@mutmutco/codex-plugin 4.5.224 → 4.5.225

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.224",
+  "version": "4.5.225",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -524,6 +524,7 @@ __export(github_client_exports, {
   classifyGhTokenExecFailure: () => classifyGhTokenExecFailure,
   createGitHubClient: () => createGitHubClient,
   defaultGitHubClient: () => defaultGitHubClient,
+  githubKeyringTokenRead: () => githubKeyringTokenRead,
   githubToken: () => githubToken,
   githubTokenRead: () => githubTokenRead,
   rateLimitResetNote: () => rateLimitResetNote,
@@ -543,16 +544,22 @@ function classifyGhTokenExecFailure(e) {
   }
   return { state: "failed", detail };
 }
+async function githubKeyringTokenRead() {
+  const env = { ...process.env };
+  delete env.GH_TOKEN;
+  delete env.GITHUB_TOKEN;
+  cachedGhCliTokenRead ??= execFileP("gh", ["auth", "token"], { env }).then(({ stdout }) => {
+    const token = stdout.trim();
+    return token ? { state: "ok", token } : { state: "absent", detail: "`gh auth token` exited 0 without printing a token" };
+  }).catch((e) => classifyGhTokenExecFailure(e));
+  return cachedGhCliTokenRead;
+}
 async function githubTokenRead() {
   const mmiPat = process.env.MMI_GH_PAT?.trim();
   if (mmiPat) return { state: "ok", token: mmiPat };
   if (process.env.GH_TOKEN) return { state: "ok", token: process.env.GH_TOKEN };
   if (process.env.GITHUB_TOKEN) return { state: "ok", token: process.env.GITHUB_TOKEN };
-  cachedGhCliTokenRead ??= execFileP("gh", ["auth", "token"]).then(({ stdout }) => {
-    const token = stdout.trim();
-    return token ? { state: "ok", token } : { state: "absent", detail: "`gh auth token` exited 0 without printing a token" };
-  }).catch((e) => classifyGhTokenExecFailure(e));
-  return cachedGhCliTokenRead;
+  return githubKeyringTokenRead();
 }
 async function githubToken() {
   const read = await githubTokenRead();
@@ -1158,6 +1165,7 @@ var init_house_map = __esm({
       // org-managed repository rule delivery (.gitignore)
       // --- vault — secrets ----------------------------------------------------------------------------
       secrets: "vault",
+      oauth: "vault",
       "org oauth": "vault",
       // OAuth credential planning/set/verify
       // --- learning — self-improvement ----------------------------------------------------------------
@@ -1576,7 +1584,12 @@ async function writeHubBoardField(request) {
     signal: AbortSignal.timeout(25e3)
   });
   const body = await res.json().catch(() => null);
-  if (!res.ok || body?.updated !== true) throw new Error(`board field write HTTP ${res.status}: ${body?.error ?? "unconfirmed result"}`);
+  if (!res.ok || body?.updated !== true) {
+    throw Object.assign(new Error(`board field write HTTP ${res.status}: ${body?.error ?? "unconfirmed result"}`), {
+      status: res.status,
+      rateLimited: res.status === 429 || res.status === 503 && body?.code === "github-rate-limited"
+    });
+  }
 }
 async function addIssueToProjectViaHub(cfg, contentNodeId) {
   const config = await loadConfig();
@@ -14891,6 +14904,10 @@ var VERB_ALIAS_TABLE = [
   // #6494: there is no top-level or housed `registry` command; org/registry project metadata is
   // `oracle org project get`.
   { typed: ["registry"], canonical: ["oracle", "org", "project", "get"] },
+  // #9049: the legacy `registry org` (org constants + App spend) consolidated to `oracle org config
+  // get` (command-consolidation.ts move(registry, config, 'org', 'get')) — the bare `registry` entry
+  // above must not shadow it, or `--github-spend-minutes` lands on project get, which rejects it.
+  { typed: ["registry", "org"], canonical: ["oracle", "org", "config", "get"] },
   // #6486: filing/managing an issue reads as devops work (it ships something) but issues are oracle's
   // live truth; the real command is `oracle issue create`. (A narrower house-token-only reroute for
   // this same case may also exist elsewhere — this entry keeps the general table a complete answer on
@@ -21815,8 +21832,23 @@ mutation($projectId: ID!, $itemId: ID!) {
 async function updateItemSingleSelect(client, projectId, itemId, fieldId, optionId) {
   if (process.env.MMI_ACTOR?.trim() === "app") {
     const { writeHubBoardField: writeHubBoardField2 } = await Promise.resolve().then(() => (init_board_write(), board_write_exports));
-    await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
-    return { credential: "app_installation" };
+    try {
+      await writeHubBoardField2({ projectId, itemId, fieldId, optionId });
+      return { credential: "app_installation" };
+    } catch (error) {
+      const refusal = error;
+      if (refusal?.rateLimited !== true || refusal.status !== 503 && refusal.status !== 429) throw error;
+      try {
+        const identity = await githubKeyringTokenRead();
+        if (identity.state !== "ok") throw error;
+        const owner = createGitHubClient({ token: async () => identity.token });
+        await owner.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
+      } catch {
+        throw error;
+      }
+      process.stderr.write("board write: Hub App allowance exhausted \u2014 wrote with your own GitHub login (#9053)\n");
