@mutmutco/codex-plugin 4.5.136 → 4.5.138

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.136",
+  "version": "4.5.138",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -14682,7 +14682,9 @@ async function claimOneBoardItem(ctx, selector, options) {
   const wouldWrite = flatItem.assignees.length === 0 && (flatItem.status === "Todo" || flatItem.status === "In Progress" || flatItem.status === "In Review");
   if (wouldWrite && !ctx.writable.has(flatItem.repository.toLowerCase())) {
     throw new NotClaimableError(
-      `${flatItem.ref} is not claimable: the token from ${describeTokenSource()} reports no write access to ${flatItem.repository}`,
+      // #8245: name the real source. With a Hub snapshot the probe is the Hub's server-side check for the
+      // session login, not the local gh token, so `gh repo view --json viewerPermission` can disagree.
+      `${flatItem.ref} is not claimable: no write access to ${flatItem.repository} for @${report.viewer} (read from the Hub board snapshot's access probe when one was used, else the token from ${describeTokenSource()})`,
       { ref: flatItem.ref }
     );
   }
@@ -18275,10 +18277,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.136",
-    tag: "v4.5.136",
-    commit: "642526387569",
-    npm: "@mutmutco/cli@4.5.136"
+    version: "4.5.138",
+    tag: "v4.5.138",
+    commit: "2b2ba344f112",
+    npm: "@mutmutco/cli@4.5.138"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -18295,14 +18297,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.136"
+          v3Target: "v4.5.138"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.136 and redeploy the Hub Lambda from tag v4.5.136 (642526387569); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.136 (@mutmutco/cli@4.5.136, tag commit 642526387569 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.138 and redeploy the Hub Lambda from tag v4.5.138 (2b2ba344f112); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.138 (@mutmutco/cli@4.5.138, tag commit 2b2ba344f112 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -22179,6 +22181,10 @@ async function announceShippedRelease(deps, args, model, legs, deferred) {
   return (await deps.announce(args)).note;
 }
 async function listTargetRun(deps, repo, target, headSha) {
+  const { read: _read, ...run } = await readTargetRun(deps, repo, target, headSha);
+  return run;
+}
+async function readTargetRun(deps, repo, target, headSha) {
   let rows;
   try {
     rows = JSON.parse(await deps.run("gh", [
@@ -22199,11 +22205,12 @@ async function listTargetRun(deps, repo, target, headSha) {
     ]));
     if (!Array.isArray(rows)) throw new Error("run list did not return an array");
   } catch {
-    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending" };
+    return { workflow: `${target.workflow} (${target.event}) not listable`, event: target.event, conclusion: "pending", read: "failed" };
   }
   const row = rows.find((r) => typeof r.databaseId === "number" && r.event === target.event);
-  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending" };
+  if (!row) return { workflow: `${target.workflow} (${target.event}) has not started`, event: target.event, conclusion: "pending", read: "absent" };
   return {
+    read: "found",
     workflow: target.workflow,
     runId: row.databaseId,
     runUrl: row.url,
@@ -25738,6 +25745,8 @@ var COMPOSE_GUARD_HARD_FAIL = /^secrets preflight: .*noEnvFile is (not )?true.*$
 var PREFLIGHT_TIMEOUT = /aborted due to timeout|TimeoutError|ETIMEDOUT|ESOCKETTIMEDOUT|UND_ERR_(?:HEADERS|CONNECT)_TIMEOUT/i;
 var PREFLIGHT_TIMEOUT_RETRIES = 2;
 var PREFLIGHT_RETRY_BASE_MS = 1e3;
+var CANDIDATE_PUSH_GATE_WAIT_MS = 20 * 6e4;
+var CANDIDATE_PUSH_GATE_POLL_MS = 3e4;
 function readOriginWorkflowsDefault(root, ref) {
   const git3 = (args) => (0, import_node_child_process9.execFileSync)("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
   let paths;
@@ -26019,6 +26028,51 @@ async function runTrainDoctor(input) {
   if (workflows === null && !startBranchMissing) {
     add({ code: "workflows-unreadable", severity: "blocker", source: "local", title: `.github/workflows at ${workflowsRef} could not be read from ${cwd} \u2014 the tag-addressability (#5428) and npm-major (#5666) preflights did not run`, remedy: `run from a checkout whose git can read ${workflowsRef} (fetch origin first), then rerun; an unread workflow set is unverified, not green` });
