@mutmutco/codex-plugin 4.5.185 → 4.5.187

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.185",
+  "version": "4.5.187",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -19193,10 +19193,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.185",
-    tag: "v4.5.185",
-    commit: "a5a484666253",
-    npm: "@mutmutco/cli@4.5.185"
+    version: "4.5.187",
+    tag: "v4.5.187",
+    commit: "725e17b3adb5",
+    npm: "@mutmutco/cli@4.5.187"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19213,14 +19213,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.185"
+          v3Target: "v4.5.187"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.185 and redeploy the Hub Lambda from tag v4.5.185 (a5a484666253); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.185 (@mutmutco/cli@4.5.185, tag commit a5a484666253 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.187 and redeploy the Hub Lambda from tag v4.5.187 (725e17b3adb5); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.187 (@mutmutco/cli@4.5.187, tag commit 725e17b3adb5 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -23886,6 +23886,7 @@ async function dispatchCanary(deps, targetRepo2, nonce) {
   );
 }
 var HOSTED_LABEL_RE = /\b(?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*)\b/;
+var FALLBACK_EXPR_GLOBAL_RE = /\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'(?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*)'\s*\|\|\s*fromJSON\('\[[^\n']+\]'\)\s*\}\}/g;
 var AUTOMATIC_TRIGGERS = /* @__PURE__ */ new Set(["push", "pull_request", "pull_request_target", "release", "schedule", "workflow_run", "merge_group", "create", "deployment", "repository_dispatch", "check_run", "check_suite", "issues", "issue_comment"]);
 function workflowTriggers(yaml) {
   const lines2 = yaml.split(/\r?\n/);
@@ -23902,7 +23903,7 @@ function workflowTriggers(yaml) {
   return out;
 }
 function workflowNeedsHostedRunner(yaml) {
-  const body = yaml.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join("\n");
+  const body = yaml.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join("\n").replace(FALLBACK_EXPR_GLOBAL_RE, "");
   return HOSTED_LABEL_RE.test(body) && workflowTriggers(yaml).some((t) => AUTOMATIC_TRIGGERS.has(t));
 }
 async function hostedWorkflowsOf(deps, repo) {
@@ -26867,6 +26868,8 @@ function enforceBumpRules(input) {
     return decision();
   }
   if (proposal.breaking.length && effective === "patch") {
+    if (input.suite && input.revamp) return decision();
+    if (input.suite) throw new Error(`range carries breaking changes (${evidence}): suite versions auto-mint as patch (#8224), so release it as an owner-approved revamp with --owner-go --big, or ship a shim (#8666)`);
     throw new Error(input.preOneZero ? `range carries breaking changes (${evidence}): this repo is held on 0.x.y, so declare MMI_BUMP_INTENT=minor with MMI_BUMP_REASON, or ship a shim (patch) (#8499)` : `range carries breaking changes (${evidence}): ship a shim (patch) or declare an owner-gated major (MMI_BUMP_INTENT=major, MMI_BUMP_REASON, MMI_MAJOR_APPROVED=<version>) (#8499)`);
   }
   if (proposal.breaking.length && !input.preOneZero) {
@@ -29959,7 +29962,7 @@ async function resolveTrainBumpIntent(deps, env = process.env, latestRelease, pr
   }
   return "patch";
 }
-async function enforceTrainBump(deps, env, intent, preOneZero, source) {
+async function enforceTrainBump(deps, env, intent, preOneZero, source, suite = { suite: false, revamp: false }) {
   const raw = await deps.run("git", ["log", `origin/main..${source}`, RANGE_LOG_FORMAT]);
   const proposal = proposeBump(parseRangeLog(raw), { preOneZero });
   let majorTarget;
@@ -29968,7 +29971,7 @@ async function enforceTrainBump(deps, env, intent, preOneZero, source) {
     const latest = await latestLocalReleaseTag(deps, void 0, preOneZero);
     majorTarget = explicit || `${latest.major + 1}.0.0`;
   }
-  return enforceBumpRules({ intent, env, proposal, preOneZero, majorTarget });
+  return enforceBumpRules({ intent, env, proposal, preOneZero, majorTarget, ...suite });
 }
 async function resolveHotfixVersion(deps, env = process.env, preOneZero = false) {
   const latest = await latestLocalReleaseTag(deps, "origin/main", preOneZero);
@@ -30023,7 +30026,8 @@ async function runTrainApplyLocked(command, deps, options = {}) {
     process.env,
     declaredIntent,
     preOneZeroInForce(meta),
-    command === "release" && !directTrack && options.dev !== true ? "origin/rc" : "origin/development"
+    command === "release" && !directTrack && options.dev !== true ? "origin/rc" : "origin/development",