+      return { credential: "user" };
+    }
   }
   try {
     await client.graphql(UPDATE_ITEM_FIELD_MUTATION, { projectId, itemId, fieldId, optionId });
@@ -27056,10 +27088,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.224",
-    tag: "v4.5.224",
-    commit: "806e92434bb2",
-    npm: "@mutmutco/cli@4.5.224"
+    version: "4.5.225",
+    tag: "v4.5.225",
+    commit: "b41b26dda1a8",
+    npm: "@mutmutco/cli@4.5.225"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27076,14 +27108,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.224"
+          v3Target: "v4.5.225"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.224 and redeploy the Hub Lambda from tag v4.5.224 (806e92434bb2); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.224 (@mutmutco/cli@4.5.224, tag commit 806e92434bb2 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.225 and redeploy the Hub Lambda from tag v4.5.225 (b41b26dda1a8); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.225 (@mutmutco/cli@4.5.225, tag commit b41b26dda1a8 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -39550,7 +39582,7 @@ var PRIMARY_GROUPS = [
   ["Setup and support", ["bootstrap", "secrets", "docs", "tests", "spawn", "dist"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
-var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["org", "runtime", "plugin", "packages", "github", "archive-prune"]);
+var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["oauth", "org", "runtime", "plugin", "packages", "github", "archive-prune"]);
 var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup", "read"]);
 var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "dist", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
@@ -39604,6 +39636,7 @@ var COMMAND_OWNERSHIP = {
   // #7833
   bootstrap: { module_owner: "cli/src/bootstrap-commands.ts", consumer: "repo-bootstrap" },
   secrets: { module_owner: "cli/src/secrets-commands.ts", consumer: "authenticated-operator" },
+  oauth: { module_owner: "cli/src/connections-oauth.ts", consumer: "authenticated-operator" },
   docs: { module_owner: "cli/src/docs-index-command.ts", consumer: "repo-gates" },
   tests: { module_owner: "cli/src/test-policy-core.ts", consumer: "repo-gates" },
   spawn: { module_owner: "cli/src/spawn-policy-core.ts", consumer: "repo-gates" },
@@ -62441,6 +62474,18 @@ function parseBrokerInt(raw, flag, min, max) {
   }
   return n;
 }
+function parseBrokerLimit(raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1) {
+    throw new Error(`read: --limit must be a positive integer (received '${raw}')`);
+  }
+  if (n > 100) {
+    process.stderr.write(`mmi-cli read: --limit ${raw} clamped to 100; results may be truncated
+`);
+    return 100;
+  }
+  return n;
+}
 function parseBrokerJsonFields(raw, allowed) {
   if (raw === void 0 || raw === false) return void 0;
   if (raw === true) return void 0;
@@ -62562,7 +62607,7 @@ function buildPrListSpec(o) {
   if (search !== void 0) args.push("--search", search);
   const assignee = parseBrokerAssignee(o.assignee);
   if (assignee) args.push("--assignee", assignee);
-  if (o.limit !== void 0) args.push("--limit", String(parseBrokerInt(o.limit, "--limit", 1, 100)));
+  if (o.limit !== void 0) args.push("--limit", String(parseBrokerLimit(o.limit)));
   return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
 }
 function withRepo(args, repo) {
@@ -62600,7 +62645,7 @@ function buildRunListSpec(o) {
   if (status) args.push("--status", status);
   const created = parseBrokerCreated(o.created);
   if (created) args.push("--created", created);
-  if (o.limit !== void 0) args.push("--limit", String(parseBrokerInt(o.limit, "--limit", 1, 100)));
+  if (o.limit !== void 0) args.push("--limit", String(parseBrokerLimit(o.limit)));
   return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
 }
 function buildRunWatchSpec(id, o) {
@@ -62660,7 +62705,7 @@ function buildIssueListSpec(o) {
   if (label !== void 0) args.push("--label", label);
   const state = parseBrokerIssueState(o.state);
   if (state) args.push("--state", state);
-  if (o.limit !== void 0) args.push("--limit", String(parseBrokerInt(o.limit, "--limit", 1, 100)));
+  if (o.limit !== void 0) args.push("--limit", String(parseBrokerLimit(o.limit)));
   return { program: "gh", args, timeoutMs: SINGLE_SHOT_TIMEOUT_MS };
 }
 function brokerChildEnv(base = process.env) {
@@ -62792,6 +62837,7 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
   const repoOpt = (v) => parseBrokerRepo(v, "--repo");
   const idOpt = (what) => (v) => parseBrokerId(v, what);
   const intOpt = (flag, min, max) => (v) => String(parseBrokerInt(v, flag, min, max));
+  const limitOpt = (v) => String(parseBrokerLimit(v));
   const jsonOpt = (v) => parseBrokerJsonFields(v);
   const checksJsonOpt = (v) => parseBrokerJsonFields(v, GH_PR_CHECKS_JSON_FIELDS);
   const workflowOpt = (v) => parseBrokerWorkflow(v);
@@ -62815,7 +62861,7 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
     }
     await dispatchGh(spec, "read run view", o.jq);
   });
