@mutmutco/codex-plugin 4.5.219 → 4.5.221

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.219",
+  "version": "4.5.221",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -27056,10 +27056,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.219",
-    tag: "v4.5.219",
-    commit: "c54fdc7b3ebf",
-    npm: "@mutmutco/cli@4.5.219"
+    version: "4.5.221",
+    tag: "v4.5.221",
+    commit: "874331d0251d",
+    npm: "@mutmutco/cli@4.5.221"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27076,14 +27076,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.219"
+          v3Target: "v4.5.221"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.219 and redeploy the Hub Lambda from tag v4.5.219 (c54fdc7b3ebf); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.219 (@mutmutco/cli@4.5.219, tag commit c54fdc7b3ebf \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.221 and redeploy the Hub Lambda from tag v4.5.221 (874331d0251d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.221 (@mutmutco/cli@4.5.221, tag commit 874331d0251d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -47101,6 +47101,10 @@ async function suiteRcandRun(deps, opts) {
   if (opts.dryRun) {
     const existing = readSuiteCut(deps.recordPath);
     if (existing) plan.push(`existing cut record: ${deps.recordPath} (${existingCutDescription(existing)})`);
+    if (existing && !existing.leadReleased && (existing.pinPr || existing.leadRcTag || existing.members.some((m) => m.tag))) {
+      const why = !heldMatches(existing.heldMembers ?? [], held) ? "suite hold changed since cut began" : existing.members.length !== active.length || active.some((m) => !existing.members.some((r) => r.repo === m.repo && r.id === m.id)) ? "suite roster changed since cut began" : "";
+      if (why) plan.push(`the real run resumes that record and refuses (${why}); retire it first with mmi-cli devops suite abandon --owner-go`);
+    }
     plan.push(...await Promise.all(modules.map(async (m) => `${m.repo}: ${heldById.has(m.id) ? "HELD" : await dryRunStatus(deps, m)}`)));
     return { plan };
   }
@@ -58806,9 +58810,9 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr,
     bundleKit: async (url) => {
       try {
         const res = await fetch(url, { signal: AbortSignal.timeout(GH_TIMEOUT) });
-        return res.ok ? kitFromBundle(await res.text()) : void 0;
+        return res.ok ? kitFromBundle(await res.text()) : `unreadable (HTTP ${res.status})`;
       } catch {
-        return void 0;
+        return "unreadable (unreachable)";
       }
     },
     // #7738: a member hotfixes as suite-solo; the lead hotfixes under its suite-lead capability (inTrain sets it).
@@ -62380,7 +62384,11 @@ async function readRunLog(id, o, runner) {
   const jobs = pages.flatMap((page) => page.jobs);
   const selected = jobs.filter((job) => jobName === void 0 ? FAILED2.has(job.conclusion ?? "") : job.name === jobName);
   const result = { runId, repo, jobs: [] };
-  if (!selected.length) return { result, exitCode: 1, message: `read run log: no matching job for run ${runId} in ${repo}; conclusions seen: ${[...new Set(jobs.map((j) => j.conclusion ?? "pending"))].join(", ") || "none"}` };
+  if (!selected.length && jobName === void 0) return { result, exitCode: 1, message: `read run log: no matching job for run ${runId} in ${repo}; conclusions seen: ${[...new Set(jobs.map((j) => j.conclusion ?? "pending"))].join(", ") || "none"}` };
+  if (!selected.length) {
+    const listed = jobs.slice(0, 30).map((j) => `${j.name} (${j.id})`).join(", ");
+    return { result, exitCode: 1, message: `read run log: --job takes the exact job name, not its id; jobs in run ${runId}: ${listed || "none"}${jobs.length > 30 ? `, \u2026+${jobs.length - 30} more` : ""}` };
+  }
   for (const job of selected) {
     const text = await readAppApi(`repos/${repo}/actions/jobs/${parseBrokerId(String(job.id), "job id")}/logs`, runner);
     result.jobs.push({ id: job.id, name: job.name, conclusion: job.conclusion, failedStep: job.steps?.find((s) => s.conclusion === "failure")?.name ?? null, ...sliceRunLog(text, tail) });
@@ -66466,7 +66474,7 @@ async function runProjectDeployGet(repoOrSlug, o) {
   const stage = o.stage?.trim();
   if (stage && !["dev", "rc", "main"].includes(stage)) return fail("org project deploy get: --stage must be dev, rc, or main");
   const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
-  console.log(JSON.stringify(payload));
+  console.log(JSON.stringify(payload, null, 2));
 }
 var projectDeploy = project.command("deploy").description("read nonsecret DEPLOY# facts (domain, port, deploy path, substrate, host presence)").argument("[ownerRepo]", "shorthand for `get <owner/repo>`").addOption(new Option("--stage <stage>", "dev | rc | main").choices(["dev", "rc", "main"])).option("--json", "machine-readable output").action(async (ownerRepo, o) => runProjectDeployGet(ownerRepo, o));
 projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# facts for one project; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").choices(["dev", "rc", "main"])).option("--json", "machine-readable output").action(async (repoOrSlug, o) => runProjectDeployGet(repoOrSlug, { stage: projectDeploy.opts().stage, json: o.json }));

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.219",
+  "version": "4.5.221",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.219",
+  "version": "4.5.221",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -21,7 +21,7 @@ accepts an incomplete board. The CLI partitions rows into **Yours**, **Free to c
 stamps (4 hours without work) hold nothing. Partition rules, stamp details and `--out` rationale:
 [reference.md](reference.md).
 
-**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`); `--jq '<expr>'` on that typed read filters locally. Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those.
+**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`); `--jq '<expr>'` on that typed read filters locally. Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `gh issue edit <n> --repo <owner/repo> --body-file .jerv/tmp/issue-body.md` — `gh` writes pass under the pool.
 
 ## Step 2 — render it
 
@@ -62,7 +62,7 @@ Announce issue/PR counts; refresh `mmi-cli oracle board read` this session and s
 
 Follow printed owner rulings; record new ones with `mmi-cli oracle issue decision`. One concurrent worktree per batch: [reference.md](reference.md).
 
-With several task lanes in one session, pass `worktree: <the mmi-worktrees/<Repo>/<issue>-<slug> path jerv_worktree_create reported>` to `jerv_worktree_exec` / `jerv_worktree_land` every time; they refuse to guess (#5629).
+With several task lanes in one session, pass `worktree: <the mmi-worktrees/<Repo>/<issue>-<slug> path jerv_worktree_create reported>` to `jerv_worktree_exec` / `jerv_worktree_land` every time; they refuse to guess (#5629). While any mmi-worktrees lane is registered for this repo, run focused tests/gates from the task-worktree root `jerv_worktree_create` reported — never the primary checkout; the test policy refuses it (`test-command-untrusted-worktree-cwd`).
 
 A fresh mmi worktree has no `.jerv/`: run `mkdir -p .jerv/tmp` before writing scratch files there (PR bodies, batches) or listing it.
 

package/skills/epic/SKILL.md

@@ -70,7 +70,7 @@ This JSON is the placement authority: every intended child must be linked and on
 mmi-cli oracle issue link-child <parent> <child>
 ```
 
-Each child is now a parallel item: one worktree + PR each. With several task lanes in one session, pass `worktree: <the mmi-worktrees/<Repo>/<issue>-<slug> path jerv_worktree_create reported>` to `jerv_worktree_exec` / `jerv_worktree_land` every time; they refuse to guess (#5629). On Windows set `git config core.longpaths true` on the main checkout before the first `git worktree add`. When linked worktrees share a clone, serialize `git branch -m` and other ref renames (or retry serially on `.tmp-renamed-log`). **When the last child merges, close the umbrella** (board `Done` follows).
+Each child is now a parallel item: one worktree + PR each. With several task lanes in one session, pass `worktree: <the mmi-worktrees/<Repo>/<issue>-<slug> path jerv_worktree_create reported>` to `jerv_worktree_exec` / `jerv_worktree_land` every time; they refuse to guess (#5629). While any mmi-worktrees lane is registered for this repo, run focused tests/gates from the task-worktree root `jerv_worktree_create` reported — never the primary checkout; the test policy refuses it (`test-command-untrusted-worktree-cwd`). On Windows set `git config core.longpaths true` on the main checkout before the first `git worktree add`. When linked worktrees share a clone, serialize `git branch -m` and other ref renames (or retry serially on `.tmp-renamed-log`). **When the last child merges, close the umbrella** (board `Done` follows).
 
 Never free-type children with raw `gh issue create`: the batch path carries validation, board attach and structured output.