@mutmutco/codex-plugin 4.5.98 → 4.5.100

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.98",
+  "version": "4.5.100",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -5731,6 +5731,182 @@ init_github_quota();
 // src/pr-checks-rest.ts
 init_cli_shared();
 
+// ../shared/github-quota-scope.ts
+var import_node_crypto3 = require("node:crypto");
+function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
+  return `github-app-v1:${(0, import_node_crypto3.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
+}
+
+// src/app-actor.ts
+var import_node_crypto4 = require("node:crypto");
+var APP_ACTOR_ENV = "MMI_ACTOR";
+var APP_VAULT_REPO = "mutmutco/MMI-Hub";
+var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
+var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
+  "pr checks-wait",
+  "pr view",
+  "issue list",
+  "issue view",
+  "api get"
+]);
+var APP_POLL_PERMISSIONS = {
+  metadata: "read",
+  contents: "read",
+  pull_requests: "read",
+  // #7185: without issues:read GraphQL silently drops pr view's closingIssuesReferences.
+  issues: "read",
+  checks: "read",
+  statuses: "read",
+  actions: "read"
+};
+var APP_JWT_BACKDATE_S = 60;
+var APP_JWT_TTL_S = 9 * 60;
+var AppActorError = class extends Error {
+  constructor(message2, code = "mint-failed") {
+    super(message2);
+    this.code = code;
+  }
+  code;
+};
+function commandPathOf(cmd) {
+  const parts = [];
+  let cursor = cmd;
+  while (cursor && cursor.parent) {
+    parts.unshift(cursor.name());
+    cursor = cursor.parent;
+  }
+  return parts.join(" ");
+}
+function b64url(input) {
+  return Buffer.from(input).toString("base64url");
+}
+function mintAppJwt(appId, privateKeyPem, nowSec) {
+  if (!Number.isFinite(nowSec)) throw new AppActorError("app actor: invalid clock reading for JWT mint");
+  const now = Math.floor(nowSec);
+  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = b64url(JSON.stringify({
+    iat: now - APP_JWT_BACKDATE_S,
+    exp: now + APP_JWT_TTL_S,
+    iss: appId
+  }));
+  const signer = (0, import_node_crypto4.createSign)("RSA-SHA256");
+  signer.update(`${header}.${payload}`);
+  return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
+}
+var activeQuotaScope;
+function activeAppQuotaScope() {
+  return activeQuotaScope;
+}
+async function mintInstallationToken(deps) {
+  const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
+  if (!appId || !installationId || !privateKey) {
+    const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
+    if (missing.length === APP_VAULT_KEYS.length) {
+      throw new AppActorError(
+        `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
+        "vault-denied"
+      );
+    }
+    throw new AppActorError(
+      `app actor: vault carries a PARTIAL App credential set \u2014 missing ${missing.join(", ")} (${APP_VAULT_REPO} tier); fix the vault. Automation fails closed, no personal-token fallback`,
+      "mint-failed"
+    );
+  }
+  const nowSec = deps.nowSec ?? (() => Math.floor(Date.now() / 1e3));
+  let res;
+  try {
+    const jwt = mintAppJwt(appId.trim(), privateKey, nowSec());
+    res = await deps.fetch(`https://api.github.com/app/installations/${installationId.trim()}/access_tokens`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${jwt}`,
+        accept: "application/vnd.github+json",
+        "content-type": "application/json",
+        "user-agent": "mmi-cli-app-actor"
+      },
+      body: JSON.stringify({ permissions: APP_POLL_PERMISSIONS })
+    });
+  } catch (e) {
+    if (e instanceof AppActorError) throw e;
+    throw new AppActorError(`app actor: token mint transport failed (${e?.constructor?.name ?? "Error"}) \u2014 automation fails closed, no personal-token fallback`);
+  }
+  if (!res.ok) {
+    throw new AppActorError(`app actor: installation token mint failed (HTTP ${res.status}) \u2014 automation fails closed, no personal-token fallback`);
+  }
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    throw new AppActorError("app actor: mint response unparsable \u2014 automation fails closed");
+  }
+  if (!body.token || !body.expires_at) {
+    throw new AppActorError("app actor: mint response carried no token \u2014 automation fails closed");
+  }
+  return { token: body.token, expiresAt: body.expires_at, quotaScope: appQuotaScope(appId, installationId, process.env.GITHUB_API_URL) };
+}
+async function pollTokenOrUndefined(deps) {
+  try {
+    return (await mintInstallationToken(deps)).token;
+  } catch {
+    return void 0;
+  }
+}
+var APP_POLL_HEADROOM_FRACTION = 0.4;
+var APP_POLL_RESET_DEFAULT_MS = 36e5;
+var appPollGuardState = {};
+function appPollGuardSnapshot() {
+  return { ...appPollGuardState };
+}
+function appPollAllowsApp(nowMs) {
+  if (appPollGuardState.fallbackUntilMs !== void 0) {
+    if (nowMs < appPollGuardState.fallbackUntilMs) return false;
+    appPollGuardState = {};
+  }
+  const { remaining, limit } = appPollGuardState;
+  if (remaining === void 0 || limit === void 0 || limit <= 0) return true;
+  return remaining / limit >= APP_POLL_HEADROOM_FRACTION;
+}
+function latchAppPollFallback(nowMs) {
+  appPollGuardState.fallbackUntilMs = appPollGuardState.resetAtMs ?? nowMs + APP_POLL_RESET_DEFAULT_MS;
+}
+function noteAppPollResponse(headers, rateLimited, nowMs) {
+  if (headers.remaining !== void 0) appPollGuardState.remaining = headers.remaining;
+  if (headers.limit !== void 0) appPollGuardState.limit = headers.limit;
+  if (headers.resetSec !== void 0 && headers.resetSec > 0) appPollGuardState.resetAtMs = headers.resetSec * 1e3;
+  const { remaining, limit } = appPollGuardState;
+  const belowFloor = !rateLimited && remaining !== void 0 && limit !== void 0 && limit > 0 && remaining / limit < APP_POLL_HEADROOM_FRACTION;
+  const headroomUnverifiable = !rateLimited && (headers.remaining === void 0 || headers.limit === void 0);
+  if (rateLimited || belowFloor || headroomUnverifiable && appPollGuardState.resetAtMs !== void 0) {
+    latchAppPollFallback(nowMs);
+  }
+}
+function resetAppPollGuard() {
+  appPollGuardState = {};
+}
+var notedIneligibleCommand = false;
+async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
+`)) {
+  activeQuotaScope = void 0;
+  const requested = (env[APP_ACTOR_ENV] ?? "").trim();
+  if (!requested) return "personal";
+  if (requested !== "app") {
+    throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' is supported; refusing to guess an identity`);
+  }
+  if (!APP_ELIGIBLE_COMMANDS.has(commandPath3)) {
+    if (!notedIneligibleCommand) {
+      notedIneligibleCommand = true;
+      note(`app actor: '${commandPath3}' is personal-only (viewer/@me/authorship) \u2014 running on the personal token despite ${APP_ACTOR_ENV}=app`);
+    }
+    return "personal";
+  }
+  delete env.GH_TOKEN;
+  delete env.GITHUB_TOKEN;
+  const minted = await mint();
+  env.GH_TOKEN = minted.token;
+  activeQuotaScope = minted.quotaScope;
+  return "app";
+}
+
 // src/merge-ci-policy.ts
 function resolveMergeCiPolicy(input) {
   if (input.registryCi === "none") {
@@ -6111,12 +6287,19 @@ function isReleaseShaDeployEnumerationCandidate(row, nonDeployEvents) {
 }
 
