@mutmutco/codex-plugin 4.3.45 → 4.3.47

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.3.45",
+  "version": "4.3.47",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.3.45",
+  "version": "4.3.47",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/stage/SKILL.md

@@ -128,12 +128,12 @@ file (#6351). A vault-native repo with no `.env` gets `PORT` defaulted to the bo
 
 ## /stage --live — personal cloud dev stage
 
-dev.x stages are **not standing environments**: without `--live` the dev stage is dark. `--live`
-deploys the **current branch** to the project's dev runtime and serves it **only to your public IP** —
-gated at the **Cloudflare edge** (#1761). The CLI detects your IP, dispatches the central
-`tenant-deploy.yml` (stage=dev), then `tenant-control.yml` `cf-gate-allow` (an ephemeral Cloudflare WAF
-rule scoped to your dev host + IP). The box no longer IP-gates dev. No SSH from your machine; everything
-moves through the central workflows.
+Project admins can deploy the **current branch** to their project's dev runtime without an IP
+restriction. The CLI dispatches legacy gate cleanup, then the dev deploy through the Hub backend.
+Cleanup removes only that project's old stage rules and creates no Cloudflare rules, so rule-slot
+quotas do not block staging. It still reads Cloudflare to detect old gates; cleanup failures stay visible.
+The stage is accessible from any IP after both workflows succeed. The app's own sign-in still applies.
+No SSH from your machine; project authorization remains enforced by the Hub.
 
 **Deploy-model preflight (#5466 / #5467).** `/stage --live` is **not** generally available. Read
 `deployModel` first (`mmi-cli oracle org project get {owner}/{repo}` → `deployModel`, or the dry
@@ -141,15 +141,15 @@ moves through the central workflows.
 model the Hub tenant-deploy + tenant-control gates require). **`registry-publish` is not applicable**
 for live stages — nor are hub-serverless, solo-container, static-cdn, content, or none. For an
 unsupported model the dry plan refuses **before** offering `--apply` / `--down`; do not invent a
-tenant deploy or gate.
+tenant deploy.
 
 ```bash
 mmi-cli stage --live           # dry-run plan (refuses when deployModel is not tenant-container)
-mmi-cli stage --live --apply   # deploy + gate your IP at the Cloudflare edge
+mmi-cli stage --live --apply   # clear legacy gates + deploy without an IP restriction
 ```
 
-Tear it down when done — **only when `--apply` actually created a runtime or gate**. The runtime stops
-and the Cloudflare edge gate is removed:
+Tear it down when done — **only when `--apply` actually created a runtime**. This stops the runtime
+without Cloudflare work:
 
 ```bash
 mmi-cli stage --live --down --apply
@@ -166,8 +166,8 @@ The stage URL, what's running (server + tools), the workspace path (`tmp/stage/`
 ## Notes
 
 - `/stage` is local — no AWS, no deploy, no board or version effect. The one cloud exception is
-  `--live`: an on-demand **dev** stage of your branch for **`tenant-container`** repos only, gated to
-  your IP at the Cloudflare edge (above). Preflight `deployModel` before offering it; `registry-publish`
+  `--live`: an on-demand **dev** stage of your branch for **`tenant-container`** repos only, without
+  a stage IP restriction (above). Preflight `deployModel` before offering it; `registry-publish`
   and other models have no live stage.
 - Remote rc/live environments move only through `/rcand`, `/release`, and `/hotfix`.
 - Everything is gitignored; `/stage` never produces a tracked change.