@mutmutco/codex-plugin 4.6.15 → 4.6.16

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.15",
+  "version": "4.6.16",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -25523,6 +25523,7 @@ __export(gate_budget_exports, {
   BLESSED_JEV_FAILURES_SHA: () => BLESSED_JEV_FAILURES_SHA,
   BLESSED_KIT_AGENT_FILES_SHA: () => BLESSED_KIT_AGENT_FILES_SHA,
   BLESSED_RUNBOOK_GUARD_SHA: () => BLESSED_RUNBOOK_GUARD_SHA,
+  BLESSED_RUNNER_CHECK_POLICY_SHA: () => BLESSED_RUNNER_CHECK_POLICY_SHA,
   BLESSED_RUNNER_CHOICE_SHA: () => BLESSED_RUNNER_CHOICE_SHA,
   BLESSED_RUNNER_GATE_SHA: () => BLESSED_RUNNER_GATE_SHA,
   BLESSED_RUN_WITH_BUDGET_SHA: () => BLESSED_RUN_WITH_BUDGET_SHA,
@@ -25533,6 +25534,7 @@ __export(gate_budget_exports, {
 });
 var BLESSED_RUN_WITH_BUDGET_SHA = "cb31a94c89729beac83500ad4d301132dcfe2e4c";
 var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
+var BLESSED_RUNNER_CHECK_POLICY_SHA = "67bb2012710a96d21be825c29a5d5c2b4b8001e2";
 var BLESSED_KIT_AGENT_FILES_SHA = "e976df208d891b215844386c1cac0f161946b6fa";
 var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
 var BLESSED_VERDICT_RECEIPT_SHA = "";
@@ -25912,6 +25914,11 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     // The pin is the CLI's blessed SHA, not an operator knob — one central place to bump (#3178).
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA,
     GATE_RUNNER_SHA: BLESSED_RUNNER_GATE_SHA,
+    GATE_CHECK_POLICY_SHA: BLESSED_RUNNER_CHECK_POLICY_SHA,
+    // No shared threshold: only a caller's matched complete-check experiment may enable concurrency.
+    GATE_CHECK_PARALLEL_MIN_FREE_MB: "0",
+    GATE_CHECK_POLICY_STEP_YAML: "",
+    GATE_CHECK_POLICY_ENV_YAML: "",
     // #9161: the suite-only kit-file drift action arrived after the shared runner pin, so it carries its own
     // blessed revision — bumping GATE_RUNNER_SHA for it would move every generic repo's toolchain too.
     KIT_AGENT_FILES_SHA: BLESSED_KIT_AGENT_FILES_SHA,
@@ -25979,6 +25986,7 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranc
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime, requiredCheckBranches, requiredChecks))) {
     out[key] ??= value;
   }
+  Object.assign(out, gateCheckPolicyYaml(out.GATE_CHECK_POLICY_SHA, out.GATE_CHECK_PARALLEL_MIN_FREE_MB, runtime));
   if (!out.GATE_AFFECTED_CMD.trim()) out.GATE_AFFECTED_CMD = out.GATE_CMD;
   return out;
 }
@@ -26147,6 +26155,26 @@ function gateJevStepsYaml(sha, runtime = "node") {
     GATE_JEV_REPORT_YAML: step("Report test outcomes to Jev", "always() && ", "outcomes")
   };
 }
+function gateCheckPolicyYaml(sha, minFreeMb, runtime) {
+  if (runtime !== "node" || !/^[0-9a-f]{40}$/.test(sha) || !/^0*[1-9][0-9]*$/.test(minFreeMb)) {
+    return { GATE_CHECK_POLICY_STEP_YAML: "", GATE_CHECK_POLICY_ENV_YAML: "" };
+  }
+  return {
+    GATE_CHECK_POLICY_STEP_YAML: [
+      "\n      - name: Choose check scheduling",
+      "\n        id: check-policy",
+      "\n        if: ${{ steps.development-gate.outputs.reuse != 'true' }}",
+      "\n        continue-on-error: true",
+      "\n        timeout-minutes: 1",
+      `
+        uses: mutmutco/MMI-Hub/.github/actions/runner-check-policy@${sha}`,
+      "\n        with:",
+      `
+          min-free-mb: ${yamlScalar(minFreeMb)}`
+    ].join(""),
+    GATE_CHECK_POLICY_ENV_YAML: "\n          RUN_CHECK_SERIAL: ${{ steps.check-policy.outputs.serial || '1' }}"
+  };
+}
 function gateExtraStepsYaml(steps) {
   return steps.map((step) => [
     `
@@ -27186,7 +27214,16 @@ async function auditRepoCollaborators(repo, owners, deps, projectAdmins = /* @__
   }
   return findings;
 }
-async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set()) {
+async function directWriters(deps, repo) {
+  const collabs = await restPagedJson(deps, `repos/${repo}/collaborators?affiliation=direct`, []);
+  const writers = /* @__PURE__ */ new Set();
+  for (const c of collabs) {
+    const role = collaboratorRole(c);
+    if (role !== null && POWERED_ROLES.has(role)) writers.add(c.login.toLowerCase());
+  }
+  return writers;
+}
+async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), writers = /* @__PURE__ */ new Set()) {
   let restrictions = null;
   try {
     restrictions = await deps.client.rest("GET", `repos/${repo}/branches/${branch}/protection/restrictions`) ?? null;
@@ -27221,15 +27258,16 @@ async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @
   }
   const findings = [];
   const users = (restrictions.users ?? []).map((u) => u.login);
+  const listed = (logins, login) => [...logins].some((entry) => entry.toLowerCase() === login.toLowerCase());
   for (const login of users) {
-    if (!owners.has(login) && !projectAdmins.has(login)) {
+    if (!listed(owners, login) && !listed(projectAdmins, login) && !listed(writers, login)) {
       findings.push({
         repo,
         branch,
         kind: "train-allowlist-extra",
         severity: "medium",
         actor: login,
-        detail: `@${login} is on the ${branch} push allowlist \u2014 legitimate only if an intended full-write project-admin; confirm`,
+        detail: `@${login} is on the ${branch} push allowlist \u2014 legitimate only if an intended full-write member (project-admin or direct repo writer); confirm`,
         remediation: `# if NOT an intended full-write member: gh api -X DELETE repos/${repo}/branches/${branch}/protection/restrictions/users -f users[]="${login}"`
       });
     }
@@ -27296,8 +27334,9 @@ async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /*
   findings.push(...await auditRepoCollaborators(repo, owners, deps, projectAdmins, sanctionedAdmins));
   if (dataAccess) findings.push(...auditDataAccessContracts(repo, dataAccess));
   const track = releaseTrack ?? (repoClass === "content" ? "trunk" : void 0);
+  const writers = repo.toLowerCase() === PLUGIN_READ_REPO2.toLowerCase() ? /* @__PURE__ */ new Set() : await directWriters(deps, repo);
   for (const branch of lockedBranches(repoClass, track)) {
-    findings.push(...await auditTrainBranch(repo, branch, owners, deps, projectAdmins));
+    findings.push(...await auditTrainBranch(repo, branch, owners, deps, projectAdmins, writers));
   }
   return { repo, class: repoClass, releaseTrack: track, ok: !findings.some((f) => f.severity === "high"), findings };
 }
@@ -27766,10 +27805,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.15",
-    tag: "v4.6.15",
-    commit: "ad44168c2ed4",
-    npm: "@mutmutco/cli@4.6.15"
+    version: "4.6.16",
+    tag: "v4.6.16",
+    commit: "4bd6f2423939",
+    npm: "@mutmutco/cli@4.6.16"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27786,14 +27825,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.15"
+          v3Target: "v4.6.16"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.15 and redeploy the Hub Lambda from tag v4.6.15 (ad44168c2ed4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.15 (@mutmutco/cli@4.6.15, tag commit ad44168c2ed4 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.16 and redeploy the Hub Lambda from tag v4.6.16 (4bd6f2423939); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.16 (@mutmutco/cli@4.6.16, tag commit 4bd6f2423939 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -68336,6 +68375,7 @@ function registerSchedulesCommands(program3) {
 var company_emails_default = {
   _comment: "Org-level, NON-secret GitHub login -> company email map (#7678). `mmi-cli oracle org access sync <repo>` maps a repo's current developer/admin collaborators through it to rebuild the stage allowlist a project opts into with the registry field `stageAllowlist` (e.g. MM-Work's MMW_STAGE_ALLOWLIST). Bundled into mmi-cli at build time (cli/src/stage-allowlist.ts) \u2014 one source of truth, edited here in a PR. Keys are lowercase GitHub logins; a collaborator missing here is reported loudly by the sync, never silently dropped.",
   emails: {
+    guzelt: "guzel@mutatismutandis.co",
     jervaise: "suphi@mutatismutandis.co",
     sezenlerinadil: "adil@mutatismutandis.co"
   }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.15",
+  "version": "4.6.16",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.15",
+  "version": "4.6.16",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/reference.md