 // src/pr-checks-rest.ts
+init_github_quota();
 var REST_GH_TIMEOUT_MS = 2e4;
 var pollTokenProvider;
 var pollTokenOnce;
+var lastPollSource;
+function lastRestPollSource() {
+  return lastPollSource;
+}
 function setPollTokenProvider(provider) {
   pollTokenProvider = provider;
   pollTokenOnce = void 0;
+  resetAppPollGuard();
+  lastPollSource = void 0;
 }
 async function pollToken() {
   if (!pollTokenProvider) return void 0;
@@ -6137,24 +6320,60 @@ function parseIncludedOutput(out) {
   });
   return { body, status, etag, pages };
 }
+function parseRateLimitHeaders(out) {
+  const first = (name) => {
+    const match = new RegExp(`^x-ratelimit-${name}:\\s*(\\d+)\\s*$`, "im").exec(out);
+    return match ? Number(match[1]) : void 0;
+  };
+  return { remaining: first("remaining"), limit: first("limit"), resetSec: first("reset") };
+}
 var etagCache = /* @__PURE__ */ new Map();
+function appPoolDetail() {
+  const guard = appPollGuardSnapshot();
+  const counts = guard.remaining !== void 0 && guard.limit !== void 0 ? `App pool at ${guard.remaining}/${guard.limit}` : "App pool headroom unverified";
+  return guard.resetAtMs !== void 0 ? `${counts}, resets ${new Date(guard.resetAtMs).toISOString()}` : counts;
+}
 async function defaultGhApi(args) {
-  const key = args.join("\0");
-  const cached = etagCache.get(key);
-  let stdout;
-  try {
-    ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
-      timeout: REST_GH_TIMEOUT_MS
-    }));
-  } catch (e) {
-    const out = e.stdout;
-    if (cached && typeof out === "string" && parseIncludedOutput(out).status === 304) return cached.body;
-    throw e;
+  const appToken = await pollToken();
+  let source = appToken && appPollAllowsApp(Date.now()) ? "app" : "user";
+  if (lastPollSource !== void 0 && lastPollSource !== source) {
+    console.warn(source === "user" ? `poll credential: ${appPoolDetail()} \u2014 below the ${APP_POLL_HEADROOM_FRACTION * 100}% App-poll headroom floor (#7843); REST poll reads switch to the ambient user token until the App pool resets` : "poll credential: App pool reset passed \u2014 REST poll reads return to the App installation token (#7843)");
+  }
+  for (; ; ) {
+    const key = `${source}\0${args.join("\0")}`;
+    const cached = etagCache.get(key);
+    let stdout;
+    try {
+      ({ stdout } = await execFileP("gh", ["api", "--include", ...cached ? ["-H", `If-None-Match: ${cached.etag}`] : [], ...args], {
+        timeout: REST_GH_TIMEOUT_MS,
+        // Only on the App source: passing `env` at all replaces the inherited environment wholesale,
+        // and `gh` needs the rest of it (PATH, GH_HOST, config home). Ambient rides the inherited env.
+        ...source === "app" && appToken ? { env: { ...process.env, GH_TOKEN: appToken } } : {}
+      }));
+    } catch (e) {
+      const out = e.stdout;
+      const errOut = typeof out === "string" ? out : void 0;
+      const status = errOut !== void 0 ? parseIncludedOutput(errOut).status : void 0;
+      if (cached && status === 304) {
+        lastPollSource = source;
+        return cached.body;
+      }
+      if (source === "app" && appToken && (status === 403 || status === 429)) {
+        noteAppPollResponse(parseRateLimitHeaders(errOut), true, Date.now());
+        console.warn(`poll credential: App pool refused the read (HTTP ${status}, ${appPoolDetail()}) \u2014 REST poll reads switch to the ambient user token until the App pool resets (#7843)`);
+        lastPollSource = "user";
+        source = "user";
+        continue;
+      }
+      throw e;
+    }
+    const { body, etag, pages } = parseIncludedOutput(stdout);
+    if (source === "app") noteAppPollResponse(parseRateLimitHeaders(stdout), false, Date.now());
+    lastPollSource = source;
+    if (etag && pages === 1) etagCache.set(key, { etag, body });
+    else etagCache.delete(key);
+    return body;
   }
-  const { body, etag, pages } = parseIncludedOutput(stdout);
-  if (etag && pages === 1) etagCache.set(key, { etag, body });
-  else etagCache.delete(key);
-  return body;
 }
 function classifyCheckRun(run) {
   if (run.status !== "completed") return "pending";
@@ -6300,12 +6519,20 @@ async function ambientGhApi(args) {
   const { stdout } = await execFileP("gh", ["api", ...args], { timeout: REST_GH_TIMEOUT_MS });
   return stdout;
 }
-async function fetchRestRepoMergeSettings(repo, gh2 = defaultGhApi, ambientGh = ambientGhApi) {
-  const primary = await readRepoMergeSettingsOnce(repo, gh2);
-  if (primary.proven) return primary;
-  const fallback = await readRepoMergeSettingsOnce(repo, ambientGh);
-  if (fallback.proven) return fallback;
-  return { proven: false, reason: `${primary.reason}; ambient fallback: ${fallback.reason}` };
+var REPO_SETTINGS_RATE_LIMIT_DELAYS_MS = [15e3, 45e3];
+async function fetchRestRepoMergeSettings(repo, gh2 = defaultGhApi, ambientGh = ambientGhApi, options = {}) {
+  const delays = options.delaysMs ?? REPO_SETTINGS_RATE_LIMIT_DELAYS_MS;
+  const sleep2 = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  for (let attempt = 0; ; attempt++) {
+    const primary = await readRepoMergeSettingsOnce(repo, gh2);
+    if (primary.proven) return primary;
+    const fallback = await readRepoMergeSettingsOnce(repo, ambientGh);
+    if (fallback.proven) return fallback;
+    const reason = `${primary.reason}; ambient fallback: ${fallback.reason}`;
+    if (attempt >= delays.length || !isRateLimitText(reason)) return { proven: false, reason };
+    console.warn(`pr merge: repository settings read was rate-limited; retrying in ${Math.round(delays[attempt] / 1e3)}s`);
+    await sleep2(delays[attempt]);
+  }
 }
 var PR_SNAPSHOT_READ_RETRIES = 3;
 var PR_SNAPSHOT_READ_DELAY_MS = 2e3;
@@ -7496,9 +7723,9 @@ function extractWorkflowCrons(yamlText) {
 function workflowEntry(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   if (!crons.length) return null;
-  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
+  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
   return {
-    name: `${repo}/${basename3.replace(/\.ya?ml$/, "")}`,
+    name: `${repo}/${basename4.replace(/\.ya?ml$/, "")}`,
     cadence: crons.join(" + "),
     executor: "github-actions",
     llm: llmFromHeader(yamlText),
@@ -7827,8 +8054,8 @@ function scheduleRecordFromWorkflow(repo, workflowPath, yamlText) {
   const crons = extractWorkflowCrons(yamlText);
   const header = parseScheduleHeader(yamlText);
   if (!crons.length && !header.schedule) return null;
-  const basename3 = workflowPath.split("/").pop() ?? workflowPath;
-  const expectedId = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+  const basename4 = workflowPath.split("/").pop() ?? workflowPath;
+  const expectedId = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
   if (isHarbourUnmanaged(yamlText)) return null;
   const missing = SCHEDULE_HEADER_FIELDS.filter((f) => !header[f]);
   if (missing.length) {
@@ -8061,6 +8288,28 @@ async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
     return { ok: false, status: 0, body: null, error: e.message, unreachable: "transport" };
   }
 }
+async function edgeDnsForStage(slug, stage, deps, ensure = false) {
+  if (!deps.baseUrl) throw new Error("Hub API URL unavailable");
+  const token = await deps.token();
+  if (!token) throw new Error("Hub session token unavailable");
+  const path2 = `/projects/${encodeURIComponent(slug)}/edge-dns/${stage}`;
+  let body;
+  if (ensure) {
+    const write = await postJson(path2, {}, deps, "POST", { noRetry: true });
+    if (!write.ok) throw new Error(`Hub edge dns ensure failed: ${write.error ?? `HTTP ${write.status}`}`);
+    body = write.body;
+  } else {
+    const res = await retriedFetch(
+      deps,
+      `${deps.baseUrl.replace(/\/$/, "")}${path2}`,
+      { method: "GET", headers: { Authorization: `Bearer ${token}` } }
+    );
+    if (!res.ok) throw new Error(`Hub edge dns read failed: HTTP ${res.status}`);
+    body = await res.json();
+  }
+  if (typeof body?.required !== "boolean") throw new Error("Hub edge dns response invalid");
+  return body;
+}
 async function edgeCertificateForStage(slug, stage, deps, ensure = false) {
   if (!deps.baseUrl) throw new Error("Hub API URL unavailable");
   const token = await deps.token();
@@ -9247,7 +9496,7 @@ init_clean_exit();
 var import_promises = require("node:fs/promises");
 var import_node_os4 = require("node:os");
 var import_node_path9 = require("node:path");
-var import_node_crypto3 = require("node:crypto");
+var import_node_crypto5 = require("node:crypto");
 
