@mutmutco/codex-plugin 4.5.200 → 4.5.201

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.200",
+  "version": "4.5.201",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -19279,10 +19279,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.200",
-    tag: "v4.5.200",
-    commit: "331035205b9a",
-    npm: "@mutmutco/cli@4.5.200"
+    version: "4.5.201",
+    tag: "v4.5.201",
+    commit: "bd1c969606c6",
+    npm: "@mutmutco/cli@4.5.201"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -19299,14 +19299,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.200"
+          v3Target: "v4.5.201"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.200 and redeploy the Hub Lambda from tag v4.5.200 (331035205b9a); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.200 (@mutmutco/cli@4.5.200, tag commit 331035205b9a \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.201 and redeploy the Hub Lambda from tag v4.5.201 (bd1c969606c6); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.201 (@mutmutco/cli@4.5.201, tag commit bd1c969606c6 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.200",
+  "version": "4.5.201",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.200",
+  "version": "4.5.201",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/browser-pass.template.yml

@@ -2,6 +2,9 @@ name: browser-pass
 # OPT-IN: copy to .github/workflows/browser-pass.yml, edit the dev URL, and replace
 # {{BROWSER_PASS_SHA}} with a reviewed 40-character Hub commit containing browser-pass.yml.
 # Never add PR, push, merge_group or gate callers. Not installed by bootstrap/propagation.
+# Owner 2026-10-25 (#8814, #8816): functional journeys only, workflow_dispatch-only, never design checks.
+# UI/design verification uses @mutmutco/mmwork-ds (mmwork-check-ui) and the Impeccable v4.7.0 toolkit
+# (context, hooks on, detect --json, critique, audit, playbooks); MM Artifacts A/B canvas for owner choices.
 on:
   workflow_dispatch:
     inputs:

package/skills/bootstrap/seeds/gate.template.yml

@@ -3,10 +3,12 @@ name: gate
 # and v* tags so /release and /hotfix can discover required contexts on the tagged SHA.
 #
 # Runner: self-hosted mmi-runner (mmi-live) — see docs/Guides/gh-runner-runbook.md in MMI-Hub.
-# #7914 (owner, 2026-10-06): this gate holds only fast, deterministic checks. Browser and long suites
-#   (screens, geometry/motion, synthetic, Chrome renders and tests) never go here; they run in their own
-#   workflow, nightly through the Hub schedule plane and on demand (docs/decisions/2026-10-06-browser-checks-nightly.md).
-# #4118: if GATE_CMD runs tsgo or other memory-heavy typecheck / browser work, pin this job to
+# #8814 / #8816 (owner, 2026-10-25): fast deterministic checks only (lint, types, build, unit/db tests).
+# UI/design uses @mutmutco/mmwork-ds (mmwork-check-ui) plus the Impeccable v4.7.0 skill/toolkit:
+# context, hooks on, detect --json, critique, audit and refinement playbooks. Use our own MM Artifacts
+# A/B canvas only when an owner A/B choice is needed.
+# Functional browser journeys remain opt-in workflow_dispatch-only, never a required gate.
+# #4118: if GATE_CMD runs tsgo or other memory-heavy typecheck/build work, pin this job to
 #   runs-on: [self-hosted, linux, x64, mmi-heavy]
 # instead — standard lanes are MemoryMax=1200M and will cgroup-OOM those workloads.
 # Stack-aware (#1550): the runtime is rendered into the setup-step `if:` — both the Node and Python

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -1,6 +1,6 @@
 # MM-Work module
 
-Read the matching `module/node_modules/@mutmutco/mmwork-ds/GUIDE.md` before changing this module. The starter entry and Vite setting come from MM-Work's `examples/example-module`; replace the example screens with your product's screens using only the shared design system.
+Use the MM-Work Atomic Design v1.1.0 contract and Designer Card. Query only task pieces/import ancestry through kit MCP or `catalog.json`, then the relevant contract/GUIDE section, never the whole registry or GUIDE. The starter entry and Vite setting come from MM-Work's `examples/example-module`; replace the example screens using only existing shared kit pieces, templates and tokens. Report the installed kit version and available checks separately from contract identity; missing information stays unknown with a lookup action.
 
 Sign-in belongs to MM-Work: verify its pass before adding protected backend routes. Do not provision a Google OAuth client or implement a separate login. Google and other shared services are reached through `ctx.act`, not module-owned credentials.
 
@@ -8,4 +8,18 @@ Before the first CI/deploy, an org admin must grant this repo **Read** on `@mutm
 
 The server exposes `/health` and `/module.js`. Register the module's bundle URL, id, name and capabilities with MM-Work following the GUIDE. The seed deliberately exposes no authenticated product API yet.
 
-`gate` installs and checks the backend and module. Product repos carry no screenshot or browser tests (owner ruling 2026-10-15, MM-Work#5388).
+`gate` installs and checks the backend and module, including `mmwork-check-ui` from `@mutmutco/mmwork-ds`. Gates run fast deterministic checks only (owner rulings 2026-10-15, MM-Work#5388, and 2026-10-25, MM-Work#7629).
+
+## Mandatory Impeccable workflow (owner, 2026-10-25; Hub#8814 / MM-Work#7629)
+
+UI and design verification uses `@mutmutco/mmwork-ds` (`mmwork-check-ui`) plus Impeccable on every design task: inspect the toolkit for applicable capabilities, work directly on the live app, and use our own MM Artifacts A/B canvas only when an owner A/B choice is needed. Functional journeys, where separately permitted, stay opt-in `workflow_dispatch`-only and never act as design checks.
+
+Impeccable v4.7.0 (engine v0.1.16) workflow; CLI verbs and agent playbooks are distinct:
+
+1. Boot once with `impeccable context --target <path>`. Use the `init` playbook for durable PRODUCT.md context, `document` for DESIGN.md + `.impeccable/design.json`, `impeccable doctor --json` to report drift, and `extract` to identify reuse. Read `reference/craft-floor.md` immediately before UI edits and `reference/operate.md` for task-oriented app UI. Extract through the existing kit; only the Design Lead can authorize kit changes.
+2. Run `impeccable hooks on`: shared `.impeccable/config.json` enables hooks; private overrides/consent live in gitignored `.impeccable/config.local.json`. Tier 1 scans mechanical issues per edit; Tier 2 runs a deep scan at turn-end `Stop` on supported hosts. Hook support is host-specific: verify `hooks status`; hosts without automatic hooks must run the manual detector. `impeccable detect --json <target>` exits **0 clean / 2 findings**; crashes or malformed output are failures, not clean passes. Source scans need markup files/directories, not CSS-only targets.
+3. Use the dual-subagent `critique` playbook, persisting through `critique-storage`, and `audit` (accessibility, performance, theming, responsive design, implementation integrity; five dimensions scored 0–4, **20 points** total). Keep independent design judgment separate from detector evidence; disclose degraded runs and unavailable checks. Still inspect the live result.
+4. Select applicable refinement/enhancement/fix playbooks, not every playbook blindly: `polish`, `bolder`, `quieter`, `distill`, `harden`, `onboard`, `layout`, `typeset`, `colorize`, `animate`, `delight`, `overdrive`, `clarify`, `adapt`, `optimize` (15 names in v4.7.0).
+5. Iterate live with `live` and `generate` (`live-generate`, `live-poll`, `live-server`). `serve-question` supports choices; MM-Work owner choices use the MM Artifacts review canvas with live kit pieces, never loose pictures. Record canvas choice ID and owner-decision reference; no A/B needed means no canvas. Stop temporary servers when finished.
+
+Check installed skill/engine versions and the approved upstream update channel before design work; apply available updates through the owning installer, not by modifying shared skill files from a module task. Shared config alone does not prove hook installation or CI toolkit availability. Record piece/import provenance and command + exit + findings in the task/PR; neither agent reports nor detector success establish conformance.

package/skills/org-guide/references/work-and-releases.md

@@ -27,11 +27,36 @@ Open a PR through `mmi-cli devops pr create` with a closing issue link, and land
 `mmi-cli devops pr land`. Verify required checks, merge, issue closure, and cleanup before calling
 the implementation complete. A merged implementation is not a production release.
 
-Browser checks and long CI run nightly, never as PR checks (owner, 2026-10-06;
-`docs/decisions/2026-10-06-browser-checks-nightly.md`). The required `gate` holds only fast,
-deterministic checks. Screen, geometry, motion, synthetic and Chrome suites run in a separate
-workflow armed nightly through the Hub schedule plane and on demand; it is never required, and a red
-run updates one `ci-heavy-red` issue. Never add such a suite to a gate or a local test policy.
+Owner ruling 2026-10-25 (#8814, #8816, MM-Work#7629; `docs/decisions/2026-10-06-browser-checks-nightly.md`):
+the required `gate` holds fast deterministic checks only; UI/design uses `@mutmutco/mmwork-ds`
+(`mmwork-check-ui`) and the mandatory Impeccable skill/toolkit. Inspect all applicable toolkit
+capabilities for every design task. Work on the live app; use our own MM Artifacts A/B canvas only
+for owner choices, with live kit pieces and recorded choice ID / owner-decision reference.
+Functional browser journeys remain opt-in `workflow_dispatch`-only, never design checks or gates.
+
+Impeccable **v4.7.0 / engine v0.1.16** workflow:
+
+- Boot once: `impeccable context --target <path>`; `init` captures PRODUCT.md, `document` maintains
+  `DESIGN.md` and its `design.json` sidecar, `impeccable doctor --json` reports drift, and `extract`
+  identifies reusable candidates (kit additions still need the Design Lead). Read
+  `reference/craft-floor.md` before UI edits and `reference/operate.md` for app UI.
+- `impeccable hooks on` enables shared `.impeccable/config.json`; local overrides/consent belong in
+  ignored `.impeccable/config.local.json`. Tier 1 scans mechanical problems per edit; Tier 2 deep-scans
+  at turn-end `Stop` on supported hosts. Verify `hooks status` and host support, not config alone.
+  If automatic hooks are unavailable, run `impeccable detect --json <target>` manually on markup
+  files/directories (not CSS-only): **0 clean / 2 findings**. Unavailable or broken scans are not passes.
+- Dual-subagent `critique` keeps design assessment independent from detector evidence and persists via
+  `critique-storage`; disclose degraded runs. `audit` scores accessibility, performance, theming,
+  responsive design and implementation integrity 0–4 each (**20 points**). These evaluations are
+  agent playbooks, not standalone engine CLI verbs; still inspect the live result.
+- Pick relevant playbooks: `polish`, `bolder`, `quieter`, `distill`, `harden`, `onboard`, `layout`,
+  `typeset`, `colorize`, `animate`, `delight`, `overdrive`, `clarify`, `adapt`, `optimize` (15 names in
+  v4.7.0, despite the requested “14”). Do not apply conflicting playbooks blindly.
+- Iterate with `live` / `generate` (`live-generate`, `live-poll`, `live-server`); `serve-question`
+  supports choices, while owner A/B decisions use the MM Artifacts canvas.
+  Stop temporary servers. Check installed versions and approved upstream updates via the owning
+  installer; do not modify shared skills from a module task. Record command + exit + findings,
+  kit version and available checks separately from contract identity; reports are not conformance.
 
 ## Documentation preflight
 

package/skills/stage/SKILL.md

@@ -33,7 +33,7 @@ mmi-cli stage run --apply --port 5180            # pin a port
 mmi-cli stage run --apply --timeout-ms 120000    # slow stacks
 ```
 
-All artifacts (build output, screenshots, traces, local DB files) stay under untracked `tmp/stage/`. When grinding or issue acceptance criteria exist, read [smoke.md](smoke.md) and run its post-smoke panel before teardown.
+All artifacts (build output, traces, local DB files) stay under untracked `tmp/stage/`. When grinding or issue acceptance criteria exist, read [smoke.md](smoke.md) and run its post-smoke panel before teardown.
 
 ## Step 2 — stop when done