@mutmutco/codex-plugin 4.5.99 → 4.5.101

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.5.99",
+  "version": "4.5.101",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -6043,7 +6043,7 @@ function isRetryableGitHubWaitReadError(e) {
   const codes = /* @__PURE__ */ new Set();
   if (typeof status === "number" && status > 0) codes.add(status);
   for (const m of text.matchAll(/\bHTTP\/?\d*(?:\.\d)?\s+(\d{3})\b/g)) codes.add(Number(m[1]));
-  const rateLimited = e?.rateLimited === true || /API rate limit already exceeded|rate limit already exceeded|RATE_LIMITED|secondary rate|abuse detection/i.test(text);
+  const rateLimited = e?.rateLimited === true || /rate limit (?:already )?exceeded|RATE_LIMITED|secondary rate|abuse detection/i.test(text);
   if ([401, 404, 409, 422].some((c) => codes.has(c))) return false;
   if (codes.has(403) && !rateLimited) return false;
   if (codes.has(429) || rateLimited) return true;
@@ -8288,6 +8288,28 @@ async function postJson(pathSuffix, payload, deps, method = "POST", opts = {}) {
     return { ok: false, status: 0, body: null, error: e.message, unreachable: "transport" };
   }
 }
+async function edgeDnsForStage(slug, stage, deps, ensure = false) {
+  if (!deps.baseUrl) throw new Error("Hub API URL unavailable");
+  const token = await deps.token();
+  if (!token) throw new Error("Hub session token unavailable");
+  const path2 = `/projects/${encodeURIComponent(slug)}/edge-dns/${stage}`;
+  let body;
+  if (ensure) {
+    const write = await postJson(path2, {}, deps, "POST", { noRetry: true });
+    if (!write.ok) throw new Error(`Hub edge dns ensure failed: ${write.error ?? `HTTP ${write.status}`}`);
+    body = write.body;
+  } else {
+    const res = await retriedFetch(
+      deps,
+      `${deps.baseUrl.replace(/\/$/, "")}${path2}`,
+      { method: "GET", headers: { Authorization: `Bearer ${token}` } }
+    );
+    if (!res.ok) throw new Error(`Hub edge dns read failed: HTTP ${res.status}`);
+    body = await res.json();
+  }
+  if (typeof body?.required !== "boolean") throw new Error("Hub edge dns response invalid");
+  return body;
+}
 async function edgeCertificateForStage(slug, stage, deps, ensure = false) {
   if (!deps.baseUrl) throw new Error("Hub API URL unavailable");
   const token = await deps.token();
@@ -15861,8 +15883,11 @@ function edgeDomainsByStage(meta) {
   }
   return out;
 }
-function inferEdgeDomainsForWrite(slug) {
+function inferEdgeDomainsForWrite(slug, suite) {
   const subdomain = defaultSubdomain(slug);
+  if (suite === "mm-work" && slug !== suite) {
+    return { dev: `dev.${subdomain}.mutmut.work`, main: `${subdomain}.mutmut.work` };
+  }
   return {
     dev: `dev.${subdomain}.mutatismutandis.co`,
     rc: `rc.${subdomain}.mutatismutandis.co`,
@@ -16236,10 +16261,11 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
   }
   const deployModel = inferDeployModelForWrite({ ...shape, projectType }, parsedRepo.fullName);
   const releaseTrack = (isReleaseTrack(options.releaseTrack) ? options.releaseTrack : void 0) ?? (isReleaseTrack(options.existing?.releaseTrack) ? options.existing.releaseTrack : void 0) ?? resolveBootstrapReleaseTrack(cls, void 0);
-  const inferredDomains = inferEdgeDomainsForWrite(slug);
-  const derivedDomains = Object.fromEntries(branchesForTrack(releaseTrack).map((branch) => {
+  const suite = vars.SUITE || options.existing?.suite || void 0;
+  const inferredDomains = inferEdgeDomainsForWrite(slug, suite);
+  const derivedDomains = Object.fromEntries(branchesForTrack(releaseTrack).flatMap((branch) => {
     const stage = branch === "development" ? "dev" : branch;
-    return [stage, inferredDomains[stage]];
+    return inferredDomains[stage] ? [[stage, inferredDomains[stage]]] : [];
   }));
   const num = (v) => {
     if (v == null || v === "") return void 0;
@@ -16263,6 +16289,7 @@ function buildRegisterPayload(repo, cls, vars, options = {}) {
     // Identity. name/division default off the repo name when the skill didn't pass them.
