const portLaneShas = await classifyHotfixPortLanePicks(deps, preflight2.failures);
+      throw new Error(formatHotfixBatchPreflightRefusal(preflight2.failures, specs, portLaneShas));
     }
     if (preflight2.skipped.length > 0) {
       const skippedShas = new Set(preflight2.skipped.map((s) => s.sha));
@@ -37720,7 +37827,6 @@ async function advanceClosedIssuesToDone(deps) {
       error: `expected an array of closing issue references, got ${closing === null ? "null" : typeof closing}`
     };
   }
-  if (closing.length === 0) return { status: "none", entries: [] };
   const refs = [];
   for (const [i, candidate] of closing.entries()) {
     const repo = repoOf2(candidate);
@@ -37734,6 +37840,29 @@ async function advanceClosedIssuesToDone(deps) {
     refs.push({ ref: candidate, repo });
   }
   const entries = [];
+  const fallbackNumbers = /* @__PURE__ */ new Set();
+  let fallbackError;
+  if (deps.fallback) {
+    try {
+      const registered = new Set(refs.filter((r) => r.repo.toLowerCase() === deps.repo.toLowerCase()).map((r) => r.ref.number));
+      for (const n of [...new Set(await deps.fallback.fetchClaimed())].filter((n2) => !registered.has(n2))) {
+        try {
+          const closed = await deps.fallback.closeIssue(n);
+          if ("error" in closed) entries.push({ issue: `#${n}`, moved: false, status: "failed", error: `GitHub did not register the closing reference and the CLI could not close it (${closed.error})` });
+          else if (closed.state === "closed") {
+            fallbackNumbers.add(n);
+            const [owner, name] = deps.repo.split("/");
+            refs.push({ ref: { number: n, repository: { name: name ?? "", owner: { login: owner ?? "" } } }, repo: deps.repo });
+          }
+        } catch (e) {
+          entries.push({ issue: `#${n}`, moved: false, status: "failed", error: `GitHub did not register the closing reference and the CLI could not close it (${e.message})` });
+        }
+      }
+    } catch (e) {
+      fallbackError = e.message;
+    }
+  }
+  if (refs.length === 0 && entries.length === 0) return { status: "none", entries: [], ...fallbackError ? { fallbackError } : {} };
   for (const { ref, repo } of refs) {
     if (repo.toLowerCase() !== deps.repo.toLowerCase()) {
       entries.push({
@@ -37774,14 +37903,15 @@ async function advanceClosedIssuesToDone(deps) {
       entries.push({ issue, moved: false, status: "failed", error: e.message });
     }
   }
-  return { status: entries.every((e) => e.moved) ? "ok" : "partial", entries };
+  for (const e of entries) if (fallbackNumbers.has(Number(e.issue.slice(1)))) e.closedByFallback = true;
+  return { status: entries.every((e) => e.moved) && !fallbackError ? "ok" : "partial", entries, ...fallbackError ? { fallbackError } : {} };
 }
 function boardAdvanceFailures(result) {
   return (result?.entries ?? []).filter((e) => !e.moved);
 }
 function boardAdvanceExitCode(result) {
   if (!result) return void 0;
-  if (result.status === "fetch-failed") return 1;
+  if (result.status === "fetch-failed" || result.fallbackError) return 1;
   return boardAdvanceFailures(result).length > 0 ? 1 : void 0;
 }
 function boardAdvanceFailureMessage(result) {
@@ -37790,6 +37920,7 @@ function boardAdvanceFailureMessage(result) {
     return `pr merge: could not read the PR's closing issues (${result.error ?? "unknown error"}) \u2014 the PR MERGED, but no board item was advanced. Check the board by hand.`;
   }
   const failures = boardAdvanceFailures(result);
+  if (result.fallbackError) return `pr merge: could not read the PR body to close unregistered closing lines (${result.fallbackError}) \u2014 the PR MERGED; check by hand whether its "Closes #N" issues are still open.`;
   if (!failures.length) return void 0;
   const named = failures.map((f) => f.error ? `${f.issue} (${f.error})` : f.issue).join(", ");
   return `pr merge: board advance incomplete for ${named} \u2014 the PR MERGED, but ${failures.length === 1 ? "this issue" : "these issues"} did not reach Done on the board.`;
@@ -38882,6 +39013,41 @@ async function resolveBoardAdvanceForPr(prNumber, repoOption) {
   }
   return advanceClosedIssuesToDone({
     repo,
+    // #7691: GitHub sometimes fails to register a body `Closes #N`, so the merge closes nothing. Close the
+    // still-OPEN issues the body claims on a deliberate line-start closing line (same repo only). GitHub closes
+    // only for PRs into the default branch, so a PR into rc/main (a train or hotfix PR) never falls back.
