@mutmutco/codex-plugin 4.5.209 → 4.5.211

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.209",
+  "version": "4.5.211",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.209",
+  "version": "4.5.211",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -21,6 +21,8 @@ accepts an incomplete board. The CLI partitions rows into **Yours**, **Free to c
 stamps (4 hours without work) hold nothing. Partition rules, stamp details and `--out` rationale:
 [reference.md](reference.md).
 
+Read single issues/PRs with `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`) and filter the JSON locally: under the App pool, gh `--jq`/`-q`/`--template`/`--web` are refused.
+
 ## Step 2 — render it
 
 Plain markdown, never a fenced block. Flat `-` lists under bold heads, never `##` headings, never tables.
@@ -56,12 +58,13 @@ Present the plan — batch count, issue count, one line per batch naming its sha
 mmi-cli oracle board claim <ref> <ref> <ref> --json
 ```
 
-Say the size first: how many issues, how many PRs. Read per-item results; any failure exits nonzero. **Route
-is `oracle board claim` only**; `oracle issue claim` and flat `board claim` refuse.
+Announce issue/PR counts; refresh `mmi-cli oracle board read` this session and select ordinary claims from **Free to claim**. Read every result: failures exit nonzero. On conflict, do not blindly retry: refresh, pick another candidate or coordinate a handoff; `--force` only for an owner-authorized intentional takeover. Run writes separately, never `;`; dependent follow-ups use `&&`.
+
+Follow printed owner rulings; record new ones with `mmi-cli oracle issue decision`. One concurrent worktree per batch: [reference.md](reference.md).
 
-The claim prints the issue's recorded owner rulings; follow them. Record a new one with `mmi-cli oracle issue decision`.
+With several task lanes in one session, pass `worktree: <the mmi-worktrees/<Repo>/<issue>-<slug> path jerv_worktree_create reported>` to `jerv_worktree_exec` / `jerv_worktree_land` every time; they refuse to guess (#5629).
 
-One worktree per batch, all concurrently. Windows setup and ref renames: [reference.md](reference.md).
+A fresh mmi worktree has no `.jerv/`: run `mkdir -p .jerv/tmp` before writing scratch files there (PR bodies, batches) or listing it.
 
 ## Step 5 — land one PR per batch
 

package/skills/bootstrap/seeds/gate.template.yml

@@ -29,7 +29,7 @@ name: gate
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
 # GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
-# #8671 owner ruling (23 Oct 2026): GitHub-hosted backup is permitted on every OS via vars.MMI_RUNNER_FALLBACK.
+# #8911 supersedes #8671: existing self-hosted capacity only; no hosted fallback.
 on:
   pull_request:
   merge_group:
@@ -63,7 +63,7 @@ jobs:
     # that runs the full job; main must never become skippable via bootstrap vars alone while the
     # org ruleset still requires `gate` on main.
     if: ${{ github.event_name != 'push' || github.ref_name == '{{GATE_FULL_RUN_BRANCH}}' || github.ref_name == 'main' || github.ref_type == 'tag' }}
-    runs-on: ${{ vars.MMI_RUNNER_FALLBACK == 'hosted' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","x64","mmi-live"]') }}
+    runs-on: [self-hosted, linux, x64, mmi-live]
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }{{GATE_SERVICES_YAML}}
     steps:

package/skills/bootstrap/seeds/runbook-unaffected.json

@@ -1,7 +1,7 @@
 {
   ".github/workflows/agent-pr.yml": {
-    "blob": "eda96c054fd556fede71b900a1c7e7cbba2649d2",
-    "reason": "runs-on gains the MMI_RUNNER_FALLBACK hosted backup expression (#8671); jobs, steps and operator procedures unchanged (#8681)"
+    "blob": "fb6185c6da068daeec869034ee028fb00ef0b849",
+    "reason": "runs-on only: hosted-fallback expression replaced by the literal self-hosted tuple it already resolved to (#8911); job logic and operator steps unchanged"
   },
   "scripts/next-version.mjs": {
     "blob": "2c1985b59edc779695479559074e7654c1574a11",

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -16,7 +16,7 @@ permissions:
   packages: read
 jobs:
   gate:
-    runs-on: ${{ vars.MMI_RUNNER_FALLBACK == 'hosted' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","x64","mmi-live"]') }}
+    runs-on: [self-hosted, linux, x64, mmi-live]
     timeout-minutes: 10
     steps:
       # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.

package/skills/bootstrap/seeds/suite-guide.template.md

@@ -147,7 +147,7 @@ Front-load Impeccable before any UI or MM Artifact authoring: `impeccable contex
 
 Impeccable v4.7.0 (engine v0.1.16) workflow; CLI verbs and agent playbooks are distinct:
 
-1. Boot once with `impeccable context --target <path>`. Use the `init` playbook for durable PRODUCT.md context, `document` for DESIGN.md + `.impeccable/design.json`, `impeccable doctor --json` to report drift, and `extract` to identify reuse. Read `reference/craft-floor.md` immediately before UI edits and `reference/operate.md` for task-oriented app UI. Extract through the existing kit; only the Design Lead can authorize kit changes.
+1. Boot once with `impeccable context --target <path>`. Use the `init` playbook for durable PRODUCT.md context, `document` for DESIGN.md + `.impeccable/design.json`, `impeccable doctor --json` to report drift, and `extract` to identify reuse. Read `reference/craft-floor.md` immediately before UI edits and `reference/operate.md` for task-oriented app UI. Extract through the existing kit; only the Design Lead can authorize kit changes. The Impeccable CLI is the installed script at `~/.agents/skills/impeccable/scripts/impeccable` (or bare `impeccable` on `PATH`); no Impeccable CLI package is published on npm, so never run `npx @impeccable-style/cli ...` (it 404s) or chain `npx` guesses into git/bootstrap commands (#8885).
 2. Run `impeccable hooks on`: shared `.impeccable/config.json` enables hooks; private overrides/consent live in gitignored `.impeccable/config.local.json`. Tier 1 scans mechanical issues per edit; Tier 2 runs a deep scan at turn-end `Stop` on supported hosts. Hook support is host-specific: verify `hooks status`; hosts without automatic hooks must run the manual detector. `impeccable detect --json <target>` exits **0 clean / 2 findings**; crashes or malformed output are failures, not clean passes. Source scans need markup files/directories, not CSS-only targets.
 3. Use the dual-subagent `critique` playbook, persisting through `critique-storage`, and `audit` (accessibility, performance, theming, responsive design, implementation integrity; five dimensions scored 0–4, **20 points** total). Keep independent design judgment separate from detector evidence; disclose degraded runs and unavailable checks. Still inspect the live result.
 4. Select applicable refinement/enhancement/fix playbooks, not every playbook blindly: `polish`, `bolder`, `quieter`, `distill`, `harden`, `onboard`, `layout`, `typeset`, `colorize`, `animate`, `delight`, `overdrive`, `clarify`, `adapt`, `optimize` (15 names in v4.7.0).

package/skills/epic/SKILL.md

@@ -29,7 +29,7 @@ Inspect existing children first:
 mmi-cli oracle issue children <owner/repo#N>
 ```
 
-Write a JSON array, one object per child, to `.jerv/tmp/epic-<parentNumber>-children.json` (unique per epic; a leftover batch from another epic collides with the new rows):
+Write a JSON array, one object per child, to `.jerv/tmp/epic-<parentNumber>-children.json` (unique per epic; a leftover batch from another epic collides with the new rows). A fresh mmi worktree has no `.jerv/`; run `mkdir -p .jerv/tmp` first:
 
 ```json
 [
@@ -70,7 +70,7 @@ This JSON is the placement authority: every intended child must be linked and on
 mmi-cli oracle issue link-child <parent> <child>
 ```
 
-Each child is now a parallel item: one worktree + PR each. On Windows set `git config core.longpaths true` on the main checkout before the first `git worktree add`. When linked worktrees share a clone, serialize `git branch -m` and other ref renames (or retry serially on `.tmp-renamed-log`). **When the last child merges, close the umbrella** (board `Done` follows).
+Each child is now a parallel item: one worktree + PR each. With several task lanes in one session, pass `worktree: <the mmi-worktrees/<Repo>/<issue>-<slug> path jerv_worktree_create reported>` to `jerv_worktree_exec` / `jerv_worktree_land` every time; they refuse to guess (#5629). On Windows set `git config core.longpaths true` on the main checkout before the first `git worktree add`. When linked worktrees share a clone, serialize `git branch -m` and other ref renames (or retry serially on `.tmp-renamed-log`). **When the last child merges, close the umbrella** (board `Done` follows).
 
 Never free-type children with raw `gh issue create`: the batch path carries validation, board attach and structured output.
 

package/skills/hotfix/SKILL.md

@@ -29,6 +29,8 @@ mmi-cli devops train doctor --lane hotfix --heal --json
 
 Parse stdout only; never `2>&1`. `ready` false → stop and quote every blocker's `code` and `remedy`; an unread origin is never green. Findings carry `code`, `severity`, `source`, `remedy`, `anchor`.
 
+Piping `mmi-cli devops api get` into a JSON parser: a refusal exits 1 with empty stdout, so guard both: `out=$(MMI_ACTOR=app mmi-cli devops api get <path>) && [ -n "$out" ] && printf '%s' "$out" | node -e '…'`. One job's metadata: read the allowlisted `repos/{owner}/{repo}/actions/runs/{id}/jobs` and filter `jobs[]` by `id`; `actions/jobs/{id}` is refused (only its `/logs`, with `--out`).
+
 ## Apply
 
 From the primary checkout.
@@ -56,12 +58,12 @@ MMI-Hub adds `--announce-summary-file "$f"`: a fresh 3–6 line neutral summary,
 
 Read receipts, not the exit code (`1` = follow-up failed after tag; pending exits `0`):
 
-- `runs[]`: watch each non-success: `gh run watch <run-id> --repo {owner}/{repo} --exit-status --interval 30`. `deploy.yml`, `publish.yml`, `tenant-deploy.yml`, `jerv-gateway` are deploy/publish verdicts; a `gate` run is ordinary CI.
+- `runs[]`: watch each non-success: `mmi-cli devops read run watch <run-id> --repo {owner}/{repo} --exit-status --interval 60`; failed-job logs: `mmi-cli devops read run log <run-id> --repo {owner}/{repo} --failed --tail 200`. `deploy.yml`, `publish.yml`, `tenant-deploy.yml`, `jerv-gateway` are deploy/publish verdicts; a `gate` run is ordinary CI.
 - `foldStatus`/`foldNote`: land the fold PR by true merge (Merge floor).
 - `announceNote`, `verifyNote`, `checkout`, `localSync`, `ledger`: pending or failed = unresolved.
 - `localInstall` (MMI-Hub): via `mmi-hub update`, never `npm i -g`.
 
-`gh api repos/{owner}/{repo}/releases/latest --jq .tag_name` must equal the tag, on `origin/main`.
+`tag_name` from `mmi-cli devops api get repos/{owner}/{repo}/releases/latest` must equal the tag, on `origin/main`. Use typed reads, never raw `gh` reads or formatter flags the App pool refuses; filter their JSON stdout in a pipe, never via a `tmp/` file.
 
 ## Recovery
 
@@ -71,8 +73,8 @@ On any failure or interruption, read [recovery.md](recovery.md).
 
 - **Never squash-merge a tagged commit (#3167).** A squash re-mints the SHA and orphans the tag, so tag-anchored checks mis-read. Any merge that carries an already-tagged commit — the `main → development` roll-forward, an alignment PR, a hotfix fold PR — lands as a true merge: `mmi-cli devops pr merge <number> --auto --merge` (or `--wait --merge`); `--wait` alone still squashes. The hotfix main-base PR itself may squash: its tag lands after, on the merged `main` HEAD, and the `-x` trailer must survive the squash message.
 - **A refused train is a stop, never a license to finish by hand.** Every fail-closed halt — doctor blocker, authority probe, coverage guard, untolerated conflict, required checks, stray tag, ledger — ends the run. Fix the cause on `development` through a normal PR and rerun the train; never hand-resolve on `main`, hand-cherry-pick, bare-push a train branch, ack to save time, or bypass a check.
-- **Version probes anchor on the latest Release tag, not a branch (#2734).** A branch manifest or a stale local tag is not a version source; a surviving local tag silently mints the next version.
-- **One train at a time on a repo (#5380).** Two overlapping runs race the shared tag namespace; the ledger refuses the second — never start one to help the first.
+- **Probe the latest Release tag, not branches or stale local tags (#2734).** Queue: `mmi-cli devops read pr queue <number> --repo <owner/repo> --json`; gh rejects `mergeQueueEntry`.
+- **One train per repo (#5380).** Overlapping trains race tags; never start one to help another.
 - **Tag and Release deletion need Jervaise's yes (principle 12),** named in the guide entry that prescribes it.
 
 ## Report

package/skills/mmi-help/SKILL.md

@@ -20,8 +20,7 @@ Print a friendly, human-readable **MMI help** card of at most 180 words:
    files or personal agent instructions, and approved MMI release workflows.
 4. Name the org-guide skill for details, board, secrets, and release for common tasks, and
    brand when a company document, report, deck, or artifact needs the house identity. Note that
-   org-guide also carries the MM Open Design System Bible: MM Artifacts, Live Docs (`Canlı belgeler`),
-   `@mutmutco/mmwork-ds`, front-loaded Impeccable v4.7.0, and system-first autolearn.
+   org-guide carries the MM Open Design System Bible; handoffs cite it by path, never restate it.
    Render invocation syntax for the current host only, using the forms above with the skill name
    substituted. If the host is unknown, use plain skill names rather than guessing.
 

package/skills/org-guide/SKILL.md

@@ -23,6 +23,8 @@ the [MMI help skill](../mmi-help/SKILL.md).
   and respect a decline; see [tooling bug reports](references/work-and-releases.md#report-mmi-tooling-bugs).
 - Read the registry for release tracks, domains, and OAuth. Use MMI provisioning and release
   workflows, never parallel deployment or credential paths.
+- Verify canonical/Git-resolved support scripts; use absolute script/target/source paths, never sibling guesses
+  ([invocation rules](references/work-and-releases.md#shared-support-script-invocation)).
 - Design work follows the [MM Open Design System Bible](references/work-and-releases.md#the-mm-open-design-system-bible-8837-8839):
   never patch broken shared tools with one-off `tmp/` scripts; fix them at source, record a learning
   note, and update memory.
@@ -40,5 +42,4 @@ the [MMI help skill](../mmi-help/SKILL.md).
 | Build an MM-Work module | not bundled — [MM-Work module guide](https://github.com/mutmutco/MM-Work/blob/development/packages/mmwork-ds/GUIDE.md) in `@mutmutco/mmwork-ds` |
 | Produce company-facing documents in the MM brand | not bundled — the MM-Strategy MCP serves the brand kit (`mm_brand_guide`); strategists install `@mutmutco/strategy` |
 
-This is MMI organization guidance, not Jerv or JervCode instructions. These bundled files match the
-installed plugin release; resolve current values and flags through the live CLI, not this guide.
+Bundled MMI guidance matches the installed plugin, not Jerv/JervCode. Resolve current values and flags through the live CLI.

package/skills/org-guide/references/work-and-releases.md

@@ -13,10 +13,16 @@ Reading or discussing the board is read-only until the developer authorizes work
 Claim approved work with `mmi-cli oracle board claim <issue>`, then prepare an isolated task
 workspace through the host. Preserve other developers' work.
 
-MMI workflows require no personal Jerv installation. Use Git or your chosen host for worktree
-creation; MMI performs its own guarded cleanup. Report a skill misfire with
-`mmi-cli learning skill-lesson --skill <name> --title <summary> --body-file <path>`.
-Feedback belongs on the MMI Hub board and never requires another developer's personal tooling.
+Use host worktrees and MMI cleanup; no personal Jerv is required. Report skill misfires to Hub
+with `mmi-cli learning skill-lesson --skill <name> --title <summary> --body-file <path>`.
+Under the App pool,
+`--jq`/`-q`/`--template`/`--web` are refused: use
+`MMI_ACTOR=app mmi-cli devops read issue view <id> --repo <owner/repo> --json comments`
+(or `pr`/`run view` with their fields); filter returned JSON locally.
+For run logs, never native `gh run view --log`/`--log-failed`: use
+`MMI_ACTOR=app mmi-cli devops read run log <runId> --repo <owner/repo> [--failed | --job <name>] [--tail N]`.
+A refused command writes no output, so a `> file` redirect leaves it empty or missing: read the
+refusal, then rerun the typed form.
 
 Read the issue, implementation, callers, and repository policy before editing.
 Run `mmi-cli tests policy --base <comparison-base>` to determine required checks against your target
@@ -36,10 +42,10 @@ Functional browser journeys remain opt-in `workflow_dispatch`-only, never design
 
 ## The MM Open Design System Bible (#8837, #8839)
 
-This is the bible for the MM open design system: every agent doing UI, design, document or MM
-Artifact work reads it first and treats it as second nature. Part 1 says how the system is built and
-used; Part 2 says how agents improve it when it fails them; Part 3 governs A/B choosing architecture
-and viewer behavior; Part 4 makes design-spec requests a visual A/B choice before any kit change.
+Every agent doing UI, design, document or MM Artifact work reads this first: Part 1 builds the
+system, Part 2 improves it, Part 3 governs A/B choosing, Part 4 gates kit changes on visual A/B.
+Handoff and workaround notes cite this section by path and add only the task's own deviation,
+failure and action, never a restatement; new owner rulings are still recorded verbatim.
 
 ### Part 1 — The five pillars of the MM Open Design System
 
@@ -82,6 +88,14 @@ Four owner decisions (2026-10-25T15:35:52Z):
 
 Impeccable **v4.7.0 / engine v0.1.16** details:
 
+- Impeccable is invoked as the installed script at `~/.agents/skills/impeccable/scripts/impeccable` or
+  bare `impeccable` on `PATH` — no Impeccable CLI is published on npm, so never run
+  `npx @impeccable-style/cli ...` (it 404s) or chain `npx` guesses into git/bootstrap commands (#8885).
+  Refresh the local kit cache with `node "<absolute-MM-Work-root>/scripts/sync-design-system.mjs" "<absolute-MM-Work-root>/packages/mmwork-ds/source"`
+  (the source argument is required, #8887); resolve and verify the checkout as described under
+  [shared support-script invocation](#shared-support-script-invocation). A local `npm ci` against `npm.pkg.github.com` that returns
+  `E401` needs auth: `NODE_AUTH_TOKEN=$(gh auth token) npm ci --prefix module`, or adopt credential-free
+  with `mmi-cli devops packages adopt-export` (`docs/Guides/package-adopt-export.md`, #8886).
 - Boot once: `impeccable context --target <path>`; `init` captures PRODUCT.md, `document` maintains
   `DESIGN.md` and its `design.json` sidecar, `impeccable doctor --json` reports drift, and `extract`
   identifies reusable candidates (kit additions still need the Design Lead). Read
@@ -125,7 +139,37 @@ Craft essentials every agent applies (owner, 2026-10-25, #8839):
 - **Verify the SSR pre-rendered HTML.** `impeccable detect --json` is blind on an unrendered
   `<div id="root"></div>` file, so verify the output of `review.mjs <folder> --standalone --open`,
   which pre-renders the board into `#root` first. An empty `#root`, missing fonts or an unrendered
-  detector run is a failed check, not a pass.
+  detector run is a failed check, not a pass. For one page-spec module, run
+  `node scripts/design-pack-render.mjs --page-spec <spec.mjs>` (it SSR-renders `renderPage(ctx)` per
+  theme mode and runs `impeccable detect --json` on the HTML), or `node artifacts/review/review.mjs
+  <folder> --standalone` for a pack; never hand-roll an inline `node -e` SSR script, which evaluates
+  as CommonJS and fails on the spec's ESM `import` lines (#8876).
+
+### Shared support-script invocation
+
+Resolve shared support tools from their **known canonical checkout**, not the caller's module/worktree
+layout (#8890). Never guess `../../MMI-Hub/scripts/kit-adopt.mjs`: that can resolve to the
+`mmi-worktrees/MMI-Hub` container, not a checkout, or to a sibling branch without the script.
+
+1. Start with a known absolute MMI-Hub checkout/worktree path supplied by repository or host metadata.
+   If only a Hub task worktree is known, use `git -C "<known-Hub-worktree>" rev-parse --path-format=absolute --git-common-dir`
+   and `git -C "<known-Hub-worktree>" worktree list --porcelain` to identify its canonical/main checkout.
+   Git metadata is repository-specific: a module's common directory cannot locate MMI-Hub. If no Hub
+   checkout is known, ask for it; do not scan drive roots or traverse arbitrary parents.
+2. Verify the selected checkout's identity with `git -C "<absolute-Hub-root>" remote get-url origin`
+   (must identify `mutmutco/MMI-Hub`) and verify `"<absolute-Hub-root>/scripts/kit-adopt.mjs"` exists as
+   a file before invocation. If missing, stop and resolve the correct checkout/version; do not retry
+   sibling guesses or create a replacement script.
+3. Resolve each target/source independently to its intended absolute path. Invoke Node with separate,
+   quoted arguments, for example:
+   `node "<absolute-Hub-root>/scripts/kit-adopt.mjs" --local-dir "<absolute-module-root>" --version <kit-version>`.
+   For cache refresh, verify `<absolute-MM-Work-root>/scripts/sync-design-system.mjs`, then
+   pass both the absolute script path and absolute `packages/mmwork-ds/source` path as shown above.
+   These are path patterns, not literal host paths; keep machine-specific roots out of bundled docs.
+
+Verify paths before chaining unrelated operations such as a board claim. Path resolution grants no
+new authority: use only the tool mode and target already authorized; never replay a successful claim
+just because a later script failed to load.
 
 ### Part 2 — The System-First Autolearn Doctrine (never work around a broken tool in `tmp/`)
 

package/skills/rcand/SKILL.md

@@ -45,7 +45,7 @@ mmi-cli devops rcand --apply --json --out "$r"
 Read the receipt at `$r`, never the exit code (`1` = deploy failed after promotion; unresolved exits `0`):
 
 - `promoted` is `true` even when the deploy failed; `tag` is the minted `vX.Y.0-rc.N` (`resumeNote`: resumed).
-- `deployStatus`: `pending` is never terminal. Watch each non-success run in `workflowRuns`: `gh run watch <run-id> --repo {owner}/{repo} --exit-status --interval 30`.
+- `deployStatus`: `pending` is never terminal. Watch each non-success run in `workflowRuns`: `mmi-cli devops read run watch <run-id> --repo {owner}/{repo} --exit-status --interval 60`.
 - `releaseVerdict`: `followUpStatus` (`complete` · `pending` · `failed`); a failed `legs` row carries its error.
 - `checkout.status: returned` to `development` and `localSync`/`ledger` green, or the named reason.
 
@@ -59,8 +59,8 @@ On any failure or interruption, read [recovery.md](recovery.md).
 
 - **Never squash-merge a tagged commit (#3167).** A squash re-mints the SHA and orphans the tag, so tag-anchored checks mis-read. Any merge that carries an already-tagged commit — the `main → development` roll-forward, an alignment PR, a hotfix fold PR — lands as a true merge: `mmi-cli devops pr merge <number> --auto --merge` (or `--wait --merge`); `--wait` alone still squashes. The hotfix main-base PR itself may squash: its tag lands after, on the merged `main` HEAD, and the `-x` trailer must survive the squash message.
 - **A refused train is a stop, never a license to finish by hand.** Every fail-closed halt — doctor blocker, authority probe, coverage guard, untolerated conflict, required checks, stray tag, ledger — ends the run. Fix the cause on `development` through a normal PR and rerun the train; never hand-resolve on `main`, hand-cherry-pick, bare-push a train branch, ack to save time, or bypass a check.
-- **Version probes anchor on the latest Release tag, not a branch (#2734).** A branch manifest or a stale local tag is not a version source; a surviving local tag silently mints the next version.
-- **One train at a time on a repo (#5380).** Two overlapping runs race the shared tag namespace; the ledger refuses the second — never start one to help the first.
+- **Probe the latest Release tag, not branches or stale local tags (#2734).** Queue: `mmi-cli devops read pr queue <number> --repo <owner/repo> --json`; gh rejects `mergeQueueEntry`.
+- **One train per repo (#5380).** Overlapping trains race tags; never start one to help another.
 - **Tag and Release deletion need Jervaise's yes (principle 12),** named in the guide entry that prescribes it.
 
 ## Report

package/skills/rcand/recovery.md

@@ -7,4 +7,4 @@ Every refusal and every doctor blocker names its `code` and `anchor`: open `docs
 
 The JSON is on stdout alone; a stale CLI first prints its self-update notice on stderr and re-runs itself, so parse stdout only, never `2>&1`. Read `ready`, then `findings[]`: each carries `code`, `severity` (`blocker` · `warning` · `healed` · `info`), `source` (`local` · `origin`), `remedy` and `anchor`. `ready: false` → stop and quote every blocker's `code` and `remedy`; an unread origin is never green. `--apply` re-runs this doctor as its step 0 with heal on.
 
-- `deployStatus` — `pending` is never terminal. `runId` / `runUrl` / `workflowRuns` name the run: the dispatched `tenant-deploy.yml` for tenant-container, the auto-fired `deploy.yml` for serverless. Watch each non-success entry to conclusion: `gh run watch <run-id> --repo {owner}/{repo} --exit-status --interval 30`.
+- `deployStatus` — `pending` is never terminal. `runId` / `runUrl` / `workflowRuns` name the run: the dispatched `tenant-deploy.yml` for tenant-container, the auto-fired `deploy.yml` for serverless. Watch each non-success entry to conclusion: `mmi-cli devops read run watch <run-id> --repo {owner}/{repo} --exit-status --interval 60`.

package/skills/release/SKILL.md

@@ -31,7 +31,7 @@ Run mktemp alone, copy its path; no channel: drop the summary flag. `mmi-cli dev
 
 ## Verify
 
-Receipt fields (`served-channel`, npm, `jerv-gateway`): [verification.md](verification.md). Latest: `gh release list --repo {owner}/{repo} --limit 1 --json tagName,isLatest,publishedAt` → `isLatest: true`, resolved tag. Close on: `origin/main..origin/development` count, tag on origin, Latest, green runs on the SHA.
+Receipt fields (`served-channel`, npm, `jerv-gateway`): [verification.md](verification.md). Latest: `tag_name` from `mmi-cli devops api get repos/{owner}/{repo}/releases/latest` equals the resolved tag (recipe in verification.md); a failed read is unverified. Close on: `origin/main..origin/development` count, tag on origin, Latest, green runs on the SHA.
 
 ## Recovery
 
@@ -41,8 +41,8 @@ On failure or a pending ledger leg: [recovery.md](recovery.md).
 
 - **Never squash-merge a tagged commit (#3167).** A squash re-mints the SHA and orphans the tag, so tag-anchored checks mis-read. Any merge that carries an already-tagged commit — the `main → development` roll-forward, an alignment PR, a hotfix fold PR — lands as a true merge: `mmi-cli devops pr merge <number> --auto --merge` (or `--wait --merge`); `--wait` alone still squashes. The hotfix main-base PR itself may squash: its tag lands after, on the merged `main` HEAD, and the `-x` trailer must survive the squash message.
 - **A refused train is a stop, never a license to finish by hand.** Every fail-closed halt — doctor blocker, authority probe, coverage guard, untolerated conflict, required checks, stray tag, ledger — ends the run. Fix the cause on `development` through a normal PR and rerun the train; never hand-resolve on `main`, hand-cherry-pick, bare-push a train branch, ack to save time, or bypass a check.
-- **Version probes anchor on the latest Release tag, not a branch (#2734).** A branch manifest or a stale local tag is not a version source; a surviving local tag silently mints the next version.
-- **One train at a time on a repo (#5380).** Two overlapping runs race the shared tag namespace; the ledger refuses the second — never start one to help the first.
+- **Probe the latest Release tag, not branches or stale local tags (#2734).** Queue: `mmi-cli devops read pr queue <number> --repo <owner/repo> --json`; gh rejects `mergeQueueEntry`.
+- **One train per repo (#5380).** Overlapping trains race tags; never start one to help another.
 - **Tag and Release deletion need Jervaise's yes (principle 12),** named in the guide entry that prescribes it.
 
 ## Report

package/skills/release/recovery.md

@@ -1,7 +1,7 @@
 # Release recovery and ledger continuation
 
 
-Every refusal and every doctor blocker names its `code` and `anchor`: open `docs/Guides/train-troubleshooting.md#<code>` and follow that entry, nothing else. That guide is test-parsed, never free text — the infra drift and plugin-set suites validate every anchor cited here and assert policy from its wording — so an edit to it re-runs the infra suite (`npm --prefix infra test`) in the same PR: a heading or slug change is a code change. A pre-tag abort with no finding code (for example, a transient secrets-preflight timeout) is a transient stop: nothing was promoted and no tag was cut. Confirm no tag reached origin (`git ls-remote --tags origin` or `gh api repos/{owner}/{repo}/tags`), then rerun `mmi-cli devops release --apply` as a fresh cut, never `--resume`; resume is only for a partial release with the tag already on origin. A partial release (tag on origin, later phases pending or failed) continues with `mmi-cli devops release --resume --watch --json --out <fresh-receipt>` — the only continuation form: `--resume` never re-tags or republishes, posts a deferred announcement only when it is the run that first proves deploy and publish green, and `--apply` belongs to a new cut only. A SUPERSEDED leg is not a pending one: a ledger that records a supersession is phases-green — `--resume` must not be used on it, and the deferred announcement is the next patch train's to carry. A refused train is a stop (Merge floor): fix the cause on `development` through a normal PR, then rerun.
+Every refusal and every doctor blocker names its `code` and `anchor`: open `docs/Guides/train-troubleshooting.md#<code>` and follow that entry, nothing else. That guide is test-parsed, never free text — the infra drift and plugin-set suites validate every anchor cited here and assert policy from its wording — so an edit to it re-runs the infra suite (`npm --prefix infra test`) in the same PR: a heading or slug change is a code change. A pre-tag abort with no finding code (for example, a transient secrets-preflight timeout) is a transient stop: nothing was promoted and no tag was cut. Confirm no tag reached origin (`git ls-remote --tags origin`), then rerun `mmi-cli devops release --apply` as a fresh cut, never `--resume`; resume is only for a partial release with the tag already on origin. A partial release (tag on origin, later phases pending or failed) continues with `mmi-cli devops release --resume --watch --json --out <fresh-receipt>` — the only continuation form: `--resume` never re-tags or republishes, posts a deferred announcement only when it is the run that first proves deploy and publish green, and `--apply` belongs to a new cut only. A SUPERSEDED leg is not a pending one: a ledger that records a supersession is phases-green — `--resume` must not be used on it, and the deferred announcement is the next patch train's to carry. A refused train is a stop (Merge floor): fix the cause on `development` through a normal PR, then rerun.
 
 **Exactly one continuation per ledger state.** Pick the row, run its verb, never combine two:
 

package/skills/release/verification.md

@@ -1,6 +1,6 @@
-For the independent run recheck, scope the read to the release window, so a busy repo's unrelated runs cannot fill the cap: note the UTC instant you started `--apply` (`date -u +%Y-%m-%dT%H:%M:%SZ`), then run `gh run list --repo {owner}/{repo} --created ">=<apply-start-utc>" --limit 100 --json databaseId,headSha,workflowName,status,conclusion,url > .jerv/tmp/release-runs.json`, then filter locally by the exact SHA from the saved receipt with `node -e 'const rows = require("./.jerv/tmp/release-runs.json"); const sha = process.argv[1]; const matches = rows.filter((run) => run.headSha === sha); if (rows.length >= 100 || !matches.length) throw new Error("release run set is incomplete or absent"); console.log(JSON.stringify(matches, null, 2));' "<release-sha>"`.
+For the independent run recheck, scope the read to the release window, so a busy repo's unrelated runs cannot fill the cap: note the UTC instant you started `--apply` (`date -u +%Y-%m-%dT%H:%M:%SZ`), then pipe the typed App-pool list straight into a local filter on the exact SHA from the saved receipt: `mmi-cli devops read run list --repo {owner}/{repo} --created ">=<apply-start-utc>" --limit 100 --json databaseId,headSha,workflowName,status,conclusion,url | node -e 'const rows = JSON.parse(require("node:fs").readFileSync(0, "utf8")); const sha = process.argv[1]; const matches = rows.filter((run) => run.headSha === sha); if (rows.length >= 100 || !matches.length) throw new Error("release run set is incomplete or absent"); console.log(JSON.stringify(matches, null, 2));' "<release-sha>"`.
 
-Do not use the raw `releases/latest` API route, a `--jq` formatter, or `gh run list --commit`; if the bounded list reaches 100 rows or has no SHA match, the run set is unverified and must not be called green.
+Do not use a `--jq` formatter, raw `gh` reads (`gh run list`, `gh run list --commit`, `gh release list`, `gh api`), or a `tmp/` file read back with `require`; if the read fails, the bounded list reaches 100 rows or has no SHA match, the run set is unverified and must not be called green.
 
 - A `private` npm surface (`surfaces.json`): the doctor's `npm-token-rejected` finding comes first. A 401 from `npm whoami` through the `_org` `npm/NPM_TOKEN` vault hop means the token is rejected, and every authenticated `npm view` then 404s exactly like an absent package — rotate the token; only after a login is a restricted 404 "unverifiable from here", never "not published" (`publish-private-package`). On a repo whose workflows publish through Trusted Publishing and name no registry token, that row is `info`, not a warning: no lane consumes the org token, so it constrains your manual read only.
 
@@ -21,7 +21,7 @@ Read the saved result, never the exit code (`1` = a follow-up failed after promo
 - `deployStatus`: `pending` is never terminal; `promoted: true` holds even when a deploy failed.
 - `workflowRuns`: every run on the release SHA; `parallel: true` marks legs run together. Name the red run: `deploy.yml`, `publish.yml`, `tenant-deploy.yml` and `jerv-gateway` are deploy/publish verdicts; a `gate` push run is ordinary CI.
 - `announceNote`: `announced`, `skipped`, `not announced` (deploy/publish not green; a `--resume` with the same `--announce-summary-file` posts it), or the failure note. A failed announcement keeps its summary file; an uncertain delivery is never replayed automatically. Never install AWS, ask for AWS credentials, or copy the Slack key.
-- `devRollForward` / `rcAlignment`: `pushed`, or `pr-pending` with an alignment PR to land by true merge; read the method back with `gh pr view <n> --json autoMergeRequest --jq .autoMergeRequest.mergeMethod`: it must be `MERGE`, and `SQUASH` is a stop.
+- `devRollForward` / `rcAlignment`: `pushed`, or `pr-pending` with an alignment PR to land by true merge; read `autoMergeRequest.mergeMethod` from `mmi-cli devops read pr view <n> --repo {owner}/{repo} --json autoMergeRequest`: it must be `MERGE`, and `SQUASH` is a stop.
 - `versionFold`, `rcRetirement`, `checkout`: `returned`, or the reason you are still on `main`.
 - `localInstall` (MMI-Hub): the train installs via `mmi-hub update`; never `npm i -g`.
 
@@ -67,12 +67,12 @@ Describe the release in plain words before each command: “Preparing release”
 
 Use the actual current stage, never a guessed sequence. Explain a pending result as “Publishing is still pending” or name the unfinished step, then narrate the sanctioned resume command as “Checking the remaining release steps”. Say “Release complete” only after the status fields prove every required follow-up complete. Temporary filenames, `XXXXXX`, receipts, and ledger folding are internal bookkeeping, never a user-facing status.
 
-- `workflowRuns` — every run on the release SHA (deploy-model runs, any `push: main` deploy, the repo's own `gate`). On this host, discover them with the bounded run-list read below; filter locally by the exact receipt SHA. If the list hits its 100-row cap or returns no matching SHA, treat the run set as unverified and stop rather than infer completeness. Watch each matching non-success entry to conclusion: `gh run watch <run-id> --repo {owner}/{repo} --exit-status --interval 30`. Name which run is red: `deploy.yml` / `publish.yml` / `tenant-deploy.yml` / `jerv-gateway` is a deploy or publish verdict; a `gate` push run is ordinary CI sharing the SHA.
+- `workflowRuns` — every run on the release SHA (deploy-model runs, any `push: main` deploy, the repo's own `gate`). On this host, discover them with the bounded run-list read below; filter locally by the exact receipt SHA. If the list hits its 100-row cap or returns no matching SHA, treat the run set as unverified and stop rather than infer completeness. Watch each matching non-success entry to conclusion: `mmi-cli devops read run watch <run-id> --repo {owner}/{repo} --exit-status --interval 60`. Name which run is red: `deploy.yml` / `publish.yml` / `tenant-deploy.yml` / `jerv-gateway` is a deploy or publish verdict; a `gate` push run is ordinary CI sharing the SHA.
 - With `--watch`, require every follow-up complete before declaring the cut done. For any pending ledger leg, read [recovery.md](recovery.md) before continuing or starting a new train.
 - `announceNote` — `announced` (to the alerts channel for the Hub, to the project release channel for a product repo), `skipped`, `not announced` (deploy or publish not green; the note says whether a `--resume` carrying the same `--announce-summary-file` will post it), or the failure note. The channel id itself is never printed.
-- `devRollForward` / `rcAlignment` — `pushed`, or `pr-pending` with the alignment PR to land by true merge (Merge floor). An enqueued auto-merge is not evidence of the method; before reporting, read the enqueued method back — `gh pr view <n> --json autoMergeRequest --jq .autoMergeRequest.mergeMethod` — and prove it is `MERGE`. An enqueued `SQUASH` is a stop under the Merge floor, not something to wait out.
+- `devRollForward` / `rcAlignment` — `pushed`, or `pr-pending` with the alignment PR to land by true merge (Merge floor). An enqueued auto-merge is not evidence of the method; before reporting, read the enqueued method back — `autoMergeRequest.mergeMethod` from `mmi-cli devops read pr view <n> --repo {owner}/{repo} --json autoMergeRequest` — and prove it is `MERGE`. An enqueued `SQUASH` is a stop under the Merge floor, not something to wait out.
 - `versionFold`, `rcRetirement`, `checkout` — `returned`, or the named reason you are still on `main`.
 - `localInstall` (MMI-Hub) — the train installs the release on this machine via `mmi-hub update`; never run `npm i -g`.
 For a private npm surface, read [verification.md](verification.md) before interpreting authentication or package visibility.
 
-Then verify Latest with this bounded one-row read; require `isLatest: true` and `tagName` equal to the resolved tag: `gh release list --repo {owner}/{repo} --limit 1 --json tagName,isLatest,publishedAt`.
+Then verify Latest with the typed App-pool read (GitHub's Latest: never a draft or prerelease); a failed or empty read leaves Latest unverified: `mmi-cli devops api get repos/{owner}/{repo}/releases/latest | node -e 'const r = JSON.parse(require("node:fs").readFileSync(0, "utf8")); if (!r.tag_name || r.tag_name !== process.argv[1] || r.draft || r.prerelease) throw new Error("Latest is not the resolved tag"); console.log(r.tag_name, r.published_at);' "<resolved-tag>"`.