@mutmutco/codex-plugin 4.5.96 → 4.5.98

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.96",
+  "version": "4.5.98",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -5927,7 +5927,7 @@ async function waitForPrChecks(deps) {
       reason = NO_CI_LIVE_CHECKS_CONTRADICTION_REASON;
       deps.log?.(`merge CI policy contradiction: ${reason}; waiting for live PR checks`);
       policy = "wait-for-checks";
-      queuedStates.push(firstState);
+      if (!deps.pollChecksWithEvidence) queuedStates.push(firstState);
     } catch (e) {
       if (!isRetryableGitHubWaitReadError(e)) {
         return { policy, status: "failure", reason: waitReadFailureMessage(e), detail: "github-read-failed" };
@@ -5955,6 +5955,8 @@ async function waitForPrChecks(deps) {
   let successStreak = 0;
   let failureStreak = 0;
   let zeroRunsStreak = 0;
+  let evidenceHeadSha;
+  let lastEvidence;
   report("starting");
   while (now() < deadline) {
     if (deps.pollRateLimit) {
@@ -5986,7 +5988,17 @@ async function waitForPrChecks(deps) {
     }
     let state;
     try {
-      state = queuedStates.shift() ?? await deps.pollChecks();
+      if (queuedStates.length) state = queuedStates.shift();
+      else if (deps.pollChecksWithEvidence) {
+        lastEvidence = await deps.pollChecksWithEvidence();
+        if (evidenceHeadSha !== void 0 && evidenceHeadSha !== lastEvidence.headSha) {
+          successStreak = 0;
+          failureStreak = 0;
+          zeroRunsStreak = 0;
+        }
+        evidenceHeadSha = lastEvidence.headSha;
+        state = lastEvidence.state;
+      } else state = await deps.pollChecks();
     } catch (e) {
       if (!isRetryableGitHubWaitReadError(e)) {
         return { policy, status: "failure", reason: waitReadFailureMessage(e), detail: "github-read-failed", waitedMs: now() - started };
@@ -6032,7 +6044,13 @@ async function waitForPrChecks(deps) {
     if (state === "success") {
       successStreak += 1;
       if (successStreak >= PR_CHECKS_SUCCESS_CONFIRMATIONS) {
-        return { policy, status: "success", reason, detail: "checks-success" };
+        return {
+          policy,
+          status: "success",
+          reason,
+          detail: "checks-success",
+          ...lastEvidence ? { headSha: lastEvidence.headSha, checks: lastEvidence.checks, workflowRuns: lastEvidence.workflows } : {}
+        };
       }
       lastDetail = "confirming-success";
       await deps.sleep(PR_CHECKS_CONFIRM_MS);
@@ -6347,6 +6365,36 @@ async function pollRestPrChecks(prNumber, repo, gh2 = defaultGhApi, requiredCont
   const { relevant } = partitionByRequired(entries, requiredContexts);
   return derivePollState(relevant);
 }
+async function pollRestPrChecksWithWorkflowEvidence(prNumber, repo, gh2 = defaultGhApi) {
+  const snapshot = await fetchRestPrSnapshot(prNumber, repo, gh2);
+  const [entries, rawRuns] = await Promise.all([
+    fetchHeadCheckEntries(snapshot.headSha, repo, gh2),
+    gh2(["--paginate", `repos/${repo}/actions/runs?head_sha=${encodeURIComponent(snapshot.headSha)}&per_page=100`, "--jq", ".workflow_runs[] | {id, name, head_sha, status, conclusion, html_url}"])
+  ]);
+  const checks = entries.filter((entry) => !AUXILIARY_RELEASE_CHECK_CONTEXTS.has(entry.name)).map((entry) => ({ name: entry.name, state: entry.bucket }));
+  const workflows = parseNdjsonLines(rawRuns).flatMap((run) => {
+    if (run.head_sha !== snapshot.headSha || typeof run.id !== "number" || typeof run.name !== "string" || typeof run.status !== "string") return [];
+    if (AUXILIARY_RELEASE_CHECK_CONTEXTS.has(run.name)) return [];
+    return [{
+      id: run.id,
+      name: run.name,
+      headSha: snapshot.headSha,
+      status: run.status,
+      conclusion: typeof run.conclusion === "string" ? run.conclusion : null,
