@mutmutco/codex-plugin 4.5.97 → 4.5.99

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.97",
+  "version": "4.5.99",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -5731,6 +5731,182 @@ init_github_quota();
 // src/pr-checks-rest.ts
 init_cli_shared();
 
+// ../shared/github-quota-scope.ts
+var import_node_crypto3 = require("node:crypto");
+function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
+  return `github-app-v1:${(0, import_node_crypto3.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
+}
+
+// src/app-actor.ts
+var import_node_crypto4 = require("node:crypto");
+var APP_ACTOR_ENV = "MMI_ACTOR";
+var APP_VAULT_REPO = "mutmutco/MMI-Hub";
+var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
+var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
+  "pr checks-wait",
+  "pr view",
+  "issue list",
+  "issue view",
+  "api get"
+]);
+var APP_POLL_PERMISSIONS = {
+  metadata: "read",
+  contents: "read",
+  pull_requests: "read",
+  // #7185: without issues:read GraphQL silently drops pr view's closingIssuesReferences.
+  issues: "read",
+  checks: "read",
+  statuses: "read",
+  actions: "read"
+};
+var APP_JWT_BACKDATE_S = 60;
+var APP_JWT_TTL_S = 9 * 60;
+var AppActorError = class extends Error {
+  constructor(message2, code = "mint-failed") {
+    super(message2);
+    this.code = code;
+  }
+  code;
+};
+function commandPathOf(cmd) {
+  const parts = [];
+  let cursor = cmd;
+  while (cursor && cursor.parent) {
+    parts.unshift(cursor.name());
+    cursor = cursor.parent;
+  }
+  return parts.join(" ");
+}
+function b64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function mintAppJwt(appId, privateKeyPem, nowSec) {
+  if (!Number.isFinite(nowSec)) throw new AppActorError("app actor: invalid clock reading for JWT mint");
+  const now = Math.floor(nowSec);
+  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = b64url(JSON.stringify({
+    iat: now - APP_JWT_BACKDATE_S,
+    exp: now + APP_JWT_TTL_S,
+    iss: appId
+  }));
+  const signer = (0, import_node_crypto4.createSign)("RSA-SHA256");
+  signer.update(`${header}.${payload}`);
+  return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
+}
+var activeQuotaScope;
+function activeAppQuotaScope() {
+  return activeQuotaScope;
+}
+async function mintInstallationToken(deps) {
+  const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
+  if (!appId || !installationId || !privateKey) {
+    const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
+    if (missing.length === APP_VAULT_KEYS.length) {
+      throw new AppActorError(
+        `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
+        "vault-denied"
+      );
+    }
+    throw new AppActorError(
+      `app actor: vault carries a PARTIAL App credential set \u2014 missing ${missing.join(", ")} (${APP_VAULT_REPO} tier); fix the vault. Automation fails closed, no personal-token fallback`,
+      "mint-failed"
+    );
+  }
+  const nowSec = deps.nowSec ?? (() => Math.floor(Date.now() / 1e3));
+  let res;
+  try {
+    const jwt = mintAppJwt(appId.trim(), privateKey, nowSec());
+    res = await deps.fetch(`https://api.github.com/app/installations/${installationId.trim()}/access_tokens`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${jwt}`,
+        accept: "application/vnd.github+json",
+        "content-type": "application/json",
+        "user-agent": "mmi-cli-app-actor"
+      },
+      body: JSON.stringify({ permissions: APP_POLL_PERMISSIONS })
+    });
+  } catch (e) {
+    if (e instanceof AppActorError) throw e;
+    throw new AppActorError(`app actor: token mint transport failed (${e?.constructor?.name ?? "Error"}) \u2014 automation fails closed, no personal-token fallback`);
+  }
+  if (!res.ok) {
+    throw new AppActorError(`app actor: installation token mint failed (HTTP ${res.status}) \u2014 automation fails closed, no personal-token fallback`);
+  }
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    throw new AppActorError("app actor: mint response unparsable \u2014 automation fails closed");
+  }
+  if (!body.token || !body.expires_at) {
+    throw new AppActorError("app actor: mint response carried no token \u2014 automation fails closed");
+  }
+  return { token: body.token, expiresAt: body.expires_at, quotaScope: appQuotaScope(appId, installationId, process.env.GITHUB_API_URL) };
+}
+async function pollTokenOrUndefined(deps) {
+  try {
+    return (await mintInstallationToken(deps)).token;
+  } catch {
+    return void 0;
+  }
+}
+var APP_POLL_HEADROOM_FRACTION = 0.4;
+var APP_POLL_RESET_DEFAULT_MS = 36e5;
+var appPollGuardState = {};
+function appPollGuardSnapshot() {
+  return { ...appPollGuardState };
+}
+function appPollAllowsApp(nowMs) {
+  if (appPollGuardState.fallbackUntilMs !== void 0) {
+    if (nowMs < appPollGuardState.fallbackUntilMs) return false;
+    appPollGuardState = {};