   }
+  if (lane === "release" && !startBranchMissing) {
+    const required = meta?.requiredChecks?.length ? meta.requiredChecks : ["gate"];
+    const emitters = (workflows ?? []).filter((f) => parseWorkflowJobIds(f.body).some((id) => required.some((context) => contextMatchesJobId(id, context))));
+    const gateFiles = emitters.length ? emitters : (workflows ?? []).filter((f) => isGateWorkflowPath(f.path));
+    const gates = gateFiles.length ? gateFiles.map((f) => f.path.split("/").pop()) : ["gate"];
+    try {
+      const tip = await git3(["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${startBranch}`]);
+      for (const workflow of gates) {
+        let run = await readTargetRun(train, repo, { workflow, event: "push" }, tip);
+        let lastUrl = run.runUrl;
+        let elapsed = 0;
+        const startedAt = Date.now();
+        while (input.refuse && run.read === "found" && run.conclusion === "pending" && elapsed < CANDIDATE_PUSH_GATE_WAIT_MS) {
+          train.warn?.(`candidate push gate ${run.runUrl} still running \u2014 ${elapsed / 1e3}s elapsed (20m bound)`);
+          await deps.sleep(CANDIDATE_PUSH_GATE_POLL_MS);
+          run = await readTargetRun(train, repo, { workflow, event: "push" }, tip);
+          elapsed = Math.max(elapsed + CANDIDATE_PUSH_GATE_POLL_MS, Date.now() - startedAt);
+          lastUrl = run.runUrl ?? lastUrl;
+        }
+        const url = run.runUrl ?? lastUrl ?? (run.runId ? `https://github.com/${repo}/actions/runs/${run.runId}` : "(no run URL)");
+        if (run.read === "failed") {
+          originUnverified = true;
+          add({ code: "candidate-push-gate-unread", severity: "warning", source: "origin", title: `${workflow} push runs on ${startBranch}@${tip.slice(0, 12)} could not be read`, remedy: `repair the GitHub run-list read and rerun; unread is not a pass${elapsed ? ` \u2014 last observed run: ${url}` : ""}` });
+          if (input.refuse && elapsed) throw new Error(`candidate push gate became unreadable while waiting \u2014 ${url}; nothing was tagged`);
+        } else if (run.read === "absent") {
+          add({ code: "candidate-push-gate-missing", severity: "warning", source: "origin", title: `no ${workflow} push run on ${startBranch}@${tip.slice(0, 12)}`, remedy: "no pre-tag push verdict is available; some repos intentionally run gate only on PRs and tags" });
+        } else if (run.conclusion === "failure") {
+          let jobs = "failed jobs unreadable";
+          try {
+            const rows = JSON.parse(await train.run("gh", ["run", "view", String(run.runId), "--repo", repo, "--json", "jobs"]));
+            jobs = rows.jobs.filter((j) => !["success", "skipped", "neutral", ""].includes(j.conclusion)).map((j) => j.name).join(", ") || "no failed job names reported";
+          } catch {
+          }
+          add({ code: "candidate-push-gate-red", severity: "blocker", source: "origin", title: `${workflow} push gate failed on ${startBranch}@${tip.slice(0, 12)} \u2014 ${url}`, remedy: `${url} \u2014 failed job(s): ${jobs}. Fix on development through a normal CI-gated PR and rerun; --heal never clears a red gate` });
+        } else if (run.conclusion === "pending") {
+          add({ code: "candidate-push-gate-running", severity: "warning", source: "origin", title: `${workflow} push gate still running \u2014 ${url}`, remedy: "wait for the run to conclude and rerun; apply waits up to 20 minutes before refusing" });
+          if (input.refuse) throw new Error(`candidate push gate still running after 20 minutes \u2014 ${url}; nothing was tagged`);
+        }
+      }
+    } catch (e) {
+      if (input.refuse) throw e;
+      originUnverified = true;
+      add({ code: "candidate-push-gate-unread", severity: "warning", source: "origin", title: `candidate push gate could not be read: ${message(e)}`, remedy: "repair the candidate SHA / GitHub read and rerun; unread is not a pass" });
+    }
+  }
   if (!startBranchMissing) {
     try {
       const required = await discoverRequiredCheckContexts(train, ctx, stage);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.136",
+  "version": "4.5.138",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.136",
+  "version": "4.5.138",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/org-guide/references/work-and-releases.md

