@mutmutco/codex-plugin 4.3.16 → 4.3.18

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.3.16",
+  "version": "4.3.18",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.3.16",
+  "version": "4.3.18",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -381,6 +381,13 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   $OWNER/$REPO` remains the supported fallback; confirm `product required-check ruleset enforcement active`
   with `bootstrap verify` before reporting bootstrap complete. MMI-Hub keeps its own three-job gate
   (`cli`/`infra`/`docs`) — never apply the product ruleset there.
+- **The ruleset requires an up-to-date head (#6263)** — the seeded reference sets
+  `strict_required_status_checks_policy: true` ("require branches to be up to date before merging"), so the
+  last of several parallel landings re-tests on the real combination instead of a base that lacked the
+  others (Jerv-JervCode#4289). `bootstrap apply --execute` and `ci reconcile --apply` re-PUT an existing
+  non-strict ruleset; `bootstrap verify` reports it as `product required-check ruleset requires an up-to-date
+  branch`. `pr merge` / `pr land` update a BEHIND head from the base with a merge commit and re-wait once —
+  see `docs/Guides/train-troubleshooting.md#head-behind-base`.
 - **A brand-new repo cannot pass the gate you just installed — its first commit must carry a real project
   (#2928).** The seeded `gate.yml` runs `GATE_INSTALL_CMD` + `GATE_CMD` (`npm ci` + `npm run check` by
   default) **unconditionally**. An empty repo has no `package.json`, so the gate **fails on the seed PR
@@ -438,18 +445,6 @@ collaborator list + the per-branch allowlist are the record — no separate rost
 - **`docs/index.md` is an optional generated routing index (#3545).** Apply may create `docs/index.md` once for link routing; it never rewrites it. Once the repo has docs of its own,
   `mmi-cli oracle docs index --write` owns the routing artifact and `--check` gates drift — it is not product
   current-state SSOT. Decision records under `docs/decisions/` remain append-only *why*.
-- **Push the mandated fill past the active ruleset (#1807).** Deployable repos activate
-  `mmi-product-required-checks` during apply (its `bypass_actors` is empty by design), so the `gate` check is
-  required on `development`/`main` before the seeded README + architecture have ever produced a green run. The
-  fill above (#1520) then cannot be pushed, and not even `gh pr merge --admin` clears it (GH013 on push /
-  GraphQL rule violation on admin-merge). Sanctioned final step: in GitHub Settings > Rules > Rulesets >
-  `mmi-product-required-checks`, set **Enforcement** to **Disabled**, push/merge the filled `README.md` +
-  `architecture.md`, then set **Enforcement** back to **Active**. Programmatic equivalent: PUT the ruleset
-  with `enforcement: disabled` (a PATCH is rejected, #917/#922), push the fill, then PUT it back to
-  `active` (or re-run `mmi-cli devops ci reconcile --apply --repo $OWNER/$REPO` once the gate is green, which
-  should activate idempotently). Before reporting bootstrap complete, run `mmi-cli devops bootstrap verify` and
-  confirm `product required-check ruleset enforcement active` is OK — a parked ruleset is not done. Never
-  leave enforcement disabled.
 - `.claude/settings.local.json` is local-only and gitignored; bootstrap seeds no committed `.claude/settings.json`.
 - **No agent guide is committed — none, anywhere (#2921).** `mmi-no-agent-files-org` is active with no bypass
   and restricts `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `.claude/**`, `.codex/**`, `.agents/**` **and

package/skills/bootstrap/seeds/gate.template.yml

@@ -36,6 +36,11 @@ name: gate
 # (mmi-live / mmi-heavy) is the only CI merge gate. Rare Windows proof stays on the owner's machine or
 # a future self-hosted Windows runner — never windows-latest.
 # (seed touch: keep BOM digests in lockstep after classifier land.)
+# harbour: unmanaged
+# The nightly `schedule` cron below is GitHub's own clock by design (docs/schedules.md rule 5, #6270): it is
+# the drift catcher for the PR gate (#6254), a required-check workflow that must not become a SCHEDULE# row
+# armed and dispatched by the plane it otherwise never touches — the merge gate stays decoupled from the
+# schedule plane, exactly as the deadman is.
 on:
   pull_request:
   push:

package/skills/bootstrap/seeds/mmi-product-required-checks.template.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Repository-level ruleset requiring the product gate job (#1333). Apply via GitHub repo rulesets (master-admin) after bootstrap seeds gate.yml — the job name gate must match this context.",
+  "_comment": "Repository-level ruleset requiring the product gate job (#1333). Apply via GitHub repo rulesets (master-admin) after bootstrap seeds gate.yml — the job name gate must match this context. strict_required_status_checks_policy=true (#6263): the head must be up to date with the base before merging, so the last of several parallel landings re-tests on the real combination.",
   "name": "mmi-product-required-checks",
   "target": "branch",
   "enforcement": "active",
@@ -13,7 +13,7 @@
     {
       "type": "required_status_checks",
       "parameters": {
-        "strict_required_status_checks_policy": false,
+        "strict_required_status_checks_policy": true,
         "required_status_checks": [
           { "context": "gate" }
         ]

package/skills/hotfix/SKILL.md

@@ -42,10 +42,9 @@ mmi-cli devops hotfix start --from <pr|sha>[,<pr|sha>…] --json --out "$r1"
 
 `hotfix start` derives the PATCH from the latest Release tag on `origin/main`, branches `hotfix/vX.Y.Z` from `origin/main`, cherry-picks with `-x`, folds the version, pushes, and opens the main-base PR with its carries marker. Never duplicate those steps with raw branch, cherry-pick or PR commands.
 
-2. Verify the main-base PR: the repo's local gate on the hotfix branch, the independent review the active agent doctrine requires, and the original issue's acceptance criteria. Then wait for required CI and merge through Hub — the PR may squash, and the `-x` trailer must survive in the squash message:
+2. Verify the main-base PR: the repo's local gate on the hotfix branch, the independent review the active agent doctrine requires, and the original issue's acceptance criteria. Then merge through Hub — it waits for required CI and demands the review verdict itself; the PR may squash, and the `-x` trailer must survive in the squash message:
 
 ```bash
-mmi-cli devops pr checks-wait <number>
 mmi-cli devops pr merge <number> --squash
 ```