@mutmutco/codex-plugin 4.5.234 → 4.5.236

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.234",
+  "version": "4.5.236",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -1216,6 +1216,8 @@ var init_house_map = __esm({
       // allowlisted GitHub REST GET reads for automation (pull files, compare, contents)
       ci: "devops",
       // the CI/gate audit
+      jev: "devops",
+      // #9295: read-only status of the Hub-maintained Jev test-ordering learner
       rcand: "devops",
       release: "devops",
       hotfix: "devops",
@@ -25116,6 +25118,7 @@ function createDocsIndexDeps(repoRoot2) {
 var BLESSED_RUN_WITH_BUDGET_SHA = "5ce541add569e54e7ca96de67a768577d3d604e4";
 var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
 var BLESSED_KIT_AGENT_FILES_SHA = "a8b273ed418e703c0aa501a53ea87228ba28b1f0";
+var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
 var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
@@ -25498,7 +25501,9 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     GATE_RUNBOOK_SHA: BLESSED_RUNBOOK_GUARD_SHA,
     // #7407: repo-declared service containers and extra check steps; empty renders today's gate byte-for-byte.
     GATE_SERVICES_YAML: "",
-    GATE_EXTRA_STEPS_YAML: ""
+    GATE_EXTRA_STEPS_YAML: "",
+    // #9293: Jev failure-memory fetch/report steps from the blessed jev-failures pin (an empty pin renders none).
+    ...gateJevStepsYaml(BLESSED_JEV_FAILURES_SHA, runtime)
   };
   const track = releaseTrack ?? (cls === "content" ? "trunk" : "full");
   const trackBranches = track === "trunk" ? ["main"] : track === "single" ? ["development"] : track === "direct" ? ["development", "main"] : ["development", "rc", "main"];
@@ -25647,6 +25652,39 @@ function gateServicesYaml(services) {
   }
   return out;
 }
+function gateJevStepsYaml(sha, runtime = "node") {
+  if (!/^[0-9a-f]{40}$/.test(sha)) return { GATE_JEV_FETCH_YAML: "", GATE_JEV_REPORT_YAML: "" };
+  const listFiles = runtime === "python" ? `git ls-files -z -- 'test_*.py' '*_test.py' | python3 -c "import sys,json;print(json.dumps([p for p in sys.stdin.read().split(chr(0)) if p]))" > .jerv/jev-test-files.json` : `git ls-files -z -- '*.test.*' '*.spec.*' | node -e "process.stdout.write(JSON.stringify(require('fs').readFileSync(0,'utf8').split('\\0').filter(Boolean)))" > .jerv/jev-test-files.json`;
+  const listStep = [
+    "\n      - name: List test files for the Jev plan",
+    "\n        if: ${{ steps.development-gate.outputs.reuse != 'true' }}",
+    "\n        continue-on-error: true",
+    "\n        timeout-minutes: 1",
+    `
+        run: mkdir -p .jerv && ${listFiles}`
+  ].join("");
+  const step = (name, cond, mode) => [
+    `
+      - name: ${name}`,
+    `
+        if: \${{ ${cond}steps.development-gate.outputs.reuse != 'true' }}`,
+    "\n        continue-on-error: true",
+    "\n        timeout-minutes: 1",
+    `
+        uses: mutmutco/MMI-Hub/.github/actions/jev-failures@${sha}`,
+    "\n        with:",
+    `
+          mode: ${mode}`,
+    mode === "outcomes" ? `
+          report-format: ${runtime === "python" ? "junit-xml" : "vitest-json"}` : "",
+    mode === "plan" ? "\n          plan-files: .jerv/jev-test-files.json" : "",
+    "\n          token: ${{ github.token }}"
+  ].join("");
+  return {
+    GATE_JEV_FETCH_YAML: step("Fetch Jev recent failures (empty on any fault)", "", "fetch") + listStep + step("Plan Jev test order and PR-only skips (full order on any fault)", "", "plan"),
+    GATE_JEV_REPORT_YAML: step("Report test outcomes to Jev", "always() && ", "outcomes")
+  };
+}
 function gateExtraStepsYaml(steps) {
   return steps.map((step) => [
     `
@@ -27242,10 +27280,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.234",
-    tag: "v4.5.234",
-    commit: "60e52d3f566e",
-    npm: "@mutmutco/cli@4.5.234"
+    version: "4.5.236",
+    tag: "v4.5.236",
+    commit: "b28d6f0940ce",
+    npm: "@mutmutco/cli@4.5.236"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27262,14 +27300,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.234"
+          v3Target: "v4.5.236"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.234 and redeploy the Hub Lambda from tag v4.5.234 (60e52d3f566e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.234 (@mutmutco/cli@4.5.234, tag commit 60e52d3f566e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.236 and redeploy the Hub Lambda from tag v4.5.236 (b28d6f0940ce); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.236 (@mutmutco/cli@4.5.236, tag commit b28d6f0940ce \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -38291,6 +38329,7 @@ function registryRepoKey(repo) {
 }
 
 // src/ci-audit.ts
+var import_yaml2 = __toESM(require_dist(), 1);
 var HUB_REPO4 = "mutmutco/MMI-Hub";
 var HUB_GATE_CONTEXTS = ["cli", "infra", "docs"];
 var PRODUCT_GATE_PATH = ".github/workflows/gate.yml";
@@ -38357,6 +38396,127 @@ function auditRunnerFallbacks(repo, files, closure) {
     remediation: f.cost === "hosted" || f.cost === "unknown" ? "Resolve source reads and unsupported selectors/callees; preserve checks and artifacts. See gh-runner-runbook.md." : void 0
   }));
 }
+var LIVE_SELF_HOSTED_LINUX_LABELS = /* @__PURE__ */ new Set([
+  "self-hosted",
+  "linux",
+  "x64",
+  "mmi-live",
+  "mmi-heavy",
+  "mmi-bare-metal",
+  "mmi-journeys",
+  "mmi-deploy",
+  "mmi-browser"
+]);
+var NON_LINUX_RUNNER_LABEL = /^(?:macos|windows|arm64)$/i;
+var NODE_SETUP_USE = /(?:^|\/)(?:actions\/setup-node|runner-node-toolchain)(?:@|$)/;
+var RUNS_NODE = /(?:^|[\s;&|(`])(?:node|npm|npx)(?=\s|$)/m;
+var plainRecord = (value) => Boolean(value && typeof value === "object" && !Array.isArray(value));
+function runsOnLabelSets(job) {
+  const toSet = (value) => typeof value === "string" ? [value] : Array.isArray(value) && value.every((l) => typeof l === "string") ? value : void 0;
+  let selector = job["runs-on"];
+  if (plainRecord(selector)) selector = selector.labels;
+  if (typeof selector !== "string" || !selector.includes("${{")) return [toSet(selector)].filter((s) => Boolean(s));
+  const sets = [];
+  for (const m of selector.matchAll(/fromJSON\('([^']+)'\)/g)) {
+    try {
+      const parsed = toSet(JSON.parse(m[1]));
+      if (parsed) sets.push(parsed);
+    } catch {
+    }
+  }
+  const axis = /^\$\{\{\s*matrix\.([\w-]+)\s*\}\}$/.exec(selector.trim())?.[1];
+  const matrix = plainRecord(job.strategy) && plainRecord(job.strategy.matrix) ? job.strategy.matrix : void 0;
+  if (axis && matrix && Array.isArray(matrix[axis])) for (const value of matrix[axis]) {
+    const s = toSet(value);
+    if (s) sets.push(s);
+  }
+  return sets;
+}
+function auditSelfHostedRunnerHygiene(files) {
+  const checks = [];
+  for (const { path: path2, body } of files) {
+    let doc;
+    try {
+      doc = (0, import_yaml2.parse)(body);
+    } catch {
+      continue;
+    }
+    const jobs = plainRecord(doc) && plainRecord(doc.jobs) ? doc.jobs : {};
+    for (const [id, job] of Object.entries(jobs)) {
+      if (!plainRecord(job)) continue;
+      const linuxSets = runsOnLabelSets(job).filter((set) => set.some((l) => l.toLowerCase() === "self-hosted") && !set.some((l) => NON_LINUX_RUNNER_LABEL.test(l)));
+      if (!linuxSets.length) continue;
+      const stale = [...new Set(linuxSets.flat().filter((l) => !LIVE_SELF_HOSTED_LINUX_LABELS.has(l.toLowerCase())))];
+      if (stale.length) {
+        checks.push({
+          ok: false,
+          label: `self-hosted job requests only live runner labels (#9293): ${path2}:${id}`,
+          detail: stale.map((l) => /^mmi-runner/i.test(l) ? `'${l}' is a host pin \u2014 route by class label, never hostname` : `'${l}' is carried by no live lane`).join("; "),
+          remediation: `Use ubuntu-latest, or a live class tuple such as [self-hosted, linux, x64, mmi-live]. Live labels: ${[...LIVE_SELF_HOSTED_LINUX_LABELS].join(", ")} (gh-runner-runbook.md \xA7 Lane classes).`
+        });
+      }
+      if (job.container !== void 0 || !Array.isArray(job.steps)) continue;
+      for (const [index, step] of job.steps.entries()) {
+        if (!plainRecord(step)) continue;
+        const uses = typeof step.uses === "string" ? step.uses : "";
+        if (NODE_SETUP_USE.test(uses)) break;
+        const command = typeof step.run === "string" ? step.run : uses.includes("run-with-budget") && plainRecord(step.with) && typeof step.with.command === "string" ? step.with.command : "";
+        if (!RUNS_NODE.test(command)) continue;
+        checks.push({
+          ok: true,
+          severity: "warn",
+          label: `self-hosted job sets up node before running it (#9293): ${path2}:${id}`,
+          detail: `step ${index + 1}${typeof step.name === "string" ? ` ('${step.name}')` : ""} runs node/npm/npx before any actions/setup-node or runner-node-toolchain step \u2014 it gets whatever node the lane's PATH has`,
+          remediation: "Add mutmutco/MMI-Hub/.github/actions/runner-node-toolchain (or actions/setup-node) before the first node command, or run the job on ubuntu-latest."
+        });
+        break;
+      }
+    }
+  }
+  return checks;
+}
+var RUNS_TESTS = /(?:^|[\s;&|(`])(?:vitest|jest|pytest|npm\s+(?:run\s+)?test|npm\s+t|npx\s+(?:vitest|jest)|node\s+--test|mmi-cli\s+tests\b|ci-jev-tests)(?=\s|$)/m;
+var JEV_ACTION = /(?:^|\/)\.github\/actions\/jev-failures@?([0-9a-fA-F]*)/;
+function auditJevOutcomes(files) {
+  const checks = [];
+  for (const { path: path2, body } of files) {
+    let doc;
+    try {
+      doc = (0, import_yaml2.parse)(body);
+    } catch {
+      continue;
+    }
+    const jobs = plainRecord(doc) && plainRecord(doc.jobs) ? doc.jobs : {};
+    for (const [id, job] of Object.entries(jobs)) {
+      if (!plainRecord(job) || !Array.isArray(job.steps)) continue;
+      const steps = job.steps.filter(plainRecord);
+      const stepCommand = (s) => typeof s.run === "string" ? s.run : typeof s.uses === "string" && s.uses.includes("run-with-budget") && plainRecord(s.with) && typeof s.with.command === "string" ? s.with.command : "";
+      const jev = steps.filter((s) => typeof s.uses === "string" && JEV_ACTION.test(s.uses));
+      const reports = jev.some((s) => plainRecord(s.with) && s.with.mode === "outcomes" && /\balways\(\)/.test(String(s.if ?? "")));
+      if (!reports && steps.some((s) => RUNS_TESTS.test(stepCommand(s)))) {
+        checks.push({
+          ok: true,
+          severity: "warn",
+          label: `test job reports outcomes to the Jev learner (#9295): ${path2}:${id}`,
+          detail: "this job runs tests but has no jev-failures step with mode: outcomes and if: always(), so the Hub learns nothing from it and cannot order or skip its tests",
+          remediation: `Add after the test step: uses: mutmutco/MMI-Hub/.github/actions/jev-failures@${BLESSED_JEV_FAILURES_SHA} with mode: outcomes and if: always() - see skills/bootstrap/seeds/gate.template.yml`
+        });
+      }
+      for (const s of jev) {
+        const sha = JEV_ACTION.exec(String(s.uses))?.[1]?.toLowerCase();
+        if (!sha || sha === BLESSED_JEV_FAILURES_SHA) continue;
+        checks.push({
+          ok: true,
+          severity: "warn",
+          label: `jev-failures pin is the blessed SHA (#9295): ${path2}:${id}`,
+          detail: `pins ${sha.slice(0, 7)}, blessed is ${BLESSED_JEV_FAILURES_SHA.slice(0, 7)}`,
+          remediation: `Re-pin to mutmutco/MMI-Hub/.github/actions/jev-failures@${BLESSED_JEV_FAILURES_SHA}`
+        });
+      }
+    }
+  }
+  return checks;
+}
 var PENDING_LANDING_LABEL = "pending PRs landing (#8783)";
 var PENDING_LANDING_LIST_CAP = 50;
 var PENDING_LANDING_STALL_MS = 15 * 60 * 1e3;
@@ -39150,6 +39310,8 @@ async function auditRepoCi(repo, callerDeps) {
       } catch (e) {
         checks.push({ ok: false, label: "runner workflow source is readable (#8958)", detail: e instanceof WorkflowSourceError ? e.message : "workflow source: read-failed" });
       }
+      checks.push(...auditSelfHostedRunnerHygiene(workflows));
+      checks.push(...auditJevOutcomes(workflows));
       if (repoClass !== "hub") checks.push(...await auditSharedActionPins(workflows, deps));
     } else {
       checks.push({ ok: false, label: "runner workflow source is readable (#8958)", detail: "workflow source inventory unreadable" });
@@ -39845,7 +40007,7 @@ var PRIMARY_GROUPS = [
   ["Setup and support", ["bootstrap", "secrets", "docs", "tests", "spawn", "dist"]],
   ["Coordinate and improve", ["wave", "report", "skill-lesson", "closure-rate"]]
 ];
-var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["oauth", "org", "runtime", "plugin", "packages", "github", "archive-prune", "intercom"]);
+var OPERATIONAL_TOP_LEVEL = /* @__PURE__ */ new Set(["oauth", "org", "runtime", "plugin", "packages", "github", "archive-prune", "intercom", "jev"]);
 var CAMPAIGN_ORCHESTRATOR_TOP_LEVEL = /* @__PURE__ */ new Set(["pickup", "read"]);
 var SUPPORT_PRIMARY = /* @__PURE__ */ new Set(["doctor", "whoami", "commands", "explain", "docs", "tests", "spawn", "dist", "wave", "report", "skill-lesson", "closure-rate"]);
 var TOP_LEVEL_ORDER = /* @__PURE__ */ new Map();
@@ -39899,6 +40061,8 @@ var COMMAND_OWNERSHIP = {
   train: { module_owner: "cli/src/train-commands.ts", consumer: "release-operator" },
   suite: { module_owner: "cli/src/suite-commands.ts", consumer: "release-operator" },
   // #7264
+  jev: { module_owner: "cli/src/jev-status.ts", consumer: "release-operator" },
+  // #9295
   packages: { module_owner: "cli/src/packages-adopt-export.ts", consumer: "agent-workflow" },
   // #7833
   bootstrap: { module_owner: "cli/src/bootstrap-commands.ts", consumer: "repo-bootstrap" },
@@ -61027,6 +61191,52 @@ function suiteStatusDeps(github, registry2) {
   };
 }
 
+// src/jev-status.ts
+init_cli_shared();
+init_fetch_retry();
+init_client_version();
+var JEV_NOT_DEPLOYED = "learner status not deployed yet (the Hub has no /ci/jev/status route)";
+async function readJevStatus(deps, repo) {
+  if (!deps.baseUrl) return { ok: false, reason: "unavailable", detail: "no Hub API URL" };
+  const token = await deps.token().catch(() => void 0);
+  if (!token) return { ok: false, reason: "unavailable", detail: "no Hub session token (run `gh auth login`)" };
+  try {
+    const res = await fetchWithRetry(deps.fetch ?? fetch, `${deps.baseUrl.replace(/\/$/, "")}/ci/jev/status`, {
+      method: "GET",
+      headers: { ...clientVersionHeaders(), Authorization: `Bearer ${token}` }
+    }, { attempts: 2, timeoutMs: deps.timeoutMs ?? 8e3, sleep: deps.retrySleep });
+    if (res.status === 404) return { ok: false, reason: "not-deployed", detail: JEV_NOT_DEPLOYED };
+    if (!res.ok) return { ok: false, reason: "unavailable", detail: `Hub answered HTTP ${res.status}` };
+    const body = await res.json().catch(() => null);
+    const repos = body?.repositories;
+    if (!Array.isArray(repos)) return { ok: false, reason: "unavailable", detail: "Hub answer was not a repo list" };
+    return { ok: true, repos: repo ? repos.filter((r) => r.repository.toLowerCase() === repo.toLowerCase()) : repos };
+  } catch (e) {
+    return { ok: false, reason: "unavailable", detail: e.message };
+  }
+}
+var pct = (n) => `${Math.round(n * 1e3) / 10}%`;
+function formatJevStatus(read) {
+  if (!read.ok) return read.reason === "not-deployed" ? `Jev: ${read.detail}.` : `Jev: learner status unavailable - ${read.detail}.`;
+  if (!read.repos.length) return "Jev: the learner has not learned from any repo yet.";
+  return read.repos.map((r) => {
+    const gain = r.medianFirstFailureGain == null ? "first-failure gain not measured yet" : `first failure ${pct(r.medianFirstFailureGain)} earlier (median)`;
+    const shadow = r.shadow.active ? `skipping on PRs is ON (miss rate ${pct(r.shadow.missRate)} over ${r.shadow.runs} shadow runs)` : `skipping on PRs is OFF (${r.shadow.runs} shadow runs, miss rate ${pct(r.shadow.missRate)}; needs 30 runs at 1% or less)`;
+    return `${r.repository}: learned from ${r.runsLearned} runs, ${r.filesTracked} test files; ${shadow}; ${r.prSkipShare30d == null ? "no PR runs in 30 days" : `${pct(r.prSkipShare30d)} of PR tests skipped in 30 days`}; ${gain}; updated ${r.updatedAt ? new Date(r.updatedAt).toISOString() : "never"}`;
+  }).join("\n");
+}
+function registerJevCommands(program3) {
+  const jev = program3.command("jev").description("the Hub-maintained Jev test-ordering learner, read-only (#9295)");
+  jev.command("status").description("per repo: runs learned, whether PR skipping is on, miss rate, skip share, first-failure gain, last update").option("--repo <owner/repo>", "one repo only").option("--json", "structured output").action(async (o) => {
+    try {
+      const read = await readJevStatus(registryClientDeps(await loadConfig()), o.repo);
+      console.log(o.json ? JSON.stringify(read, null, 2) : formatJevStatus(read));
+    } catch (e) {
+      fail(`jev status: ${e.message}`);
+    }
+  });
+}
+
 // src/packages-adopt-export.ts
 var import_node_child_process19 = require("node:child_process");
 var import_node_fs53 = require("node:fs");
@@ -69452,6 +69662,7 @@ registerDeployCommands(program2);
 registerSuiteCommands(program2);
 registerIntercomGuestCommands(program2);
 registerPackagesCommands(program2);
+registerJevCommands(program2);
 registerDiscoveryCommands(program2);
 registerExplainCommand(program2);
 registerPrLifecycleCommands(program2);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.234",
+  "version": "4.5.236",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.234",
+  "version": "4.5.236",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -207,12 +207,24 @@ jobs:
         run: |
           python3 --version || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — python3 not on PATH after setup-python. This is the runner, not your diff; no install or test ran. Re-run the job; if it persists the mmi-runner python toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
       - run: {{GATE_INSTALL_CMD}}
-        if: ${{ steps.development-gate.outputs.reuse != 'true' }}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}{{GATE_JEV_FETCH_YAML}}
       # #3178: the check runs under the org wall-clock budget — a hung suite dies at the ceiling instead
       # of squatting a runner lane for GitHub's 6h default. ci-audit + the release train enforce this step.
+      # #9293: PRs fail fast, merge_group and tags run everything. pytest reads PYTEST_ADDOPTS natively; a
+      # Node check script opts in with MMI_FAIL_FAST (`vitest run ${MMI_FAIL_FAST:+--bail=1}`, or
+      # `--fail-fast` on the org node runner). #9295: on PRs the Jev plan step exports JEV_PYTEST_ARGS
+      # (`--ignore=<path>` per skipped file, folded into PYTEST_ADDOPTS) and JEV_VITEST_ARGS; a Node check script
+      # opts in to the skips with `vitest run ${MMI_FAIL_FAST:+--bail=1} $MMI_JEV_SKIP_ARGS`. The merge queue
+      # never skips. The Jev fetch/plan/outcomes steps around this one (#9295) render
+      # only once bootstrap carries a blessed jev-failures pin; they are continue-on-error and never fail it. The
+      # outcomes step runs under always() (pass or fail).
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
+        env:
+          MMI_FAIL_FAST: ${{ github.event_name == 'pull_request' && '1' || '' }}
+          PYTEST_ADDOPTS: ${{ github.event_name == 'pull_request' && format('--maxfail=1 {0}', env.JEV_PYTEST_ARGS) || '' }}
+          MMI_JEV_SKIP_ARGS: ${{ github.event_name == 'pull_request' && env.JEV_VITEST_ARGS || '' }}
         with:
           command: {{GATE_CMD}}
           max-seconds: {{GATE_MAX_SECONDS}}
-          working-directory: {{GATE_WORKDIR}}{{GATE_EXTRA_STEPS_YAML}}
+          working-directory: {{GATE_WORKDIR}}{{GATE_EXTRA_STEPS_YAML}}{{GATE_JEV_REPORT_YAML}}

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -78,10 +78,15 @@ jobs:
       # Suite only: generic product gates must not load or require design-agent content.
       - name: Check kit agent-file drift
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
-        uses: mutmutco/MMI-Hub/.github/actions/check-kit-agent-files@{{KIT_AGENT_FILES_SHA}} # #9161: own pin — this action postdates the shared runner pin
+        uses: mutmutco/MMI-Hub/.github/actions/check-kit-agent-files@{{KIT_AGENT_FILES_SHA}} # #9161: own pin — this action postdates the shared runner pin{{GATE_JEV_FETCH_YAML}}
+      # #9293: PRs fail fast (the module check reads MMI_FAIL_FAST); merge_group and tags run everything.
+      # #9295: a module check opts in to Jev PR-only skips with `vitest run $MMI_JEV_SKIP_ARGS` (set on PRs only).
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
+        env:
+          MMI_FAIL_FAST: ${{ github.event_name == 'pull_request' && '1' || '' }}
+          MMI_JEV_SKIP_ARGS: ${{ github.event_name == 'pull_request' && env.JEV_VITEST_ARGS || '' }}
         with:
           command: npm run typecheck && npm run build && npm --prefix module run check
           max-seconds: {{GATE_MAX_SECONDS}}
-          working-directory: .
+          working-directory: .{{GATE_JEV_REPORT_YAML}}