+      ...typeof run.html_url === "string" ? { url: run.html_url } : {}
+    }];
+  });
+  const workflowBuckets = workflows.map((run) => {
+    if (run.status !== "completed") return "pending";
+    return run.conclusion === "success" || run.conclusion === "neutral" || run.conclusion === "skipped" ? "pass" : "fail";
+  });
+  return {
+    state: derivePollState([...checks.map((check) => check.state), ...workflowBuckets]),
+    headSha: snapshot.headSha,
+    checks,
+    workflows
+  };
+}
 async function pollRestCommitChecks(sha, repo, gh2 = defaultGhApi) {
   return derivePollState(partitionByRequired(await fetchHeadCheckEntries(sha, repo, gh2), null).relevant);
 }
@@ -13143,6 +13191,7 @@ function deriveLoopStaleness(item, loopState, now = Date.now()) {
   };
 }
 var CLAIM_MARKER_PATTERN = /<!--\s*mmi-claim:\s*(\{[\s\S]*?\})\s*-->/g;
+var CLAIM_RELEASE_PATTERN = /<!--\s*mmi-claim-release:\s*(\{[\s\S]*?\})\s*-->/g;
 var CLAIM_MARKER_LIVE_MS = 24 * 60 * 6e4;
 var CLAIM_STAMP_IDLE_MS = 4 * 60 * 6e4;
 function isValidClaimMarker(parsed) {
@@ -13161,10 +13210,36 @@ function parseClaimMarkers(body) {
   }
   return out;
 }
+function isValidClaimRelease(parsed) {
+  if (!parsed || typeof parsed !== "object") return false;
+  const release = parsed;
+  return typeof release.v === "number" && typeof release.ts === "string" && Number.isFinite(Date.parse(release.ts)) && (release.session === void 0 || typeof release.session === "string") && (release.surface === void 0 || typeof release.surface === "string") && (release.host === void 0 || typeof release.host === "string");
+}
+function parseClaimReleases(body) {
+  const out = [];
+  for (const match of body.matchAll(CLAIM_RELEASE_PATTERN)) {
+    try {
+      const parsed = JSON.parse(match[1]);
+      if (isValidClaimRelease(parsed)) out.push(parsed);
+    } catch {
+    }
+  }
+  return out;
+}
+function renderClaimReleaseBody(release) {
+  return `Released by \`${formatSessionIdentity(release)}\` at ${release.ts}.
+
+<!-- mmi-claim-release: ${JSON.stringify(release)} -->`;
+}
 function latestClaimMarker(comments) {
   for (let i = comments.length - 1; i >= 0; i -= 1) {
-    const markers = parseClaimMarkers(comments[i].body);
-    if (markers.length) return markers[markers.length - 1];
+    const body = comments[i].body;
+    const markers = parseClaimMarkers(body);
+    const releases = parseClaimReleases(body);
+    if (!markers.length && !releases.length) continue;
+    if (!releases.length) return markers[markers.length - 1];
+    if (!markers.length) return void 0;
+    return body.lastIndexOf("mmi-claim-release:") > body.lastIndexOf("mmi-claim:") ? void 0 : markers[markers.length - 1];
   }
   return void 0;
 }
@@ -13198,7 +13273,7 @@ function claimFromMarker(item, marker, linked = {}, now = Date.now()) {
     holder: describeClaimMarker(marker),
     ageMs: now - Date.parse(marker.ts),
     currentlyClaimed: item.assignees.length > 0 && item.status === "In Progress",
-    ...claimStampStaleness(marker, { activityAt: [item.updatedAt, ...linked.activityAt ?? []], linkedWork: linked.linkedWork }, now)
+    ...claimStampStaleness(marker, { activityAt: [...linked.activityAt ?? []], linkedWork: linked.linkedWork }, now)
   };
 }
 function classifyClaimableMarker(comments, actor, now = Date.now(), activityAt = []) {
@@ -13280,7 +13355,7 @@ async function demoteLiveClaimedClaimables(scope, client, actor = describeSessio
       warnings.push(`${item.ref} left claimable: claim-marker evidence could not be read`);
       continue;
     }
-    const verdict = classifyClaimableMarker(comments, actor, deps.now, [item.updatedAt]);
+    const verdict = classifyClaimableMarker(comments, actor, deps.now);
     if (verdict.verdict === "claimable") {
       stillClaimable.push(item);
     } else if (verdict.verdict === "owned") {