+    fallback: {
+      fetchClaimed: async () => {
+        const { stdout } = await execFileP("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "body,baseRefName"], { timeout: GC_GH_TIMEOUT_MS });
+        const { body, baseRefName } = JSON.parse(stdout || "null") ?? {};
+        if (typeof body !== "string" || typeof baseRefName !== "string") throw new Error("gh returned no PR body or base branch");
+        const repoView = await execFileP("gh", ["repo", "view", repo, "--json", "defaultBranchRef"], { timeout: GC_GH_TIMEOUT_MS });
+        const defaultBranch = JSON.parse(repoView.stdout || "null")?.defaultBranchRef?.name;
+        if (typeof defaultBranch !== "string" || !defaultBranch) throw new Error("gh returned no default branch");
+        if (baseRefName !== defaultBranch) return [];
+        return findLineStartClosings(body, repo);
+      },
+      closeIssue: async (n) => {
+        try {
+          const view = await execFileP("gh", ["issue", "view", String(n), "--repo", repo, "--json", "state"], { timeout: GC_GH_TIMEOUT_MS });
+          if (JSON.parse(view.stdout || "null")?.state !== "OPEN") return { state: "already-closed" };
+          await execFileP("gh", [
+            "issue",
+            "close",
+            String(n),
+            "--repo",
+            repo,
+            "--reason",
+            "completed",
+            "--comment",
+            `Closed by the CLI after PR #${prNumber} merged: its body says it closes this issue, but GitHub did not register the closing reference (#7691).`
+          ], { timeout: GH_MUTATION_TIMEOUT_MS });
+          return { state: "closed" };
+        } catch (e) {
+          return { error: e.message };
+        }
+      }
+    },
     fetchClosingIssues: async () => {
       const { stdout } = await execFileP("gh", ["pr", "view", prNumber, ...repoArgs, "--json", "closingIssuesReferences"], { timeout: GC_GH_TIMEOUT_MS });
       const parsed = JSON.parse(stdout || "null");
@@ -41689,6 +41855,8 @@ function findEnvFiles(root) {
 // src/stage-runtime-env.ts
 var SERVICE_NAME_RE = /^[A-Za-z0-9_.-]+$/;
 var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var EXCLUDE_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
+var EXCLUDE_LABEL = "mmi.runtime-env.exclude";
 var RUNTIME_ENV_OVERRIDE_RELPATH = "tmp/stage/runtime-env.override.yml";
 function labelsMarkRuntimeEnv(labels) {
   if (Array.isArray(labels)) {
@@ -41699,6 +41867,50 @@ function labelsMarkRuntimeEnv(labels) {
   }
   return false;
 }
+function labelValue(labels, name) {
+  if (Array.isArray(labels)) {
+    for (const l of labels) {
+      if (typeof l !== "string") continue;
+      const eq = l.indexOf("=");
+      if (eq < 0 || l.slice(0, eq).trim() !== name) continue;
+      const value = l.slice(eq + 1).trim();
+      const quote = value[0];
+      const quoted = value.length >= 2 && (quote === '"' || quote === "'") && value.endsWith(quote);
+      return quoted ? value.slice(1, -1) : value;
+    }
+    return "";
+  }
+  if (labels && typeof labels === "object") return String(labels[name] ?? "");
+  return "";
+}
+function parseRuntimeEnvExclude(value, service = "?") {
+  if (!value.trim()) return [];
+  return value.split(",").map((raw) => {
+    const key = raw.trim();
+    if (!EXCLUDE_KEY_RE.test(key)) {
+      throw new Error(`invalid ${EXCLUDE_LABEL} entry on service ${service}: '${key}' (comma-separated env-var names matching ^[A-Z_][A-Z0-9_]*$)`);
+    }
+    return key;
+  });
+}
+function runtimeEnvExcludes(composeConfigJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(composeConfigJson);
+  } catch {
+    return {};
+  }
+  const services = parsed?.services;
+  if (!services || typeof services !== "object" || Array.isArray(services)) return {};
+  const out = {};
+  for (const [name, svc] of Object.entries(services)) {
+    const labels = svc?.labels;
+    if (!SERVICE_NAME_RE.test(name) || !labelsMarkRuntimeEnv(labels)) continue;