+    { suite: !!meta.suite, revamp: command === "release" && options.big === true }
   );
   const bumpIntent = bump.intent;
   const bumpReceipt = { intent: bump.intent, reason: bump.reason, proposed: bump.proposed, breaking: bump.breaking };
@@ -30069,6 +30073,33 @@ function registryRepoKey(repo) {
   return repo.toLowerCase();
 }
 
+// ../shared/runner-fallback.ts
+var RUNNER_FALLBACK_EXPR_RE = /^\$\{\{\s*vars\.MMI_RUNNER_FALLBACK\s*==\s*'hosted'\s*&&\s*'((?:ubuntu|windows|macos)-(?:latest|\d[\w.-]*))'\s*\|\|\s*fromJSON\('(\[[^\n']+\])'\)\s*\}\}$/;
+var FLEET_ONLY_RUNNER_JOBS = {
+  "backup-health.yml:judge": "SSH backup inventory; hosted source-IP access unverified",
+  "browser-pass.yml:browser-pass": "owner-bounded two-lane browser capacity",
+  "app-publish.yml:publish": "SSH tenant publish; hosted source-IP access unverified",
+  "get-publish.yml:publish": "SSH installer publish; hosted source-IP access unverified",
+  "get-publish-desktop.yml:publish": "SSH installer publish; hosted source-IP access unverified",
+  "hetzner-knownhosts-pin.yml:pin": "SSH host-key probe; hosted source-IP access unverified",
+  "module-rc-publish.yml:publish": "SSH live-container snapshot and tenant persistent state",
+  "tenant-control.yml:control": "SSH tenant control; hosted source-IP access unverified",
+  "tenant-deploy.yml:deploy": "SSH tenant deploy; hosted source-IP access unverified",
+  "tenant-reconcile.yml:reconcile": "SSH tenant reconciliation; hosted source-IP access unverified"
+};
+function parseRunnerFallbackExpression(runsOn) {
+  const match = RUNNER_FALLBACK_EXPR_RE.exec(runsOn.trim());
+  if (!match) return void 0;
+  try {
+    const parsed = JSON.parse(match[2]);
+    if (!Array.isArray(parsed) || !parsed.length || !parsed.every((item) => typeof item === "string")) return void 0;
+    if (!parsed.some((item) => item.toLowerCase() === "self-hosted")) return void 0;
+    return { hosted: match[1], labels: parsed };
+  } catch {
+    return void 0;
+  }
+}
+
 // src/ci-audit.ts
 var HUB_REPO4 = "mutmutco/MMI-Hub";
 var HUB_GATE_CONTEXTS = ["cli", "infra", "docs"];
@@ -30128,6 +30159,29 @@ var NPM_PUBLISH_SAFE_FLOOR_SHA = "b5632c8b940d8025fdb5630e576502e1397c4552";
 var SHARED_ACTION_PINS = [
   { path: "npm-publish", floor: NPM_PUBLISH_SAFE_FLOOR_SHA }
 ];
+function auditRunnerFallbacks(repo, files) {
+  const checks = [];
+  for (const { path: path2, body } of files) {
+    const jobs = parseWorkflowJobs(body.split(/\r?\n/).filter((line) => !/^\s*#/.test(line)).join("\n"));
+    for (const job of jobs) {
+      const runsOn = /^    runs-on:\s*(.+)$/m.exec(job.body)?.[1] ?? "";
+      const runnerSection = /^    runs-on:([^\n]*(?:\n {6,}[^\n]*)*)/m.exec(job.body)?.[1] ?? "";
+      const fallback = parseRunnerFallbackExpression(runsOn);
+      const selfHosted = !!fallback || /self-hosted/i.test(runnerSection) || /matrix\./.test(runsOn) && /self-hosted/i.test(job.body);
+      if (!selfHosted) continue;
+      const key = `${path2.split("/").pop()}:${job.id}`;
+      const exemption = repo === HUB_REPO4 ? FLEET_ONLY_RUNNER_JOBS[key] : void 0;
+      const safe = !!fallback;
+      checks.push({
+        ok: !!exemption || safe,
+        label: `runner has hosted backup (#8671): ${path2}:${job.id}`,
+        detail: exemption ? `fleet-only: ${exemption}` : safe ? void 0 : "self-hosted runner does not use the vars.MMI_RUNNER_FALLBACK backup expression",
+        remediation: exemption || safe ? void 0 : `Use runs-on: \${{ vars.MMI_RUNNER_FALLBACK == 'hosted' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","x64","mmi-live"]') }} (keeping the job's original self-hosted tuple). See gh-runner-runbook.md.`
+      });
+    }
+  }
+  return checks;
+}
 function slugFromRepo(repo) {
   return (repo.includes("/") ? repo.split("/")[1] : repo).toLowerCase();
 }
@@ -30821,9 +30875,12 @@ async function auditRepoCi(repo, callerDeps) {
       }
     }
   }
-  if (repoClass !== "hub") {
+  {
     const workflows = await getBranchWorkflows();
-    if (workflows) checks.push(...await auditSharedActionPins(workflows, deps));
+    if (workflows) {
+      checks.push(...auditRunnerFallbacks(repo, workflows));
+      if (repoClass !== "hub") checks.push(...await auditSharedActionPins(workflows, deps));
+    }
   }
   if (meta?.deployModel === "tenant-container" && deps.getDeployFacts) {
     const fresh = await auditDevStageFreshness(repo, deps);
