@mutmutco/codex-plugin 4.6.10 → 4.6.12

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.10",
+  "version": "4.6.12",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.10",
+  "version": "4.6.12",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -39,6 +39,9 @@ name: gate
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
 # GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
+# GATE_VERDICT_STEP_YAML (org CI H1) renders the first step from the blessed verdict-receipt pin: a train push
+# reuses the merge queue's exact-SHA verdict, an rc tag the train push verdict (#8206). merge_group is the full
+# set here (only pull_request fails fast or skips), so `queue-is-full-verdict: 'true'` holds. Empty pin: the legacy #8206 rc-tag step.
 # #9248 supersedes #8911's "existing self-hosted capacity only; no hosted fallback": standard included
 # GitHub-hosted images are the default source for CI, and #8671's hosted-lane ban is retired. Larger/paid
 # images stay refused (#8911) — they bill above the included allowance, which the spending limit guards.
@@ -56,13 +59,15 @@ env:
 # #3001: cancel superseded runs — agent push-bursts queue a full fresh run per push.
 # Per-PR group only (a repo-wide group hits GitHub's one-pending-slot limit and cancels
 # innocent queued runs — MMC-ZuberShade#880). Pushes group by ref: each tag and the train
-# branch supersede only themselves.
+# branch supersede only themselves. Org CI H1 (Merv, 2 Nov 2026): only PR runs cancel in progress. A running
+# push run always finishes (Hub#7710); GitHub keeps only the newest pending push per ref, and each merge
+# queue entry has its own group. Most push runs then reuse the queue verdict through the receipt step.
 concurrency:
-  group: gate-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
-  cancel-in-progress: true
+  group: gate-${{ github.event.pull_request.number || github.event.merge_group.head_ref || (github.event_name == 'push' && format('push-{0}', github.ref)) || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
-  actions: read # #8206: exact-SHA development workflow verdict
+  actions: read # #8206 / org CI H1: exact-SHA verdict receipt reads workflow runs and jobs
   contents: read
   pull-requests: read # #8343: source commit declarations omitted by queue squashes
   # MMI-Hub#7542: the product image build below reads org private packages with the workflow's
@@ -78,34 +83,7 @@ jobs:
     runs-on: ubuntu-latest  # #9248: included GitHub-hosted capacity, first choice for CI.
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }{{GATE_SERVICES_YAML}}
-    steps:
-      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
-      - name: Reuse development gate for rc tag
-        id: development-gate
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
-        with:
-          script: |
-            core.setOutput('reuse', 'false');
-            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
-            try {
-              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
-              const { data } = await github.rest.actions.listWorkflowRuns({
-                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
-                event: 'push', head_sha: context.sha, per_page: 100
-              });
-              // API returns newest first: a newer red/pending rerun must not reuse an older green.
-              const run = data.workflow_runs[0];
-              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
-                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
-              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
-                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
-              });
-              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
-              core.setOutput('reuse', 'true');
-              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
-            } catch (error) {
-              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
-            }
+    steps:{{GATE_VERDICT_STEP_YAML}}
       - if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -7,10 +7,10 @@ on:
     branches: {{GATE_PUSH_BRANCHES_YAML}}
     tags: ['v*']
 concurrency:
-  group: gate-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
-  cancel-in-progress: true
+  group: gate-${{ github.event.pull_request.number || github.event.merge_group.head_ref || (github.event_name == 'push' && format('push-{0}', github.ref)) || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 permissions:
-  actions: read # #8206: exact-SHA development workflow verdict
+  actions: read # #8206 / org CI H1: exact-SHA verdict receipt reads workflow runs and jobs
   contents: read
   pull-requests: read # #8343: source commit declarations omitted by queue squashes
   packages: read
@@ -23,34 +23,7 @@ jobs:
     # larger/paid images, GPU and custom runner groups stay refused.
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    steps:
-      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
-      - name: Reuse development gate for rc tag
-        id: development-gate
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
-        with:
-          script: |
-            core.setOutput('reuse', 'false');
-            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
-            try {
-              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
-              const { data } = await github.rest.actions.listWorkflowRuns({
-                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
-                event: 'push', head_sha: context.sha, per_page: 100
-              });
-              // API returns newest first: a newer red/pending rerun must not reuse an older green.
-              const run = data.workflow_runs[0];
-              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
-                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
-              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
-                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
-              });
-              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
-              core.setOutput('reuse', 'true');
-              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
-            } catch (error) {
-              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
-            }
+    steps:{{GATE_VERDICT_STEP_YAML}}
       - if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:

package/skills/org-guide/references/work-and-releases.md

@@ -56,7 +56,12 @@ are recorded per worktree, so a receipt from another tree does not clear the gua
 a lane root or sibling worktree (use `git -C` / `npm --prefix` instead, #3187). A historical main-based
 hotfix worktree without test-policy.json chains
 `mmi-cli tests policy --json --base origin/main --policy-ref <current origin/development commit> && <focused test>`
-in one command (#3243). Complete the documentation preflight below before pushing.
+in one command (#3243). A lane diff is only readable from revisions the task worktree actually has (#9627):
+take the head from `HEAD` or `origin/<base>`, or prove the sha first with
+`git rev-parse --verify <sha>^{commit}` (fetching that commit when it is absent), and never gate the
+`mmi-cli tests policy --base <comparison-base> && <focused test>` chain on an unverified short sha — `git` exits 128 there, so the
+`&&` short-circuits and the policy run is silently skipped while the receipt looks missing rather than failed.
+Complete the documentation preflight below before pushing.
 Open a PR through `mmi-cli devops pr create` with a closing issue link, and land through
 `mmi-cli devops pr land`. Verify required checks, merge, issue closure, and cleanup before calling
 the implementation complete. A merged implementation is not a production release.