+    const keys = parseRuntimeEnvExclude(labelValue(labels, EXCLUDE_LABEL), name);
+    if (keys.length) out[name] = keys;
+  }
+  return out;
+}
 function runtimeEnvMarkedServices(composeConfigJson) {
   let parsed;
   try {
@@ -41710,19 +41922,24 @@ function runtimeEnvMarkedServices(composeConfigJson) {
   if (!services || typeof services !== "object" || Array.isArray(services)) return [];
   return Object.entries(services).filter(([name, svc]) => SERVICE_NAME_RE.test(name) && labelsMarkRuntimeEnv(svc?.labels)).map(([name]) => name).sort();
 }
-function renderRuntimeEnvOverride(services, keys) {
+function renderRuntimeEnvOverride(services, keys, excludes = {}) {
   const safeServices = services.filter((s) => SERVICE_NAME_RE.test(s)).sort();
   const safeKeys = [...new Set(keys.filter((k) => ENV_KEY_RE.test(k)))].sort();
-  if (!safeServices.length || !safeKeys.length) return null;
+  const keysFor = (service) => {
+    const skip = new Set(excludes[service] ?? []);
+    return safeKeys.filter((k) => !skip.has(k));
+  };
+  const withKeys = safeServices.filter((s) => keysFor(s).length);
+  if (!withKeys.length) return null;
   const lines2 = [
     "# Generated by `mmi-cli stage` (#6345) \u2014 do not edit, do not commit.",
     '# Passes the vault-resolved runtime env through to every service labelled mmi.runtime-env: "true",',
     "# exactly as the box deploy does. KEY NAMES ONLY: the values live in the compose process env (#2655).",
     "services:"
   ];
-  for (const service of safeServices) {
+  for (const service of withKeys) {
     lines2.push(`  ${service}:`, "    environment:");
-    for (const key of safeKeys) lines2.push(`      ${key}: \${${key}:?}`);
+    for (const key of keysFor(service)) lines2.push(`      ${key}: \${${key}:?}`);
   }
   return `${lines2.join("\n")}
 `;
@@ -42124,7 +42341,7 @@ async function prepareRuntimeEnvPassthrough(cwd, composeEnv, vaultEnvMerge) {
   } catch {
     return {};
   }
-  const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys);
+  const body = renderRuntimeEnvOverride(runtimeEnvMarkedServices(configJson), keys, runtimeEnvExcludes(configJson));
   if (!body) return {};
   const overridePath = (0, import_node_path38.join)(cwd, RUNTIME_ENV_OVERRIDE_RELPATH);
   (0, import_node_fs38.mkdirSync)((0, import_node_path38.join)(cwd, "tmp", "stage"), { recursive: true });
@@ -44100,6 +44317,11 @@ ${list}`);
 `
       );
     }
+    const safeTitle = rewriteUnregisteredClosingKeywords(title, findClosingMentions(body).map((m) => m.issue));
+    if (safeTitle !== title) {
+      title = safeTitle;
+      process.stderr.write('pr create: WARNING \u2014 rewrote close-keyword text in the title to "part of #N": the squash commit subject would close it (#7688). Put closing keywords on a "Closes #N" body line.\n');
+    }
     const docsCheck = await checkDocsIndexAtHead({ repo: o.repo, head: o.head }, createPrCreateDocsIndexDeps());
     if (docsCheck && !docsCheck.ok) {
       return fail(`pr create: ${docsCheck.detail} \u2014 ${docsCheck.fix}`);
@@ -45047,7 +45269,7 @@ async function requireFreshTrainCli(commandName) {
   process.exit(converge.reexecCode);
 }
 var GH_TRAIN_TIMEOUT_MS = 3e4;
-var GH_RUN_WATCH_TIMEOUT_MS = 20 * 6e4;
+var GH_RUN_WATCH_TIMEOUT_MS = 90 * 6e4;
 var NODE_PREPARE_TIMEOUT_MS = 10 * 6e4;
 var NODE_VERIFY_TIMEOUT_MS = 5 * 6e4;
 var NPM_TRAIN_TIMEOUT_MS = 6e4;
@@ -46311,6 +46533,12 @@ function suiteRcDataProdDeps() {
     },
     readToken: readOrgVercelApiToken,
     readVault: async (vaultKey) => fetchSecretValue(makeSecretsDeps(await loadConfig()), vaultKey, { repo: RC_DATA_VAULT_REPO }),
+    readLeadRcSubstrate: async () => {
+      const facts = await fetchDeployFactsBySlug("mm-work", registryClientDeps(await loadConfig()));
+      if (!facts) throw new Error("MM-Work deploy facts unreadable; stop");
+      const rc = facts.stages.rc;
+      return rc?.present ? rc.substrate ?? "an unnamed substrate" : null;
+    },
     sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