@@ -14201,6 +14276,20 @@ async function unclaimBoardIssue(options, deps = {}) {
     if (!options.allowPartial) throw new Error(warning);
     return { item, viewer, repo: currentRepo, status: item.status, partial: true, warning };
   }
+  try {
+    const actor = deps.session ?? describeSessionIdentity();
+    const release = {
+      v: 1,
+      session: actor.session,
+      surface: actor.surface,
+      host: actor.host,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await postIssueComment(client, { ref: item.ref, body: renderClaimReleaseBody(release) });
+  } catch (e) {
+    process.stderr.write(`warning: ${item.ref} was unclaimed, but recording the release marker comment failed: ${ghError(e)}
+`);
+  }
   const optionId = cfg.statusOptions[toStatus];
   let unclaimCredential = "user";
   try {
@@ -15224,7 +15313,7 @@ function createDocsIndexDeps(repoRoot2) {
 
 // src/gate-budget.ts
 var BLESSED_RUN_WITH_BUDGET_SHA = "5ce541add569e54e7ca96de67a768577d3d604e4";
-var BLESSED_RUNNER_GATE_SHA = "a6ee756d94fd95884451381e94408f0348eb11db";
+var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
 var LOCAL_USE = "./.github/actions/run-with-budget";
 var FULL_SHA = /^[0-9a-f]{40}$/;
@@ -17256,10 +17345,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.96",
-    tag: "v4.5.96",
-    commit: "191fc3cf3396",
-    npm: "@mutmutco/cli@4.5.96"
+    version: "4.5.98",
+    tag: "v4.5.98",
+    commit: "125c59187d10",
+    npm: "@mutmutco/cli@4.5.98"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17276,14 +17365,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.96"
+          v3Target: "v4.5.98"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.96 and redeploy the Hub Lambda from tag v4.5.96 (191fc3cf3396); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.96 (@mutmutco/cli@4.5.96, tag commit 191fc3cf3396 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.98 and redeploy the Hub Lambda from tag v4.5.98 (125c59187d10); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.98 (@mutmutco/cli@4.5.98, tag commit 125c59187d10 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -30465,8 +30554,10 @@ function trainPlanTargetsFromTags(tags, explicitRaw) {
 }
 function derivedStagePlan(derived, shell2, stops = true) {
   const { port } = derived;
-  const envOrder = ["MMI_STAGE", "MMI_PORT", "COMPOSE_PROFILES"];
-  const resolved = { MMI_STAGE: "development", MMI_PORT: String(port), COMPOSE_PROFILES: "local" };
+  const baseOrder = ["MMI_STAGE", "MMI_PORT", "COMPOSE_PROFILES"];
+  const projectName = derived.config.env?.COMPOSE_PROJECT_NAME?.trim();
+  const envOrder = projectName ? [...baseOrder, "COMPOSE_PROJECT_NAME"] : baseOrder;
+  const resolved = { MMI_STAGE: "dev", MMI_PORT: String(port), COMPOSE_PROFILES: "local", ...projectName ? { COMPOSE_PROJECT_NAME: projectName } : {} };
   const ensureEnv = shell2 === "powershell" ? `if (-not (Test-Path -LiteralPath '.env')) { Copy-Item -LiteralPath '.env.example' -Destination '.env' }` : `[ -f .env ] || cp .env.example .env`;
   const envPrefix = shell2 === "powershell" ? envOrder.map((k) => `$env:${k}='${resolved[k]}'`).join("; ") : envOrder.map((k) => `${k}=${resolved[k]}`).join(" ");
   const build = shell2 === "powershell" ? `${envPrefix}; ${derived.config.build ?? "docker compose build --no-cache"}` : `${envPrefix} ${derived.config.build ?? "docker compose build --no-cache"}`;
@@ -30871,7 +30962,7 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold"];
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold", "internalPeers"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -31406,6 +31497,7 @@ var SETTABLE_VAR_KEYS = [
   "requiredRuntimeSecrets",
   "requiredBuildSecrets",
   "tenantTasks",
+  "internalPeers",
   "edgeDomains",
   "statusFieldId",
   "statusOptions",
@@ -31444,6 +31536,7 @@ var SETTABLE_VAR_HINTS = {
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
   tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",secretOutput?:{path,vault:{repo,key},overwrite?}}} \u2014 merged per entry, at most 20 stored in total; retire ONE task with --unset-task NAME; use {artifact} in argv when required; a secretOutput is master-only',
+  internalPeers: "JSON {owner/repo:[dev|rc|main]} \u2014 same-box suite peers via the box Caddy; clear with --unset internalPeers (#7886)",
   secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
@@ -31520,6 +31613,26 @@ function clearSecretsConfirmationError(unsets, existing, confirmed) {
   if (confirmed) return null;
   return `org project set: --unset secrets clears the WHOLE catalog for ${existing?.slug ?? "this project"} (${count} declared entr${count === 1 ? "y" : "ies"} would be removed). To drop ONE entry use --unset-secret <KEY>; re-run with --confirm-clear-secrets to wipe all ${count}.`;
 }
+function parseInternalPeersVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("org project set: internalPeers must be valid JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("org project set: internalPeers must be a JSON object");
+  const entries = Object.entries(parsed);
+  if (entries.length < 1 || entries.length > 20) throw new Error("org project set: internalPeers holds 1-20 peer declarations");
+  const repoRe = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+  const validStages = /* @__PURE__ */ new Set(["dev", "rc", "main"]);
+  const out = {};
+  for (const [repo, rawStages] of entries) {
+    if (!repoRe.test(repo)) throw new Error("org project set: internalPeers key must look like owner/name \u2014 got " + JSON.stringify(repo));
+    if (!Array.isArray(rawStages) || rawStages.length < 1 || rawStages.length > 3 || rawStages.some((stg) => typeof stg !== "string" || !validStages.has(stg)) || new Set(rawStages).size !== rawStages.length) throw new Error("org project set: internalPeers stages must be a non-empty array of unique dev/rc/main values");
+    out[repo] = rawStages;
+  }
+  return out;
+}
 function parseSuiteHoldVar(raw) {
   let parsed;
   try {
@@ -31582,6 +31695,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseBuildSecretsVar(raw);
     } else if (key === "tenantTasks") {
       patch[key] = parseTenantTasksVar(raw);
+    } else if (key === "internalPeers") {
+      patch[key] = parseInternalPeersVar(raw);
     } else if (key === "secrets") {
       patch[key] = parseSecretsCatalogVar(raw);
     } else if (key === "edgeDomains") {
@@ -36456,7 +36571,7 @@ function readSuiteHotfix(path2) {
   } catch {
     throw new Error(`suite hotfix record unreadable at ${path2}; repair it, never restart`);
   }
-  if (r.schema !== "mmi-suite-hotfix/v1" || !r.repo || !r.member || !r.from || r.tag !== void 0 && !RELEASE_TAG.test(r.tag) || r.released && !r.tag || r.pinMerged && !r.released || r.leadTag !== void 0 && (!RELEASE_TAG.test(r.leadTag) || !r.pinMerged) || r.leadReleased && !r.leadTag || r.mapped && !r.leadReleased)
+  if (r.schema !== "mmi-suite-hotfix/v1" || !r.repo || !r.member || !r.from || r.tag !== void 0 && !RELEASE_TAG.test(r.tag) || r.released && !r.tag || r.pinMerged && !r.released || r.mainPublished && !r.released || r.leadTag !== void 0 && (!RELEASE_TAG.test(r.leadTag) || !r.pinMerged) || r.leadReleased && !r.leadTag || r.mapped && !r.leadReleased)
     throw new Error(`suite hotfix record has unknown or invalid state at ${path2}; repair it, never restart`);
   return r;
 }
@@ -36471,8 +36586,10 @@ async function suiteHotfix(deps, opts) {
   if (found.repo === SUITE_REPO) throw new Error(`${SUITE_REPO} is the suite lead; hotfix a member, this command cuts the lead; nothing was written`);
   const held = await deps.hold(found);
   if (held) throw new Error(`${found.repo} is HELD (${held.reason}); clear it with suite hold clear before a suite hotfix; nothing was written`);
+  const mainPath = mainBundlePath(found.bundles);
   const plan = [
     `${found.repo}: hotfix start --from ${opts.from} + release (suite-solo, in-process)`,
+    `${found.repo}: publish main bundle (module-rc-publish channel=main) at ${mainPath}`,
     `${SUITE_REPO}: main pin PR for ${found.id}, wait for merge`,
     `${SUITE_REPO}: hotfix (patch) carrying only the merged pin PR onto main`,
     `${SUITE_REPO}: record suite version -> member versions on its release`
@@ -36491,6 +36608,7 @@ async function suiteHotfix(deps, opts) {
   const save = () => writeSuiteHotfix(path2, rec);
   save();
   const resume = `rerun suite hotfix ${found.id} --from ${rec.from} --owner-go to resume`;
+  if (!rec.released) await deps.preflightMain(found.repo, mainPath);
   if (!rec.tag) {
     const started = await deps.hotfixStart(found.repo, { from: rec.from, ack: rec.ack });
     if (!RELEASE_TAG.test(started.tag)) throw new Error(`${found.repo}: hotfix start returned no vX.Y.Z tag`);
@@ -36508,6 +36626,15 @@ async function suiteHotfix(deps, opts) {
     rec.released = true;
     save();
   }
+  if (!rec.mainPublished) {
+    try {
+      await deps.publishMain(found.repo, rec.tag, mainPath);
+    } catch (e) {
+      throw new Error(`${found.repo}: main bundle publish failed (${e.message}); ${rec.tag} is released: ${resume}`);
+    }
+    rec.mainPublished = true;
+    save();
+  }
   if (!rec.pinMerged) {
     const pin = await deps.soloPin(found.repo, rec.tag);
     if (pin.status === "superseded") throw new Error(`${found.id} pin at ${rec.tag} is superseded by ${pin.pr}; a newer ${found.id} release owns the pin; stop`);
@@ -39572,11 +39699,6 @@ var PROTECTED_BRANCHES = /* @__PURE__ */ new Set(["development", "main", "master
 function isProtectedBranch(branch) {
   return PROTECTED_BRANCHES.has(branch.trim());
 }
-function deriveComposeProjectName(worktreePath) {
-  const base = worktreePath.replace(/\\/g, "/").replace(/\/+$/, "").split("/").pop()?.toLowerCase() ?? "";
-  const name = base.replace(/[^a-z0-9_-]+/g, "_").replace(/^[^a-z0-9]+/, "");
-  return name || void 0;
-}
 
 // src/pr-merge-helpers.ts
 function buildPrMergeArgs(input) {
@@ -41789,6 +41911,53 @@ function parsePrChecksTable(stdout) {
   }
   return rows;
 }
+function includeMissingRequiredChecks(rows, required) {
+  const reported = new Set(rows.map((row) => row.name));
+  const missing = [...new Set(required)].filter((name) => !reported.has(name)).map((name) => ({
+    name,
+    status: "missing",
+    details: "expected required check has not reported"
+  }));
+  return [...rows, ...missing];
+}
+async function requiredCheckContexts(repo, prNumber) {
+  const { stdout: prOutput } = await execFileP("gh", ["pr", "view", String(prNumber), "--repo", repo, "--json", "baseRefName"], { timeout: GC_GH_TIMEOUT_MS2 });
+  const baseRef = JSON.parse(prOutput).baseRefName;
+  if (typeof baseRef !== "string" || !baseRef) throw new Error("pull request response had no base branch");
+  const read = async (path2) => {
+    try {
+      const { stdout } = await execFileP("gh", ["api", path2], { timeout: GC_GH_TIMEOUT_MS2 });
+      return JSON.parse(stdout);
+    } catch (e) {
+      const err = e;
+      if (/\b404\b|Not Found/i.test(`${err.stderr ?? ""} ${err.message ?? ""}`)) return null;
+      throw e;
+    }
+  };
+  const [classic, rules] = await Promise.all([
+    read(`repos/${repo}/branches/${encodeURIComponent(baseRef)}/protection/required_status_checks`),
+    read(`repos/${repo}/rules/branches/${encodeURIComponent(baseRef)}`)
+  ]);
+  const contexts = /* @__PURE__ */ new Set();
+  const oldContexts = classic?.contexts;
+  if (Array.isArray(oldContexts)) {
+    for (const name of oldContexts) if (typeof name === "string") contexts.add(name);
+  }
+  if (Array.isArray(rules)) {
+    for (const rule of rules) {
+      const required = rule.type === "required_status_checks" ? rule.parameters?.required_status_checks : void 0;
+      if (Array.isArray(required)) for (const check of required) {
+        const name = check?.context;
+        if (typeof name === "string") contexts.add(name);
+      }
+    }
+  }
+  return [...contexts];
+}
+function checksStateWithExpected(state, rows, required) {
+  const checks = includeMissingRequiredChecks(rows, required);
+  return checks.some((row) => row.status === "missing") && (state === "success" || state === "no-checks-reported") ? { state: "incomplete", rows: checks } : { state, rows: checks };
+}
 function parseLinkedIssues(body) {
   const refs = /* @__PURE__ */ new Set();
   const re = /\b(?:close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved|ref|refs|re|references)\s+#(\d+)\b/gi;
@@ -42049,6 +42218,7 @@ function registerPrLifecycleCommands(program3) {
       return stdout;
     };
     const withLogs = async (rows) => o.logs ? attachFailureLogs(rows, fetchLog) : rows;
+    let expected = [];
     const snap = async () => {
       let stdout = "";
       let stderr = "";
@@ -42063,14 +42233,15 @@ function registerPrLifecycleCommands(program3) {
       const parsed = parseGhPrChecksResult(stdout, stderr);
       const state = pollStateFromParsed(parsed);
       const rows = parsePrChecksTable(stdout);
-      return { state, rows };
+      return checksStateWithExpected(state, rows, expected);
     };
     try {
+      expected = await requiredCheckContexts(repo, n);
       if (!o.watch) {
         const { state, rows } = await snap();
         const output = { state, checks: await withLogs(rows) };
         console.log(JSON.stringify(output));
-        if (state === "failure" || state === "failing") process.exitCode = 1;
+        if (state === "failure" || state === "failing" || state === "incomplete") process.exitCode = 1;
         return;
       }
       const deadline = Date.now() + CHECKS_WATCH_TIMEOUT_MS;
@@ -42801,11 +42972,18 @@ function parseDockerContainerLs(stdout) {
 function containersPublishingPort(containers, port) {
   return containers.filter((c) => c.publishedHostPorts.includes(port));
 }
+function stageComposeProjectName(cwd) {
+  const parts = cwd.replace(/\\/g, "/").replace(/\/+$/, "").split("/").filter(Boolean);
+  const base = parts.pop() ?? "";
+  const parent = parts.pop();
+  const raw = parent ? `${parent}-${base}` : base;
+  const name = raw.toLowerCase().replace(/[^a-z0-9_-]+/g, "_").replace(/^[^a-z0-9]+/, "");
+  return name || "mmi-stage";
+}
 function isOwnComposeContainer(container, cwd) {
   if (container.composeWorkingDir && normPath(container.composeWorkingDir) === normPath(cwd)) return true;
   if (container.composeWorkingDir && pathUnder(container.composeWorkingDir, cwd)) return true;
-  const derived = deriveComposeProjectName(cwd);
-  return Boolean(derived && container.composeProject === derived);
+  return container.composeProject === stageComposeProjectName(cwd);
 }
 function planStagePortTeardown(containers, port, cwd) {
   const ownProjects = [];
@@ -43047,11 +43225,13 @@ function composeResolvesPort(cwd) {
   return (0, import_node_fs38.existsSync)(envFile) && envFileKeys((0, import_node_fs38.readFileSync)(envFile, "utf8")).has("PORT");
 }
 function stageComposeEnv(config, stagePort, vaultEnvMerge, cwd) {
+  const composeProject = config.env?.COMPOSE_PROJECT_NAME ?? vaultEnvMerge?.COMPOSE_PROJECT_NAME ?? stageComposeProjectName(cwd);
   return {
     // Vault secrets first so the stage-selection contract (MMI_STAGE/MMI_PORT/…) always wins on any collision.
     ...vaultEnvMerge ?? {},
     ...stageProcessEnv(stagePort, stageExtraEnv(config, stagePort)),
-    ...stagePort != null && !composeResolvesPort(cwd) ? { PORT: String(stagePort) } : {}
+    ...stagePort != null && !composeResolvesPort(cwd) ? { PORT: String(stagePort) } : {},
+    COMPOSE_PROJECT_NAME: composeProject
   };
 }
 function stageComposeFiles(cwd) {
@@ -43201,6 +43381,58 @@ async function killTree(pid) {
     }
   }
 }
+async function describeExitedComposeServices(cwd, env) {
+  const dockerEnv = { ...process.env, ...env };
+  const run = (args) => execFileP3("docker", args, {
+    cwd,
+    windowsHide: true,
+    timeout: DOCKER_TIMEOUT_MS,
+    maxBuffer: 1024 * 1024 * 4,
+    env: dockerEnv
+  }).then(({ stdout }) => stdout);
+  let rows;
+  try {
+    const text = (await run(["compose", "ps", "--all", "--format", "json"])).trim();
+    if (!text) return void 0;
+    try {
+      const parsed = JSON.parse(text);
+      rows = Array.isArray(parsed) ? parsed : [parsed];
+    } catch {
+      rows = text.split(/\r?\n/).flatMap((line) => {
+        try {
+          return [JSON.parse(line)];
+        } catch {
+          return [];
+        }
+      });
+    }
+  } catch {
+    return void 0;
+  }
+  const exited = rows.filter((row) => typeof row.State === "string" && /^(exited|dead)$/i.test(row.State));
+  if (!exited.length) return void 0;
+  const parts = [];
+  for (const row of exited.slice(0, 3)) {
+    const service = String(row.Service ?? row.Name ?? "unknown");
+    let exit = row.ExitCode ?? row.exitCode;
+    if (exit == null && row.ID) {
+      try {
+        exit = (await run(["inspect", "--format", "{{.State.ExitCode}}", String(row.ID)])).trim() || void 0;
+      } catch {
+      }
+    }
+    let tail = "";
+    try {
+      tail = (await run(["compose", "logs", "--no-color", "--tail", "50", service])).trim();
+    } catch {
+    }
+    parts.push(`service '${service}' exited before health (exit ${exit ?? "unknown"})${tail ? ` \u2014 log tail:
+${tail}` : ""}`);
+  }
+  return `
+compose services exited before health:
+${parts.join("\n")}`;
+}
 async function waitForHealth(url, timeoutMs, anyStatus = false) {
   const deadline = Date.now() + timeoutMs;
   let last = "";
@@ -43301,7 +43533,15 @@ async function startStage(config = {}, opts = {}) {
     if (state.healthUrl) await waitForHealth(state.healthUrl, opts.timeoutMs ?? 6e4, config.healthAnyStatus);
     else await waitForProcessStability(child2);
   } catch (e) {
+    let detail;
+    if (state.healthUrl) {
+      try {
+        detail = await describeExitedComposeServices(cwd, upEnv);
+      } catch {
+      }
+    }
     await cleanupStageState(state, [statePath, globalStatePath], opts.timeoutMs ?? 6e4, cwd, upEnv);
+    if (detail) throw new Error(`${e.message}${detail}`, { cause: e });
     throw e;
   }
   const result = {
@@ -45242,6 +45482,11 @@ ${list}`);
     } else {
       printLine(`${label}: ${result.status}${result.reason ? ` \u2014 ${result.reason}` : ""}${result.detail ? ` (${result.detail})` : ""}`);
       for (const line of failedChecksReceiptLines(label, result)) printLine(line);
+      if (result.status === "success" && result.headSha) {
+        const checks = result.checks?.map((check) => `${check.name}=${check.state}`).join(", ") || "none";
+        const workflows = result.workflowRuns?.map((run) => `${run.name}#${run.id}=${run.status}/${run.conclusion ?? "pending"}`).join(", ") || "none";
+        printLine(`${label}: verified head ${result.headSha}; checks: ${checks}; workflows: ${workflows}`);
+      }
     }
     if (result.status === "failure" || result.status === "conflicting") process.exitCode = 1;
     if (result.status === "timeout" || result.status === "rate-limited") process.exitCode = PR_CHECKS_TIMEOUT_EXIT_CODE;
@@ -45294,6 +45539,7 @@ ${list}`);
       // pending must hold the wait open, and a non-required red must fail it; #4396's scoping is the
       // merge paths' contract (`pr land`, `pr merge --wait`), which mirror the GitHub merge button.
       pollChecks: () => pollRestPrChecks(number, repo),
+      pollChecksWithEvidence: () => pollRestPrChecksWithWorkflowEvidence(number, repo),
       pollMergeable: () => pollRestPrMergeable(number, repo),
       pollRateLimit: () => waitLoopCorePool("pr checks-wait"),
       // #3388: on a confirmed red, read the failing runs' annotations so a wall-clock budget kill stops
@@ -51812,10 +52058,13 @@ function deriveStage(inputs) {
     // #2655: only bootstrap a `.env` when the repo ships `.env.example` (legacy). Without it, the stage is
     // vault-native — the runner injects the declared dev secrets into the compose process env (no disk file).
     ...inputs.hasEnvExample ? { ensureEnv: { example: ".env.example", target: ".env" } } : {},
-    // MMI_PORT is the host-published port (the free STAGE_PORT); PORT is intentionally absent so compose
-    // reads the container's bind port from .env rather than this overriding it to the publish port (#1505).
+    // MMI_STAGE is the local dev stage name the estate compose contract selects on (`${MMI_STAGE:-dev}`
+    // in the seeded compose template): `development` never matched it, so a derived stage booted with
+    // the wrong stage identity (#7870). MMI_PORT is the host-published port (the free STAGE_PORT); PORT
+    // is intentionally absent so compose reads the container's bind port from .env rather than this
+    // overriding it to the publish port (#1505).
     env: {
-      MMI_STAGE: "development",
+      MMI_STAGE: "dev",
       MMI_PORT: "$STAGE_PORT",
       COMPOSE_PROFILES: "local"
     }
@@ -52014,13 +52263,20 @@ function registerStageCommands(program3) {
     const portRangeMeta = project2?.portRange ?? void 0;
     const portRange = portRangeMeta && typeof portRangeMeta.start === "number" && typeof portRangeMeta.end === "number" ? [portRangeMeta.start, portRangeMeta.end] : void 0;
     const repo = Array.isArray(project2?.repos) && typeof project2.repos[0] === "string" ? project2.repos[0] : slug;
+    const resolution = decideStage({
+      registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
+      hasCompose: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
+      hasEnvExample: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
+      repo
+    });
+    if (resolution.source === "derived" && resolution.derived) {
+      resolution.derived.config.env = {
+        ...resolution.derived.config.env,
+        COMPOSE_PROJECT_NAME: stageComposeProjectName(process.cwd())
+      };
+    }
     return {
-      resolution: decideStage({
-        registry: { deployModel: project2?.deployModel, portRange, error: read.ok ? void 0 : read.error },
-        hasCompose: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), "docker-compose.yml")),
-        hasEnvExample: (0, import_node_fs48.existsSync)((0, import_node_path46.join)(process.cwd(), ".env.example")),
-        repo
-      }),
+      resolution,
       project: project2,
       cfg
     };

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.96",
+  "version": "4.5.98",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.96",
+  "version": "4.5.98",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",