-  run.command("list").description("list workflow runs (workflow/branch/commit/status/created/limit/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--workflow <name>", "filter by workflow name or file", workflowOpt).option("--branch <name>", "filter by branch", branchOpt).option("--commit <sha>", "filter by the full 40-character head commit SHA (#8937)", (v) => parseBrokerCommit(v)).option("--status <status>", "filter by run status", runStatusOpt).option("--created <filter>", 'only runs created in this window, e.g. ">=2026-10-11T00:30:00Z" (#8096)', (v) => parseBrokerCreated(v)).option("--limit <n>", "maximum runs to fetch (1-100)", intOpt("--limit", 1, 100)).option("--jq <expr>", JQ_HELP, jqOpt).action(async (o) => {
+  run.command("list").description("list workflow runs (workflow/branch/commit/status/created/limit/json; formatters refused)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--workflow <name>", "filter by workflow name or file", workflowOpt).option("--branch <name>", "filter by branch", branchOpt).option("--commit <sha>", "filter by the full 40-character head commit SHA (#8937)", (v) => parseBrokerCommit(v)).option("--status <status>", "filter by run status", runStatusOpt).option("--created <filter>", 'only runs created in this window, e.g. ">=2026-10-11T00:30:00Z" (#8096)', (v) => parseBrokerCreated(v)).option("--limit <n>", "maximum runs to fetch (1-100; larger values clamp to 100)", limitOpt).option("--jq <expr>", JQ_HELP, jqOpt).action(async (o) => {
     let spec;
     try {
       requireJqJson(o.jq, o.json);
@@ -62835,7 +62881,7 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
     await dispatchGh(spec, "read run watch");
   });
   const pr = read.command("pr").description("pull-request reads \u2014 view/list/diff ride gh; queue uses fixed GraphQL; checks is REST-backed (deterministic closed-custody adapter; native was EMPTY only on the historical #3035 fixture)");
-  pr.command("list").description("list viewer-free PRs (author/viewer filters stay personal)").option("--repo <owner/repo>", "target repo (required \u2014 no git-origin default)", repoOpt).option("--json [fields]", "native gh JSON fields", jsonOpt).addOption(new Option("--state <state>", "open|closed|merged|all").choices(["open", "closed", "merged", "all"])).option("--base <branch>", "base branch", branchOpt).option("--head <branch>", "head branch", branchOpt).option("--label <label>", "filter by label", labelOpt).option("--search <query>", "viewer-free search", (v) => parseBrokerPrSearch(v)).option("--assignee <login>", "explicit assignee (viewer refused)", assigneeOpt).option("--limit <n>", "maximum PRs (1-100)", intOpt("--limit", 1, 100)).option("--jq <expr>", JQ_HELP, jqOpt).action(async (o) => {
+  pr.command("list").description("list viewer-free PRs (author/viewer filters stay personal)").option("--repo <owner/repo>", "target repo (required \u2014 no git-origin default)", repoOpt).option("--json [fields]", "native gh JSON fields", jsonOpt).addOption(new Option("--state <state>", "open|closed|merged|all").choices(["open", "closed", "merged", "all"])).option("--base <branch>", "base branch", branchOpt).option("--head <branch>", "head branch", branchOpt).option("--label <label>", "filter by label", labelOpt).option("--search <query>", "viewer-free search", (v) => parseBrokerPrSearch(v)).option("--assignee <login>", "explicit assignee (viewer refused)", assigneeOpt).option("--limit <n>", "maximum PRs (1-100; larger values clamp to 100)", limitOpt).option("--jq <expr>", JQ_HELP, jqOpt).action(async (o) => {
     if (!o.repo) return fail(missingBrokerPrRepoMessage("list"));
     try {
       requireJqJson(o.jq, o.json);
@@ -62917,7 +62963,7 @@ function registerAppReadBrokerCommands(program3, resolveRepo2, overrides) {
       return fail(`read issue view: ${e.message}`);
     }
   });
-  issue.command("list").description("list/search issues (search/assignee/label/state/limit/json; viewer pronouns refused \u2014 viewer-scoped reads stay personal)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--search <query>", "search issues", searchOpt).option("--assignee <login>", "filter by assignee (viewer pronouns refused)", assigneeOpt).option("--label <label>", "filter by label", labelOpt).addOption(new Option("--state <state>", "open|closed|all").choices(["open", "closed", "all"])).option("--limit <n>", "maximum issues to fetch (1-100)", intOpt("--limit", 1, 100)).option("--jq <expr>", JQ_HELP, jqOpt).action(async (o) => {
+  issue.command("list").description("list/search issues (search/assignee/label/state/limit/json; viewer pronouns refused \u2014 viewer-scoped reads stay personal)").option("--repo <owner/repo>", "target repo (defaults to the current repo)", repoOpt).option("--json [fields]", "machine-readable output (comma-separated gh fields)", jsonOpt).option("--search <query>", "search issues", searchOpt).option("--assignee <login>", "filter by assignee (viewer pronouns refused)", assigneeOpt).option("--label <label>", "filter by label", labelOpt).addOption(new Option("--state <state>", "open|closed|all").choices(["open", "closed", "all"])).option("--limit <n>", "maximum issues to fetch (1-100; larger values clamp to 100)", limitOpt).option("--jq <expr>", JQ_HELP, jqOpt).action(async (o) => {
     let spec;
     try {
       requireJqJson(o.jq, o.json);
@@ -63453,6 +63499,25 @@ function renderTrackToDirectResult(result) {
   return lines2.join("\n");
 }
 
