@mutmutco/codex-plugin 4.5.103 → 4.5.104

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.103",
+  "version": "4.5.104",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -14908,7 +14908,7 @@ async function readDefaultBranchGate(repo, client, baseBranch, now = Date.now(),
 async function gateIsProvenGreen(repo, client, baseBranch, gateFiles = DEFAULT_GATE_FILES) {
   return (await readDefaultBranchGate(repo, client, baseBranch, Date.now(), gateFiles)).state === "green";
 }
-async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active") {
+async function activateProductRuleset(repo, rulesetBody, client, enforcement = "active", dryRun = false) {
   const want = new Set(rulesetRequiredContexts({ rules: rulesetBody.rules }));
   const wantStrict = rulesetStrictPolicy({ rules: rulesetBody.rules });
   const wantBranches = rulesetBranchIncludes(rulesetBody);
@@ -14927,10 +14927,10 @@ async function activateProductRuleset(repo, rulesetBody, client, enforcement = "
     if (detail.enforcement === effective && branchesMatch && strictMatch && have.size === want.size && [...want].every((c) => have.has(c))) {
       return { action: "skipped", enforcement: effective, detail: `${effective} ruleset already matches required contexts, branches and up-to-date policy${kept}` };
     }
-    await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body: { ...rulesetBody, enforcement: effective }, timeoutMs: 2e4 });
+    if (!dryRun) await client.rest("PUT", `repos/${repo}/rulesets/${existing.id}`, { body: { ...rulesetBody, enforcement: effective }, timeoutMs: 2e4 });
     return { action: "updated", enforcement: effective, detail: `ruleset ${existing.id}${kept}` };
   }
-  await client.rest("POST", `repos/${repo}/rulesets`, { body: { ...rulesetBody, enforcement }, timeoutMs: 2e4 });
+  if (!dryRun) await client.rest("POST", `repos/${repo}/rulesets`, { body: { ...rulesetBody, enforcement }, timeoutMs: 2e4 });
   return { action: "created", enforcement };
 }
 async function gateContextEnforced(repo, rest) {
@@ -16383,7 +16383,7 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     suite,
     ...suite === "mm-work" && deployModel === "tenant-container" ? {
       requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"],
-      requiredChecks: ["gate", "screens / screens"]
+      requiredChecks: options.existing?.requiredChecks ?? ["gate"]
     } : {},
     repos: [`${parsedRepo.owner}/${slug}`],
     branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
@@ -17699,10 +17699,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.103",
-    tag: "v4.5.103",
-    commit: "c2dd99cf0d72",
-    npm: "@mutmutco/cli@4.5.103"
+    version: "4.5.104",
+    tag: "v4.5.104",
+    commit: "6bf765dc986c",
+    npm: "@mutmutco/cli@4.5.104"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17719,14 +17719,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.103"
+          v3Target: "v4.5.104"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.103 and redeploy the Hub Lambda from tag v4.5.103 (c2dd99cf0d72); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.103 (@mutmutco/cli@4.5.103, tag commit c2dd99cf0d72 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.104 and redeploy the Hub Lambda from tag v4.5.104 (6bf765dc986c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.104 (@mutmutco/cli@4.5.104, tag commit 6bf765dc986c \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -28344,7 +28344,7 @@ function planBranchRequiredContexts(input) {
   })).filter((entry) => entry.contexts.length > 0);
   return { common, pending, waiting };
 }
-async function branchContextPlan(deps, repo, authority, meta) {
+async function branchContextPlan(deps, repo, authority, meta, emittedBranchesOnly = false) {
   const branches = resolveRequiredCheckBranches(meta, repo);
   const emittedByBranch = {};
   const unreadable = [];
@@ -28354,7 +28354,10 @@ async function branchContextPlan(deps, repo, authority, meta) {
     emittedByBranch[branch] = await resolveEmittedPrContexts(deps, repo, branch);
     if (presence === void 0 || emittedByBranch[branch] === void 0) unreadable.push(branch);
   }
-  return { ...planBranchRequiredContexts({ contexts: authority.contexts, branches, emittedByBranch }), unreadable };
+  const bindingBranches = emittedBranchesOnly ? branches.filter((branch) => authority.contexts.some((context) => emittedByBranch[branch]?.includes(context))) : branches;
+  const plan = planBranchRequiredContexts({ contexts: authority.contexts, branches: bindingBranches, emittedByBranch });
+  const waiting = planBranchRequiredContexts({ contexts: authority.contexts, branches, emittedByBranch }).waiting;