@@ -109,7 +109,7 @@ commit, so build and verify the lines from one pass over that range —
 subject, body and changed files — never from subjects, PR titles or memory; a line whose claim is not
 in that output does not go in the file. A Hub summary never mentions a Jerv-side project; the train
 refuses such a line.
-Every new MM-Work suite Release, solo and hotfix included, requires `--announce-summary-file` and `--announce-summary-file-tr` in the bilingual update-notes template of the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md) (`Fixed`/`Düzeldi`, then `New`/`Yeni`, with `<Area>: <sentence>.` lines). A suite release requires `--member-summary-file owner/repo=path` and `--member-summary-file-tr owner/repo=path` for every member it releases. Details: the release skill.
+Every new MM-Work suite Release, solo and hotfix included, requires `--announce-summary-file` and `--announce-summary-file-tr` in the bilingual update-notes template of the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md#update-notes) (`Fixed`/`Düzeldi`, then `New`/`Yeni`, with `<Area>: <sentence>.` lines). A suite release requires `--member-summary-file owner/repo=path` and `--member-summary-file-tr owner/repo=path` for every member it releases. Details: the release skill.
 
 Announcement delivery uses the developer's GitHub-authenticated Hub session. The Hub checks project
 authority, resolves the registered channel, and reads the MMI Future Slack key inside its vault boundary.

package/skills/release/SKILL.md

@@ -15,7 +15,7 @@ Full-track repos ship exactly what is on `rc` (never `development`): merge `rc
 
 In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
 
-Every new mm-work suite Release (including solo and hotfix releases) requires both `--announce-summary-file <path>` (English) and `--announce-summary-file-tr <path>` (Turkish, "sen" form) in the update-notes template. The canonical wording lives in the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md); this repo links it and never copies it. Each file has the section word `Fixed` / `Düzeldi` (the problem the person saw, present tense) and/or `New` / `Yeni` (what you can now do) on its own line, Fixed first, each only when it has lines. Under them go 1–8 lines of `<Area>: <sentence>.`, each at most 120 characters, with no issue numbers, versions or commit prefixes. Off-template or missing files refuse before tagging. Do not write the head (app · date · time) or the thanks line: MM-Work renders both from the Release date and credits. Suite release also requires a valid `--member-summary-file <owner/repo=path>` and `--member-summary-file-tr <owner/repo=path>` for every member being released, before promoting any member. Carried, held and already-released members need none, and existing Releases can resume without new files.
+Every new mm-work suite Release (including solo and hotfix releases) requires both `--announce-summary-file <path>` (English) and `--announce-summary-file-tr <path>` (Turkish, "sen" form) in the update-notes template. The canonical wording lives in the [MM-Work GUIDE, "Update notes"](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md#update-notes); this repo links it and never copies it. Each file has the section word `Fixed` / `Düzeldi` (the problem the person saw, present tense) and/or `New` / `Yeni` (what you can now do) on its own line, Fixed first, each only when it has lines. Under them go 1–8 lines of `<Area>: <sentence>.`, each at most 120 characters, with no issue numbers, versions or commit prefixes. Off-template or missing files refuse before tagging. Do not write the head (app · date · time) or the thanks line: MM-Work renders both from the Release date and credits. Suite release also requires a valid `--member-summary-file <owner/repo=path>` and `--member-summary-file-tr <owner/repo=path>` for every member being released, before promoting any member. Carried, held and already-released members need none, and existing Releases can resume without new files.
 The `/user-releases` feed serves template notes as `updateNotes: {en?, tr?: {fixed[], new[]}}`. Older title-and-notes bodies keep `plainWords` and get `updateNotes: null`.
 
 Read META and name the lane before describing or executing anything: