@mutmutco/codex-plugin 4.5.101 → 4.5.103

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.101",
+  "version": "4.5.103",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -6053,6 +6053,16 @@ function isRetryableGitHubWaitReadError(e) {
   }
   return /Something went wrong while executing your query/.test(text) || /^\s*unexpected end of JSON input\s*$/m.test(text);
 }
+function refusalWaitMs(e, nowMs) {
+  const err = e;
+  const text = [err?.stdout, err?.stderr, e instanceof Error ? e.message : ""].filter((t) => typeof t === "string").join("\n");
+  const header = (name) => new RegExp(`^${name}:\\s*(\\d+)\\s*$`, "im").exec(text)?.[1];
+  const retryAfter = header("retry-after");
+  if (retryAfter !== void 0) return Number(retryAfter) * 1e3;
+  const reset = header("x-ratelimit-remaining") === "0" ? Number(header("x-ratelimit-reset")) : typeof err?.rateLimitReset === "number" ? err.rateLimitReset : NaN;
+  if (reset * 1e3 > nowMs) return reset * 1e3 - nowMs;
+  return /secondary rate|abuse detection/i.test(text) ? 6e4 : void 0;
+}
 function waitReadFailureMessage(e) {
   const err = e;
   const stderr = typeof err?.stderr === "string" ? err.stderr.trim() : "";
@@ -6180,9 +6190,21 @@ async function waitForPrChecks(deps) {
         return { policy, status: "failure", reason: waitReadFailureMessage(e), detail: "github-read-failed", waitedMs: now() - started };
       }
       lastDetail = `github-read-transient (${waitReadFailureMessage(e)})`;
-      deps.log?.(`transient GitHub read failure \u2014 retrying within the wait budget: ${lastDetail}`);
-      report("pending");
-      await deps.sleep(PR_CHECKS_POLL_MS);
+      const askedMs = refusalWaitMs(e, now());
+      const jitter = deps.jitterMs ?? (() => Math.floor(Math.random() * PR_CHECKS_RATELIMIT_JITTER_MAX_MS));
+      const waitMs = askedMs !== void 0 && askedMs > PR_CHECKS_POLL_MS ? askedMs + jitter() : PR_CHECKS_POLL_MS;
+      if (askedMs !== void 0 && now() + waitMs >= deadline) {
+        return {
+          policy,
+          status: "rate-limited",
+          reason: `GitHub refused the read for rate limit and asked for ${Math.round(askedMs / 1e3)}s, past the wait deadline (${lastDetail})`,
+          detail: "rate-limited",
+          waitedMs: now() - started
+        };
+      }
+      deps.log?.(`transient GitHub read failure \u2014 retrying in ${Math.round(waitMs / 1e3)}s within the wait budget: ${lastDetail}`);
+      report(askedMs !== void 0 ? "rate-limited" : "pending");
+      await deps.sleep(waitMs);
       continue;
     }
     report(state);
@@ -6300,6 +6322,7 @@ function setPollTokenProvider(provider) {
   pollTokenOnce = void 0;
   resetAppPollGuard();
   lastPollSource = void 0;
+  observedPool.clear();
 }
 async function pollToken() {
   if (!pollTokenProvider) return void 0;
@@ -6327,12 +6350,43 @@ function parseRateLimitHeaders(out) {
   };
   return { remaining: first("remaining"), limit: first("limit"), resetSec: first("reset") };
 }
+function describeRefusal(out) {
+  const header = (name) => new RegExp(`^${name}:\\s*(.+?)\\s*$`, "im").exec(out)?.[1];
+  let message2 = "";
+  const body = out.slice(out.search(/\r?\n\r?\n/) + 1).trim();
+  try {
+    message2 = String(JSON.parse(body).message ?? "");
+  } catch {
+    message2 = body;
+  }
+  const parts = [
+    ["resource", header("x-ratelimit-resource")],
+    ["remaining", header("x-ratelimit-remaining")],
+    ["reset", header("x-ratelimit-reset")],
+    ["retry-after", header("retry-after")]
+  ].filter(([, v]) => v !== void 0).map(([k, v]) => `${k}=${v}`);
+  const text = message2.replace(/\s+/g, " ").slice(0, 160);
+  return [parts.join(" "), text ? `"${text}"` : ""].filter(Boolean).join(" ") || "no rate-limit headers or message";
+}
 var etagCache = /* @__PURE__ */ new Map();
 function appPoolDetail() {
   const guard = appPollGuardSnapshot();
   const counts = guard.remaining !== void 0 && guard.limit !== void 0 ? `App pool at ${guard.remaining}/${guard.limit}` : "App pool headroom unverified";
   return guard.resetAtMs !== void 0 ? `${counts}, resets ${new Date(guard.resetAtMs).toISOString()}` : counts;
 }
+var observedPool = /* @__PURE__ */ new Map();
+var OBSERVED_POOL_MAX_AGE_MS = 3 * 6e4;