 // src/board-priority.ts
 var BOARD_PRIORITY_NAMES = ["Urgent", "High", "Medium", "Low"];
@@ -9334,7 +9583,7 @@ async function bodyArgsViaFile(args, deps = {}) {
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os4.tmpdir)();
-  const file = (0, import_node_path9.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.md`);
+  const file = (0, import_node_path9.join)(dir, `mmi-gh-body-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.md`);
   await ensureDir((0, import_node_path9.dirname)(file), { recursive: true }).catch(() => {
   });
   await write(file, args[i + 1], "utf8");
@@ -9664,7 +9913,7 @@ async function defaultRestCreatePr(exec2, input, deps = {}) {
   const remove2 = deps.remove ?? import_promises.unlink;
   const ensureDir = deps.ensureDir ?? import_promises.mkdir;
   const dir = deps.dir ?? (0, import_node_os4.tmpdir)();
-  const file = (0, import_node_path9.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}.json`);
+  const file = (0, import_node_path9.join)(dir, `mmi-rest-pr-${process.pid}-${(0, import_node_crypto5.randomBytes)(4).toString("hex")}.json`);
   const payload = {
     title: input.title,
     head: input.head,
@@ -11064,7 +11313,7 @@ function findDuplicateLesson(source, openLessons) {
 }
 
 // src/session-identity.ts
-var import_node_crypto4 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_os8 = require("node:os");
 
 // src/plugin-guard-io.ts
@@ -11948,7 +12197,7 @@ function readSessionIdSource(env) {
 var synthesizedSessionId;
 function fallbackSessionId(surface) {
   if (!synthesizedSessionId) {
-    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto4.randomBytes)(3).toString("hex")}`;
+    synthesizedSessionId = `${SYNTH_SESSION_PREFIX}${surface}-${process.pid}-${(0, import_node_crypto6.randomBytes)(3).toString("hex")}`;
   }
   return synthesizedSessionId;
 }
@@ -14646,7 +14895,7 @@ async function propagateMayAutoMerge(repo, repoClass, rest) {
 }
 
 // src/bootstrap-apply.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 
 // src/bootstrap-seeds.ts
 var PLACEHOLDER_RE = /\{\{([A-Z0-9_]+)\}\}/g;
@@ -15634,8 +15883,11 @@ function edgeDomainsByStage(meta) {
   }
   return out;
 }
-function inferEdgeDomainsForWrite(slug) {
+function inferEdgeDomainsForWrite(slug, suite) {
   const subdomain = defaultSubdomain(slug);
+  if (suite === "mm-work" && slug !== suite) {
+    return { dev: `dev.${subdomain}.mutmut.work`, main: `${subdomain}.mutmut.work` };
+  }
   return {
     dev: `dev.${subdomain}.mutatismutandis.co`,
     rc: `rc.${subdomain}.mutatismutandis.co`,
@@ -15877,7 +16129,7 @@ function planSeedAction(seed, exists) {
   return exists ? { target: seed.target, action: "update", ownership: "org", reason: "org-owned, refresh to current" } : { target: seed.target, action: "create", ownership: "org", reason: "org-owned, missing" };
 }
 var GATE_RENDER_NOTE = "# Rendered from the registry gate config by mmi-cli devops bootstrap apply <repo> --only gate.yml --from-config; edit the config, not this file.\n";
-var gateHash = (body) => (0, import_node_crypto5.createHash)("sha256").update(body, "utf8").digest("hex");
+var gateHash = (body) => (0, import_node_crypto7.createHash)("sha256").update(body, "utf8").digest("hex");
 function parseGateRenderStamp(content) {
   const match = /^# mmi-gate-render: sha256=([a-f0-9]{64})\n/.exec(content);
   return match ? { hash: match[1], body: content.slice(match[0].length) } : null;
@@ -16009,10 +16261,11 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
   }
   const deployModel = inferDeployModelForWrite({ ...shape, projectType }, parsedRepo.fullName);
   const releaseTrack = (isReleaseTrack(options.releaseTrack) ? options.releaseTrack : void 0) ?? (isReleaseTrack(options.existing?.releaseTrack) ? options.existing.releaseTrack : void 0) ?? resolveBootstrapReleaseTrack(cls, void 0);
-  const inferredDomains = inferEdgeDomainsForWrite(slug);
-  const derivedDomains = Object.fromEntries(branchesForTrack(releaseTrack).map((branch) => {
+  const suite = vars.SUITE || options.existing?.suite || void 0;
+  const inferredDomains = inferEdgeDomainsForWrite(slug, suite);
+  const derivedDomains = Object.fromEntries(branchesForTrack(releaseTrack).flatMap((branch) => {
     const stage = branch === "development" ? "dev" : branch;
-    return [stage, inferredDomains[stage]];
+    return inferredDomains[stage] ? [[stage, inferredDomains[stage]]] : [];
   }));
   const num = (v) => {
     if (v == null || v === "") return void 0;
@@ -16036,6 +16289,7 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     // Identity. name/division default off the repo name when the skill didn't pass them.
     name: vars.NAME || parsedRepo.name,
     division: vars.DIVISION || parsedRepo.name.split("-")[0] || void 0,
+    suite: vars.SUITE || void 0,
     repos: [`${parsedRepo.owner}/${slug}`],
     branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
     class: cls,
@@ -16135,6 +16389,11 @@ function decideSeedPrAction(openPrs) {
   }
   return { action: "create" };
 }
+function decideFirstDevDeploy(input) {
+  if (!input.devRowWritten) return "skip";
+  if (input.seedMode === "direct") return "dispatch";
+  return (input.seedPrs ?? []).some((pr) => typeof pr?.mergedAt === "string" && pr.mergedAt !== "") ? "dispatch" : "defer";
+}
 function decideSeedDelivery(branchRules) {
   const rules = Array.isArray(branchRules) ? branchRules : [];
   const types = new Set(
@@ -17345,10 +17604,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.98",
-    tag: "v4.5.98",
-    commit: "125c59187d10",
-    npm: "@mutmutco/cli@4.5.98"
+    version: "4.5.100",
+    tag: "v4.5.100",
+    commit: "ba367dd0d814",
+    npm: "@mutmutco/cli@4.5.100"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17365,14 +17624,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.98"
+          v3Target: "v4.5.100"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.98 and redeploy the Hub Lambda from tag v4.5.98 (125c59187d10); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.98 (@mutmutco/cli@4.5.98, tag commit 125c59187d10 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.100 and redeploy the Hub Lambda from tag v4.5.100 (ba367dd0d814); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.100 (@mutmutco/cli@4.5.100, tag commit ba367dd0d814 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -19730,7 +19989,9 @@ async function correlateRun(deps, args) {
       return Number.isFinite(created) && created < threshold;
     });
     const tokens2 = args.mode === "dispatch" ? args.titleIncludes : void 0;
-    const titleMatch = tokens2 && tokens2.length ? candidates.find((c) => tokens2.every((t) => (c.row.displayTitle ?? "").includes(t))) : void 0;
+    const fieldsFrom = args.mode === "dispatch" ? args.titleFieldsFrom : void 0;
+    const titleHas = (title) => fieldsFrom === void 0 ? tokens2.every((t) => title.includes(t)) : tokens2.every((t, i) => title.split(" ")[fieldsFrom + i] === t);
+    const titleMatch = tokens2 && tokens2.length ? candidates.find((c) => titleHas(c.row.displayTitle ?? "")) : void 0;
     const match = titleMatch ?? (!("requireTitleMatch" in args && args.requireTitleMatch) && (args.mode === "workflow" || windowProvenWhole) ? candidates[0] : void 0);
     if (match) return { runId: match.row.databaseId, runUrl: match.row.url, read: "found" };
     if (!windowProvenWhole) truncatedWindow = true;
@@ -19756,7 +20017,7 @@ function correlateGetPublishRun(deps, since, product, mode) {
   return correlateRun(deps, { workflow: "get-publish.yml", since, mode: "dispatch", titleIncludes: [product, ...mode ? [mode] : []], ...mode ? { requireTitleMatch: true } : {} });
 }
 function correlateControlRun(deps, since, titleIncludes) {
-  return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes });
+  return correlateRun(deps, { workflow: "tenant-control.yml", since, mode: "dispatch", titleIncludes, titleFieldsFrom: 2, ...titleIncludes?.length ? { requireTitleMatch: true } : {} });
 }
 function correlateReconcileRun(deps, since, titleIncludes) {
   return correlateRun(deps, { workflow: "tenant-reconcile.yml", since, mode: "dispatch", titleIncludes });
@@ -21562,7 +21823,7 @@ async function runTenantControl(deps, options) {
   const watch = options.watch ?? tenantControlWatches(action);
   const base = { command: "tenant-control", repo, stage, action };
   const since = (deps.now ?? Date.now)();
-  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
+  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, since: options.logSince, until: options.logUntil, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
   if (!d.ok) {
     const transport = d.category === "transport-failed";
     return {
@@ -22778,7 +23039,7 @@ function checkLineEndings(probe) {
 // src/release-ledger.ts
 var import_node_fs22 = require("node:fs");
 var import_node_path22 = require("node:path");
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 
 // src/file-lock.ts
 var import_promises2 = require("node:fs/promises");
@@ -23140,7 +23401,7 @@ function releaseLedgerPath(cwd) {
 }
 function atomicWriteJson(path2, ledger) {
   (0, import_node_fs22.mkdirSync)((0, import_node_path22.dirname)(path2), { recursive: true });
-  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto6.randomBytes)(4).toString("hex")}`;
+  const tmp = `${path2}.tmp-${process.pid}-${(0, import_node_crypto8.randomBytes)(4).toString("hex")}`;
   (0, import_node_fs22.writeFileSync)(tmp, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
   (0, import_node_fs22.renameSync)(tmp, path2);
@@ -29869,150 +30130,6 @@ function renderPluginCachePlan(plan, applied) {
   return lines2.join("\n");
 }
 
