@mutmutco/codex-plugin 4.6.14 → 4.6.16

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.14",
+  "version": "4.6.16",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.14",
+  "version": "4.6.16",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -33,7 +33,7 @@ item is `mmi-cli oracle board move <status> <ref>`, never a hand-written `gh api
 lookup. Partition rules,
 stamp details and `--out` rationale: [reference.md](reference.md).
 
-**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run list --event`/`--jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`, `run list --event <event>`, or `MMI_ACTOR=app mmi-cli devops api get "repos/<owner>/<repo>/actions/runs?event=<event>&per_page=<n>"`); `--jq '<expr>'` on that typed read filters locally. Those typed reads take **one** number per call, exactly like native gh: a second number is refused as `too many arguments`, so read several issues by repeating the typed read once per number (one `--jq` each, joined `&&`). Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `mmi-cli oracle issue edit <ref> --body-file .jerv/tmp/issue-body.md`. When `node -e` reads saved JSON, pass an absolute path or use `JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))`: `require()` of a relative path (e.g. `tmp\board.json` from `cygpath -w`) throws MODULE_NOT_FOUND.
+**Under the App pool, never type raw `gh` for a read** (`gh issue list/view --jq`, `gh run list --event`/`--jq`, `gh run view --jq`, `gh api -q` all bounce). Use `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json <fields>` (or `issue list`, `pr view`, `run view`, `run list --event <event>`, or `MMI_ACTOR=app mmi-cli devops api get "repos/<owner>/<repo>/actions/runs?event=<event>&per_page=<n>"`); `--jq '<expr>'` on that typed read filters locally. A single issue or PR item (`repos/<owner>/<repo>/issues/<n>` and `pulls/<n>`) has no `devops api get` route — `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner>/<repo> --json <fields>` (and `pr view`) is the only read. Those typed reads take **one** number per call, exactly like native gh: a second number is refused as `too many arguments`, so read several issues by repeating the typed read once per number (one `--jq` each, joined `&&`). Filter in a pipe or save output (`>`, `2>&1`, `--out`) under this worktree's `.jerv/tmp/` (`mkdir -p .jerv/tmp` first), never `../` or a sibling path: the workspace output guard refuses those. Body edits are read-then-edit: `MMI_ACTOR=app mmi-cli devops read issue view <n> --repo <owner/repo> --json body > .jerv/tmp/issue-body.json`, append or filter the JSON locally (`node -e`; the typed read's own `--jq` also filters locally), then write back with `mmi-cli oracle issue edit <ref> --body-file .jerv/tmp/issue-body.md`. When `node -e` reads saved JSON, pass an absolute path or use `JSON.parse(require('fs').readFileSync(process.argv[1],'utf8'))`: `require()` of a relative path (e.g. `tmp\board.json` from `cygpath -w`) throws MODULE_NOT_FOUND.
 
 ## Step 2 — render it
 

package/skills/bootstrap/reference.md

@@ -309,7 +309,15 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   with `--var GATE_MAX_SECONDS=` (300s onboarding default — tighten once the gate is measured, via
   `--var` or `org project set <repo> --var gate={"maxSeconds":N}`); `ci audit` and the release train
   both enforce the step, so do not remove it. The tenant-container product image build (#7542)
-  shares that ceiling — no separate knob. Every trigger runs the full `GATE_CMD`. A repo whose checks
+  shares that ceiling — no separate knob. Node gates can opt into the shared memory policy (#9710), with
+  `--var GATE_CHECK_PARALLEL_MIN_FREE_MB=0` by default: no policy step or scheduling variable is rendered,
+  so existing scheduler behavior stays unchanged. A positive caller-measured minimum free MiB opts in;
+  the step then exports `RUN_CHECK_SERIAL=1` unless that minimum is met, and missing output keeps `1`.
+  A check script may consume that switch without changing its command or coverage. Opt in only after a
+  matched full-check serial/parallel experiment records duration, effective memory, whole-check peak,
+  OOM-event deltas and exit status. Python renders no policy step or variable. Shared pin propagation preserves
+  consumer thresholds; new seed delivery and live adoption remain separate verification.
+  Every trigger runs the full `GATE_CMD`. A repo whose checks
   need a service container or an extra budgeted step declares them in its registry gate config, never by
   hand-editing the rendered gate (#7407): `gate.services` is keyed by service name with `image`, `env`,
   `ports`, one-line `options` and `tmpfs` paths; `gate.steps` is a list of `{name, command, env,

package/skills/bootstrap/seeds/gate.template.yml

@@ -32,6 +32,8 @@ name: gate
 #   GATE_PY_VERSION    — Python version for setup-python ({{GATE_PY_VERSION}})
 #   GATE_MAX_SECONDS   — run-with-budget wall-clock ceiling in seconds ({{GATE_MAX_SECONDS}}); 300 default,
 #                        tighten per repo (org project set --var gate={"maxSeconds":N}) once measured (#3178)
+#   GATE_CHECK_PARALLEL_MIN_FREE_MB — measured minimum free MiB for parallel Node checks; 0 leaves scheduling unchanged.
+#                        Override only after a matched complete-check experiment (#9710).
 #   GATE_PUSH_BRANCHES_YAML — YAML list of push branches that trigger the workflow file (rendered by
 #                        bootstrap from the release track; not usually hand-passed)
 #   GATE_FULL_RUN_BRANCH — train branch whose PUSHES run the full gate job (development on full/direct;
@@ -39,6 +41,7 @@ name: gate
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
 # GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
+# GATE_CHECK_POLICY_SHA pins the opt-in memory policy; once configured, missing output selects serial (#9710).
 # GATE_VERDICT_STEP_YAML (org CI H1) renders the first step from the blessed verdict-receipt pin: a train push
 # reuses the merge queue's exact-SHA verdict, an rc tag the train push verdict (#8206). merge_group is the full
 # set here (only pull_request fails fast or skips), so `queue-is-full-verdict: 'true'` holds. Empty pin: the legacy #8206 rc-tag step.
@@ -185,7 +188,7 @@ jobs:
         run: |
           python3 --version || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — python3 not on PATH after setup-python. This is the runner, not your diff; no install or test ran. Re-run the job; if it persists the mmi-runner python toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
       - run: {{GATE_INSTALL_CMD}}
-        if: ${{ steps.development-gate.outputs.reuse != 'true' }}{{GATE_JEV_FETCH_YAML}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}{{GATE_JEV_FETCH_YAML}}{{GATE_CHECK_POLICY_STEP_YAML}}
       # #3178: the check runs under the org wall-clock budget — a hung suite dies at the ceiling instead
       # of squatting a runner lane for GitHub's 6h default. ci-audit + the release train enforce this step.
       # #9293: PRs fail fast, merge_group and tags run everything. pytest reads PYTEST_ADDOPTS natively; a
@@ -198,7 +201,7 @@ jobs:
       # outcomes step runs under always() (pass or fail).
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
-        env:
+        env:{{GATE_CHECK_POLICY_ENV_YAML}}
           MMI_FAIL_FAST: ${{ github.event_name == 'pull_request' && '1' || '' }}
           PYTEST_ADDOPTS: ${{ github.event_name == 'pull_request' && format('--maxfail=1 {0}', env.JEV_PYTEST_ARGS) || '' }}
           MMI_JEV_SKIP_ARGS: ${{ github.event_name == 'pull_request' && env.JEV_VITEST_ARGS || '' }}

package/skills/org-guide/references/work-and-releases.md

@@ -5,9 +5,9 @@ registry enrollment. Registry-listed admins with repository write access remain
 Use `mmi-cli oracle org access role <owner/repo> --json` to verify authority for release,
 candidate, hotfix, and runtime operations. Organization membership role alone is not this check.
 Verified repository writers (GitHub write, maintain or admin) may land PRs targeting `development`
-on non-Hub repositories. `/train-authority` reports this separately as `developmentMerge`;
-it does not grant release, candidate, hotfix or runtime train authority. MMI-Hub development
-merges remain master-only.
+and hold rc/main merge authority (`train: true`) on non-Hub product repositories (#9748) — keep them
+on those repos' branch-lock push allowlists. They keep the `developer` role: no `/secrets` or
+`/tenant-control` authority. The Hub's development merges and its distribution train remain master-only.
 The Hub distribution train remains organization-master-only. It runs in the `hub-release` workflow on
 our self-hosted runners, dispatched by an org owner, never on a workstation (#9137).
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is