@mutmutco/codex-plugin 4.5.61 → 4.5.63

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.61",
+  "version": "4.5.63",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.61",
+  "version": "4.5.63",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -383,7 +383,8 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   under the org **wall-clock budget** (#3178): the render pins `run-with-budget` to the CLI's blessed SHA
   with `--var GATE_MAX_SECONDS=` (300s onboarding default — tighten once the gate is measured, via
   `--var` or `org project set <repo> --var gate={"maxSeconds":N}`); `ci audit` and the release train
-  both enforce the step, so do not remove it. Every trigger runs the full `GATE_CMD`. A repo whose checks
+  both enforce the step, so do not remove it. The tenant-container product image build (#7542)
+  shares that ceiling — no separate knob. Every trigger runs the full `GATE_CMD`. A repo whose checks
   need a service container or an extra budgeted step declares them in its registry gate config, never by
   hand-editing the rendered gate (#7407): `gate.services` is keyed by service name with `image`, `env`,
   `ports`, one-line `options` and `tmpfs` paths; `gate.steps` is a list of `{name, command, env,

package/skills/bootstrap/seeds/gate.template.yml

@@ -48,6 +48,9 @@ concurrency:
 
 permissions:
   contents: read
+  # MMI-Hub#7542: the product image build below reads org private packages with the workflow's
+  # own ephemeral token (NODE_AUTH_TOKEN) — the same reader the central deploy uses.
+  packages: read
 
 jobs:
   gate:
@@ -94,6 +97,39 @@ jobs:
             done < "$offenders"
             exit 1
           fi
+      # MMI-Hub#7542: build the product image in the gate. The post-merge deploy builds the
+      # product's own docker-compose.yml (`docker compose up --build` on the box); nothing in the
+      # gate did, so MMI-Scout#301 merged green and turned the next dev deploy red (exit 70) when
+      # its Dockerfile ran a test-only entry the image never received. `docker compose build`
+      # reuses the deploy's OWN build definition — context, dockerfile, args, target — so a
+      # Dockerfile/compose break fails this required `gate` job before the merge instead of the dev
+      # deploy after it. Tenant-container only: repos without the deploy's pre-flighted runtime
+      # files (Dockerfile + docker-compose.yml) skip in a second — no new job, no new required
+      # context, no ruleset or registry change (#7012 needs nothing to cover).
+      - name: Product image build (tenant-container only)
+        env:
+          # The documented build-secret opt-in (compose `build.secrets` + registry
+          # requiredBuildSecrets `NODE_AUTH_TOKEN=@github-packages-token`): the workflow's own
+          # ephemeral token reads org private packages — the same reader the central deploy
+          # uses. Repos whose compose never references it never consume it.
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
+        with:
+          # Build-only: no push, no run, no published ports. The absolute -f keeps a non-root
+          # GATE_WORKDIR building the repo-root compose the deploy ships; relative build contexts
+          # inside that file resolve against its own directory, exactly as on the box. Layer cache
+          # is the runner-local dockerd shared across the host's mmi-live lanes — the same
+          # local-cache model the box-side `up --build` relies on, so warm PRs pay seconds.
+          command: |
+            if [ ! -f "$GITHUB_WORKSPACE/Dockerfile" ] || [ ! -f "$GITHUB_WORKSPACE/docker-compose.yml" ]; then
+              echo "no tenant-container runtime files (Dockerfile + docker-compose.yml) — skipping product image build"
+              exit 0
+            fi
+            docker compose version >/dev/null 2>&1 || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — 'docker compose' not on PATH. This is the runner, not your diff; no image was built. Re-run the job; if it persists the mmi-runner docker toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
+            docker compose -f "$GITHUB_WORKSPACE/docker-compose.yml" build
+          max-seconds: {{GATE_MAX_SECONDS}}
+          label: product image build
+          working-directory: {{GATE_WORKDIR}}
       # #5660: self-hosted gates opt OUT of setup-node automatic npm cache restore unless a bounded
       # cache policy is declared on runner-node-toolchain (cache + cache-restore-max-mb). Per-job
       # NPM_CONFIG_CACHE above is the org default; unbounded Actions cache blobs can exhaust mmi-live