   };
 }
@@ -49665,7 +49893,7 @@ function registerSchedulesCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  schedules.command("park <schedule-id>").description("record a deliberate hold on a SCHEDULE# row \u2014 the reconciler skips it and `org schedules` renders `parked (<reason>)` instead of DRIFT (#4257)").requiredOption("--reason <ref>", "why the lane is held, e.g. an issue ref (#1774)").action(async (scheduleId, o) => {
+  schedules.command("park <schedule-id>").description("record a deliberate hold on a SCHEDULE# row \u2014 the reconciler skips it and `org schedules` renders `parked (<reason>)` instead of DRIFT (#4257). It does NOT stop an armed clock from dispatching: to stop a lane firing, disable its workflow (`gh workflow disable`) or remove its header and re-register (#7685)").requiredOption("--reason <ref>", "why the lane is held, e.g. an issue ref (#1774)").action(async (scheduleId, o) => {
     try {
       const res = await postSchedulesPark(scheduleId, o.reason, registryClientDeps(await loadConfig()));
       if (!res.ok) {
@@ -49673,6 +49901,7 @@ function registerSchedulesCommands(program3) {
         return;
       }
       console.log(JSON.stringify(res.body, null, 2));
+      console.error(`schedules park: ${scheduleId} is parked for drift reporting only \u2014 an armed clock still dispatches it. To stop it firing: gh workflow disable <workflow> -R <owner/repo>, or remove its schedule header and re-run \`mmi-cli harbour org schedules register\`.`);
     } catch (e) {
       await failGraceful(e.message);
     }
@@ -49717,6 +49946,96 @@ function registerSchedulesCommands(program3) {
   });
 }
 
+// ../company-emails.json
+var company_emails_default = {
+  _comment: "Org-level, NON-secret GitHub login -> company email map (#7678). `mmi-cli oracle org access sync <repo>` maps a repo's current developer/admin collaborators through it to rebuild the stage allowlist a project opts into with the registry field `stageAllowlist` (e.g. MM-Work's MMW_STAGE_ALLOWLIST). Bundled into mmi-cli at build time (cli/src/stage-allowlist.ts) \u2014 one source of truth, edited here in a PR. Keys are lowercase GitHub logins; a collaborator missing here is reported loudly by the sync, never silently dropped.",
+  emails: {
+    jervaise: "suphi@mutatismutandis.co",
+    sezenlerinadil: "adil@mutatismutandis.co"
+  }
+};
+
+// src/stage-allowlist.ts
+var ALLOWLIST_STAGES = ["dev", "rc", "main"];
+var ALLOWLIST_ROLES = /* @__PURE__ */ new Set(["write", "maintain", "admin"]);
+function bundledCompanyEmails() {
+  return normalizeEmailMap(company_emails_default.emails ?? {});
+}
+function normalizeEmailMap(raw) {
+  const out = {};
+  for (const [login, email] of Object.entries(raw)) {
+    if (typeof email === "string" && email.trim()) out[login.toLowerCase()] = email.trim().toLowerCase();
+  }
+  return out;
+}
+function stageAllowlistConfig(project2) {
+  const cfg = project2?.stageAllowlist;
+  if (!cfg || typeof cfg.key !== "string" || !Array.isArray(cfg.stages)) return null;
+  const stages = cfg.stages.filter((s) => ALLOWLIST_STAGES.includes(s));
+  return stages.length > 0 ? { key: cfg.key, stages } : null;
+}
+function developerAdminLogins(collaborators) {
+  const logins = /* @__PURE__ */ new Set();
+  for (const c of collaborators) {
+    const role = c.role_name ?? (c.permissions?.admin ? "admin" : c.permissions?.maintain ? "maintain" : c.permissions?.push ? "write" : "read");
+    if (ALLOWLIST_ROLES.has(role)) logins.add(c.login.toLowerCase());
+  }
+  return [...logins].sort();
+}
+function computeAllowlist(logins, emailMap) {
+  const emails = /* @__PURE__ */ new Set();
+  const unmapped = [];
+  for (const login of logins) {
+    const email = emailMap[login.toLowerCase()];
+    if (email) emails.add(email);
+    else unmapped.push(login);
+  }
+  return { emails: [...emails].sort(), unmapped };
+}
+function diffAllowlist(current, next) {