@@ -309,7 +309,15 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   with `--var GATE_MAX_SECONDS=` (300s onboarding default — tighten once the gate is measured, via
   `--var` or `org project set <repo> --var gate={"maxSeconds":N}`); `ci audit` and the release train
   both enforce the step, so do not remove it. The tenant-container product image build (#7542)
-  shares that ceiling — no separate knob. Every trigger runs the full `GATE_CMD`. A repo whose checks
+  shares that ceiling — no separate knob. Node gates can opt into the shared memory policy (#9710), with
+  `--var GATE_CHECK_PARALLEL_MIN_FREE_MB=0` by default: no policy step or scheduling variable is rendered,
+  so existing scheduler behavior stays unchanged. A positive caller-measured minimum free MiB opts in;
+  the step then exports `RUN_CHECK_SERIAL=1` unless that minimum is met, and missing output keeps `1`.
+  A check script may consume that switch without changing its command or coverage. Opt in only after a
+  matched full-check serial/parallel experiment records duration, effective memory, whole-check peak,
+  OOM-event deltas and exit status. Python renders no policy step or variable. Shared pin propagation preserves
+  consumer thresholds; new seed delivery and live adoption remain separate verification.
+  Every trigger runs the full `GATE_CMD`. A repo whose checks
   need a service container or an extra budgeted step declares them in its registry gate config, never by
   hand-editing the rendered gate (#7407): `gate.services` is keyed by service name with `image`, `env`,
   `ports`, one-line `options` and `tmpfs` paths; `gate.steps` is a list of `{name, command, env,

