@mutmutco/codex-plugin 4.5.226 → 4.5.228

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.226",
+  "version": "4.5.228",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.226",
+  "version": "4.5.228",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -21,7 +21,7 @@ accepts an incomplete board. The CLI partitions rows into **Yours**, **Free to c
 stamps (4 hours without work) hold nothing. Partition rules, stamp details and `--out` rationale:
 [reference.md](reference.md).
 
-**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`); `--jq '<expr>'` on that typed read filters locally. Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `gh issue edit <n> --repo <owner/repo> --body-file .jerv/tmp/issue-body.md` — `gh` writes pass under the pool. When `node -e` reads saved JSON, pass an absolute path or use `JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))`: `require()` of a relative path (e.g. `tmp\board.json` from `cygpath -w`) throws MODULE_NOT_FOUND.
+**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`); `--jq '<expr>'` on that typed read filters locally. Those typed reads take **one** number per call, exactly like native gh: a second number is refused as `too many arguments`, so read several issues by repeating the typed read once per number (one `--jq` each, joined `&&`). Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `gh issue edit <n> --repo <owner/repo> --body-file .jerv/tmp/issue-body.md` — `gh` writes pass under the pool. When `node -e` reads saved JSON, pass an absolute path or use `JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))`: `require()` of a relative path (e.g. `tmp\board.json` from `cygpath -w`) throws MODULE_NOT_FOUND.
 
 ## Step 2 — render it
 
@@ -58,7 +58,7 @@ Present the plan — batch count, issue count, one line per batch naming its sha
 mmi-cli oracle board claim <ref> <ref> <ref> --json
 ```
 
-Announce issue/PR counts; refresh `mmi-cli oracle board read` this session and select ordinary claims from **Free to claim**. Read every result: failures exit nonzero. On conflict, do not blindly retry: refresh, pick another candidate or coordinate a handoff; `--force` only for an owner-authorized intentional takeover. Run writes separately, never `;`; dependent follow-ups use `&&`.
+Announce issue/PR counts; refresh `mmi-cli oracle board read` immediately before each claim (a list read earlier in the session may already be stale) and select ordinary claims from **Free to claim**. Read every result: failures exit nonzero. On conflict, do not blindly retry: stop that batch, never retry the same ref, refresh and reselect from the fresh **Free to claim** list, or coordinate a handoff; `--force` only for an owner-authorized intentional takeover. Run writes separately, never `;`; dependent follow-ups use `&&`.
 
 Run each `mmi-cli oracle issue create` as its own simple command with plain double-quoted arguments — never a shell
 helper function or nested escaped quotes around a long body in the same call: the workspace env-enumeration guard

package/skills/bootstrap/SKILL.md

@@ -3,7 +3,7 @@ name: bootstrap
 description: Provision an org repo with board, registry, rules, and plugin setup.
 ---
 
-**Host-native invocation:** Claude `/mmi:bootstrap` · Codex `$mmi:bootstrap` · jervcode `/bootstrap` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:bootstrap` · Codex `$mmi:bootstrap` · jervcode `/bootstrap`. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 # /bootstrap — provision a repo into the org
 

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -73,7 +73,7 @@ jobs:
       # Suite only: generic product gates must not load or require design-agent content.
       - name: Check kit agent-file drift
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
-        uses: mutmutco/MMI-Hub/.github/actions/check-kit-agent-files@{{GATE_RUNNER_SHA}}
+        uses: mutmutco/MMI-Hub/.github/actions/check-kit-agent-files@{{KIT_AGENT_FILES_SHA}} # #9161: own pin — this action postdates the shared runner pin
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with:

package/skills/hotfix/SKILL.md

@@ -3,7 +3,7 @@ name: hotfix
 description: Promote a merged development fix to main and production via the Hub train.
 ---
 
-**Host-native invocation:** Claude `/mmi:hotfix` · Codex `$mmi:hotfix` · jervcode `/hotfix` · Hermes skill_view.
+**Host-native invocation:** Claude `/mmi:hotfix` · Codex `$mmi:hotfix` · jervcode `/hotfix`.
 
 **Argument:** none; PATCH-only (leave `MMI_BUMP_INTENT`, `MMI_RELEASE_VERSION` unset).
 
@@ -29,7 +29,15 @@ mmi-cli devops train doctor --lane hotfix --heal --json
 
 Parse stdout only; never `2>&1`. `ready` false → stop and quote every blocker's `code` and `remedy`; an unread origin is never green. Findings carry `code`, `severity`, `source`, `remedy`, `anchor`.
 
-Piping `mmi-cli devops api get` into a JSON parser: a refusal exits 1 with empty stdout, so guard both: `out=$(MMI_ACTOR=app mmi-cli devops api get <path>) && [ -n "$out" ] && printf '%s' "$out" | node -e '…'`. One job's metadata: read the allowlisted `repos/{owner}/{repo}/actions/runs/{id}/jobs` and filter `jobs[]` by `id`; `actions/jobs/{id}` is refused (only its `/logs`, with `--out`).
+Piping `mmi-cli devops api get` into a JSON parser: a refusal exits 1 with empty stdout, so guard both exit status and nonempty output. For one job's runner and timestamps, read the allowlisted `repos/{owner}/{repo}/actions/runs/{id}/jobs` and filter `jobs[]` by `id`; `actions/jobs/{id}` is refused (only its `/logs`, with `--out`). Do not retry that refused endpoint or broaden the allowlist.
+
+```bash
+# Set repo, run_id and job_id to the target repository, run and job.
+out=$(MMI_ACTOR=app mmi-cli devops api get "repos/$repo/actions/runs/$run_id/jobs") &&
+  [ -n "$out" ] && printf '%s' "$out" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const j=JSON.parse(s).jobs.find(j=>String(j.id)===process.argv[1]);if(!j)throw new Error("Job not found in run jobs");console.log(JSON.stringify({runner_name:j.runner_name,started_at:j.started_at,completed_at:j.completed_at,conclusion:j.conclusion}))})' "$job_id"
+```
+
+Do not parse stdout after a failing read, suppress its stderr, or merge stderr into the JSON.
 
 ## Apply
 

package/skills/mmi-help/SKILL.md

@@ -6,7 +6,7 @@ description: Introduce MMI and its commands.
 # MMI help
 
 This is the MMI help command: Claude `/mmi:mmi-help`, Codex `$mmi:mmi-help`, JervCode
-`/mmi-help`, or Hermes `skill_view(name='mmi-help')`. These are host skill invocations, not shell
+`/mmi-help`, or OpenBot `use the mmi-help skill`. These are host skill invocations, not shell
 commands. The distinct name avoids colliding with a host's built-in help command.
 
 Read the [org guide entry](../org-guide/SKILL.md) and

package/skills/org-guide/references/getting-started.md

@@ -19,11 +19,10 @@ also keeps the one-line installer's launcher current when one is installed.
 `mmi-hub install --dry-run` previews changes without enabling the schedule.
 
 Complete the host's trust and reload step: reload plugins or restart Claude Code, restart Codex,
-restart JervCode, or start a fresh Hermes process. An existing session
-may still hold the old skill catalog until then. The updater manages the MMI plugin on each
-supported host present on the machine, and on Hermes that means every profile home as well as the
-default one; each running profile needs its own fresh process. It does not grant repository or
-vault access.
+restart JervCode, or start a fresh OpenBot agent run. An existing session may still hold the old skill
+catalog until then. The updater manages the MMI plugin on each supported host present on the machine.
+On OpenBot it copies the skills into each agent workspace's `.agents/skills`, leaving any skill folder
+it did not install in place and reporting it. It does not grant repository or vault access.
 
 Authenticate GitHub for your assigned repository. In its checkout, run `mmi-cli onboard` for
 readiness and `mmi-cli oracle board read` for work. Use `mmi-cli commands --json` to discover routes

package/skills/org-guide/references/work-and-releases.md

@@ -4,7 +4,8 @@ GitHub repository admins hold project-admin authority on their own projects with
 registry enrollment. Registry-listed admins with repository write access remain supported.
 Use `mmi-cli oracle org access role <owner/repo> --json` to verify authority for release,
 candidate, hotfix, and runtime operations. Organization membership role alone is not this check.
-The Hub distribution train remains organization-master-only.
+The Hub distribution train remains organization-master-only. It runs in the `hub-release` workflow on
+our self-hosted runners, dispatched by an org owner, never on a workstation (#9137).
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is
 not a denial: wait for the reset time it names, then retry.
 
@@ -18,11 +19,20 @@ Use host worktrees and MMI cleanup; no personal Jerv is required. At handoff, st
 session; never copy them forward from an earlier handoff, even labelled unverified (#9039).
 Report skill misfires to Hub
 with `mmi-cli learning skill-lesson --skill <name> --title <summary> --body-file <path>`.
-Under the App pool,
+Under the App pool, on raw `gh`
 `--jq`/`-q`/`--template`/`--web` are refused: use
 `MMI_ACTOR=app mmi-cli devops read issue view <id> --repo <owner/repo> --json comments`
 (or `pr`/`run view` with their fields); filter returned JSON locally, e.g. by adding
 `--jq '<expr>'` to that typed read (runs the local jq, never inside gh).
+For the last N comments (here, 3), use the typed JSON read with local filtering, not raw gh formatters:
+```bash
+MMI_ACTOR=app mmi-cli devops read issue view <id> --repo <owner/repo> --json comments --jq '.comments[-3:][] | {createdAt, body}'
+```
+PR lists take the same shape — `read pr list` answers a `--head <branch>` PR lookup that raw
+`gh pr list --jq` bounces on, and its `--jq` also runs locally:
+```bash
+MMI_ACTOR=app mmi-cli devops read pr list --repo <owner/repo> --head <branch> --json number,state,title,headRefName,baseRefName --jq '.[] | {number,state,title,headRefName,baseRefName}'
+```
 For run logs, never native `gh run view --log`/`--log-failed`: use
 `MMI_ACTOR=app mmi-cli devops read run log <runId> --repo <owner/repo> [--failed | --job <name>] [--tail N]`.
 A refused command writes no output, so a `> file` redirect leaves it empty or missing: read the

package/skills/rcand/SKILL.md

@@ -3,7 +3,7 @@ name: rcand
 description: Promote development to a release candidate.
 ---
 
-**Host-native invocation:** Claude `/mmi:rcand` · Codex `$mmi:rcand` · jervcode `/rcand` · Hermes skill_view.
+**Host-native invocation:** Claude `/mmi:rcand` · Codex `$mmi:rcand` · jervcode `/rcand`.
 
 **Argument:** `/rcand minor|major|patch` — a bare bump word, never a flag or env var; none → `patch`.
 

package/skills/release/SKILL.md

@@ -3,7 +3,7 @@ name: release
 description: Ship rc or direct-track development to main and production.
 ---
 
-**Host-native invocation:** Claude `/mmi:release` · Codex `$mmi:release` · jervcode `/release` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:release` · Codex `$mmi:release` · jervcode `/release`. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 # /release — ship to main + prod
 
@@ -27,6 +27,8 @@ mktemp .jerv/tmp/release-receipt.XXXXXX
 mmi-cli devops release --apply --watch --announce-summary-file "<summary-path>" --json --out "<result-path>"
 ```
 
+MMI-Hub itself releases through the `hub-release` workflow instead: an org owner runs `gh workflow run hub-release.yml --repo mutmutco/MMI-Hub --ref development -f summary='line | line | line'` and watches that run; never build a Hub release on a workstation.
+
 Run mktemp alone, copy its path; no channel: drop the summary flag. `mmi-cli devops release --apply --ack <sha>` only for a verified main-only commit the hotfix-coverage guard refused. It runs the version fold (automatic, inside `mmi-cli devops release --apply`) bumping manifests unconditionally, pushes the tag first (`gate.yml` runs on `v*` tags), deploys (`tenant-deploy.yml` for tenant-container), announces. Nothing by hand.
 
 ## Verify

package/skills/secrets/SKILL.md

@@ -3,7 +3,7 @@ name: secrets
 description: Manage the project vault and granted org-infra secrets.
 ---
 
-**Host-native invocation:** Claude `/mmi:secrets` · Codex `$mmi:secrets` · jervcode `/secrets` · Hermes skill_view. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
+**Host-native invocation:** Claude `/mmi:secrets` · Codex `$mmi:secrets` · jervcode `/secrets`. A backticked `/name` in this doc names the matching workflow (this skill or a sibling), not a literal command.
 
 # /secrets — two-tier project secrets