+// src/connections-oauth.ts
+async function connectProvider(provider, repo, deps) {
+  if (!/^[a-z][a-z0-9-]*$/.test(provider)) throw new Error("invalid provider");
+  const result = await postJson(`/connections/${provider}/connect`, { repo }, deps, "POST", { noRetry: true });
+  const body = result.body;
+  if (!result.ok || typeof body?.authorizeUrl !== "string") throw new Error(result.error ?? "could not start consent");
+  return body.authorizeUrl;
+}
+function registerConnectionsOauth(program3, deps) {
+  program3.command("oauth").description("Hub-owned provider connections").command("connect <provider>").requiredOption("--repo <owner/repo>", "consuming project repository").description("print a one-time provider consent URL; tokens stay inside the Hub").action(async (provider, options) => {
+    try {
+      console.log(await connectProvider(provider, options.repo, await deps()));
+    } catch (e) {
+      console.error(e.message);
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/schedules-commands.ts
 var import_promises10 = require("node:fs/promises");
 init_clean_exit();
@@ -67234,6 +67299,7 @@ program2.command("archive-prune").description("inventory worktree evidence archi
 });
 installProcessBackstop();
 consolidateCommandNamespaces(program2);
+registerConnectionsOauth(program2, async () => registryClientDeps(await loadConfig()));
 registerOrgHealthQuery(program2);
 applyCommandTaxonomy(program2);
 function registeredPathPrefix(path2) {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.224",
+  "version": "4.5.225",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.224",
+  "version": "4.5.225",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -21,7 +21,7 @@ accepts an incomplete board. The CLI partitions rows into **Yours**, **Free to c
 stamps (4 hours without work) hold nothing. Partition rules, stamp details and `--out` rationale:
 [reference.md](reference.md).
 
