@mutmutco/codex-plugin 3.139.1 → 3.139.3

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "3.139.1",
+  "version": "3.139.3",
   "mmiCompat": "3.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "3.139.1",
+  "version": "3.139.3",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -22,7 +22,11 @@ name: gate
 #   GATE_FULL_RUN_BRANCH — train branch whose PUSHES run the full gate job (development on full/direct;
 #                        main on trunk). `main` is ALWAYS included in the job `if:` below so a required-
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
+#   GATE_WINDOWS_COMPAT  — `true` opts the repo into the informational windows-latest compat job
+#                        (#5113: registry gate={"windowsCompat":true} or --var). Default OFF: Windows
+#                        minutes cost more than Linux and the required gate stays the Linux lane.
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
+# GATE_WINDOWS_COMPAT_JOB_YAML is rendered by the CLI from the final layered vars — not an operator knob.
 # (seed touch: keep kilo mirror + BOM digests in lockstep after classifier land.)
 on:
   pull_request:
@@ -55,6 +59,28 @@ jobs:
       run: { working-directory: {{GATE_WORKDIR}} }
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      # MMI-Hub#5111: Windows CRLF in tracked shell scripts breaks Linux runners before the real
+      # check can explain it. Inspect only tracked files before install; .gitattributes is the fix.
+      - name: Line-ending guard
+        shell: bash
+        run: |
+          offenders=$(mktemp)
+          trap 'rm -f "$offenders"' EXIT
+          {
+            git grep -Il $'\r' -- '*.sh' || true
+            git grep -Il '^#!' | while IFS= read -r path; do
+              case "$path" in
+                *.sh) ;;
+                *) git grep -Il $'\r' -- "$path" || true ;;
+              esac
+            done
+          } | sort -u > "$offenders"
+          if [[ -s "$offenders" ]]; then
+            while IFS= read -r path; do
+              echo "::error title=Line-ending guard::CR byte in tracked script: $path. Run git add --renormalize . with this repo's .gitattributes."
+            done < "$offenders"
+            exit 1
+          fi
       - if: ${{ '{{GATE_RUNTIME}}' == 'node' }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: npm, cache-dependency-path: {{GATE_CACHE_DEP_PATH}} }
@@ -83,3 +109,4 @@ jobs:
           command: {{GATE_CMD}}
           max-seconds: {{GATE_MAX_SECONDS}}
           working-directory: {{GATE_WORKDIR}}
+{{GATE_WINDOWS_COMPAT_JOB_YAML}}

package/skills/bootstrap/seeds/gitattributes.template

@@ -0,0 +1,6 @@
+# Canonical line endings for cross-platform development and Linux CI.
+* text=auto eol=lf
+*.sh text eol=lf
+*.snap text eol=lf
+*.cmd text eol=crlf
+*.bat text eol=crlf

package/skills/bootstrap/seeds/manifest.json

@@ -11,6 +11,7 @@
     { "target": ".github/workflows/agent-pr.yml", "source": "self", "ownership": "org", "classes": ["deployable"], "waivers": { "jerv-jervcode": "pins this workflow's EXACT step shapes in its own scripts/workflow-boundary-core.mjs — a literal repositories: Jerv-JervCode token scope, and whole-step equality for the surface and verdict legs. #4040 widened the org seed to the same hardened boundary (pull_request_target off the trusted base, an immutable BASE..HEAD compare with a file-count equality wall, a per-repo App token scope, and a certified-head merge), so the two now agree on substance. They cannot agree on bytes: a seed serving 16 repos resolves its token scope and its required contexts at run time, which exact-step equality rejects by construction. The waiver is permanent by design, not a deferral — lifting it would mean weakening the strictest repo to match a fleet file." } },
     { "target": ".github/rulesets/mmi-product-required-checks.json", "source": "seed:mmi-product-required-checks.template.json", "ownership": "org", "classes": ["deployable"] },
     { "target": ".gitignore", "source": "managed-block", "ownership": "org", "classes": ["deployable", "content"] },
+    { "target": ".gitattributes", "source": "seed:gitattributes.template", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "README.md", "source": "seed:README.template.md", "ownership": "repo", "classes": ["deployable", "content"], "managedBlock": { "source": "seed:readme-mmi-developer-environment.block.md", "begin": "<!-- mmi-developer-environment:start -->", "end": "<!-- mmi-developer-environment:end -->" } },
     { "target": "architecture.md", "source": "seed:architecture.template.md", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "docs/decisions/README.md", "source": "seed:decisions-readme.template.md", "ownership": "repo", "classes": ["deployable", "content"] },

package/skills/epic/SKILL.md

@@ -74,6 +74,12 @@ mmi-cli oracle issue create --type task --batch tmp/epic-children.json --surface
 placeholder. It prints per-row `{number,url}` results and fails loud on any misfire. Add
 `--idempotency-key <key>` when a retried loop must not duplicate.
 
+When creating through `mmi-cli vault secrets use GH_TOKEN -- …`, the `GH_TOKEN` environment override can
+disrupt Hub session discovery and print `board attach skipped — no Hub session token` for batch rows. That
+warning can appear when placement is correct, but it is not harmless or proof of placement: final verification
+must prove every intended child is linked and on the board as Todo with `mmi-cli oracle issue children
+<owner/repo#N> --json`.
+
 The idempotency lookup is find-before-create, not an atomic reservation. Run one batch writer at a time:
 never submit concurrent creates with the same key. Size the calling command's wall-clock budget for the
 whole sequential batch. If the command times out, its outcome is unknown — confirm the process has ended,
@@ -82,10 +88,11 @@ wait for writes to quiesce, inspect the children, then retry the missing rows wi
 ## Step 3 — confirm the tree
 
 ```bash
-mmi-cli oracle issue children <owner/repo#N>        # each child: number/title/state/repo/boardStatus/linkedPrs
+mmi-cli oracle issue children <owner/repo#N> --json # each child: number/title/state/repo/assignee/boardStatus/linkedPrs
 ```
 
-Verify every intended child is linked and on the board as Todo. To link a child that already existed (not
+This JSON is the final placement authority: verify every intended child is linked and on the board as Todo.
+If it does not prove that placement, investigate and correct the misfire. To link a child that already existed (not
 part of the batch), use the inverse-friendly single link:
 
 ```bash