+  return { ...plan, waiting, unreadable, bindingBranches };
 }
 function projectCommonAuthority(authority, common) {
   const apiPayload = patchRulesetRequiredContexts(authority.apiPayload, common);
@@ -28608,8 +28611,8 @@ async function auditRepoCi(repo, callerDeps) {
         checks.push({
           ok: pendingAligned,
           label: "branch-specific required checks match workflow emitters",
-          detail: pendingAligned ? void 0 : "pending ruleset contexts or branch conditions have not converged to the emitted registry requirements",
-          remediation: pendingAligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
+          detail: pendingAligned ? void 0 : `pending ruleset contexts or branch conditions have not converged to the emitted registry requirements \u2014 run mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`,
+          remediation: pendingAligned ? void 0 : `mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`
         });
       }
     }
@@ -28641,7 +28644,7 @@ async function auditRepoCi(repo, callerDeps) {
         checks.push({
           ok: aligned,
           label: RULESET_REFERENCE_MATCH_LABEL,
-          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy differs from committed policy \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`),
+          detail: aligned ? `contexts [${authoritativeRuleset.contexts.join(", ")}], branches [${authoritativeRuleset.branchIncludes.join(", ")}] and the up-to-date policy match declared authority` : `${authoritativeRuleset.source} requires contexts [${authoritativeRuleset.contexts.join(", ")}]; ${authoritativeRuleset.branchSource} requires branches [${authoritativeRuleset.branchIncludes.join(", ")}]; ${PRODUCT_RULESET_REF} declares contexts [${authoritativeRuleset.committedContexts.join(", ")}] / branches [${authoritativeRuleset.committedBranchIncludes.join(", ")}] and live ${PRODUCT_RULESET_NAME} has contexts [${liveContexts.join(", ")}] / branches [${liveBranchIncludes.join(", ")}]` + (strictAligned ? "" : `; strict_required_status_checks_policy differs from committed policy \u2014 ${PRODUCT_RULESET_REF} declares ${authoritativeRuleset.committedStrict}, live ${PRODUCT_RULESET_NAME} has ${liveStrict}`) + ` \u2014 live repair: mmi-cli devops bootstrap apply ${repo} --only product-ruleset --execute`,
           remediation: aligned ? void 0 : `mmi-cli devops ci reconcile --repo ${repo} --apply`
         });
       }
@@ -29184,9 +29187,14 @@ async function authoritativeSafetyHold(authority, deps, repo, baseBranch, meta)
   }
   return null;
 }
-async function applyCiReconcileRepo(repo, deps) {
+async function applyCiReconcileRepo(repo, deps, options = {}) {
+  if (options.dryRun && !options.productRulesetOnly) throw new Error("dry-run requires productRulesetOnly");
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
+  if (options.productRulesetOnly && !meta?.requiredChecks?.length) {
+    return { repo, applied: [], skipped: [], errors: ["product-ruleset requires registry META requiredChecks"] };
+  }
   const report = await auditRepoCi(repo, deps);
+  const finish = (result2, pendingReason) => options.productRulesetOnly ? Promise.resolve(result2) : finalizeCiReconcile(repo, deps, result2, report, pendingReason);
   const baseBranch = "development";
   let raw = report.class === "deployable" && !report.explicitNoCi ? await fetchRulesetSeedBody(deps, repo) : null;
   let authority = null;
@@ -29196,12 +29204,12 @@ async function applyCiReconcileRepo(repo, deps) {
       authority = parseAuthoritativeRuleset(raw, meta, repo);
     } catch (e) {
       empty.errors.push(`${PRODUCT_RULESET_REF} is not parseable: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, empty, report);
+      return finish(empty);
     }
     const hold = await authoritativeSafetyHold(authority, deps, repo, baseBranch, meta);
     if (hold) {
       empty.skipped.push(hold);
-      return finalizeCiReconcile(repo, deps, empty, report, hold);
+      return finish(empty, hold);
     }
   } else if (report.class === "deployable" && !report.explicitNoCi) {
     const registryAuthority = registryAuthorityWithoutReference(meta, repo);
@@ -29209,59 +29217,64 @@ async function applyCiReconcileRepo(repo, deps) {
       const hold = await authoritativeSafetyHold(registryAuthority, deps, repo, baseBranch, meta);
       if (hold) {
         empty.skipped.push(hold);
-        return finalizeCiReconcile(repo, deps, empty, report, hold);
+        return finish(empty, hold);
       }
     }
   }
-  const result = await applyCiReconcileMergeSettingsFromReport(repo, deps, report);
+  const result = options.productRulesetOnly ? empty : await applyCiReconcileMergeSettingsFromReport(repo, deps, report);
   if (report.class !== "deployable" || report.explicitNoCi) {
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
-  const refDelivery = await seedGateYml(repo, deps, meta, result);
+  const refDelivery = options.productRulesetOnly ? void 0 : await seedGateYml(repo, deps, meta, result);
   if (refDelivery === "pending") {
     const reason = `${PRODUCT_RULESET_REF} is pending on its protected-base source PR; live ruleset convergence waits for that source to merge`;
     result.skipped.push(reason);
-    return finalizeCiReconcile(repo, deps, result, report, reason);
+    return finish(result, reason);
   }
   raw ??= await fetchRulesetSeedBody(deps, repo);
   if (!raw) {
     result.errors.push(`missing ${PRODUCT_RULESET_REF} on development \u2014 run bootstrap apply first`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   if (authority == null) {
     try {
       authority = parseAuthoritativeRuleset(raw, meta, repo);
     } catch (e) {
       result.errors.push(`${PRODUCT_RULESET_REF} is not parseable: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
     const hold = await authoritativeSafetyHold(authority, deps, repo, baseBranch, meta);
     if (hold) {
       result.skipped.push(hold);
-      return finalizeCiReconcile(repo, deps, result, report, hold);
+      return finish(result, hold);
     }
   }
   if (authority.contexts.length === 0) {
     result.errors.push(`${authority.source} declares no required contexts`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   let pendingPlan = null;
   const declaredContexts = authority.contexts;
   if (authority.source === "registry META requiredChecks") {
-    pendingPlan = await branchContextPlan(deps, repo, authority, meta);
+    pendingPlan = await branchContextPlan(deps, repo, authority, meta, options.productRulesetOnly);
     if (pendingPlan.unreadable.length) {
       const reason = `required branch workflow emitters unreadable on [${pendingPlan.unreadable.join(", ")}] \u2014 ruleset convergence deferred`;
       result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
+      return finish(result, reason);
     }
     if (pendingPlan.common.length === 0) {
       result.errors.push("no common required context is emitted by every required branch \u2014 ruleset convergence deferred");
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
     authority = projectCommonAuthority(authority, pendingPlan.common);
+    if (options.productRulesetOnly) {
+      const apiPayload = patchRulesetBranchIncludes(authority.apiPayload, pendingPlan.bindingBranches);
+      authority = { ...authority, apiPayload, branchIncludes: rulesetBranchIncludes(apiPayload) };
+      for (const entry of pendingPlan.waiting) result.skipped.push(`${entry.branch} waits for workflow emitter(s) [${entry.contexts.join(", ")}]`);
+    }
   }
   const sourceNeedsConvergence = !sameContexts(authority.committedContexts, authority.contexts) || !sameContexts(authority.committedBranchIncludes, authority.branchIncludes) || !authority.committedStrict;
-  if (sourceNeedsConvergence) {
+  if (sourceNeedsConvergence && !options.productRulesetOnly) {
     try {
       const delivery = await deliverSeedFile(
         deps,
@@ -29278,15 +29291,15 @@ async function applyCiReconcileRepo(repo, deps) {
           `${PRODUCT_RULESET_REF} authority \u2192 contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}] delivered on ${delivery.plan.branch} (${delivery.plan.reason})${delivery.prUrl ? `: ${delivery.prUrl}` : ""}`
         );
         const reason = `${PRODUCT_RULESET_REF} authority is pending on its protected-base source PR; live ruleset convergence waits for that source to merge`;
-        return finalizeCiReconcile(repo, deps, result, report, reason);
+        return finish(result, reason);
       } else {
         result.applied.push(`reconciled ${PRODUCT_RULESET_REF} authority \u2192 contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}]`);
       }
     } catch (e) {
       result.errors.push(`ruleset reference delivery failed: ${e.message}`);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
-  } else {
+  } else if (!options.productRulesetOnly) {
     result.skipped.push(`${PRODUCT_RULESET_REF} already matches declared context and branch authority`);
   }
   let live;
@@ -29294,7 +29307,7 @@ async function applyCiReconcileRepo(repo, deps) {
     live = await readLiveProductRuleset(deps, repo);
   } catch (e) {
     result.errors.push(`cannot read the live ${PRODUCT_RULESET_NAME} ruleset: ${e.message}`);
-    return finalizeCiReconcile(repo, deps, result, report);
+    return finish(result);
   }
   const liveContexts = live == null ? [] : sortedUnique(rulesetRequiredContexts(live));
   const liveBranchIncludes = live == null ? [] : rulesetBranchIncludes(live);
@@ -29312,7 +29325,7 @@ async function applyCiReconcileRepo(repo, deps) {
   if (pendingPlan?.pending.some((entry) => entry.contexts.some((context) => unsafe.includes(context)))) {
     const reason = `pending required-check rulesets left non-enforcing \u2014 [${unsafe.join(", ")}] emitted only by path-filtered workflows`;
     result.skipped.push(reason);
-    return finalizeCiReconcile(repo, deps, result, report, reason);
+    return finish(result, reason);
   }
   const gateProvenGreen = await gateIsProvenGreen(repo, deps.client, baseBranch, gateFiles);
   const plan = resolveProductRulesetReconcilePlan({
@@ -29329,25 +29342,25 @@ async function applyCiReconcileRepo(repo, deps) {
   if (!plan.shouldActivate) {
     if (plan.holdReason) {
       result.skipped.push(plan.holdReason);
-      return finalizeCiReconcile(repo, deps, result, report, plan.holdReason);
+      return finish(result, plan.holdReason);
     }
     result.skipped.push(`live ${PRODUCT_RULESET_NAME} contexts, branches and up-to-date policy already match declared authority`);
   }
   if (plan.shouldActivate) {
     try {
-      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement);
+      const activation = await activateProductRuleset(repo, authority.apiPayload, deps.client, plan.targetEnforcement, options.dryRun);
       if (activation.action === "skipped") result.skipped.push(activation.detail ?? "product ruleset");
-      else result.applied.push(`product ruleset ${activation.action}${activation.detail ? `: ${activation.detail}` : ""}`);
+      else result.applied.push(`product ruleset ${activation.action} (${activation.enforcement}; contexts [${authority.contexts.join(", ")}], branches [${authority.branchIncludes.join(", ")}])${activation.detail ? `: ${activation.detail}` : ""}`);
     } catch (e) {
       result.errors.push(e.message);
-      return finalizeCiReconcile(repo, deps, result, report);
+      return finish(result);
     }
   }
   if (pendingPlan) {
     if (pendingPlan.pending.length > 0 && !gateProvenGreen) {
       const reason = "pending required-check rulesets left non-enforcing \u2014 the gate is not green on development";
       result.skipped.push(reason);
-      return finalizeCiReconcile(repo, deps, result, report, reason);
+      return finish(result, reason);
     }
     try {
       const desired = /* @__PURE__ */ new Set();
@@ -29363,20 +29376,20 @@ async function applyCiReconcileRepo(repo, deps) {
           patchRulesetRequiredContexts(statusOnly, entry.contexts),
           [entry.branch]
         );
-        const activation = await activateProductRuleset(repo, payload, deps.client);
-        (activation.action === "skipped" ? result.skipped : result.applied).push(`${name}: ${activation.action}`);
+        const activation = await activateProductRuleset(repo, payload, deps.client, "active", options.dryRun);
+        (activation.action === "skipped" ? result.skipped : result.applied).push(`${name}: ${activation.action} \u2014 contexts [${entry.contexts.join(", ")}]`);
       }
       const list = await deps.client.rest("GET", `repos/${repo}/rulesets`);
       for (const stale of list ?? []) {
         if (!stale.name?.startsWith(PRODUCT_PENDING_RULESET_PREFIX) || desired.has(stale.name) || stale.id == null) continue;
-        await deps.client.rest("DELETE", `repos/${repo}/rulesets/${stale.id}`);
+        if (!options.dryRun) await deps.client.rest("DELETE", `repos/${repo}/rulesets/${stale.id}`);
         result.applied.push(`deleted converged ${stale.name}`);
       }
     } catch (e) {
       result.errors.push(`pending ruleset convergence failed: ${e.message}`);
     }
   }
-  return finalizeCiReconcile(repo, deps, result, report);
+  return finish(result);
 }
 
 // src/command-composition.ts
@@ -34433,8 +34446,8 @@ function suiteModulePackageAccessCheck(suite, deployModel) {
   if (suite !== "mm-work" || deployModel !== "tenant-container") return void 0;
   return {
     ok: true,
-    label: "mmwork-ds package access (manual org-admin step; unverified)",
-    detail: "An org admin must add this repository with Read under @mutmutco/mmwork-ds \u2192 Package settings \u2192 Manage Actions access. No GitHub REST API can verify or grant this; without it CI fails with 403 read_package."