+function notePoolHeaders(source, out, nowMs) {
+  const { remaining, resetSec } = parseRateLimitHeaders(out);
+  const resource = /^x-ratelimit-resource:\s*(\S+)\s*$/im.exec(out)?.[1];
+  if (remaining !== void 0 && resetSec !== void 0 && (resource ?? "core") === "core") {
+    observedPool.set(source, { remaining, reset: resetSec, atMs: nowMs });
+  }
+}
+function observedCorePool(source, nowMs) {
+  const seen = source ? observedPool.get(source) : void 0;
+  return seen && nowMs - seen.atMs <= OBSERVED_POOL_MAX_AGE_MS && seen.reset * 1e3 > nowMs ? { remaining: seen.remaining, reset: seen.reset } : void 0;
+}
 async function defaultGhApi(args) {
   const appToken = await pollToken();
   let source = appToken && appPollAllowsApp(Date.now()) ? "app" : "user";
@@ -6354,13 +6408,14 @@ async function defaultGhApi(args) {
       const out = e.stdout;
       const errOut = typeof out === "string" ? out : void 0;
       const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
+      if (errOut !== void 0) notePoolHeaders(source, errOut, Date.now());
       if (cached && status === 304) {
         lastPollSource = source;
         return cached.body;
       }
       if (source === "app" && appToken && (status === 403 || status === 429)) {
         noteAppPollResponse(parseRateLimitHeaders(errOut), true, Date.now());
-        console.warn(`poll credential: App pool refused the read (HTTP ${status}, ${appPoolDetail()}) \u2014 REST poll reads switch to the ambient user token until the App pool resets (#7843)`);
+        console.warn(`poll credential: App pool refused the read (HTTP ${status}, ${appPoolDetail()}; response: ${describeRefusal(errOut)}) \u2014 REST poll reads switch to the ambient user token until the App pool resets (#7843)`);
         lastPollSource = "user";
         source = "user";
         continue;
@@ -6368,6 +6423,7 @@ async function defaultGhApi(args) {
       throw e;
     }
     const { body, etag, pages } = parseIncludedOutput(stdout);
+    notePoolHeaders(source, stdout, Date.now());
     if (source === "app") noteAppPollResponse(parseRateLimitHeaders(stdout), false, Date.now());
     lastPollSource = source;
     if (etag && pages === 1) etagCache.set(key, { etag, body });
@@ -6840,7 +6896,9 @@ async function fetchRequiredCheckContexts(repo, branch, gh2 = defaultGhApi) {
   }
   return contexts;
 }
-async function fetchRestCorePool(gh2 = defaultGhApi) {
+async function fetchRestCorePool(gh2 = defaultGhApi, nowMs = Date.now()) {
+  const seen = gh2 === defaultGhApi ? observedCorePool(await pollToken() && appPollAllowsApp(nowMs) ? "app" : "user", nowMs) : void 0;
+  if (seen) return { state: "ok", ...seen };
   let core;
   try {
     core = JSON.parse(await gh2(["rate_limit"])).resources?.core;
@@ -16108,6 +16166,39 @@ function gateConfigToVars(gate) {
   if (extras.steps?.length) out.GATE_EXTRA_STEPS_YAML = gateExtraStepsYaml(extras.steps);
   return out;
 }
+function suiteModuleSeeds(seeds, suite, deployModel) {
+  if (suite !== "mm-work" || deployModel !== "tenant-container") return seeds;
+  const replacements = {
+    Dockerfile: "suite-Dockerfile.template",
+    "docker-compose.yml": "suite-compose.template.yml",
+    ".github/workflows/gate.yml": "suite-gate.template.yml"
+  };
+  const additions = {
+    "src/index.ts": "suite-server.template.ts",
+    "package.json": "suite-package.template.json",
+    "package-lock.json": "suite-package-lock.template.json",
+    "tsconfig.json": "suite-tsconfig.template.json",
+    "module/package.json": "suite-module-package.template.json",
+    "module/package-lock.json": "suite-module-package-lock.template.json",
+    "module/.npmrc": "suite-npmrc.template",
+    "module/src/module.jsx": "suite-module.template.jsx",
+    "module/vite.config.mjs": "suite-vite.template.mjs",
+    "module/screens/screens.json": "suite-screens.template.json",
+    "module/screens/files.json": "suite-files.template.json",
+    ".github/workflows/screens.yml": "suite-screens.template.yml",
+    "docs/Guides/mm-work-module.md": "suite-guide.template.md"
+  };
+  return [
+    ...seeds.filter((s) => s.target !== "docs/Guides/google-login.md").map((s) => replacements[s.target] ? { ...s, source: `seed:${replacements[s.target]}` } : s),
+    ...Object.entries(additions).map(([target, source]) => ({
+      target,
+      source: `seed:${source}`,
+      ownership: "repo",
+      classes: ["deployable"],
+      deployModels: ["tenant-container"]
+    }))
+  ];
+}
 function seedMatchesDeployModel(seed, deployModel) {
   if (!seed.deployModels?.length) return true;
   return deployModel != null && seed.deployModels.includes(deployModel);
@@ -16289,7 +16380,11 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     // Identity. name/division default off the repo name when the skill didn't pass them.
     name: vars.NAME || parsedRepo.name,
     division: vars.DIVISION || parsedRepo.name.split("-")[0] || void 0,
-    suite: vars.SUITE || void 0,
+    suite,
+    ...suite === "mm-work" && deployModel === "tenant-container" ? {
+      requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"],
+      requiredChecks: ["gate", "screens / screens"]
+    } : {},
     repos: [`${parsedRepo.owner}/${slug}`],
     branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
     class: cls,
@@ -17604,10 +17699,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.101",
-    tag: "v4.5.101",
-    commit: "a3c82f0f7aa3",
-    npm: "@mutmutco/cli@4.5.101"
+    version: "4.5.103",
+    tag: "v4.5.103",
+    commit: "c2dd99cf0d72",
+    npm: "@mutmutco/cli@4.5.103"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17624,14 +17719,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.101"
+          v3Target: "v4.5.103"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.101 and redeploy the Hub Lambda from tag v4.5.101 (a3c82f0f7aa3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.101 (@mutmutco/cli@4.5.101, tag commit a3c82f0f7aa3 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.103 and redeploy the Hub Lambda from tag v4.5.103 (c2dd99cf0d72); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.103 (@mutmutco/cli@4.5.103, tag commit c2dd99cf0d72 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -33919,14 +34014,15 @@ function deployRowChecks(repo, deployModel, releaseTrack, facts, factsRead, suit
     };
   });
 }
-function edgeCertificateChecks(results) {
+function edgeCertificateChecks(results, repo) {
   return results.flatMap((result) => {
     if (!result) return [];
     const { stage, status, error } = result;
+    const fix = status?.missing && !status.pending ? ` \u2014 run: mmi-cli devops runtime edge cert ensure ${repo} ${stage}` : "";
     return [{
       ok: !error && (status?.required === false || status?.required === true && status.missing === false),
       label: `Cloudflare edge certificate: ${stage}`,
-      detail: error ? `certificate coverage unreadable (${error}); cannot verify TLS` : status?.hint
+      detail: error ? `certificate coverage unreadable (${error}); cannot verify TLS` : status?.hint && `${status.hint}${fix}`
     }];
   });
 }
@@ -33990,6 +34086,8 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
       detail: exactAllowlist ? void 0 : ownersUnverified ? "org owner baseline is unreadable or empty; the exact restriction is unverified" : deps.pushAllowlistOwnersRead === true ? "restriction must contain exactly the org owners + mmi-github-app and no teams" : "restrictions.users is empty or unset"
     });
   }
+  const packageAccess = suiteModulePackageAccessCheck(deps.projectMeta?.suite, deps.deployModel);
+  if (packageAccess) checks.push(packageAccess);
   let environmentDrift2 = [];
   try {
     environmentDrift2 = await verifyRepoEnvironments(repo, effectiveTrack, deps.client, deps.projectMeta?.suite);
@@ -34073,7 +34171,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     const check = npmrcGitHubPackagesAuthCheck(path2, await contentText(deps, repo, baseBranch, path2));
     if (check) checks.push(check);
   }
-  checks.push(...edgeCertificateChecks(deps.edgeCertificates ?? []));
+  checks.push(...edgeCertificateChecks(deps.edgeCertificates ?? [], repo));
   checks.push(...edgeDnsChecks(deps.edgeDns ?? [], repo));
   const portRangeCheck = centralContainerPortRangeCheck(deps.deployModel, deps.projectMeta?.portRange, repo);
   if (portRangeCheck) checks.push(portRangeCheck);
@@ -34331,6 +34429,14 @@ function laneNotEvaluatedFromThisBranch(doctor) {
   const only = reasons.length === 1 ? reasons[0] : void 0;
   return only?.code === "branch-mismatch" ? only.title : void 0;
 }
+function suiteModulePackageAccessCheck(suite, deployModel) {
+  if (suite !== "mm-work" || deployModel !== "tenant-container") return void 0;
+  return {
+    ok: true,
+    label: "mmwork-ds package access (manual org-admin step; unverified)",
+    detail: "An org admin must add this repository with Read under @mutmutco/mmwork-ds \u2192 Package settings \u2192 Manage Actions access. No GitHub REST API can verify or grant this; without it CI fails with 403 read_package."
+  };
+}
 function attachTrainDoctorVerdicts(report, trainDoctors) {
   const marked = trainDoctors.map((doctor) => {
     const notEvaluatedFromThisBranch = laneNotEvaluatedFromThisBranch(doctor);
@@ -34819,13 +34925,6 @@ function registerBootstrapCommands(program3) {
     const baseBranch = o.class === "content" ? "main" : "development";
     const slug = parsedRepo.slug;
     const onlyTarget = o.fromConfig && o.only.trim() === "gate.yml" ? ".github/workflows/gate.yml" : o.only.trim();
-    const seedsToApply = onlyTarget ? manifest.seeds.filter((s) => s.target === onlyTarget || s.target.replace("{{REPO_SLUG}}", slug) === onlyTarget) : manifest.seeds;
-    if (onlyTarget && !seedsToApply.length) {
-      const known = manifest.seeds.map((s) => s.target).join("\n  ");
-      return fail(`bootstrap apply: --only '${onlyTarget}' names no seed in ${manifestPath}. Declared targets:
-  ${known}`);
-    }
-    const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     const gh2 = async (args) => execFileP("gh", args, { timeout: 2e4 });
     const readFile10 = (p) => (0, import_node_fs28.existsSync)(p) ? (0, import_node_fs28.readFileSync)(p, "utf8") : null;
     const enc = (p) => p.split("/").map(encodeURIComponent).join("/");
@@ -34895,6 +34994,20 @@ function registerBootstrapCommands(program3) {
       applyProjectType = o.projectType || registryMeta?.projectType || payload.projectType;
     } catch {
     }
+    const availableSeeds = suiteModuleSeeds(manifest.seeds, vars.SUITE || registryMeta?.suite, applyDeployModel);
+    const seedsToApply = onlyTarget ? availableSeeds.filter((s) => s.target === onlyTarget || s.target.replace("{{REPO_SLUG}}", slug) === onlyTarget) : availableSeeds;
+    if (onlyTarget && !seedsToApply.length) {
+      return fail(`bootstrap apply: --only '${onlyTarget}' names no seed for this project. Declared targets:
+  ${availableSeeds.map((s) => s.target).join("\n  ")}`);
+    }
+    const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
+    if (vars.SUITE === "mm-work" || registryMeta?.suite === "mm-work") {
+      if (applyDeployModel === "tenant-container") {
+        const moduleGate = withDerivedRepoVars({}, parsedRepo, o.class, effectiveTrack, registryRequiredCheckBranches, ["gate", "screens / screens"]);
+        vars.GATE_RULESET_CONTEXTS_JSON = moduleGate.GATE_RULESET_CONTEXTS_JSON;
+        if (registryMeta) registryMeta = { ...registryMeta, requiredChecks: ["gate", "screens / screens"] };
+      }
+    }
     const controlClient = defaultGitHubClient();
     let controlOwners = [];
     let controlDeployFacts = null;
@@ -46588,8 +46701,11 @@ function trainApplyDeps() {
     // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
     // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
     // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
-    dispatchTenantControl: async ({ repo, stage, action, lines: lines2, since, until, task, artifact, confirmDataLoss }) => {
-      const res = await tenantControl({ repo, stage, action, ...lines2 != null ? { lines: lines2 } : {}, ...since ? { since } : {}, ...until ? { until } : {}, ...task ? { task } : {}, ...artifact ? { artifact } : {}, ...confirmDataLoss ? { confirmDataLoss } : {} }, registryClientDeps(await loadConfig()));
+    // #7961: forward every SET field rather than re-listing them, so a new option (e.g. `edge`) cannot be
+    // dropped silently. Unset/false fields are omitted: the route rejects e.g. `edge` on a non-logs action.