+  }
+  const { remaining, limit } = appPollGuardState;
+  if (remaining === void 0 || limit === void 0 || limit <= 0) return true;
+  return remaining / limit >= APP_POLL_HEADROOM_FRACTION;
+}
+function latchAppPollFallback(nowMs) {
+  appPollGuardState.fallbackUntilMs = appPollGuardState.resetAtMs ?? nowMs + APP_POLL_RESET_DEFAULT_MS;
+}
+function noteAppPollResponse(headers, rateLimited, nowMs) {
+  if (headers.remaining !== void 0) appPollGuardState.remaining = headers.remaining;
+  if (headers.limit !== void 0) appPollGuardState.limit = headers.limit;
+  if (headers.resetSec !== void 0 && headers.resetSec > 0) appPollGuardState.resetAtMs = headers.resetSec * 1e3;
+  const { remaining, limit } = appPollGuardState;
+  const belowFloor = !rateLimited && remaining !== void 0 && limit !== void 0 && limit > 0 && remaining / limit < APP_POLL_HEADROOM_FRACTION;
+  const headroomUnverifiable = !rateLimited && (headers.remaining === void 0 || headers.limit === void 0);
+  if (rateLimited || belowFloor || headroomUnverifiable && appPollGuardState.resetAtMs !== void 0) {
+    latchAppPollFallback(nowMs);
+  }
+}
+function resetAppPollGuard() {
+  appPollGuardState = {};
+}
+var notedIneligibleCommand = false;
+async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
+`)) {
+  activeQuotaScope = void 0;
+  const requested = (env[APP_ACTOR_ENV] ?? "").trim();
+  if (!requested) return "personal";
+  if (requested !== "app") {
+    throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' is supported; refusing to guess an identity`);
+  }
+  if (!APP_ELIGIBLE_COMMANDS.has(commandPath3)) {
+    if (!notedIneligibleCommand) {
+      notedIneligibleCommand = true;
+      note(`app actor: '${commandPath3}' is personal-only (viewer/@me/authorship) \u2014 running on the personal token despite ${APP_ACTOR_ENV}=app`);
+    }
+    return "personal";
+  }
+  delete env.GH_TOKEN;
+  delete env.GITHUB_TOKEN;
+  const minted = await mint();
+  env.GH_TOKEN = minted.token;
+  activeQuotaScope = minted.quotaScope;
+  return "app";
+}
+
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
   if (input.registryCi === "none") {
@@ -6111,12 +6287,19 @@ function isReleaseShaDeployEnumerationCandidate(row, nonDeployEvents) {
 }
 
 // src/pr-checks-rest.ts
+init_github_quota();
 var REST_GH_TIMEOUT_MS = 2e4;
 var pollTokenProvider;
 var pollTokenOnce;
+var lastPollSource;
+function lastRestPollSource() {
+  return lastPollSource;
+}
 function setPollTokenProvider(provider) {
   pollTokenProvider = provider;
   pollTokenOnce = void 0;
+  resetAppPollGuard();
+  lastPollSource = void 0;
 }
 async function pollToken() {
   if (!pollTokenProvider) return void 0;
@@ -6137,24 +6320,60 @@ function parseIncludedOutput(out) {
   });
   return { body, status, etag, pages };
 }
+function parseRateLimitHeaders(out) {
+  const first = (name) => {
+    const match = new RegExp(`^x-ratelimit-${name}:\\s*(\\d+)\\s*$`, "im").exec(out);
+    return match ? Number(match[1]) : void 0;
+  };
+  return { remaining: first("remaining"), limit: first("limit"), resetSec: first("reset") };
+}
 var etagCache = /* @__PURE__ */ new Map();
+function appPoolDetail() {
+  const guard = appPollGuardSnapshot();
+  const counts = guard.remaining !== void 0 && guard.limit !== void 0 ? `App pool at ${guard.remaining}/${guard.limit}` : "App pool headroom unverified";
+  return guard.resetAtMs !== void 0 ? `${counts}, resets ${new Date(guard.resetAtMs).toISOString()}` : counts;
+}
 async function defaultGhApi(args) {
-  const key = args.join("\0");
-  const cached = etagCache.get(key);
-  let stdout;
-  try {
-    ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
-      timeout: REST_GH_TIMEOUT_MS
-    }));
-  } catch (e) {
-    const out = e.stdout;
-    if (cached && typeof out === "string" && parseIncludedOutput(out).status === 304) return cached.body;
-    throw e;
+  const appToken = await pollToken();
+  let source = appToken && appPollAllowsApp(Date.now()) ? "app" : "user";
+  if (lastPollSource !== void 0 && lastPollSource !== source) {
+    console.warn(source === "user" ? `poll credential: ${appPoolDetail()} \u2014 below the ${APP_POLL_HEADROOM_FRACTION * 100}% App-poll headroom floor (#7843); REST poll reads switch to the ambient user token until the App pool resets` : "poll credential: App pool reset passed \u2014 REST poll reads return to the App installation token (#7843)");
+  }
+  for (; ; ) {
+    const key = `${source}\0${args.join("\0")}`;
+    const cached = etagCache.get(key);
+    let stdout;
+    try {
+      ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
+        timeout: REST_GH_TIMEOUT_MS,
+        // Only on the App source: passing `env` at all replaces the inherited environment wholesale,
+        // and `gh` needs the rest of it (PATH, GH_HOST, config home). Ambient rides the inherited env.
