@mutmutco/codex-plugin 3.137.0 → 3.139.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "3.137.0",
+  "version": "3.139.0",
   "mmiCompat": "3.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "3.137.0",
+  "version": "3.139.0",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -345,6 +345,16 @@ workflow.
 
 ## Step 4b — developer access
 
+**Repository Environments (#4458, plan-gating #5032)** — the track's deployment environments are
+control-plane state this skill's own `bootstrap verify` asserts, so live apply provisions them itself:
+`mmi-cli devops bootstrap apply --execute` creates `dev`/`rc`/`main` (per the release track: direct has no
+`rc`, trunk has `main` only) with a **deployment-branch policy = protected branches only** — the one
+protection the check exists to carry. On an org plan whose billing entitlement rejects protection rules
+(an explicit `wait_timer` or required `reviewers` comes back 422 naming the plan), apply provisions the
+settable policy and prints `plan-gated protections` for those rules; `bootstrap verify` then reports the
+environment rows as green with an `advisory:` detail naming what the plan cannot set — never a FAIL. The
+policy is set either way, so a repo on the lower plan is still protected and ready for developers.
+
 Grant each developer their **org membership + repo access** through the App (`gh api` with the App token):
 `write` for a developer; for a **full-write** member ("project-admin") also add them to the train-branch
 push allowlist from Step 2b (so they can merge protected development PRs). GitHub's
@@ -535,7 +545,8 @@ never agent guides or a spine. The fanout pipeline that used to push this block
 
 ## Step 8 — report
 
-Repo, default branch, ruleset applied, train branches locked (push allowlist), project attached/created
+Repo, default branch, ruleset applied, train branches locked (push allowlist), repository Environments
+provisioned per track (plan-gated protections named in apply output), project attached/created
 (+ info seeded, Status lanes and Labels field verified), secrets set (names only), developer access, plugin
 installed, docs seeded, registry META written, issue templates committed, org App credentials registered,
 org-managed `.gitignore` block seeded, and the final `mmi-cli devops bootstrap verify "$OWNER/$REPO" --class ... --json` result.