+    label: "mmwork-ds + mmwork-screens package access (manual org-admin step; unverified)",
+    detail: `An org admin must add this repository with Read under BOTH @mutmutco/mmwork-ds and @mutmutco/mmwork-screens \u2192 Package settings \u2192 Manage Actions access (#7984). No GitHub REST API can verify or grant this; without it the image build or the screens job fails with 403 read_package. Once screens is green, require it: mmi-cli oracle org project set <owner/repo> --var 'requiredChecks=["gate","screens / screens"]'.`
   };
 }
 function attachTrainDoctorVerdicts(report, trainDoctors) {
@@ -34830,7 +34843,7 @@ function registerBootstrapCommands(program3) {
     }
     if (findings.some((f) => f.state !== "waived")) process.exitCode = 1;
   });
-  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special target environments (#5035) to run the deployment-environment reconcile alone (dry-run classifies, --execute writes)").option("--from-config", "with --only gate.yml: adopt an equal legacy gate with a render stamp, then update from registry config via review PR; refuse hand edits").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
+  bootstrap.command("apply <repo>").description("run from the MMI-Hub repo root: idempotent seed apply from skills/bootstrap/seeds/manifest.json; dry-run unless --execute (live, master-gated)").addOption(new Option("--class <class>", "deployable | content").default("deployable").choices(["deployable", "content"])).addOption(new Option("--project-type <type>", `${PROJECT_TYPES.join(" | ")} (capability shape)`).choices([...PROJECT_TYPES])).addOption(new Option("--deploy-model <model>", `${DEPLOY_MODELS.join(" | ")} (release/deploy path)`).choices([...DEPLOY_MODELS])).addOption(new Option("--release-track <track>", `${RELEASE_TRACKS.join(" | ")} (branch topology; direct skips rc)`).choices([...RELEASE_TRACKS])).option("--execute", "LIVE apply via gh (master-gated) \u2014 stamps seed files + labels into the repo").option("--box <name>", "resolve this live box and plan free registry DEPLOY# ports (container deploy models)").option("--domains <stages>", "optional comma-separated dev=host,rc=host,main=host deploy domains (requires --box)").option("--only <target>", "deliver ONLY this manifest target (#3818) \u2014 one file, no labels/ruleset/registry writes; or the special targets environments (#5035) / product-ruleset (#7986) to reconcile only that live surface (dry-run classifies, --execute writes)").option("--from-config", "with --only gate.yml: adopt an equal legacy gate with a render stamp, then update from registry config via review PR; refuse hand edits").option("--var <KEY=VALUE...>", "placeholder values for repo-owned templates (repeatable)").option("--json", "machine-readable output").action(async (repo, cmdOpts) => {
     const o = {
       class: rawValue("--class", "deployable"),
       projectType: rawValue("--project-type", ""),
@@ -34917,6 +34930,26 @@ function registerBootstrapCommands(program3) {
       }
       return;
     }
+    if (o.only.trim() === "product-ruleset") {
+      if (cmdOpts.var?.length) return fail("bootstrap apply: --only product-ruleset accepts no --var overrides; set registry META instead");
+      const read = await fetchProjectBySlugChecked(parsedRepo.slug, registryClientDeps(await loadConfig()));
+      if (!read.ok) return failGraceful(`bootstrap apply: registry META unreadable (${read.error}); refusing product ruleset reconciliation`);
+      if (!read.project?.requiredChecks?.length) return failGraceful("bootstrap apply: --only product-ruleset requires registry META requiredChecks");
+      const result = await applyCiReconcileRepo(repo, {
+        client: defaultGitHubClient(),
+        listProjects: async () => [],
+        getProjectMeta: async () => read.project
+      }, { productRulesetOnly: true, dryRun: !o.execute });
+      if (o.json) console.log(JSON.stringify(result, null, 2));
+      else {