package/skills/bootstrap/seeds/gate.template.yml

@@ -32,6 +32,8 @@ name: gate
 #   GATE_PY_VERSION    — Python version for setup-python ({{GATE_PY_VERSION}})
 #   GATE_MAX_SECONDS   — run-with-budget wall-clock ceiling in seconds ({{GATE_MAX_SECONDS}}); 300 default,
 #                        tighten per repo (org project set --var gate={"maxSeconds":N}) once measured (#3178)
+#   GATE_CHECK_PARALLEL_MIN_FREE_MB — measured minimum free MiB for parallel Node checks; 0 leaves scheduling unchanged.
+#                        Override only after a matched complete-check experiment (#9710).
 #   GATE_PUSH_BRANCHES_YAML — YAML list of push branches that trigger the workflow file (rendered by
 #                        bootstrap from the release track; not usually hand-passed)
 #   GATE_FULL_RUN_BRANCH — train branch whose PUSHES run the full gate job (development on full/direct;
@@ -39,6 +41,7 @@ name: gate
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
 # GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
+# GATE_CHECK_POLICY_SHA pins the opt-in memory policy; once configured, missing output selects serial (#9710).
 # GATE_VERDICT_STEP_YAML (org CI H1) renders the first step from the blessed verdict-receipt pin: a train push
 # reuses the merge queue's exact-SHA verdict, an rc tag the train push verdict (#8206). merge_group is the full
 # set here (only pull_request fails fast or skips), so `queue-is-full-verdict: 'true'` holds. Empty pin: the legacy #8206 rc-tag step.
@@ -185,7 +188,7 @@ jobs:
         run: |
           python3 --version || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — python3 not on PATH after setup-python. This is the runner, not your diff; no install or test ran. Re-run the job; if it persists the mmi-runner python toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
       - run: {{GATE_INSTALL_CMD}}
-        if: ${{ steps.development-gate.outputs.reuse != 'true' }}{{GATE_JEV_FETCH_YAML}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}{{GATE_JEV_FETCH_YAML}}{{GATE_CHECK_POLICY_STEP_YAML}}
       # #3178: the check runs under the org wall-clock budget — a hung suite dies at the ceiling instead
       # of squatting a runner lane for GitHub's 6h default. ci-audit + the release train enforce this step.
       # #9293: PRs fail fast, merge_group and tags run everything. pytest reads PYTEST_ADDOPTS natively; a
@@ -198,7 +201,7 @@ jobs:
       # outcomes step runs under always() (pass or fail).
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
-        env:
+        env:{{GATE_CHECK_POLICY_ENV_YAML}}
           MMI_FAIL_FAST: ${{ github.event_name == 'pull_request' && '1' || '' }}
           PYTEST_ADDOPTS: ${{ github.event_name == 'pull_request' && format('--maxfail=1 {0}', env.JEV_PYTEST_ARGS) || '' }}
           MMI_JEV_SKIP_ARGS: ${{ github.event_name == 'pull_request' && env.JEV_VITEST_ARGS || '' }}

package/skills/org-guide/references/work-and-releases.md

@@ -5,9 +5,9 @@ registry enrollment. Registry-listed admins with repository write access remain
 Use `mmi-cli oracle org access role <owner/repo> --json` to verify authority for release,
 candidate, hotfix, and runtime operations. Organization membership role alone is not this check.
 Verified repository writers (GitHub write, maintain or admin) may land PRs targeting `development`
-on non-Hub repositories. `/train-authority` reports this separately as `developmentMerge`;
-it does not grant release, candidate, hotfix or runtime train authority. MMI-Hub development
-merges remain master-only.
+and hold rc/main merge authority (`train: true`) on non-Hub product repositories (#9748) — keep them
+on those repos' branch-lock push allowlists. They keep the `developer` role: no `/secrets` or
+`/tenant-control` authority. The Hub's development merges and its distribution train remain master-only.
 The Hub distribution train remains organization-master-only. It runs in the `hub-release` workflow on
 our self-hosted runners, dispatched by an org owner, never on a workstation (#9137).
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is