+    dispatchTenantControl: async (input) => {
+      const payload = Object.fromEntries(Object.entries(input).filter(([, v]) => v != null && v !== "" && v !== false));
+      const res = await tenantControl(payload, registryClientDeps(await loadConfig()));
       if (res.ok) return { ok: true };
       const body = res.body;
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
@@ -53271,6 +53387,17 @@ function registerEdgeCommands(program3) {
       fail(`runtime edge dns: ${e.message}`);
     }
   });
+  edge.command("cert <action> <owner/repo> <stage>").description("read (`status`) or order-when-missing (`ensure`, master-only) the Cloudflare advanced edge certificate pack (<x> + *.<x>) a dev/rc host needs").action(async (action, repo, stage) => {
+    if (action !== "status" && action !== "ensure") return fail("runtime edge cert: <action> must be status or ensure");
+    if (stage !== "dev" && stage !== "rc") return fail("runtime edge cert: <stage> must be dev or rc (main is covered by the zone certificate)");
+    try {
+      const result = await edgeCertificateForStage(slugOf(repo), stage, registryClientDeps(await loadConfig()), action === "ensure");
+      console.log(JSON.stringify(result, null, 2));
+      if (result.required && result.missing) process.exitCode = 1;
+    } catch (e) {
+      fail(`runtime edge cert: ${e.message}`);
+    }
+  });
 }
 
 // src/command-register-developer.ts

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.101",
+  "version": "4.5.103",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.101",
+  "version": "4.5.103",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -507,7 +507,11 @@ the bootstrap seed Dockerfile and compose templates). The seeded compose is file
 `labels: { mmi.runtime-env: "true" }`, no `env_file`, and a loopback-only port; the deploy injects the stage's
 vault values at runtime (`DEPLOY#<stage>.noEnvFile: true`) and the app reads plain env vars — it must **not** self-load SSM and must **not** ship a committed `.env`.
 
-For a `web-app` that declares `oauth` META, print the canonical OAuth surface and provision the client once:
+For a `suite: mm-work` tenant-container module, bootstrap apply selects the MM-Work module seed instead: a live `/health` server and `/module.js`, the example module scaffold, secret-backed image build, and `gate` plus `screens / screens`. It sets `requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"]` and those required checks. Before the first CI/deploy, an org admin must grant the repo Read on `@mutmutco/mmwork-ds` under Package settings → Manage Actions access (no GitHub REST API; verify names the manual step).
+
+**Never provision a Google OAuth client for an MM-Work suite module, even if old META declares `oauth`.** Modules sign in through the MM-Work pass and reach Google via `ctx.act`; read the package's GUIDE. The suite seed omits the Google-login guide.
+
+For a non-suite `web-app` that declares `oauth` META, print the canonical OAuth surface and provision the client once:
 
 ```bash
 mmi-cli vault org oauth plan --repo "$OWNER/$REPO"        # the exact JS origins + redirect URIs + canonical SSM keys

package/skills/bootstrap/seeds/suite-Dockerfile.template

@@ -0,0 +1,32 @@
+# MM-Work module tenant container: the TypeScript server plus the module bundle it serves.
+
+# The module bundle. The GitHub Packages token (for @mutmutco/mmwork-ds) arrives as a BuildKit secret
+# and is never written into a layer; compose passes it from the registry's requiredBuildSecrets.
+FROM node:24-bookworm-slim AS module-build
+WORKDIR /module
+COPY module/package.json module/package-lock.json module/.npmrc ./
+RUN --mount=type=secret,id=NODE_AUTH_TOKEN,env=NODE_AUTH_TOKEN npm ci --no-audit --no-fund
+COPY module/src ./src
+COPY module/vite.config.mjs ./
+RUN npm run build
+
+# The server.
+FROM node:24-bookworm-slim AS server-build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build && npm prune --omit=dev
+
+FROM node:24-bookworm-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=server-build /app/package.json ./package.json
+COPY --from=server-build /app/node_modules ./node_modules
+COPY --from=server-build /app/dist ./dist
+COPY --from=module-build /module/dist/module.js ./module/dist/module.js
+USER node
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+CMD ["node", "dist/index.js"]

package/skills/bootstrap/seeds/suite-compose.template.yml

@@ -0,0 +1,26 @@
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      secrets:
+        - NODE_AUTH_TOKEN
+    restart: unless-stopped
+    # Fileless deploy (DEPLOY#<stage>.noEnvFile: true): no .env exists. tenant-deploy.yml streams the
+    # stage-scoped vault values over SSH into a tmpfs (/dev/shm) runtime env, and the box injects them
+    # into every service labelled mmi.runtime-env. Never add env_file.
+    labels:
+      mmi.runtime-env: "true"
+    environment:
+      NODE_ENV: production
+      MMI_STAGE: ${MMI_STAGE:-dev}
+      MMI_PORT: ${MMI_PORT:-3000}
+      PORT: ${PORT:-3000}
+      MMI_EDGE_DOMAIN: ${MMI_EDGE_DOMAIN:-}
+    ports:
+      # Loopback only: the box Caddy is the one public door (TLS), never the bare port.
+      - "127.0.0.1:${MMI_PORT:-3000}:${PORT:-3000}"
+
+secrets:
+  NODE_AUTH_TOKEN:
+    environment: NODE_AUTH_TOKEN

package/skills/bootstrap/seeds/suite-files.template.json

@@ -0,0 +1 @@
+{ "result": { "items": [{ "id": "sample", "name": "Sample brief" }] } }

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -0,0 +1,35 @@
+name: gate
+on:
+  pull_request:
+  push:
+    branches: {{GATE_PUSH_BRANCHES_YAML}}
+    tags: ['v*']
+concurrency:
+  group: gate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  packages: read
+jobs:
+  gate:
+    runs-on: [self-hosted, linux, x64, mmi-live]
+    timeout-minutes: 10
+    steps:
+      - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
+        with:
+          lockfile-path: package-lock.json
+      - name: Isolate npm cache
+        run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
+      - uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
+        with:
+          node-version: 24
+          npm-version: '12'
+      - run: npm ci --no-audit --no-fund
+      - run: npm ci --prefix module --no-audit --no-fund
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
+        with:
+          command: npm run typecheck && npm run build && npm --prefix module run check
+          max-seconds: {{GATE_MAX_SECONDS}}
+          working-directory: .

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -0,0 +1,11 @@
+# MM-Work module
+
+Read the matching `module/node_modules/@mutmutco/mmwork-ds/GUIDE.md` before changing this module. The starter entry and Vite setting come from MM-Work's `examples/example-module`; replace the example screens with your product's screens using only the shared design system.
+
+Sign-in belongs to MM-Work: verify its pass before adding protected backend routes. Do not provision a Google OAuth client or implement a separate login. Google and other shared services are reached through `ctx.act`, not module-owned credentials.
+
+Before the first CI/deploy, an org admin must grant this repo **Read** on `@mutmutco/mmwork-ds` under **Package settings → Manage Actions access**. This has no GitHub REST API. The Actions token installs the module in CI; the tenant image build uses the registry's `NODE_AUTH_TOKEN=@github-packages-token` BuildKit secret. Never commit a token.
+
+The server exposes `/health` and `/module.js`. Register the module's bundle URL, id, name and capabilities with MM-Work following the GUIDE. The seed deliberately exposes no authenticated product API yet.
+
+`gate` installs and checks the backend and module. `screens / screens` follows MM-PM's non-blocking PR/push/tag shape, using MM-Work's reusable runner with `run: false` (browser audits are not merge gates). Configure scheduled/on-demand screen audits separately when the product has screens to audit.