+        ...source === "app" && appToken ? { env: { ...process.env, GH_TOKEN: appToken } } : {}
+      }));
+    } catch (e) {
+      const out = e.stdout;
+      const errOut = typeof out === "string" ? out : void 0;
+      const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
+      if (cached && status === 304) {
+        lastPollSource = source;
+        return cached.body;
+      }
+      if (source === "app" && appToken && (status === 403 || status === 429)) {
+        noteAppPollResponse(parseRateLimitHeaders(errOut), true, Date.now());
+        console.warn(`poll credential: App pool refused the read (HTTP ${status}, ${appPoolDetail()}) \u2014 REST poll reads switch to the ambient user token until the App pool resets (#7843)`);
+        lastPollSource = "user";
+        source = "user";
+        continue;
+      }
+      throw e;
+    }
+    const { body, etag, pages } = parseIncludedOutput(stdout);
+    if (source === "app") noteAppPollResponse(parseRateLimitHeaders(stdout), false, Date.now());
+    lastPollSource = source;
+    if (etag && pages === 1) etagCache.set(key, { etag, body });
+    else etagCache.delete(key);
+    return body;
   }
-  const { body, etag, pages } = parseIncludedOutput(stdout);
-  if (etag && pages === 1) etagCache.set(key, { etag, body });
-  else etagCache.delete(key);
-  return body;
 }
 function classifyCheckRun(run) {
   if (run.status !== "completed") return "pending";
@@ -6300,12 +6519,20 @@ async function ambientGhApi(args) {
   const { stdout } = await execFileP("gh", ["api", ...args], { timeout: REST_GH_TIMEOUT_MS });
   return stdout;
 }
-async function fetchRestRepoMergeSettings(repo, gh2 = defaultGhApi, ambientGh = ambientGhApi) {
-  const primary = await readRepoMergeSettingsOnce(repo, gh2);
-  if (primary.proven) return primary;
-  const fallback = await readRepoMergeSettingsOnce(repo, ambientGh);
-  if (fallback.proven) return fallback;
-  return { proven: false, reason: `${primary.reason}; ambient fallback: ${fallback.reason}` };
+var REPO_SETTINGS_RATE_LIMIT_DELAYS_MS = [15e3, 45e3];
+async function fetchRestRepoMergeSettings(repo, gh2 = defaultGhApi, ambientGh = ambientGhApi, options = {}) {
+  const delays = options.delaysMs ?? REPO_SETTINGS_RATE_LIMIT_DELAYS_MS;
+  const sleep2 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  for (let attempt = 0; ; attempt++) {
+    const primary = await readRepoMergeSettingsOnce(repo, gh2);
+    if (primary.proven) return primary;
+    const fallback = await readRepoMergeSettingsOnce(repo, ambientGh);
+    if (fallback.proven) return fallback;
+    const reason = `${primary.reason}; ambient fallback: ${fallback.reason}`;
+    if (attempt >= delays.length || !isRateLimitText(reason)) return { proven: false, reason };
+    console.warn(`pr merge: repository settings read was rate-limited; retrying in ${Math.round(delays[attempt] / 1e3)}s`);
+    await sleep2(delays[attempt]);
+  }
 }
 var PR_SNAPSHOT_READ_RETRIES = 3;
 var PR_SNAPSHOT_READ_DELAY_MS = 2e3;
@@ -7496,9 +7723,9 @@ function extractWorkflowCrons(yamlText) {
 function workflowEntry(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   if (!crons.length) return null;
-  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
+  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
   return {
-    name: `${repo}/${basename3.replace(/\.ya?ml$/, "")}`,
+    name: `${repo}/${basename4.replace(/\.ya?ml$/, "")}`,
     cadence: crons.join(" + "),
     executor: "github-actions",
     llm: llmFromHeader(yamlText),
@@ -7827,8 +8054,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   const header = parseScheduleHeader(yamlText);
   if (!crons.length && !header.schedule) return null;
-  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
-  const expectedId = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
+  const expectedId = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
   if (isHarbourUnmanaged(yamlText)) return null;
   const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
   if (missing.length) {
@@ -9247,7 +9474,7 @@ init_clean_exit();
 var import_promises = require("node:fs/promises");
 var import_node_os4 = require("node:os");
 var import_node_path9 = require("node:path");
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 
 // src/board-priority.ts
 var BOARD_PRIORITY_NAMES = ["Urgent", "High", "Medium", "Low"];
@@ -9334,7 +9561,7 @@ async function bodyArgsViaFile(args, deps = {}) {
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os4.tmpdir)();
-  const file = (0, import_node_path9.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
+  const file = (0, import_node_path9.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.md`);
   await ensureDir((0, import_node_path9.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, args[i + 1], "utf8");
@@ -9664,7 +9891,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os4.tmpdir)();
-  const file = (0, import_node_path9.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.json`);
+  const file = (0, import_node_path9.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.json`);
   const payload = {
     title: input.title,
     head: input.head,
@@ -11064,7 +11291,7 @@ function findDuplicateLesson(source, openLessons) {
 }
 
 // src/session-identity.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_os8 = require("node:os");
 
 // src/plugin-guard-io.ts
@@ -11948,7 +12175,7 @@ function readSessionIdSource(env) {
 var synthesizedSessionId;
 function fallbackSessionId(surface) {
   if (!synthesizedSessionId) {
-    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto4.randomBytes)(3).toString("hex")}`;
+    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto6.randomBytes)(3).toString("hex")}`;
   }
   return synthesizedSessionId;
 }
@@ -14646,7 +14873,7 @@ async function propagateMayAutoMerge(repo, repoClass, rest) {
 }
 
 // src/bootstrap-apply.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 
 // src/bootstrap-seeds.ts
 var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
@@ -15877,7 +16104,7 @@ function planSeedAction(seed, exists) {
   return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
 }
 var GATE_RENDER_NOTE = "# Rendered from the registry gate config by mmi-cli devops bootstrap apply <repo> --only gate.yml --from-config; edit the config, not this file.\n";
-var gateHash = (body) => (0, import_node_crypto5.createHash)("sha256").update(body, "utf8").digest("hex");
+var gateHash = (body) => (0, import_node_crypto7.createHash)("sha256").update(body, "utf8").digest("hex");
 function parseGateRenderStamp(content) {
   const match = /^# mmi-gate-render: sha256=([a-f0-9]{64})\n/.exec(content);
   return match ? { hash: match[1], body: content.slice(match[0].length) } : null;
@@ -17345,10 +17572,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.97",
-    tag: "v4.5.97",
-    commit: "72af9cdfc1b7",
-    npm: "@mutmutco/cli@4.5.97"
+    version: "4.5.99",
+    tag: "v4.5.99",
+    commit: "44a40b83250e",
+    npm: "@mutmutco/cli@4.5.99"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17365,14 +17592,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.97"
+          v3Target: "v4.5.99"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.97 and redeploy the Hub Lambda from tag v4.5.97 (72af9cdfc1b7); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.97 (@mutmutco/cli@4.5.97, tag commit 72af9cdfc1b7 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.99 and redeploy the Hub Lambda from tag v4.5.99 (44a40b83250e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.99 (@mutmutco/cli@4.5.99, tag commit 44a40b83250e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19730,7 +19957,9 @@ async function correlateRun(deps, args) {
       return Number.isFinite(created) && created < threshold;
     });
     const tokens2 = args.mode === "dispatch" ? args.titleIncludes : void 0;
-    const titleMatch = tokens2 && tokens2.length ? candidates.find((c) => tokens2.every((t) => (c.row.displayTitle ?? "").includes(t))) : void 0;
+    const fieldsFrom = args.mode === "dispatch" ? args.titleFieldsFrom : void 0;
+    const titleHas = (title) => fieldsFrom === void 0 ? tokens2.every((t) => title.includes(t)) : tokens2.every((t, i) => title.split(" ")[fieldsFrom + i] === t);
+    const titleMatch = tokens2 && tokens2.length ? candidates.find((c) => titleHas(c.row.displayTitle ?? "")) : void 0;
     const match = titleMatch ?? (!("requireTitleMatch" in args && args.requireTitleMatch) && (args.mode === "workflow" || windowProvenWhole) ? candidates[0] : void 0);
     if (match) return { runId: match.row.databaseId, runUrl: match.row.url, read: "found" };
     if (!windowProvenWhole) truncatedWindow = true;
@@ -19756,7 +19985,7 @@ function correlateGetPublishRun(deps, since, product, mode) {
   return correlateRun(deps, { workflow: "get-publish.yml", since, mode: "dispatch", titleIncludes: [product, ...mode ? [mode] : []], ...mode ? { requireTitleMatch: true } : {} });
 }
 function correlateControlRun(deps, since, titleIncludes) {
-  return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes });
+  return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes, titleFieldsFrom: 2, ...titleIncludes?.length ? { requireTitleMatch: true } : {} });
 }
 function correlateReconcileRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-reconcile.yml", since, mode: "dispatch", titleIncludes });
@@ -21562,7 +21791,7 @@ async function runTenantControl(deps, options) {
   const watch = options.watch ?? tenantControlWatches(action);
   const base = { command: "tenant-control", repo, stage, action };
   const since = (deps.now ?? Date.now)();
-  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
+  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, since: options.logSince, until: options.logUntil, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
   if (!d.ok) {
     const transport = d.category === "transport-failed";
     return {
@@ -22778,7 +23007,7 @@ function checkLineEndings(probe) {
 // src/release-ledger.ts
 var import_node_fs22 = require("node:fs");
 var import_node_path22 = require("node:path");
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
@@ -23140,7 +23369,7 @@ function releaseLedgerPath(cwd) {
 }
 function atomicWriteJson(path2, ledger) {
   (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(path2), { recursive: true });
-  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}`;
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto8.randomBytes)(4).toString("hex")}`;
   (0, import_node_fs22.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
   (0, import_node_fs22.renameSync)(tmp, path2);
@@ -29869,150 +30098,6 @@ function renderPluginCachePlan(plan, applied) {
   return lines2.join("\n");
 }
 
-// ../shared/github-quota-scope.ts
-var import_node_crypto7 = require("node:crypto");
-function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
-  return `github-app-v1:${(0, import_node_crypto7.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
-}
-
-// src/app-actor.ts
-var import_node_crypto8 = require("node:crypto");
-var APP_ACTOR_ENV = "MMI_ACTOR";
-var APP_VAULT_REPO = "mutmutco/MMI-Hub";
-var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
-var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
-  "pr checks-wait",
-  "pr view",
-  "issue list",
-  "issue view",
-  "api get"
-]);
-var APP_POLL_PERMISSIONS = {
-  metadata: "read",
-  contents: "read",
-  pull_requests: "read",
-  // #7185: without issues:read GraphQL silently drops pr view's closingIssuesReferences.
-  issues: "read",
-  checks: "read",
-  statuses: "read",
-  actions: "read"
-};
-var APP_JWT_BACKDATE_S = 60;
-var APP_JWT_TTL_S = 9 * 60;
-var AppActorError = class extends Error {
-  constructor(message2, code = "mint-failed") {
-    super(message2);
-    this.code = code;
-  }
-  code;
-};
-function commandPathOf(cmd) {
-  const parts = [];
-  let cursor = cmd;
-  while (cursor && cursor.parent) {
-    parts.unshift(cursor.name());
-    cursor = cursor.parent;
-  }
-  return parts.join(" ");
-}
-function b64url(input) {
-  return Buffer.from(input).toString("base64url");
-}
-function mintAppJwt(appId, privateKeyPem, nowSec) {
-  if (!Number.isFinite(nowSec)) throw new AppActorError("app actor: invalid clock reading for JWT mint");
-  const now = Math.floor(nowSec);
-  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
-  const payload = b64url(JSON.stringify({
-    iat: now - APP_JWT_BACKDATE_S,
-    exp: now + APP_JWT_TTL_S,
-    iss: appId
-  }));
-  const signer = (0, import_node_crypto8.createSign)("RSA-SHA256");
-  signer.update(`${header}.${payload}`);
-  return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
-}
-var activeQuotaScope;
-function activeAppQuotaScope() {
-  return activeQuotaScope;
-}
-async function mintInstallationToken(deps) {
-  const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
-  if (!appId || !installationId || !privateKey) {
-    const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
-    if (missing.length === APP_VAULT_KEYS.length) {
-      throw new AppActorError(
-        `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
-        "vault-denied"
-      );
-    }
-    throw new AppActorError(
-      `app actor: vault carries a PARTIAL App credential set \u2014 missing ${missing.join(", ")} (${APP_VAULT_REPO} tier); fix the vault. Automation fails closed, no personal-token fallback`,
-      "mint-failed"
-    );
-  }
-  const nowSec = deps.nowSec ?? (() => Math.floor(Date.now() / 1e3));
-  let res;
-  try {
-    const jwt = mintAppJwt(appId.trim(), privateKey, nowSec());
-    res = await deps.fetch(`https://api.github.com/app/installations/${installationId.trim()}/access_tokens`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${jwt}`,
-        accept: "application/vnd.github+json",
-        "content-type": "application/json",
-        "user-agent": "mmi-cli-app-actor"
-      },
-      body: JSON.stringify({ permissions: APP_POLL_PERMISSIONS })
-    });
-  } catch (e) {
-    if (e instanceof AppActorError) throw e;
-    throw new AppActorError(`app actor: token mint transport failed (${e?.constructor?.name ?? "Error"}) \u2014 automation fails closed, no personal-token fallback`);
-  }
-  if (!res.ok) {
-    throw new AppActorError(`app actor: installation token mint failed (HTTP ${res.status}) \u2014 automation fails closed, no personal-token fallback`);
-  }
-  let body;
-  try {
-    body = await res.json();
-  } catch {
-    throw new AppActorError("app actor: mint response unparsable \u2014 automation fails closed");
-  }
-  if (!body.token || !body.expires_at) {
-    throw new AppActorError("app actor: mint response carried no token \u2014 automation fails closed");
-  }
-  return { token: body.token, expiresAt: body.expires_at, quotaScope: appQuotaScope(appId, installationId, process.env.GITHUB_API_URL) };
-}
-async function pollTokenOrUndefined(deps) {
-  try {
-    return (await mintInstallationToken(deps)).token;
-  } catch {
-    return void 0;
-  }
-}
-var notedIneligibleCommand = false;
-async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
-`)) {
-  activeQuotaScope = void 0;
-  const requested = (env[APP_ACTOR_ENV] ?? "").trim();
-  if (!requested) return "personal";
-  if (requested !== "app") {
-    throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' is supported; refusing to guess an identity`);
-  }
-  if (!APP_ELIGIBLE_COMMANDS.has(commandPath3)) {
-    if (!notedIneligibleCommand) {
-      notedIneligibleCommand = true;
-      note(`app actor: '${commandPath3}' is personal-only (viewer/@me/authorship) \u2014 running on the personal token despite ${APP_ACTOR_ENV}=app`);
-    }
-    return "personal";
-  }
-  delete env.GH_TOKEN;
-  delete env.GITHUB_TOKEN;
-  const minted = await mint();
-  env.GH_TOKEN = minted.token;
-  activeQuotaScope = minted.quotaScope;
-  return "app";
-}
-
 // src/board-commands.ts
 init_cli_shared();
 
@@ -30962,7 +31047,7 @@ init_hub_auth();
 init_github_client();
 
 // src/project-set.ts
-var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold"];
+var UNSET_KEYS = ["projectAdmins", "installer", "oauth", "requiredRuntimeSecrets", "requiredBuildSecrets", "tenantTasks", "secrets", "edgeDomains", "requiredGcpApis", "publishRequired", "publishDir", "releaseChannel", "releaseLanguage", "dsManifestPath", "consumesDesignSystem", "ci", "requiredChecks", "requiredCheckBranches", "ciExemptReason", "gate", "seedCanary", "notifyOnDeploy", "vercelVersionEnv", "stageAllowlist", "suiteHold", "internalPeers"];
 var UNSET_KEY_SET = new Set(UNSET_KEYS);
 var RUNTIME_SECRET_STAGES = ["dev", "rc", "main"];
 var SECRET_CONSUMERS = ["runtime", "build", "lambda", "actions", "agent", "box"];
@@ -31497,6 +31582,7 @@ var SETTABLE_VAR_KEYS = [
   "requiredRuntimeSecrets",
   "requiredBuildSecrets",
   "tenantTasks",
+  "internalPeers",
   "edgeDomains",
   "statusFieldId",
   "statusOptions",
@@ -31535,6 +31621,7 @@ var SETTABLE_VAR_HINTS = {
   requiredRuntimeSecrets: 'JSON stage map, e.g. {"dev":["KEY"],"rc":["KEY"],"main":["KEY"]}',
   requiredBuildSecrets: 'JSON flat array, e.g. ["NODE_AUTH_TOKEN=@github-packages-token"]',
   tenantTasks: 'JSON map {name:{service,command[],stages[],timeoutSeconds?,artifact?:"required",secretOutput?:{path,vault:{repo,key},overwrite?}}} \u2014 merged per entry, at most 20 stored in total; retire ONE task with --unset-task NAME; use {artifact} in argv when required; a secretOutput is master-only',
+  internalPeers: "JSON {owner/repo:[dev|rc|main]} \u2014 same-box suite peers via the box Caddy; clear with --unset internalPeers (#7886)",
   secrets: "JSON catalog map keyed by KEY {key,purpose,group,owner,stages[],consumers[]} \u2014 merged per entry; drop ONE entry with --unset-secret KEY; clear ALL with --unset secrets --confirm-clear-secrets; prefer --secrets-file",
   edgeDomains: "JSON {dev,rc,main} domain map",
   statusOptions: "JSON name\u2192id map",
@@ -31611,6 +31698,26 @@ function clearSecretsConfirmationError(unsets, existing, confirmed) {
   if (confirmed) return null;
   return `org project set: --unset secrets clears the WHOLE catalog for ${existing?.slug ?? "this project"} (${count} declared entr${count === 1 ? "y" : "ies"} would be removed). To drop ONE entry use --unset-secret <KEY>; re-run with --confirm-clear-secrets to wipe all ${count}.`;
 }
+function parseInternalPeersVar(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("org project set: internalPeers must be valid JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("org project set: internalPeers must be a JSON object");
+  const entries = Object.entries(parsed);
+  if (entries.length < 1 || entries.length > 20) throw new Error("org project set: internalPeers holds 1-20 peer declarations");
+  const repoRe = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+  const validStages = /* @__PURE__ */ new Set(["dev", "rc", "main"]);
+  const out = {};
+  for (const [repo, rawStages] of entries) {
+    if (!repoRe.test(repo)) throw new Error("org project set: internalPeers key must look like owner/name \u2014 got " + JSON.stringify(repo));
+    if (!Array.isArray(rawStages) || rawStages.length < 1 || rawStages.length > 3 || rawStages.some((stg) => typeof stg !== "string" || !validStages.has(stg)) || new Set(rawStages).size !== rawStages.length) throw new Error("org project set: internalPeers stages must be a non-empty array of unique dev/rc/main values");
+    out[repo] = rawStages;
+  }
+  return out;
+}
 function parseSuiteHoldVar(raw) {
   let parsed;
   try {
@@ -31673,6 +31780,8 @@ function buildProjectSetPatch(input) {
       patch[key] = parseBuildSecretsVar(raw);
     } else if (key === "tenantTasks") {
       patch[key] = parseTenantTasksVar(raw);
+    } else if (key === "internalPeers") {
+      patch[key] = parseInternalPeersVar(raw);
     } else if (key === "secrets") {
       patch[key] = parseSecretsCatalogVar(raw);
     } else if (key === "edgeDomains") {
@@ -36547,7 +36656,7 @@ function readSuiteHotfix(path2) {
   } catch {
     throw new Error(`suite hotfix record unreadable at ${path2}; repair it, never restart`);
   }
-  if (r.schema !== "mmi-suite-hotfix/v1" || !r.repo || !r.member || !r.from || r.tag !== void 0 && !RELEASE_TAG.test(r.tag) || r.released && !r.tag || r.pinMerged && !r.released || r.leadTag !== void 0 && (!RELEASE_TAG.test(r.leadTag) || !r.pinMerged) || r.leadReleased && !r.leadTag || r.mapped && !r.leadReleased)
+  if (r.schema !== "mmi-suite-hotfix/v1" || !r.repo || !r.member || !r.from || r.tag !== void 0 && !RELEASE_TAG.test(r.tag) || r.released && !r.tag || r.pinMerged && !r.released || r.mainPublished && !r.released || r.leadTag !== void 0 && (!RELEASE_TAG.test(r.leadTag) || !r.pinMerged) || r.leadReleased && !r.leadTag || r.mapped && !r.leadReleased)
     throw new Error(`suite hotfix record has unknown or invalid state at ${path2}; repair it, never restart`);
   return r;
 }
@@ -36562,8 +36671,10 @@ async function suiteHotfix(deps, opts) {
   if (found.repo === SUITE_REPO) throw new Error(`${SUITE_REPO} is the suite lead; hotfix a member, this command cuts the lead; nothing was written`);
   const held = await deps.hold(found);
   if (held) throw new Error(`${found.repo} is HELD (${held.reason}); clear it with suite hold clear before a suite hotfix; nothing was written`);
+  const mainPath = mainBundlePath(found.bundles);
   const plan = [
     `${found.repo}: hotfix start --from ${opts.from} + release (suite-solo, in-process)`,
+    `${found.repo}: publish main bundle (module-rc-publish channel=main) at ${mainPath}`,
     `${SUITE_REPO}: main pin PR for ${found.id}, wait for merge`,
     `${SUITE_REPO}: hotfix (patch) carrying only the merged pin PR onto main`,
     `${SUITE_REPO}: record suite version -> member versions on its release`
@@ -36582,6 +36693,7 @@ async function suiteHotfix(deps, opts) {
   const save = () => writeSuiteHotfix(path2, rec);
   save();
   const resume = `rerun suite hotfix ${found.id} --from ${rec.from} --owner-go to resume`;
+  if (!rec.released) await deps.preflightMain(found.repo, mainPath);
   if (!rec.tag) {
     const started = await deps.hotfixStart(found.repo, { from: rec.from, ack: rec.ack });
     if (!RELEASE_TAG.test(started.tag)) throw new Error(`${found.repo}: hotfix start returned no vX.Y.Z tag`);
@@ -36599,6 +36711,15 @@ async function suiteHotfix(deps, opts) {
     rec.released = true;
     save();
   }
+  if (!rec.mainPublished) {
+    try {
+      await deps.publishMain(found.repo, rec.tag, mainPath);
+    } catch (e) {
+      throw new Error(`${found.repo}: main bundle publish failed (${e.message}); ${rec.tag} is released: ${resume}`);
+    }
+    rec.mainPublished = true;
+    save();
+  }
   if (!rec.pinMerged) {
     const pin = await deps.soloPin(found.repo, rec.tag);
     if (pin.status === "superseded") throw new Error(`${found.id} pin at ${rec.tag} is superseded by ${pin.pr}; a newer ${found.id} release owns the pin; stop`);
@@ -42631,6 +42752,13 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
   const repo = await requireRepo(repoOption);
   const { client, throttledPaths } = withRateLimitRetry(withAppClaimMarkerRead(deps.client ?? defaultGitHubClient(), deps.appClient), deps);
   const actor = deps.actor ?? describeSessionIdentity();
+  let viewerLogin = deps.viewerLogin;
+  if (!viewerLogin) {
+    try {
+      viewerLogin = (await client.rest("GET", "user"))?.login;
+    } catch {
+    }
+  }
   const source = deps.actorSource ?? (deps.actor ? "the caller-supplied identity" : readSessionIdSource(process.env) ?? "a synthesized fallback");
   const requester = `requesting lane: ${actor.surface}/${actor.session}@${actor.host} (session id from ${source})`;
   const checkContest = deps.checkContest ?? checkLaneContest;
@@ -42644,7 +42772,7 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
       }
     }
     if (state?.toLowerCase() === "closed") continue;
-    const contest = await checkContest(client, { repository: repo, number }, actor);
+    const contest = await checkContest(client, { repository: repo, number }, actor, viewerLogin);
     if (!contest.contested) continue;
     const ref = `${repo}#${number}`;
     const commentsPath = `repos/${repo}/issues/${number}/comments`;
@@ -44423,6 +44551,9 @@ function renderPrMergeCleanupLines(cleanup) {
 
 // src/worktree-residue-sweep.ts
 var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
+function canonicalWorktreeRoot(primary) {
+  return (0, import_node_path41.join)((0, import_node_path41.dirname)(primary), "mmi-worktrees", (0, import_node_path41.basename)(primary));
+}
 function norm(p) {
   const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? s.toLowerCase() : s;
@@ -44491,16 +44622,14 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     }
   }
   if (recorded.length) writePaths(file, remaining, deps);
-  const roots = /* @__PURE__ */ new Set();
-  for (const p of [...registered.slice(1), ...recorded]) roots.add((0, import_node_path41.dirname)(p));
   const keptKeys = new Set(remaining.map(norm));
-  for (const root of roots) {
-    if (!isDir(root) || live.has(norm(root)) || norm(root) === primary) continue;
-    let children;
+  const root = registered[0] ? canonicalWorktreeRoot(registered[0]) : void 0;
+  if (root && isDir(root) && !live.has(norm(root))) {
+    report.root = root;
+    let children = [];
     try {
       children = readDir(root);
     } catch {
-      continue;
     }
     for (const name of children) {
       const child2 = (0, import_node_path41.join)(root, name);
@@ -44529,10 +44658,13 @@ function renderResidueSweepLines(report) {
   if (!report) return [];
   const lines2 = [];
   const cleaned = report.swept.length + report.emptyRemoved.length;
-  if (cleaned) lines2.push(`pr merge: removed ${cleaned} leftover worktree folder(s) from earlier merges`);
+  const where = report.root ? ` (worktree root ${report.root})` : "";
+  if (cleaned) lines2.push(`pr merge: removed ${cleaned} leftover worktree folder(s) from earlier merges${where}`);
   for (const k of report.kept) lines2.push(`pr merge: leftover folder still locked, retried on the next merge \u2014 ${k.path}`);
   if (report.unrecorded.length) {
-    lines2.push(`pr merge: ${report.unrecorded.length} unregistered folder(s) with content under the worktree root were left untouched (not recorded by a merge): ${report.unrecorded.join(", ")}`);
+    const shown = report.unrecorded.slice(0, 5).join(", ");
+    const more = report.unrecorded.length > 5 ? `, \u2026 ${report.unrecorded.length - 5} more` : "";
+    lines2.push(`pr merge: ${report.unrecorded.length} unregistered folder(s) with content under the worktree root${where} were left untouched (not recorded by a merge): ${shown}${more}`);
   }
   return lines2;
 }
@@ -45762,7 +45894,7 @@ ${list}`);
         console.error(line);
       }
     }
-    const credential = "user";
+    const credential = lastRestPollSource() === "app" ? "app_installation" : "user";
     if (o.json) printLine(JSON.stringify({ ...result, credential }));
     else printLine(
       `pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""} (credential: ${credential})` + (result.branchFinality ? ` \u2014 ${result.branchFinality}` : "")
@@ -46349,8 +46481,8 @@ function trainApplyDeps() {
     // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
     // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
     // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
-    dispatchTenantControl: async ({ repo, stage, action, lines: lines2, task, artifact, confirmDataLoss }) => {
-      const res = await tenantControl({ repo, stage, action, ...lines2 != null ? { lines: lines2 } : {}, ...task ? { task } : {}, ...artifact ? { artifact } : {}, ...confirmDataLoss ? { confirmDataLoss } : {} }, registryClientDeps(await loadConfig()));
+    dispatchTenantControl: async ({ repo, stage, action, lines: lines2, since, until, task, artifact, confirmDataLoss }) => {
+      const res = await tenantControl({ repo, stage, action, ...lines2 != null ? { lines: lines2 } : {}, ...since ? { since } : {}, ...until ? { until } : {}, ...task ? { task } : {}, ...artifact ? { artifact } : {}, ...confirmDataLoss ? { confirmDataLoss } : {} }, registryClientDeps(await loadConfig()));
       if (res.ok) return { ok: true };
       const body = res.body;
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
@@ -51532,8 +51664,8 @@ async function repoWorkflowEntries(client, repo) {
   for (const wf of workflowsList) {
     if (typeof wf?.path !== "string" || !wf.path) continue;
     if (!wf.path.startsWith(".github/workflows/")) continue;
-    const basename3 = wf.path.split("/").pop() ?? wf.path;
-    const name = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+    const basename4 = wf.path.split("/").pop() ?? wf.path;
+    const name = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
     if (wf.state !== "active") {
       disabled.push(name);
       continue;
@@ -54074,7 +54206,7 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
     if (o.confirmDataLoss !== void 0 && (action !== "retire" || stage === "rc")) return fail("runtime tenant control: --confirm-data-loss is dev/main retire-only");
     if (action === "retire" && (stage === "dev" || stage === "main")) {
@@ -54093,12 +54225,17 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
       lines2 = Number(o.lines);
       if (!Number.isInteger(lines2) || lines2 < 1 || lines2 > 2e3) return fail("runtime tenant control: --lines must be an integer between 1 and 2000");
     }
+    for (const [flag, value] of [["--since", o.since], ["--until", o.until]]) {
+      if (value === void 0) continue;
+      if (action !== "logs") return fail(`runtime tenant control: ${flag} is valid only for the logs action`);
+      if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?Z$/.test(value)) return fail(`runtime tenant control: ${flag} must be a UTC time like 2026-10-07T13:10Z`);
+    }
     if (action === "run-task") {
       if (!o.task) return fail("runtime tenant control: run-task requires --task <declared-name>");
     } else if (o.task || o.artifact) {
       return fail("runtime tenant control: --task/--artifact are valid only for run-task");
     }
-    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss });
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines: lines3, failure } = renderVerifySecrets(body);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.97",
+  "version": "4.5.99",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.97",
+  "version": "4.5.99",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -3,6 +3,9 @@ name: gate
 # and v* tags so /release and /hotfix can discover required contexts on the tagged SHA.
 #
 # Runner: self-hosted mmi-runner (mmi-live) — see docs/Guides/gh-runner-runbook.md in MMI-Hub.
+# #7914 (owner, 2026-10-06): this gate holds only fast, deterministic checks. Browser and long suites
+#   (screens, geometry/motion, synthetic, Chrome renders and tests) never go here; they run in their own
+#   workflow, nightly through the Hub schedule plane and on demand (docs/decisions/2026-10-06-browser-checks-nightly.md).
 # #4118: if GATE_CMD runs tsgo or other memory-heavy typecheck / browser work, pin this job to
 #   runs-on: [self-hosted, linux, x64, mmi-heavy]
 # instead — standard lanes are MemoryMax=1200M and will cgroup-OOM those workloads.

package/skills/org-guide/references/work-and-releases.md

@@ -26,6 +26,12 @@ Open a PR through `mmi-cli devops pr create` with a closing issue link, and land
 `mmi-cli devops pr land`. Verify required checks, merge, issue closure, and cleanup before calling
 the implementation complete. A merged implementation is not a production release.
 
+Browser checks and long CI run nightly, never as PR checks (owner, 2026-10-06;
+`docs/decisions/2026-10-06-browser-checks-nightly.md`). The required `gate` holds only fast,
+deterministic checks. Screen, geometry, motion, synthetic and Chrome suites run in a separate
+workflow armed nightly through the Hub schedule plane and on demand; it is never required, and a red
+run updates one `ci-heavy-red` issue. Never add such a suite to a gate or a local test policy.
+
 ## Report MMI tooling bugs
 
 This workflow covers bugs in MMI tooling, including its CLI, plugin, and shared workflows.