     name: vars.NAME || parsedRepo.name,
     division: vars.DIVISION || parsedRepo.name.split("-")[0] || void 0,
+    suite: vars.SUITE || void 0,
     repos: [`${parsedRepo.owner}/${slug}`],
     branch: vars.BRANCH || (cls === "content" ? "main" : "development"),
     class: cls,
@@ -16362,6 +16389,11 @@ function decideSeedPrAction(openPrs) {
   }
   return { action: "create" };
 }
+function decideFirstDevDeploy(input) {
+  if (!input.devRowWritten) return "skip";
+  if (input.seedMode === "direct") return "dispatch";
+  return (input.seedPrs ?? []).some((pr) => typeof pr?.mergedAt === "string" && pr.mergedAt !== "") ? "dispatch" : "defer";
+}
 function decideSeedDelivery(branchRules) {
   const rules = Array.isArray(branchRules) ? branchRules : [];
   const types = new Set(
@@ -17572,10 +17604,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.5.99",
-    tag: "v4.5.99",
-    commit: "44a40b83250e",
-    npm: "@mutmutco/cli@4.5.99"
+    version: "4.5.101",
+    tag: "v4.5.101",
+    commit: "a3c82f0f7aa3",
+    npm: "@mutmutco/cli@4.5.101"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -17592,14 +17624,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.5.99"
+          v3Target: "v4.5.101"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.5.99 and redeploy the Hub Lambda from tag v4.5.99 (44a40b83250e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.5.99 (@mutmutco/cli@4.5.99, tag commit 44a40b83250e \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.5.101 and redeploy the Hub Lambda from tag v4.5.101 (a3c82f0f7aa3); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.5.101 (@mutmutco/cli@4.5.101, tag commit a3c82f0f7aa3 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -21791,7 +21823,7 @@ async function runTenantControl(deps, options) {
   const watch = options.watch ?? tenantControlWatches(action);
   const base = { command: "tenant-control", repo, stage, action };
   const since = (deps.now ?? Date.now)();
-  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, since: options.logSince, until: options.logUntil, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
+  const d = await deps.dispatchTenantControl({ repo, stage, action, lines: options.lines, edge: options.edge, since: options.logSince, until: options.logUntil, task: options.task, artifact: options.artifact, confirmDataLoss: options.confirmDataLoss });
   if (!d.ok) {
     const transport = d.category === "transport-failed";
     return {
@@ -25644,29 +25676,33 @@ Cut by ${formatSessionIdentity(cutBy)}
 `;
 }
 var PLAIN_WORDS_HEADING = "## In plain words";
+var PLAIN_WORDS_HEADING_TR = "## Sade s\xF6zlerle";
 var PLAIN_WORDS_MARKER = "<!-- mmi:big -->";
-function buildPlainWordsSection(lines2, big) {
+function buildPlainWordsSection(lines2, big, heading = PLAIN_WORDS_HEADING) {
   const [title, ...notes] = lines2;
-  const body = [PLAIN_WORDS_HEADING, title ?? "", ...notes.slice(0, 5).map((n) => `- ${n}`)];
+  const body = [heading, title ?? "", ...notes.slice(0, 5).map((n) => `- ${n}`)];
   if (big) body.push(PLAIN_WORDS_MARKER);
   return body.join("\n");
 }
 function noChangePlainWordsLine(suiteTag) {
-  return `No changes to this module in this release; ships with the MM-Work suite ${suiteTag}.`;
+  return suiteTag ? `No changes to this module in this release; ships with the MM-Work suite ${suiteTag}.` : "No changes to this module in this release.";
 }
 function upsertPlainWordsSection(body, section) {
-  const lines2 = body.split(/\r?\n/);
-  const at = lines2.findIndex((l) => l.trim() === PLAIN_WORDS_HEADING);
   let rest = body;
-  if (at >= 0) {
-    let end = lines2.length;
-    for (let i = at + 1; i < lines2.length; i++) {
-      if (lines2[i].trim().startsWith("## ")) {
-        end = i;
-        break;
+  for (const heading of [PLAIN_WORDS_HEADING, PLAIN_WORDS_HEADING_TR]) {
+    const lines2 = rest.split(/\r?\n/);
+    let stripping = false;
+    let found = false;
+    const kept = lines2.filter((line) => {
+      if (line.trim() === heading) {
+        stripping = true;
+        found = true;
+        return false;
       }
-    }
-    rest = [...lines2.slice(0, at), ...lines2.slice(end)].join("\n");
+      if (line.trim().startsWith("## ")) stripping = false;
+      return !stripping;
+    });
+    if (found) rest = kept.join("\n");
   }
   const trimmedRest = rest.trim();
   return trimmedRest ? `${section}
@@ -25679,8 +25715,11 @@ function plainWordsSummaryLines(content) {
 async function writePlainWordsIfSuiteMember(deps, args) {
   if (args.meta?.suite !== "mm-work") return;
   try {
-    const lines2 = args.summaryLines && args.summaryLines.length > 0 ? args.summaryLines : [noChangePlainWordsLine(args.suiteTag ?? args.tag)];
-    const section = buildPlainWordsSection(lines2, args.big === true);
+    const lines2 = args.summaryLines && args.summaryLines.length > 0 ? args.summaryLines : [noChangePlainWordsLine(args.suiteTag)];
+    const section = [
+      buildPlainWordsSection(lines2, args.big === true),
+      ...args.summaryLinesTr?.length ? [buildPlainWordsSection(args.summaryLinesTr, false, PLAIN_WORDS_HEADING_TR)] : []
+    ].join("\n\n");
     const body = clean2(await deps.run("gh", ["release", "view", args.tag, "--repo", args.repo, "--json", "body", "-q", ".body"]));
     await deps.run("gh", ["release", "edit", args.tag, "--repo", args.repo, "--notes", upsertPlainWordsSection(body, section)]);
   } catch {
@@ -25689,7 +25728,8 @@ async function writePlainWordsIfSuiteMember(deps, args) {
 async function writePlainWordsSection(deps, options, repo, meta, tag) {
   try {
     const summaryLines = options.announceSummaryFile ? plainWordsSummaryLines(await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(options.announceSummaryFile)) : void 0;
-    await writePlainWordsIfSuiteMember(deps, { repo, tag, meta, summaryLines, big: options.big, suiteTag: options.suiteTag });
+    const summaryLinesTr = options.announceSummaryFileTr ? plainWordsSummaryLines(await (deps.readFile ?? ((p) => (0, import_promises3.readFile)(p, "utf8")))(options.announceSummaryFileTr)) : void 0;
+    await writePlainWordsIfSuiteMember(deps, { repo, tag, meta, summaryLines, summaryLinesTr, big: options.big, suiteTag: options.suiteTag });
   } catch {
   }
 }
@@ -33890,6 +33930,28 @@ function edgeCertificateChecks(results) {
     }];
   });
 }
+function edgeDnsChecks(results, repo) {
+  return results.flatMap(({ stage, status, error }) => {
+    if (!error && status?.required === false) return [];
+    const bad = (status?.hosts ?? []).filter((h) => h.status === "missing" || h.status === "conflict");
+    const ok = !error && status?.complete !== false && bad.length === 0;
+    return [{
+      ok,
+      label: `Cloudflare edge DNS: ${stage}`,
+      detail: ok ? void 0 : error ? `DNS records unreadable (${error})` : `${bad.map((h) => `${h.host} ${h.status}${h.hint ? ` (${h.hint})` : ""}`).join("; ")} \u2014 run: mmi-cli devops runtime edge dns ensure ${repo} ${stage}`
+    }];
+  });
+}
+function firstDevDeployCheck(repo, facts, factsRead) {
+  const dev = facts?.stages?.dev;
+  if (!factsRead || dev?.present !== true) return [];
+  const ok = Boolean(dev.deployedAt || dev.deployedTag);
+  return [{
+    ok,
+    label: "first dev deploy happened",
+    detail: ok ? void 0 : `DEPLOY#dev has never deployed \u2014 run: mmi-cli devops runtime tenant redeploy ${repo} dev --watch`
+  }];
+}
 async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
   const branchesWanted = expectedBranches(repoClass, releaseTrack);
   const baseBranch = releaseTrack === "trunk" || repoClass === "content" ? "main" : "development";
@@ -34012,6 +34074,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     if (check) checks.push(check);
   }
   checks.push(...edgeCertificateChecks(deps.edgeCertificates ?? []));
+  checks.push(...edgeDnsChecks(deps.edgeDns ?? [], repo));
   const portRangeCheck = centralContainerPortRangeCheck(deps.deployModel, deps.projectMeta?.portRange, repo);
   if (portRangeCheck) checks.push(portRangeCheck);
   checks.push(...deployRowChecks(
@@ -34022,6 +34085,7 @@ async function verifyBootstrap(repo, repoClass, deps, releaseTrack) {
     deps.deployFactsRead === true,
     deps.projectMeta?.suite
   ));
+  checks.push(...firstDevDeployCheck(repo, deps.deployFacts, deps.deployFactsRead === true));
   const readme = await contentText(deps, repo, baseBranch, "README.md");
   checks.push({
     ok: readme !== null && readme.includes("## Agent context"),
@@ -34460,6 +34524,13 @@ function registerBootstrapCommands(program3) {
           return { stage, error: e.message };
         }
       })),
+      edgeDns: await Promise.all(["dev", "rc", "main"].filter((stage) => deployFacts?.stages?.[stage]?.present).map(async (stage) => {
+        try {
+          return { stage, status: await edgeDnsForStage(slug, stage, reg) };
+        } catch (e) {
+          return { stage, error: e.message };
+        }
+      })),
       pushAllowlistOwners: verifyOwners,
       pushAllowlistOwnersRead: verifyOwnersRead,
       readLocalFile: (path2) => path2 === "projects.json" && apiProjects != null ? apiProjects : (0, import_node_fs28.existsSync)(path2) ? (0, import_node_fs28.readFileSync)(path2, "utf8") : null,
@@ -34857,7 +34928,7 @@ function registerBootstrapCommands(program3) {
         github,
         deployFacts: controlDeployFacts,
         deployFactsRead: controlDeployFacts !== null,
-        plannedMainDomain: registryMeta?.edgeDomains?.main ?? inferEdgeDomainsForWrite(slug).main
+        plannedMainDomain: registryMeta?.edgeDomains?.main ?? inferEdgeDomainsForWrite(slug, suiteSlug || vars.SUITE).main
       });
       if (o.box) {
         if (applyDeployModel !== "tenant-container" && applyDeployModel !== "solo-container")
@@ -34878,7 +34949,7 @@ function registerBootstrapCommands(program3) {
             host: found.box.address,
             box: found.box.name,
             owners: scan.rows,
-            domains: { ...inferEdgeDomainsForWrite(slug), ...domains, ...boxDomains },
+            domains: { ...inferEdgeDomainsForWrite(slug, suiteSlug || vars.SUITE), ...domains, ...boxDomains },
             fileless: applyDeployModel === "tenant-container"
           });
           controlRows = planned.rows;
@@ -35309,6 +35380,42 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
           ddbWrites.push({ slug, action: `deploy-${coord.stage}`, record: payload });
           applied.push(`DEPLOY#${coord.stage} ${coord.host}:${coord.port}${coord.domain ? ` ${coord.domain}` : ""}`);
         }
+        for (const coord of boxDeployPlan) {
+          try {
+            const dns = await edgeDnsForStage(slug, coord.stage, registryClientDeps(await loadConfig()), true);
+            const bad = (dns.hosts ?? []).filter((h) => h.status === "conflict");
+            applied.push(`edge dns ${coord.stage}: ${dns.required ? (dns.hosts ?? []).map((h) => `${h.host} ${h.status}`).join(", ") : "not required"}`);
+            for (const h of bad) deferredFailures.push(`edge dns ${coord.stage} ${h.host}: ${h.hint}`);
+          } catch (e) {
+            applied.push(`edge dns ${coord.stage} (failed: ${e.message})`);
+            deferredFailures.push(`edge dns ${coord.stage} not ensured: ${e.message}; re-run: mmi-cli devops runtime edge dns ensure ${repo} ${coord.stage}`);
+          }
+        }
+        let seedPrs = [];
+        if (seedPlan.mode === "pr" && seedPlan.branch) {
+          try {
+            seedPrs = JSON.parse((await gh2(["pr", "list", "--repo", repo, "--head", seedPlan.branch, "--base", baseBranch, "--state", "all", "--json", "number,url,state,mergedAt"])).stdout || "[]");
+          } catch {
+            seedPrs = [];
+          }
+        }
+        const firstDeploy = decideFirstDevDeploy({ devRowWritten: boxDeployPlan.some((c) => c.stage === "dev"), seedMode: seedPlan.mode, seedPrs });
+        if (firstDeploy === "defer") {
+          applied.push("first dev deploy: deferred \u2014 the seed PR is not merged; the Hub dev auto-deploy runs on its merge (DEPLOY#dev now exists)");
+        } else if (firstDeploy === "dispatch") {
+          try {
+            const out = await execFileP(process.execPath, [process.argv[1], ...canonicalArgvFor(["runtime", "tenant", "redeploy", repo, "dev", "--json"])], { timeout: 12e4 });
+            let run = {};
+            try {
+              run = JSON.parse(out.stdout);
+            } catch {
+            }
+            applied.push(`first dev deploy dispatched at development: ${run.runUrl ?? run.dispatch ?? "run not yet correlated"}`);
+          } catch (e) {
+            applied.push(`first dev deploy (failed: ${e.message.split("\n")[0]})`);
+            deferredFailures.push(`first dev deploy not dispatched; run: mmi-cli devops runtime tenant redeploy ${repo} dev --watch`);
+          }
+        }
         controlRows = controlRows.map((row) => {
           const coord = boxDeployPlan.find((p) => row.target === `DEPLOY#${p.stage}`);
           return coord ? {
@@ -47419,7 +47526,7 @@ function memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles) {
   return repo === SUITE_REPO ? summaryFile : memberSummaryFiles[repo];
 }
 var suiteStateDir = (root) => (0, import_node_path43.join)(resolvePrimaryGitDir(root), "mmi-runtime", "suite");
-function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
+function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}, summaryFileTr, memberSummaryFilesTr = {}) {
   const recordPath = (0, import_node_path43.join)(suiteStateDir(root), "cut.json");
   const base = (0, import_node_path43.join)(suiteStateDir(root), "checkouts");
   const checkout = async (repo) => {
@@ -47530,7 +47637,12 @@ function suiteTrainIo(root, summaryFile, memberSummaryFiles = {}) {
   });
   const release = async (repo, expected, rcSha, opts) => inTrain(repo, async (deps) => {
     await prepareRcCheckout((args) => deps.run("git", args), repo);
-    const plainWords = { announceSummaryFile: memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles), big: opts?.big, suiteTag: opts?.suiteTag };
+    const plainWords = {
+      announceSummaryFile: memberAnnounceSummaryFile(repo, summaryFile, memberSummaryFiles),
+      announceSummaryFileTr: memberAnnounceSummaryFile(repo, summaryFileTr, memberSummaryFilesTr),
+      big: opts?.big,
+      suiteTag: opts?.suiteTag
+    };
     const current = await tagSha(repo, expected);
     if (current) {
       await deps.run("git", ["fetch", "origin", "--tags"]);
@@ -47771,6 +47883,12 @@ function parseMemberSummaryFiles(entries) {
   }
   return memberSummaryFiles;
 }
+function validateSuiteReleaseSummary(path2) {
+  if (!path2) throw new Error("suite release requires --announce-summary-file before promoting any member");
+  const lines2 = (0, import_node_fs44.readFileSync)(path2, "utf8").split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+  if (lines2[0]?.startsWith("No changes to this module")) throw new Error("suite release requires a real MM-Work title, not the no-change placeholder");
+  if (lines2.length < 3 || lines2.length > 6) throw new Error("suite release announcement needs 3\u20136 curated lines before promoting any member");
+}
 function suiteRcDataProdDeps() {
   return {
     fetch: async (url, init) => {
@@ -47865,18 +47983,17 @@ function registerSuiteCommands(program3) {
       return fail(`suite abandon: ${e.message}`);
     }
   });
-  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: a member's OWN plain-words summary (#7510) \u2014 never the suite lead's summary reused; a member with no entry still ships, with the coordinator-ruled no-change line", (val, prev = []) => [...prev, val], []).option("--big", "marks MM-Work's own release big for the plain-words section (#7510); a member is never marked big through this flag \u2014 it is big only via the read route's automatic minor/major detection").option("--json", "structured receipt").action(async (o) => {
+  suite.command("release").description("verify the cut and unchanged live backends, ship members then MM-Work, announce once").option("--owner-go", "explicit owner approval to release the tested candidate").option("--announce-summary-file <path>", "curated suite announcement, posted once after the train; also this cut's plain-words summary for MM-Work itself").option("--member-summary-file <owner/repo=path>", "repeatable: a member's OWN plain-words summary (#7510) \u2014 never the suite lead's summary reused; a member with no entry still ships, with the coordinator-ruled no-change line", (val, prev = []) => [...prev, val], []).option("--announce-summary-file-tr <path>", "Turkish plain-words summary for MM-Work itself").option("--member-summary-file-tr <owner/repo=path>", "repeatable: a member's own Turkish plain-words summary", (val, prev = []) => [...prev, val], []).option("--big", "marks MM-Work's own release big for the plain-words section (#7510); a member is never marked big through this flag \u2014 it is big only via the read route's automatic minor/major detection").option("--json", "structured receipt").action(async (o) => {
     try {
       if (!o.ownerGo) throw new Error("suite release requires --owner-go; nothing was written");
-      if (!o.announceSummaryFile) throw new Error("suite release requires --announce-summary-file before promoting any member");
-      const lines2 = (0, import_node_fs44.readFileSync)(o.announceSummaryFile, "utf8").split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
-      if (lines2.length < 3 || lines2.length > 6) throw new Error("suite release announcement needs 3\u20136 curated lines before promoting any member");
+      validateSuiteReleaseSummary(o.announceSummaryFile);
       const memberSummaryFiles = parseMemberSummaryFiles(o.memberSummaryFile ?? []);
+      const memberSummaryFilesTr = parseMemberSummaryFiles(o.memberSummaryFileTr ?? []);
       const root = await leadRoot();
       const unlock = await acquireTrainWriterLock(root, "suite release");
       let result;
       try {
-        result = await suiteRelease(suiteTrainIo(root, o.announceSummaryFile, memberSummaryFiles), true, o.big === true);
+        result = await suiteRelease(suiteTrainIo(root, o.announceSummaryFile, memberSummaryFiles, o.announceSummaryFileTr, memberSummaryFilesTr), true, o.big === true);
       } finally {
         await unlock();
       }
@@ -53143,6 +53260,17 @@ function registerEdgeCommands(program3) {
       process.exitCode = 1;
     }
   });
+  edge.command("dns <action> <owner/repo> <stage>").description("read (`status`) or create-when-missing (`ensure`, master-only) the proxied Cloudflare A records for a registered DEPLOY# row; existing records are never modified").action(async (action, repo, stage) => {
+    if (action !== "status" && action !== "ensure") return fail("runtime edge dns: <action> must be status or ensure");
+    if (stage !== "dev" && stage !== "rc" && stage !== "main") return fail("runtime edge dns: <stage> must be dev, rc, or main");
+    try {
+      const result = await edgeDnsForStage(slugOf(repo), stage, registryClientDeps(await loadConfig()), action === "ensure");
+      console.log(JSON.stringify(result, null, 2));
+      if (result.required && result.complete === false) process.exitCode = 1;
+    } catch (e) {
+      fail(`runtime edge dns: ${e.message}`);
+    }
+  });
 }
 
 // src/command-register-developer.ts
@@ -54206,7 +54334,7 @@ async function reportWrite(label, res) {
   return failGraceful(`${label}: HTTP ${res.status}${detail ? ` \u2014 ${detail}` : ""}`);
 }
 var tenant = program2.command("tenant").description("tenant runtime control through Hub authority");
-tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
+tenant.command("control <owner/repo> <stage> <action>").description("bounded tenant control plus value-free vault/broker verification; dev/main retire needs master and exact data-loss confirmation").option("--watch", "block on the dispatched run and report its conclusion (status/retire/verify-secrets/verify-broker/logs watch by default)").option("--lines <n>", "logs only: trailing lines of the tenant service to return (1-2000, default 200)").option("--since <utc>", "logs only: read the journal from this UTC time, e.g. 2026-10-07T13:10Z (includes replaced containers)").option("--until <utc>", "logs only: read the journal up to this UTC time").option("--edge", "logs only: Caddy journal for this stage\u2019s hosts (default window: last 15 minutes)").option("--task <name>", "run-task only: registry-declared task name (never a command)").option("--artifact <id>", "run-task only: opaque id returned by tenant artifact put").option("--confirm-data-loss <owner/repo/stage>", "dev/main retire only: exact target to decommission; without it show the dry-run plan").option("--json", "machine-readable output").action(async (repo, stage, action, o) => {
   try {
     if (o.confirmDataLoss !== void 0 && (action !== "retire" || stage === "rc")) return fail("runtime tenant control: --confirm-data-loss is dev/main retire-only");
     if (action === "retire" && (stage === "dev" || stage === "main")) {
@@ -54219,6 +54347,7 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
         return;
       }
     }
+    if (o.edge && action !== "logs") return fail("runtime tenant control: --edge is valid only for the logs action");
     let lines2;
     if (o.lines !== void 0) {
       if (action !== "logs") return fail("runtime tenant control: --lines is valid only for the logs action");
@@ -54235,7 +54364,7 @@ Dry run: pass --confirm-data-loss ${repo}/${stage} to decommission.`);
     } else if (o.task || o.artifact) {
       return fail("runtime tenant control: --task/--artifact are valid only for run-task");
     }
-    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss });
+    const result = await runTenantControl(trainApplyDeps(), { repo, stage, action, watch: o.watch, lines: lines2, edge: o.edge, logSince: o.since, logUntil: o.until, task: o.task, artifact: o.artifact, confirmDataLoss: o.confirmDataLoss });
     if (!o.json && action === "verify-secrets" && result.secrets) {
       const body = { ok: result.conclusion === "success", secrets: result.secrets, ssmStatus: result.conclusion === "success" ? "Success" : "Failed", raw: result.secretsRaw };
       const { lines: lines3, failure } = renderVerifySecrets(body);

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.5.99",
+  "version": "4.5.101",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.5.99",
+  "version": "4.5.101",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -481,6 +481,9 @@ web tenants, `--project-type desktop-game --deploy-model none --clear-web-profil
 `--project-type mobile-app --deploy-model none --clear-web-profile` for a phone app distributed through the
 app stores, and
 `--class content --project-type content --deploy-model content --clear-web-profile` for a content/KB repo.
+An **MM-Work module** adds `--var SUITE=mm-work` (#7944): it registers `suite: mm-work` and derives its
+own `dev.<sub>.mutmut.work` + `<sub>.mutmut.work` hosts, with no rc host (the suite serves its rc from the
+live host). Without it, apply derives the `*.mutatismutandis.co` web-app hosts, which a module never uses.
 Run the apply path with the board variables discovered above, or register the same values with
 `mmi-cli oracle org project set` from the Hub or from the target project checkout:
 

package/skills/org-guide/references/domains-and-oauth.md

@@ -4,9 +4,13 @@ MMI owns the central project registry and provisioning workflows. Read
 `mmi-cli oracle org project get <owner/repo> --json` before changing hostnames or login settings.
 Use the declared edge domains for each stage; do not guess hostnames from a slug or create a
 second DNS/deployment control plane in a product repository. New project setup goes through
-[bootstrap](../../bootstrap/SKILL.md).
+[bootstrap](../../bootstrap/SKILL.md). An MM-Work suite module serves from its own
+`dev.<name>.mutmut.work` and `<name>.mutmut.work` hosts, with no rc host; bootstrap declares them
+with `--var SUITE=mm-work`.
 
 Cloudflare owns public DNS and edge TLS. Preserve unrelated records during an authorized change.
+The Hub creates each registered host's proxied record during bootstrap and never edits an existing
+one; check or re-run it with `mmi-cli devops runtime edge dns status|ensure <owner/repo> <stage>`.
 A dev stage is private only after its independent edge-block check succeeds. A configured record
 or successful deployment alone does not prove access control. Use [stage](../../stage/SKILL.md)
 for the supported private live workflow.

package/skills/org-guide/references/work-and-releases.md

@@ -109,6 +109,7 @@ commit, so build and verify the lines from one pass over that range —
 subject, body and changed files — never from subjects, PR titles or memory; a line whose claim is not
 in that output does not go in the file. A Hub summary never mentions a Jerv-side project; the train
 refuses such a line.
+MM-Work suite release also requires a real `--announce-summary-file` title (never `No changes to this module`); optional `--announce-summary-file-tr` and repeatable `--member-summary-file-tr owner/repo=path` add Turkish plain words alongside English member files supplied with `--member-summary-file`.
 
 Announcement delivery uses the developer's GitHub-authenticated Hub session. The Hub checks project
 authority, resolves the registered channel, and reads the MMI Future Slack key inside its vault boundary.

package/skills/release/SKILL.md

@@ -15,6 +15,9 @@ Full-track repos ship exactly what is on `rc` (never `development`): merge `rc
 
 In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
 
+Suite release requires `--announce-summary-file <path>` with 3–6 curated lines and refuses before promotion when it is missing or its title starts with `No changes to this module`.
+Use `--member-summary-file <owner/repo=path>` for English member notes, `--announce-summary-file-tr <path>` for MM-Work's Turkish notes and repeatable `--member-summary-file-tr <owner/repo=path>` for Turkish member notes; members without English files keep the no-change line.
+
 Read META and name the lane before describing or executing anything:
 
 ```bash