+  const before = new Set((current ?? "").split(",").map((e) => e.trim().toLowerCase()).filter(Boolean));
+  const after = new Set(next);
+  const added = [...after].filter((e) => !before.has(e)).sort();
+  const removed = [...before].filter((e) => !after.has(e)).sort();
+  return { added, removed, changed: added.length > 0 || removed.length > 0 };
+}
+async function syncStageAllowlist(deps, repo, config, emailMap, opts = {}) {
+  const logins = developerAdminLogins(await deps.listCollaborators(repo));
+  const { emails, unmapped } = computeAllowlist(logins, emailMap);
+  const stages = [];
+  for (const stage of config.stages) {
+    const coordinate = `${stage}/${config.key}`;
+    const diff = diffAllowlist(await deps.readValue(repo, coordinate), emails);
+    if (!diff.changed || opts.dryRun) {
+      stages.push({ stage, ...diff, written: false });
+      continue;
+    }
+    if (emails.length === 0) {
+      stages.push({ stage, ...diff, written: false, error: "no developer/admin collaborator has a mapped email \u2014 refusing to write an empty allowlist" });
+      continue;
+    }
+    const written = await deps.writeValue(repo, coordinate, emails.join(","));
+    stages.push({ stage, ...diff, written, ...written ? {} : { error: `vault write of ${coordinate} was refused` } });
+  }
+  return { repo, key: config.key, logins, unmapped, emails, stages, ok: unmapped.length === 0 && stages.every((s) => !s.error) };
+}
+function renderStageAllowlist(r, dryRun = false) {
+  const lines2 = [`${r.repo}: ${r.key} from ${r.logins.length} developer/admin collaborator(s): ${r.logins.map((l) => `@${l}`).join(", ") || "(none)"}`];
+  for (const s of r.stages) {
+    const change = !s.changed ? "unchanged" : `${s.added.length ? `+${s.added.join(" +")}` : ""}${s.added.length && s.removed.length ? " " : ""}${s.removed.length ? `-${s.removed.join(" -")}` : ""}`;
+    const verb = s.error ? "FAILED" : s.written ? "written" : s.changed && dryRun ? "would write" : "no write needed";
+    lines2.push(`  ${s.stage}/${r.key}: ${change} (${verb})${s.error ? ` \u2014 ${s.error}` : ""}`);
+  }
+  for (const login of r.unmapped) {
+    lines2.push(`  UNMAPPED: @${login} holds developer/admin on ${r.repo} but has NO company email in company-emails.json \u2014 they are NOT on the allowlist. Add "${login.toLowerCase()}" there, then re-run.`);
+  }
+  if (r.stages.some((s) => s.written)) lines2.push("  redeploy the stage for the runtime to pick the new value up: `mmi-cli devops runtime tenant redeploy <owner/repo> <stage>`");
+  return lines2.join("\n");
+}
+async function listRepoCollaborators(client, repo) {
+  return client.restPaginate(`repos/${repo}/collaborators`);
+}
+
 // src/session-report.ts
 init_cli_shared();
 var GC_GH_TIMEOUT_MS4 = 2e4;
@@ -52474,7 +52793,7 @@ ${filelessTransitionGuide(target, o.stage)}`
   return reportWrite("org project set-deploy", res);
 });
 var projectTenantTasks = project.command("tenant-tasks").description("project-admin self-declare of tenant tasks for every stage of your own repo \u2014 new-task-only; editing an existing task stays master-only (`org project set --var tenantTasks=...`)");
-projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", "task command as argv (repeatable; required unless --var carries it)").option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
+projectTenantTasks.command("declare <name>").description("register a NEW tenant task \u2014 becomes runnable via `runtime tenant control \u2026 run-task` on its declared dev/rc/main stages. Body shape {service,command[],stages[],timeoutSeconds?,artifact?}; required artifact tasks must carry {artifact} in the command argv.").option("--service <name>", "service in the tenant runtime the task runs in (required unless --var carries it)").option("--command <argv...>", `task command as argv (repeatable; required unless --var carries it). An argv token that starts with "-" (python -m mod) is read as an option and the whole call fails to parse: declare such a command with --var '{"service":"<svc>","command":["python","-m","mod"],"stages":["dev"]}' instead (#7668)`).option("--stages <list>", "comma-separated dev,rc,main stages this task may run on (required unless --var carries it)").option("--timeout-seconds <n>", "optional wall-clock ceiling 1..3600").option("--artifact <none|required>", "artifact contract (default none; required tasks must contain {artifact} in argv)").option("--var <json>", "full task object {service,command[],stages[],timeoutSeconds?,artifact?} \u2014 use instead of the individual flags. A task carrying secretOutput:{path,vault:{repo,key},overwrite?} is master-only; declare that via `org project set --var tenantTasks=...`").option("--repo <owner/repo>", "target repo (defaults to the current repo)").option("--json", "machine-readable output").action(async (name, o) => {
   const cfg = await loadConfig();
   let target;
   try {
@@ -52722,6 +53041,28 @@ access.command("role [repo]").description("D14 train authority for a repo (serve
   console.log(`${a.repo}: @${a.login} is ${a.role} \u2014 train ${a.train ? "AUTHORIZED" : "not authorized"}${a.hubTrainMasterOnly ? " (Hub train is master-only)" : ""}`);
   if (!a.train) process.exitCode = 1;
 });
+access.command("sync [repo]").description("rebuild the stage allowlist (e.g. MM-Work MMW_STAGE_ALLOWLIST) from the repo's developer/admin collaborators via company-emails.json and write it to the vault for each stage the project opted into (registry stageAllowlist); run it after every developer/admin change (#7678)").option("--dry-run", "print what would change without writing").option("--json", "machine-readable output").action(async (repoArg) => {
+  const o = { json: rawFlag("--json"), dryRun: rawFlag("--dry-run") };
+  const repo = repoArg ?? await resolveRepo();
+  if (!repo) return fail("org access sync: pass <owner/repo> or run inside a repo checkout");
+  const cfg = await loadConfig();
+  if (!cfg.sagaApiUrl) return fail("org access sync: Hub API URL not configured");
+  const projects = await fetchProjectsList(registryClientDeps(cfg));
+  if (!projects) return failGraceful("org access sync: could not read the org project registry \u2014 nothing written");
+  const project2 = projects.find((p) => (p.repos ?? []).some((r) => r.toLowerCase() === repo.toLowerCase())) ?? null;
+  const config = stageAllowlistConfig(project2);
+  if (!config) return failGraceful(`org access sync: ${repo} has no stageAllowlist opt-in \u2014 set it with \`mmi-cli oracle org project set ${repo} --var 'stageAllowlist={"key":"<KEY>","stages":["dev"]}'\``);
+  const secretsDeps = makeSecretsDeps(cfg);
+  const client = defaultGitHubClient();
+  const result = await syncStageAllowlist({
+    listCollaborators: (r) => listRepoCollaborators(client, r),
+    readValue: (r, coordinate) => fetchSecretValue(secretsDeps, coordinate, { repo: r }),
+    // The value is written in-process from here; putSecret confirms by NAME only.
+    writeValue: (r, coordinate, value) => putSecret(secretsDeps, coordinate, value, { repo: r })
+  }, repo, config, bundledCompanyEmails(), { dryRun: o.dryRun });
+  console.log(o.json ? JSON.stringify(result, null, 2) : renderStageAllowlist(result, o.dryRun));
+  if (!result.ok) process.exitCode = 1;
+});
 access.command("audit").description("audit collaborator roles + train-branch push allowlists vs the locked state; read-only, emits gh remediation, never applies").option("--json", "machine-readable output").option("--repo <owner/repo>", "audit a single repo instead of the whole org").option("--class <class>", "repo class for --repo (deployable | content)", "deployable").action(async () => {
   const o = { json: rawFlag("--json"), repo: rawValue("--repo", ""), class: rawValue("--class", "deployable") };
   const deps = { client: defaultGitHubClient() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.76",
+  "version": "4.5.78",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",