+        console.log(`bootstrap apply --only product-ruleset \u2014 ${o.execute ? "LIVE" : "dry-run; no writes"} (${repo}):`);
+        result.applied.forEach((line) => console.log(`  ${o.execute ? "APPLY" : "PLAN"} ${line}`));
+        result.skipped.forEach((line) => console.log(`  SKIP ${line}`));
+        result.errors.forEach((line) => console.error(`  REFUSED ${line}`));
+      }
+      if (result.errors.length) return failGraceful("bootstrap apply: product ruleset reconciliation failed");
+      return;
+    }
     const manifestPath = "skills/bootstrap/seeds/manifest.json";
     if (!(0, import_node_fs28.existsSync)(manifestPath)) return fail(`bootstrap apply: ${manifestPath} not found; bootstrap runs from the MMI-Hub repo root by design \u2014 it stamps org-level resources (Project, Ruleset, secrets, access) through the GitHub App, which is only authorized from the Hub checkout`);
     const seedSource = await resolveHubSeedSource(execGitForSeedSource);
@@ -35003,9 +35036,10 @@ function registerBootstrapCommands(program3) {
     const onlyManagedBlock = onlyTarget ? seedsToApply[0]?.managedBlock != null : false;
     if (vars.SUITE === "mm-work" || registryMeta?.suite === "mm-work") {
       if (applyDeployModel === "tenant-container") {
-        const moduleGate = withDerivedRepoVars({}, parsedRepo, o.class, effectiveTrack, registryRequiredCheckBranches, ["gate", "screens / screens"]);
+        const requiredChecks = registryMeta?.requiredChecks ?? ["gate"];
+        const moduleGate = withDerivedRepoVars({}, parsedRepo, o.class, effectiveTrack, registryRequiredCheckBranches, requiredChecks);
         vars.GATE_RULESET_CONTEXTS_JSON = moduleGate.GATE_RULESET_CONTEXTS_JSON;
-        if (registryMeta) registryMeta = { ...registryMeta, requiredChecks: ["gate", "screens / screens"] };
+        if (registryMeta) registryMeta = { ...registryMeta, requiredChecks };
       }
     }
     const controlClient = defaultGitHubClient();

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.103",
+  "version": "4.5.104",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.103",
+  "version": "4.5.104",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -507,7 +507,7 @@ the bootstrap seed Dockerfile and compose templates). The seeded compose is file
 `labels: { mmi.runtime-env: "true" }`, no `env_file`, and a loopback-only port; the deploy injects the stage's
 vault values at runtime (`DEPLOY#<stage>.noEnvFile: true`) and the app reads plain env vars — it must **not** self-load SSM and must **not** ship a committed `.env`.
 
-For a `suite: mm-work` tenant-container module, bootstrap apply selects the MM-Work module seed instead: a live `/health` server and `/module.js`, the example module scaffold, secret-backed image build, and `gate` plus `screens / screens`. It sets `requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"]` and those required checks. Before the first CI/deploy, an org admin must grant the repo Read on `@mutmutco/mmwork-ds` under Package settings → Manage Actions access (no GitHub REST API; verify names the manual step).
+For a `suite: mm-work` tenant-container module, bootstrap apply selects the MM-Work module seed instead: a live `/health` server and `/module.js`, the example module scaffold, secret-backed image build, and `gate` plus `screens / screens`. It sets `requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"]` and requires only `gate`. Before the first CI/deploy, an org admin must grant the repo Read on both `@mutmutco/mmwork-ds` and `@mutmutco/mmwork-screens` under Package settings → Manage Actions access (no GitHub REST API; verify names the manual step). Add `screens / screens` to `requiredChecks` only after the screens job is green, or every PR blocks.
 
 **Never provision a Google OAuth client for an MM-Work suite module, even if old META declares `oauth`.** Modules sign in through the MM-Work pass and reach Google via `ctx.act`; read the package's GUIDE. The suite seed omits the Google-login guide.