-// ../shared/github-quota-scope.ts
-var import_node_crypto7 = require("node:crypto");
-function appQuotaScope(appId, installationId, origin = "https://api.github.com", resource = "graphql") {
-  return `github-app-v1:${(0, import_node_crypto7.createHash)("sha256").update(JSON.stringify([new URL(origin).origin, appId.trim(), installationId.trim(), resource])).digest("hex")}`;
-}
-
-// src/app-actor.ts
-var import_node_crypto8 = require("node:crypto");
-var APP_ACTOR_ENV = "MMI_ACTOR";
-var APP_VAULT_REPO = "mutmutco/MMI-Hub";
-var APP_VAULT_KEYS = ["GITHUB_APP_ID", "GITHUB_APP_INSTALLATION_ID", "GITHUB_APP_PRIVATE_KEY"];
-var APP_ELIGIBLE_COMMANDS = /* @__PURE__ */ new Set([
-  "pr checks-wait",
-  "pr view",
-  "issue list",
-  "issue view",
-  "api get"
-]);
-var APP_POLL_PERMISSIONS = {
-  metadata: "read",
-  contents: "read",
-  pull_requests: "read",
-  // #7185: without issues:read GraphQL silently drops pr view's closingIssuesReferences.
-  issues: "read",
-  checks: "read",
-  statuses: "read",
-  actions: "read"
-};
-var APP_JWT_BACKDATE_S = 60;
-var APP_JWT_TTL_S = 9 * 60;
-var AppActorError = class extends Error {
-  constructor(message2, code = "mint-failed") {
-    super(message2);
-    this.code = code;
-  }
-  code;
-};
-function commandPathOf(cmd) {
-  const parts = [];
-  let cursor = cmd;
-  while (cursor && cursor.parent) {
-    parts.unshift(cursor.name());
-    cursor = cursor.parent;
-  }
-  return parts.join(" ");
-}
-function b64url(input) {
-  return Buffer.from(input).toString("base64url");
-}
-function mintAppJwt(appId, privateKeyPem, nowSec) {
-  if (!Number.isFinite(nowSec)) throw new AppActorError("app actor: invalid clock reading for JWT mint");
-  const now = Math.floor(nowSec);
-  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
-  const payload = b64url(JSON.stringify({
-    iat: now - APP_JWT_BACKDATE_S,
-    exp: now + APP_JWT_TTL_S,
-    iss: appId
-  }));
-  const signer = (0, import_node_crypto8.createSign)("RSA-SHA256");
-  signer.update(`${header}.${payload}`);
-  return `${header}.${payload}.${signer.sign(privateKeyPem, "base64url")}`;
-}
-var activeQuotaScope;
-function activeAppQuotaScope() {
-  return activeQuotaScope;
-}
-async function mintInstallationToken(deps) {
-  const [appId, installationId, privateKey] = await Promise.all(APP_VAULT_KEYS.map((k) => deps.fetchSecret(k)));
-  if (!appId || !installationId || !privateKey) {
-    const missing = APP_VAULT_KEYS.filter((_, i) => ![appId, installationId, privateKey][i]);
-    if (missing.length === APP_VAULT_KEYS.length) {
-      throw new AppActorError(
-        `app actor: vault denied all App credentials (${APP_VAULT_REPO} tier) \u2014 not an automation host, or no vault access`,
-        "vault-denied"
-      );
-    }
-    throw new AppActorError(
-      `app actor: vault carries a PARTIAL App credential set \u2014 missing ${missing.join(", ")} (${APP_VAULT_REPO} tier); fix the vault. Automation fails closed, no personal-token fallback`,
-      "mint-failed"
-    );
-  }
-  const nowSec = deps.nowSec ?? (() => Math.floor(Date.now() / 1e3));
-  let res;
-  try {
-    const jwt = mintAppJwt(appId.trim(), privateKey, nowSec());
-    res = await deps.fetch(`https://api.github.com/app/installations/${installationId.trim()}/access_tokens`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${jwt}`,
-        accept: "application/vnd.github+json",
-        "content-type": "application/json",
-        "user-agent": "mmi-cli-app-actor"
-      },
-      body: JSON.stringify({ permissions: APP_POLL_PERMISSIONS })
-    });
-  } catch (e) {
-    if (e instanceof AppActorError) throw e;
-    throw new AppActorError(`app actor: token mint transport failed (${e?.constructor?.name ?? "Error"}) \u2014 automation fails closed, no personal-token fallback`);
-  }
-  if (!res.ok) {
-    throw new AppActorError(`app actor: installation token mint failed (HTTP ${res.status}) \u2014 automation fails closed, no personal-token fallback`);
-  }
-  let body;
-  try {
-    body = await res.json();
-  } catch {
-    throw new AppActorError("app actor: mint response unparsable \u2014 automation fails closed");
-  }
-  if (!body.token || !body.expires_at) {
-    throw new AppActorError("app actor: mint response carried no token \u2014 automation fails closed");
-  }
-  return { token: body.token, expiresAt: body.expires_at, quotaScope: appQuotaScope(appId, installationId, process.env.GITHUB_API_URL) };
-}
-async function pollTokenOrUndefined(deps) {
-  try {
-    return (await mintInstallationToken(deps)).token;
-  } catch {
-    return void 0;
-  }
-}
-var notedIneligibleCommand = false;
-async function activateAppActor(commandPath3, env, mint, note = (line) => process.stderr.write(`${line}
-`)) {
-  activeQuotaScope = void 0;
-  const requested = (env[APP_ACTOR_ENV] ?? "").trim();
-  if (!requested) return "personal";
-  if (requested !== "app") {
-    throw new AppActorError(`app actor: unknown ${APP_ACTOR_ENV} value \u2014 only 'app' is supported; refusing to guess an identity`);
-  }
-  if (!APP_ELIGIBLE_COMMANDS.has(commandPath3)) {
-    if (!notedIneligibleCommand) {
-      notedIneligibleCommand = true;
-      note(`app actor: '${commandPath3}' is personal-only (viewer/@me/authorship) \u2014 running on the personal token despite ${APP_ACTOR_ENV}=app`);
-    }
-    return "personal";
-  }
-  delete env.GH_TOKEN;
-  delete env.GITHUB_TOKEN;
-  const minted = await mint();
-  env.GH_TOKEN = minted.token;
-  activeQuotaScope = minted.quotaScope;
-  return "app";
-}
-
 // src/board-commands.ts
 init_cli_shared();
 
@@ -33805,6 +33922,28 @@ function edgeCertificateChecks(results) {
     }];
   });
 }
+function edgeDnsChecks(results, repo) {
+  return results.flatMap(({ stage, status, error }) => {
+    if (!error && status?.required === false) return [];
+    const bad = (status?.hosts ?? []).filter((h) => h.status === "missing" || h.status === "conflict");
+    const ok = !error && status?.complete !== false && bad.length === 0;
+    return [{
+      ok,
+      label: `Cloudflare edge DNS: ${stage}`,
+      detail: ok ? void 0 : error ? `DNS records unreadable (${error})` : `${bad.map((h) => `${h.host} ${h.status}${h.hint ? ` (${h.hint})` : ""}`).join("; ")} \u2014 run: mmi-cli devops runtime edge dns ensure ${repo} ${stage}`
+    }];
+  });
+}
+function firstDevDeployCheck(repo, facts, factsRead) {
+  const dev = facts?.stages?.dev;
+  if (!factsRead || dev?.present !== true) return [];
+  const ok = Boolean(dev.deployedAt || dev.deployedTag);
+  return [{
+    ok,
+    label: "first dev deploy happened",
+    detail: ok ? void 0 : `DEPLOY#dev has never deployed \u2014 run: mmi-cli devops runtime tenant redeploy ${repo} dev --watch`
+  }];
+}
 async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   const branchesWanted = expectedBranches(repoClass, releaseTrack);
   const baseBranch = releaseTrack === "trunk" || repoClass === "content" ? "main" : "development";
@@ -33927,6 +34066,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     if (check) checks.push(check);
   }
   checks.push(...edgeCertificateChecks(deps.edgeCertificates ?? []));
+  checks.push(...edgeDnsChecks(deps.edgeDns ?? [], repo));
   const portRangeCheck = centralContainerPortRangeCheck(deps.deployModel, deps.projectMeta?.portRange, repo);
   if (portRangeCheck) checks.push(portRangeCheck);
   checks.push(...deployRowChecks(
@@ -33937,6 +34077,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     deps.deployFactsRead === true,
     deps.projectMeta?.suite
   ));
+  checks.push(...firstDevDeployCheck(repo, deps.deployFacts, deps.deployFactsRead === true));
   const readme = await contentText(deps, repo, baseBranch, "README.md");
   checks.push({
     ok: readme !== null && readme.includes("## Agent context"),
@@ -34375,6 +34516,13 @@ function registerBootstrapCommands(program3) {
           return { stage, error: e.message };
         }
       })),
+      edgeDns: await Promise.all(["dev", "rc", "main"].filter((stage) => deployFacts?.stages?.[stage]?.present).map(async (stage) => {
+        try {
+          return { stage, status: await edgeDnsForStage(slug, stage, reg) };
+        } catch (e) {
+          return { stage, error: e.message };
+        }
+      })),
       pushAllowlistOwners: verifyOwners,
       pushAllowlistOwnersRead: verifyOwnersRead,
       readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null,
@@ -34772,7 +34920,7 @@ function registerBootstrapCommands(program3) {
         github,
         deployFacts: controlDeployFacts,
         deployFactsRead: controlDeployFacts !== null,
-        plannedMainDomain: registryMeta?.edgeDomains?.main ?? inferEdgeDomainsForWrite(slug).main
+        plannedMainDomain: registryMeta?.edgeDomains?.main ?? inferEdgeDomainsForWrite(slug, suiteSlug || vars.SUITE).main
       });
       if (o.box) {
         if (applyDeployModel !== "tenant-container" && applyDeployModel !== "solo-container")
@@ -34793,7 +34941,7 @@ function registerBootstrapCommands(program3) {
             host: found.box.address,
             box: found.box.name,
             owners: scan.rows,
-            domains: { ...inferEdgeDomainsForWrite(slug), ...domains, ...boxDomains },
+            domains: { ...inferEdgeDomainsForWrite(slug, suiteSlug || vars.SUITE), ...domains, ...boxDomains },
             fileless: applyDeployModel === "tenant-container"
           });
           controlRows = planned.rows;
@@ -35224,6 +35372,42 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
           ddbWrites.push({ slug, action: `deploy-${coord.stage}`, record: payload });
           applied.push(`DEPLOY#${coord.stage} ${coord.host}:${coord.port}${coord.domain ? ` ${coord.domain}` : ""}`);
         }
+        for (const coord of boxDeployPlan) {
+          try {
+            const dns = await edgeDnsForStage(slug, coord.stage, registryClientDeps(await loadConfig()), true);
+            const bad = (dns.hosts ?? []).filter((h) => h.status === "conflict");
+            applied.push(`edge dns ${coord.stage}: ${dns.required ? (dns.hosts ?? []).map((h) => `${h.host} ${h.status}`).join(", ") : "not required"}`);
+            for (const h of bad) deferredFailures.push(`edge dns ${coord.stage} ${h.host}: ${h.hint}`);
+          } catch (e) {
+            applied.push(`edge dns ${coord.stage} (failed: ${e.message})`);
+            deferredFailures.push(`edge dns ${coord.stage} not ensured: ${e.message}; re-run: mmi-cli devops runtime edge dns ensure ${repo} ${coord.stage}`);
+          }
+        }
+        let seedPrs = [];
+        if (seedPlan.mode === "pr" && seedPlan.branch) {
+          try {
+            seedPrs = JSON.parse((await gh2(["pr", "list", "--repo", repo, "--head", seedPlan.branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,mergedAt"])).stdout || "[]");
+          } catch {
+            seedPrs = [];
+          }
+        }
+        const firstDeploy = decideFirstDevDeploy({ devRowWritten: boxDeployPlan.some((c) => c.stage === "dev"), seedMode: seedPlan.mode, seedPrs });
+        if (firstDeploy === "defer") {
+          applied.push("first dev deploy: deferred \u2014 the seed PR is not merged; the Hub dev auto-deploy runs on its merge (DEPLOY#dev now exists)");
+        } else if (firstDeploy === "dispatch") {
+          try {
+            const out = await execFileP(process.execPath, [process.argv[1], ...canonicalArgvFor(["runtime", "tenant", "redeploy", repo, "dev", "--json"])], { timeout: 12e4 });
+            let run = {};
+            try {
+              run = JSON.parse(out.stdout);
+            } catch {
+            }
+            applied.push(`first dev deploy dispatched at development: ${run.runUrl ?? run.dispatch ?? "run not yet correlated"}`);
+          } catch (e) {
+            applied.push(`first dev deploy (failed: ${e.message.split("\n")[0]})`);
+            deferredFailures.push(`first dev deploy not dispatched; run: mmi-cli devops runtime tenant redeploy ${repo} dev --watch`);
+          }
+        }
         controlRows = controlRows.map((row) => {
           const coord = boxDeployPlan.find((p) => row.target === `DEPLOY#${p.stage}`);
           return coord ? {
@@ -42667,6 +42851,13 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
   const repo = await requireRepo(repoOption);
   const { client, throttledPaths } = withRateLimitRetry(withAppClaimMarkerRead(deps.client ?? defaultGitHubClient(), deps.appClient), deps);
   const actor = deps.actor ?? describeSessionIdentity();
+  let viewerLogin = deps.viewerLogin;
+  if (!viewerLogin) {
+    try {
+      viewerLogin = (await client.rest("GET", "user"))?.login;
+    } catch {
+    }
+  }
   const source = deps.actorSource ?? (deps.actor ? "the caller-supplied identity" : readSessionIdSource(process.env) ?? "a synthesized fallback");
   const requester = `requesting lane: ${actor.surface}/${actor.session}@${actor.host} (session id from ${source})`;
   const checkContest = deps.checkContest ?? checkLaneContest;
@@ -42680,7 +42871,7 @@ async function prCreateClaimRefusal(body, repoOption, deps = {}) {
       }
     }
     if (state?.toLowerCase() === "closed") continue;
-    const contest = await checkContest(client, { repository: repo, number }, actor);
+    const contest = await checkContest(client, { repository: repo, number }, actor, viewerLogin);
     if (!contest.contested) continue;
     const ref = `${repo}#${number}`;
     const commentsPath = `repos/${repo}/issues/${number}/comments`;
@@ -44459,6 +44650,9 @@ function renderPrMergeCleanupLines(cleanup) {
 
 // src/worktree-residue-sweep.ts
 var RESIDUE_LEDGER_FILE = "mmi-worktree-residue.json";
+function canonicalWorktreeRoot(primary) {
+  return (0, import_node_path41.join)((0, import_node_path41.dirname)(primary), "mmi-worktrees", (0, import_node_path41.basename)(primary));
+}
 function norm(p) {
   const s = p.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? s.toLowerCase() : s;
@@ -44527,16 +44721,14 @@ async function sweepWorktreeResidue(gitCommonDir, registered, deps = {}) {
     }
   }
   if (recorded.length) writePaths(file, remaining, deps);
-  const roots = /* @__PURE__ */ new Set();
-  for (const p of [...registered.slice(1), ...recorded]) roots.add((0, import_node_path41.dirname)(p));
   const keptKeys = new Set(remaining.map(norm));
-  for (const root of roots) {
-    if (!isDir(root) || live.has(norm(root)) || norm(root) === primary) continue;
-    let children;
+  const root = registered[0] ? canonicalWorktreeRoot(registered[0]) : void 0;
+  if (root && isDir(root) && !live.has(norm(root))) {
+    report.root = root;
+    let children = [];
     try {
       children = readDir(root);
     } catch {
-      continue;
     }
     for (const name of children) {
       const child2 = (0, import_node_path41.join)(root, name);
@@ -44565,10 +44757,13 @@ function renderResidueSweepLines(report) {
   if (!report) return [];
   const lines2 = [];
   const cleaned = report.swept.length + report.emptyRemoved.length;
-  if (cleaned) lines2.push(`pr merge: removed ${cleaned} leftover worktree folder(s) from earlier merges`);
+  const where = report.root ? ` (worktree root ${report.root})` : "";
+  if (cleaned) lines2.push(`pr merge: removed ${cleaned} leftover worktree folder(s) from earlier merges${where}`);
   for (const k of report.kept) lines2.push(`pr merge: leftover folder still locked, retried on the next merge \u2014 ${k.path}`);
   if (report.unrecorded.length) {
-    lines2.push(`pr merge: ${report.unrecorded.length} unregistered folder(s) with content under the worktree root were left untouched (not recorded by a merge): ${report.unrecorded.join(", ")}`);
+    const shown = report.unrecorded.slice(0, 5).join(", ");
+    const more = report.unrecorded.length > 5 ? `, \u2026 ${report.unrecorded.length - 5} more` : "";
+    lines2.push(`pr merge: ${report.unrecorded.length} unregistered folder(s) with content under the worktree root${where} were left untouched (not recorded by a merge): ${shown}${more}`);
   }
   return lines2;
 }
@@ -45798,7 +45993,7 @@ ${list}`);
         console.error(line);
       }
     }
-    const credential = "user";
+    const credential = lastRestPollSource() === "app" ? "app_installation" : "user";
     if (o.json) printLine(JSON.stringify({ ...result, credential }));
     else printLine(
       `pr land: ${result.status}${result.error ? ` \u2014 ${result.error}` : ""} (credential: ${credential})` + (result.branchFinality ? ` \u2014 ${result.branchFinality}` : "")
@@ -46385,8 +46580,8 @@ function trainApplyDeps() {
     // Hub-App-authority dispatch of the central tenant-control.yml (#1717) — the Hub fires the
     // workflow_dispatch with its App token. Never throws for an expected rejection: it returns the dispatch
     // outcome so runTenantControl can map a 5xx (transport-failed, retryable) vs a 4xx (rejected) vs ok.
-    dispatchTenantControl: async ({ repo, stage, action, lines: lines2, task, artifact, confirmDataLoss }) => {
-      const res = await tenantControl({ repo, stage, action, ...lines2 != null ? { lines: lines2 } : {}, ...task ? { task } : {}, ...artifact ? { artifact } : {}, ...confirmDataLoss ? { confirmDataLoss } : {} }, registryClientDeps(await loadConfig()));
+    dispatchTenantControl: async ({ repo, stage, action, lines: lines2, since, until, task, artifact, confirmDataLoss }) => {
+      const res = await tenantControl({ repo, stage, action, ...lines2 != null ? { lines: lines2 } : {}, ...since ? { since } : {}, ...until ? { until } : {}, ...task ? { task } : {}, ...artifact ? { artifact } : {}, ...confirmDataLoss ? { confirmDataLoss } : {} }, registryClientDeps(await loadConfig()));
       if (res.ok) return { ok: true };
       const body = res.body;
       return { ok: false, category: body?.category, error: body?.error ?? res.error };
@@ -51568,8 +51763,8 @@ async function repoWorkflowEntries(client, repo) {
   for (const wf of workflowsList) {
     if (typeof wf?.path !== "string" || !wf.path) continue;
     if (!wf.path.startsWith(".github/workflows/")) continue;
-    const basename3 = wf.path.split("/").pop() ?? wf.path;
-    const name = `${repo}/${basename3.replace(/\.ya?ml$/, "")}`;
+    const basename4 = wf.path.split("/").pop() ?? wf.path;
+    const name = `${repo}/${basename4.replace(/\.ya?ml$/, "")}`;
     if (wf.state !== "active") {
       disabled.push(name);
       continue;
@@ -53047,6 +53242,17 @@ function registerEdgeCommands(program3) {
       process.exitCode = 1;
     }
   });
+  edge.command("dns <action> <owner/repo> <stage>").description("read (`status`) or create-when-missing (`ensure`, master-only) the proxied Cloudflare A records for a registered DEPLOY# row; existing records are never modified").action(async (action, repo, stage) => {
+    if (action !== "status" && action !== "ensure") return fail("runtime edge dns: <action> must be status or ensure");
+    if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime edge dns: <stage> must be dev, rc, or main");
+    try {
+      const result = await edgeDnsForStage(slugOf(repo), stage, registryClientDeps(await loadConfig()), action === "ensure");
+      console.log(JSON.stringify(result, null, 2));
+      if (result.required && result.complete === false) process.exitCode = 1;
+    } catch (e) {
+      fail(`runtime edge dns: ${e.message}`);
+    }
+  });
 }
 
 // src/command-register-developer.ts
@@ -54110,7 +54316,7 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
     if (o.confirmDataLoss !== void 0 && (action !== "retire" || stage === "rc")) return fail("runtime tenant control: --confirm-data-loss is dev/main retire-only");
     if (action === "retire" && (stage === "dev" || stage === "main")) {
@@ -54129,12 +54335,17 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
       lines2 = Number(o.lines);
       if (!Number.isInteger(lines2) || lines2 < 1 || lines2 > 2e3) return fail("runtime tenant control: --lines must be an integer between 1 and 2000");
     }
+    for (const [flag, value] of [["--since", o.since], ["--until", o.until]]) {
+      if (value === void 0) continue;
+      if (action !== "logs") return fail(`runtime tenant control: ${flag} is valid only for the logs action`);
+      if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?Z$/.test(value)) return fail(`runtime tenant control: ${flag} must be a UTC time like 2026-10-07T13:10Z`);
+    }
     if (action === "run-task") {
       if (!o.task) return fail("runtime tenant control: run-task requires --task <declared-name>");
     } else if (o.task || o.artifact) {
       return fail("runtime tenant control: --task/--artifact are valid only for run-task");
     }
-    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss });
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines: lines3, failure } = renderVerifySecrets(body);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.98",
+  "version": "4.5.100",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.98",
+  "version": "4.5.100",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -481,6 +481,9 @@ web tenants, `--project-type desktop-game --deploy-model none --clear-web-profil
 `--project-type mobile-app --deploy-model none --clear-web-profile` for a phone app distributed through the
 app stores, and
 `--class content --project-type content --deploy-model content --clear-web-profile` for a content/KB repo.
+An **MM-Work module** adds `--var SUITE=mm-work` (#7944): it registers `suite: mm-work` and derives its
+own `dev.<sub>.mutmut.work` + `<sub>.mutmut.work` hosts, with no rc host (the suite serves its rc from the
+live host). Without it, apply derives the `*.mutatismutandis.co` web-app hosts, which a module never uses.
 Run the apply path with the board variables discovered above, or register the same values with
 `mmi-cli oracle org project set` from the Hub or from the target project checkout:
 

package/skills/bootstrap/seeds/gate.template.yml

@@ -3,6 +3,9 @@ name: gate
 # and v* tags so /release and /hotfix can discover required contexts on the tagged SHA.
 #
 # Runner: self-hosted mmi-runner (mmi-live) — see docs/Guides/gh-runner-runbook.md in MMI-Hub.
+# #7914 (owner, 2026-10-06): this gate holds only fast, deterministic checks. Browser and long suites
+#   (screens, geometry/motion, synthetic, Chrome renders and tests) never go here; they run in their own
+#   workflow, nightly through the Hub schedule plane and on demand (docs/decisions/2026-10-06-browser-checks-nightly.md).
 # #4118: if GATE_CMD runs tsgo or other memory-heavy typecheck / browser work, pin this job to
 #   runs-on: [self-hosted, linux, x64, mmi-heavy]
 # instead — standard lanes are MemoryMax=1200M and will cgroup-OOM those workloads.

package/skills/org-guide/references/domains-and-oauth.md

@@ -4,9 +4,13 @@ MMI owns the central project registry and provisioning workflows. Read
 `mmi-cli oracle org project get <owner/repo> --json` before changing hostnames or login settings.
 Use the declared edge domains for each stage; do not guess hostnames from a slug or create a
 second DNS/deployment control plane in a product repository. New project setup goes through
-[bootstrap](../../bootstrap/SKILL.md).
+[bootstrap](../../bootstrap/SKILL.md). An MM-Work suite module serves from its own
+`dev.<name>.mutmut.work` and `<name>.mutmut.work` hosts, with no rc host; bootstrap declares them
+with `--var SUITE=mm-work`.
 
 Cloudflare owns public DNS and edge TLS. Preserve unrelated records during an authorized change.
+The Hub creates each registered host's proxied record during bootstrap and never edits an existing
+one; check or re-run it with `mmi-cli devops runtime edge dns status|ensure <owner/repo> <stage>`.
 A dev stage is private only after its independent edge-block check succeeds. A configured record
 or successful deployment alone does not prove access control. Use [stage](../../stage/SKILL.md)
 for the supported private live workflow.

package/skills/org-guide/references/work-and-releases.md

@@ -26,6 +26,12 @@ Open a PR through `mmi-cli devops pr create` with a closing issue link, and land
 `mmi-cli devops pr land`. Verify required checks, merge, issue closure, and cleanup before calling
 the implementation complete. A merged implementation is not a production release.
 
+Browser checks and long CI run nightly, never as PR checks (owner, 2026-10-06;
+`docs/decisions/2026-10-06-browser-checks-nightly.md`). The required `gate` holds only fast,
+deterministic checks. Screen, geometry, motion, synthetic and Chrome suites run in a separate
+workflow armed nightly through the Hub schedule plane and on demand; it is never required, and a red
+run updates one `ci-heavy-red` issue. Never add such a suite to a gate or a local test policy.
+
 ## Report MMI tooling bugs
 
 This workflow covers bugs in MMI tooling, including its CLI, plugin, and shared workflows.