@mutmutco/codex-plugin 4.0.2 → 4.0.3

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "mmiCompat": "3.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/hotfix/SKILL.md

@@ -37,8 +37,16 @@ version, BOM, and package pins. Step 3 opens that development-base fold PR autom
 
 ## Authority and preflight
 
-Production changes require the authorized human's explicit approval in the current turn. Verify authority
-and CLI health before starting:
+Production changes require the authorized human's explicit approval in the current turn. Before describing
+or executing any hotfix lane, read the project META and name the lane (#5244 — same gate as `/release`):
+```bash
+mmi-cli oracle org project get {owner}/{repo} --json
+```
+`releaseTrack: direct` means `development → main` only — **no `rc` branch** (MMI-Hub included via the
+Hub-control special case). Stop on an unreadable META record; never infer the lane from branch names or
+release history.
+
+Verify authority and CLI health before starting:
 
 ```bash
 mmi-cli oracle org access role <owner/repo> --json

package/skills/mmi/SKILL.md

@@ -299,6 +299,10 @@ something else* paths.)
   ```
   The command validates `Todo` + unassigned, assigns the viewer, and moves the Project v2 `Status` to
   `In Progress`. A partial claim exits nonzero unless the dev explicitly accepted `--allow-partial`.
+  Every claim also stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: … -->`,
+  surface/session@host) so other agents can attribute the hold (#3727): the session is the
+  host-exported id when the surface provides one, otherwise a per-process `synth-` fallback — a
+  claim is never anonymous (#5245).
   Claiming several items (batch/parallel act-paths) takes them in **one call** — `board claim <ref> <ref> …`
   — which shares the setup cost and reports per-item results (any per-item failure → nonzero exit).
 - **File a new item (guided by type → template):** don't free-type an issue. Walk the dev through it:
@@ -415,6 +419,11 @@ workspace mechanics:
 MMI owns the PR/CI/merge/board facts; the host agent owns local worktrees and branches. Neither `pr land`
 nor `pr merge` deletes a local worktree or local branch, and no MMI command should do so. The distinction:
 
+**Release-track before branch hygiene (#5244):** before hunting `rc` branches, rc worktrees, or retired rc refs
+for cleanup, read the repo's release track (`mmi-cli status`, or `mmi-cli oracle org project get` when
+status omits it). Direct-track repos have only `development` and `main` — an old rc promotion PR does not
+imply a live `rc` branch or worktree exists.
+
 - `mmi-cli devops pr land <pr>` is the normal agent path for a `development` PR: train-authority probe →
   checks wait → squash auto-merge/poll → board advance. GitHub may delete the **remote** feature branch.
 - `mmi-cli devops pr merge <pr>` is the lower-level merge primitive. It is not a shortcut around checks
@@ -451,18 +460,30 @@ Proceed only when `state` is `MERGED`, `headRefName` equals the local task branc
 local branch OID, the worktree is registered to that branch, and its status is empty. Branch name, missing
 remote ref, patch-id, or PR state **alone** is not proof. Then, from the main checkout:
 
+A clean `git status --porcelain` is **not** proof the physical directory is empty: gitignored payload such
+as `node_modules` (from `npm ci`) and this session's own scratch (e.g. `.jerv/tmp`) is invisible to it,
+and `git worktree remove` refuses a non-empty tree with `Directory not empty` (#5239). Once the receipt
+above proves delivery, delete `node_modules` and this session's own scratch first, then remove:
+
 ```bash
+rm -rf <task-worktree>/node_modules   # gitignored payload — porcelain never shows it
+rm -rf <task-worktree>/.jerv/tmp      # this session's own scratch, if this run created it
 git worktree remove <task-worktree>
 git branch -D <branch>       # deliberate: squash merge makes -d ancestry proof impossible
 git worktree prune
 ```
 
 `-D` is permitted only after the exact receipt above. Never use it for a mismatched OID, an open/unreadable
-PR, a dirty tree, another owner's tree, or an ambiguous branch.
-
-On Windows `Directory not empty`, `EBUSY`, `EPERM`, or WinError 32: re-check that every context has left the
-path and make **one bounded retry** of `git worktree remove` when it is still registered. If Git already
-unregistered the tree but a partial directory remains, or the retry is still locked, stop: do not kill
+PR, a dirty tree, another owner's tree, or an ambiguous branch. The pre-removal deletes follow the same
+rule: only artifacts this session created inside this task worktree.
+
+On Windows `Directory not empty` with a clean porcelain, suspect leftover gitignored payload: delete it as
+above and retry. On `EBUSY`, `EPERM`, or WinError 32: re-check that every context has left the path and
+make **one bounded retry** of `git worktree remove` when it is still registered. If the retry reports
+`is not a working tree`, the first failed remove already unregistered the tree; when the exact receipt
+above proves the leftover directory is this session's own merged branch, that leftover may be deleted
+(`rm -rf <task-worktree>`) — own-session artifacts only, never another session's tree, never on a
+mismatched OID or unreadable PR (#5239). Otherwise, or when the retry is still locked, stop: do not kill
 unrelated processes, recursively delete the directory, or guess. Report `deferred-lock` with the exact
 path, branch, local OID, PR, and whether the tree remains registered. Report any failed proof as
 `retained-ambiguous`. Only report `clean` after the path, registration, and local task branch are all gone.

package/skills/mmi-resume/SKILL.md

@@ -35,10 +35,20 @@ A clean self-check is silent-enough — move straight on. Do not block the snaps
 mmi-cli status
 ```
 
-`status` is the unified current-state read for **this** checkout: branch, linked worktrees, your open PRs,
-your claimed board items, and whether a local stage is running. It is the "where am I" line — render it,
-don't re-derive it from raw `git`/`gh`. Keep the case-preserving `repo` value it reports; that is the
-workspace identity the next step must use (for example `mutmutco/MMC-ZuberShade`).
+`status` is the unified current-state read for **this** checkout: branch, **release track** (when the repo is
+registered — `releaseTrack` + branch topology from Hub META), linked worktrees, your open PRs, your claimed
+board items, and whether a local stage is running. It is the "where am I" line — render it, don't re-derive
+it from raw `git`/`gh`. Keep the case-preserving `repo` value it reports; that is the workspace identity the
+next step must use (for example `mutmutco/MMC-ZuberShade`).
+
+**Release-track doctrine (#5244):** direct-track repos (`releaseTrack: direct`, plus MMI-Hub via the
+`isHubControlRepo` special case) have **only** `development` and `main` — no `rc` branch exists. Never hunt
+for, clean up, or run `/rcand` against an `rc` ref on direct-track. When `status` omits `releaseTrack`
+(unregistered repo or registry unavailable), resolve it before any train/rc/hotfix/release or branch-hygiene
+work:
+```bash
+mmi-cli oracle org project get {owner}/{repo} --json
+```
 
 ### Step 1a — report deferred host cleanup, never perform it here (#5182)
 

package/skills/rcand/SKILL.md

@@ -19,7 +19,18 @@ pushes to the protected `rc` branch, whose per-repo allowlist carries the same p
 project-admins). No `.env` role marker. Gate ordering: the tag lands the rc SHA
 for checks, and every deploy side-effect waits until the protected `rc` push accepts that checked SHA.
 
-## Step 0 — train-authority probe (server-side, D14)
+## Step 0 — confirm lane + train-authority probe (server-side, D14)
+
+Before describing or executing any rc promotion, read the project META and name the lane (#5244):
+```bash
+mmi-cli oracle org project get {owner}/{repo} --json
+```
+`releaseTrack: direct` (product repos with explicit META, plus MMI-Hub via the `isHubControlRepo`
+special-case) means **no `rc` branch** — stop here and run `/release` from `development` instead.
+`mmi-cli devops rcand --apply` refuses direct-track after its own preflight; do not reach Step 1 on direct.
+Stop on an unreadable META record; never infer the lane from branch names or the existence of a stale `rc` ref.
+
+Then probe train authority:
 
 ```bash
 mmi-cli oracle org access role {owner}/{repo} --json   # Hub-verified: { role, train }