@@ -57943,9 +58000,10 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--resume <run-id>", "run-task only: re-attach to an already-dispatched run (read-only, never re-dispatches) and print its receipt").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--input <file>", "run-task only: upload this file as the task artifact (same as tenant artifact put), then run with its id").option("--resume <run-id>", "run-task only: re-attach to an already-dispatched run (read-only, never re-dispatches) and print its receipt").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
-    if (o.resume !== void 0 && (action !== "run-task" || !/^\d+$/.test(o.resume) || o.task || o.artifact)) return fail("runtime tenant control: --resume <run-id> is run-task-only, takes a numeric run id, and cannot be combined with --task/--artifact");
+    if (o.resume !== void 0 && (action !== "run-task" || !/^\d+$/.test(o.resume) || o.task || o.artifact || o.input)) return fail("runtime tenant control: --resume <run-id> is run-task-only, takes a numeric run id, and cannot be combined with --task/--artifact/--input");
+    if (o.input !== void 0 && o.artifact !== void 0) return fail("runtime tenant control: pass --input <file> or --artifact <id>, not both");
     if (o.confirmDataLoss !== void 0 && (action !== "retire" || stage === "rc")) return fail("runtime tenant control: --confirm-data-loss is dev/main retire-only");
     if (action === "retire" && (stage === "dev" || stage === "main")) {
       if (o.confirmDataLoss !== void 0 && o.confirmDataLoss !== `${repo}/${stage}`) return fail(`runtime tenant control: --confirm-data-loss must match ${repo}/${stage} exactly`);
@@ -57971,10 +58029,11 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
     }
     if (action === "run-task") {
       if (!o.task && o.resume === void 0) return fail("runtime tenant control: run-task requires --task <declared-name>");
-    } else if (o.task || o.artifact) {
-      return fail("runtime tenant control: --task/--artifact are valid only for run-task");
+    } else if (o.task || o.artifact || o.input) {
+      return fail("runtime tenant control: --task/--artifact/--input are valid only for run-task");
     }
-    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, edge: o.edge, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss, resume: o.resume === void 0 ? void 0 : Number(o.resume) });
+    const artifact = o.input === void 0 ? o.artifact : (await putTenantArtifact(repo, stage, o.input, registryClientDeps(await loadConfig()))).artifactId;
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, edge: o.edge, logSince: o.since, logUntil: o.until, task: o.task, artifact, confirmDataLoss: o.confirmDataLoss, resume: o.resume === void 0 ? void 0 : Number(o.resume) });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines: lines3, failure } = renderVerifySecrets(body);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.185",
+  "version": "4.5.187",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.185",
+  "version": "4.5.187",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -27,11 +27,7 @@ name: gate
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
 # GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
-# Estate policy 2026-08-23: GitHub-hosted Windows (`windows-latest` / windows-*) is forbidden org-wide.
-# Do not add a windows-compat (or any other) job that runs-on GH-hosted Windows. Linux self-hosted
-# (mmi-live / mmi-heavy) is the only CI merge gate. Rare Windows proof stays on the owner's machine or
-# a future self-hosted Windows runner — never windows-latest.
-# (seed touch: keep BOM digests in lockstep after classifier land.)
+# #8671 owner ruling (23 Oct 2026): GitHub-hosted backup is permitted on every OS via vars.MMI_RUNNER_FALLBACK.
 on:
   pull_request:
   merge_group:
@@ -65,7 +61,7 @@ jobs:
     # that runs the full job; main must never become skippable via bootstrap vars alone while the
     # org ruleset still requires `gate` on main.
     if: ${{ github.event_name != 'push' || github.ref_name == '{{GATE_FULL_RUN_BRANCH}}' || github.ref_name == 'main' || github.ref_type == 'tag' }}
-    runs-on: [self-hosted, linux, x64, mmi-live]
+    runs-on: ${{ vars.MMI_RUNNER_FALLBACK == 'hosted' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","x64","mmi-live"]') }}
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }{{GATE_SERVICES_YAML}}
     steps:

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -16,7 +16,7 @@ permissions:
   packages: read
 jobs:
   gate:
-    runs-on: [self-hosted, linux, x64, mmi-live]
+    runs-on: ${{ vars.MMI_RUNNER_FALLBACK == 'hosted' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","x64","mmi-live"]') }}
     timeout-minutes: 10
     steps:
       # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.