-**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`); `--jq '<expr>'` on that typed read filters locally. Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `gh issue edit <n> --repo <owner/repo> --body-file .jerv/tmp/issue-body.md` — `gh` writes pass under the pool.
+**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`); `--jq '<expr>'` on that typed read filters locally. Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `gh issue edit <n> --repo <owner/repo> --body-file .jerv/tmp/issue-body.md` — `gh` writes pass under the pool. When `node -e` reads saved JSON, pass an absolute path or use `JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))`: `require()` of a relative path (e.g. `tmp\board.json` from `cygpath -w`) throws MODULE_NOT_FOUND.
 
 ## Step 2 — render it
 
@@ -60,7 +60,12 @@ mmi-cli oracle board claim <ref> <ref> <ref> --json
 
 Announce issue/PR counts; refresh `mmi-cli oracle board read` this session and select ordinary claims from **Free to claim**. Read every result: failures exit nonzero. On conflict, do not blindly retry: refresh, pick another candidate or coordinate a handoff; `--force` only for an owner-authorized intentional takeover. Run writes separately, never `;`; dependent follow-ups use `&&`.
 
-Follow printed owner rulings; record new ones with `mmi-cli oracle issue decision`. One concurrent worktree per batch: [reference.md](reference.md).
+Run each `mmi-cli oracle issue create` as its own simple command with plain double-quoted arguments — never a shell
+helper function or nested escaped quotes around a long body in the same call: the workspace env-enumeration guard
+blocks any command whose quoting it cannot prove inert. Write the body to a file under `.jerv/tmp/` and pass
+`--body-file` (`--title-file` for titles with backticks).
+
+Follow printed owner rulings; record new ones with `mmi-cli oracle issue decision`. One concurrent worktree per batch: [reference.md](reference.md). Always pass `--surface <value>` explicitly on every `mmi-cli oracle issue create` (surface inference is strict and bounces when the body merely mentions a path); use `--no-surface` only for genuinely exempt filings.
 
 With several task lanes in one session, pass `worktree: <the mmi-worktrees/<Repo>/<issue>-<slug> path jerv_worktree_create reported>` to `jerv_worktree_exec` / `jerv_worktree_land` every time; they refuse to guess (#5629). While any mmi-worktrees lane is registered for this repo, run focused tests/gates from the task-worktree root `jerv_worktree_create` reported — never the primary checkout; the test policy refuses it (`test-command-untrusted-worktree-cwd`).
 

package/skills/board/reference.md

@@ -65,6 +65,10 @@ and PR facts.
 full `closingIssuesReferences` list and moves **each** issue to Done, verifying every one and naming any
 that did not move. So a bundle is a first-class landing, not a trick.
 
+Preflight: when the lane changed `docs/`, run `mmi-cli oracle docs index --write`, then commit and push BEFORE
+`mmi-cli devops pr create` — freshness is checked at the pushed commit even under an active merge queue, so never
+defer index regeneration to after merge.
+
 Materialize the body as a real UTF-8 file and pass its path; do not pipe it to `--body-file -`. Read
 `mmi-cli explain devops pr create --json` before the write — flags change.
 

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -70,6 +70,10 @@ jobs:
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Suite only: generic product gates must not load or require design-agent content.
+      - name: Check kit agent-file drift
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
+        uses: mutmutco/MMI-Hub/.github/actions/check-kit-agent-files@{{GATE_RUNNER_SHA}}
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with: