@mutmutco/codex-plugin 4.6.15 → 4.6.17

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.15",
+  "version": "4.6.17",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -25523,6 +25523,7 @@ __export(gate_budget_exports, {
   BLESSED_JEV_FAILURES_SHA: () => BLESSED_JEV_FAILURES_SHA,
   BLESSED_KIT_AGENT_FILES_SHA: () => BLESSED_KIT_AGENT_FILES_SHA,
   BLESSED_RUNBOOK_GUARD_SHA: () => BLESSED_RUNBOOK_GUARD_SHA,
+  BLESSED_RUNNER_CHECK_POLICY_SHA: () => BLESSED_RUNNER_CHECK_POLICY_SHA,
   BLESSED_RUNNER_CHOICE_SHA: () => BLESSED_RUNNER_CHOICE_SHA,
   BLESSED_RUNNER_GATE_SHA: () => BLESSED_RUNNER_GATE_SHA,
   BLESSED_RUN_WITH_BUDGET_SHA: () => BLESSED_RUN_WITH_BUDGET_SHA,
@@ -25533,6 +25534,7 @@ __export(gate_budget_exports, {
 });
 var BLESSED_RUN_WITH_BUDGET_SHA = "cb31a94c89729beac83500ad4d301132dcfe2e4c";
 var BLESSED_RUNNER_GATE_SHA = "a19e9392e5ad9b0675f02e4304d68dd933fad60f";
+var BLESSED_RUNNER_CHECK_POLICY_SHA = "67bb2012710a96d21be825c29a5d5c2b4b8001e2";
 var BLESSED_KIT_AGENT_FILES_SHA = "e976df208d891b215844386c1cac0f161946b6fa";
 var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
 var BLESSED_VERDICT_RECEIPT_SHA = "";
@@ -25912,6 +25914,11 @@ function gateSeedVars(cls, releaseTrack, runtime = "node", requiredCheckBranches
     // The pin is the CLI's blessed SHA, not an operator knob — one central place to bump (#3178).
     GATE_BUDGET_SHA: BLESSED_RUN_WITH_BUDGET_SHA,
     GATE_RUNNER_SHA: BLESSED_RUNNER_GATE_SHA,
+    GATE_CHECK_POLICY_SHA: BLESSED_RUNNER_CHECK_POLICY_SHA,
+    // No shared threshold: only a caller's matched complete-check experiment may enable concurrency.
+    GATE_CHECK_PARALLEL_MIN_FREE_MB: "0",
+    GATE_CHECK_POLICY_STEP_YAML: "",
+    GATE_CHECK_POLICY_ENV_YAML: "",
     // #9161: the suite-only kit-file drift action arrived after the shared runner pin, so it carries its own
     // blessed revision — bumping GATE_RUNNER_SHA for it would move every generic repo's toolchain too.
     KIT_AGENT_FILES_SHA: BLESSED_KIT_AGENT_FILES_SHA,
@@ -25979,6 +25986,7 @@ function withDerivedRepoVars(vars, parsed, cls, releaseTrack, requiredCheckBranc
   for (const [key, value] of Object.entries(gateSeedVars(cls, track, runtime, requiredCheckBranches, requiredChecks))) {
     out[key] ??= value;
   }
+  Object.assign(out, gateCheckPolicyYaml(out.GATE_CHECK_POLICY_SHA, out.GATE_CHECK_PARALLEL_MIN_FREE_MB, runtime));
   if (!out.GATE_AFFECTED_CMD.trim()) out.GATE_AFFECTED_CMD = out.GATE_CMD;
   return out;
 }
@@ -26147,6 +26155,26 @@ function gateJevStepsYaml(sha, runtime = "node") {
     GATE_JEV_REPORT_YAML: step("Report test outcomes to Jev", "always() && ", "outcomes")
   };
 }
+function gateCheckPolicyYaml(sha, minFreeMb, runtime) {
+  if (runtime !== "node" || !/^[0-9a-f]{40}$/.test(sha) || !/^0*[1-9][0-9]*$/.test(minFreeMb)) {
+    return { GATE_CHECK_POLICY_STEP_YAML: "", GATE_CHECK_POLICY_ENV_YAML: "" };
+  }
+  return {
+    GATE_CHECK_POLICY_STEP_YAML: [
+      "\n      - name: Choose check scheduling",
+      "\n        id: check-policy",
+      "\n        if: ${{ steps.development-gate.outputs.reuse != 'true' }}",
+      "\n        continue-on-error: true",
+      "\n        timeout-minutes: 1",
+      `
+        uses: mutmutco/MMI-Hub/.github/actions/runner-check-policy@${sha}`,
+      "\n        with:",
+      `
+          min-free-mb: ${yamlScalar(minFreeMb)}`
+    ].join(""),
+    GATE_CHECK_POLICY_ENV_YAML: "\n          RUN_CHECK_SERIAL: ${{ steps.check-policy.outputs.serial || '1' }}"
+  };
+}
 function gateExtraStepsYaml(steps) {
   return steps.map((step) => [
     `
@@ -27186,7 +27214,16 @@ async function auditRepoCollaborators(repo, owners, deps, projectAdmins = /* @__
   }
   return findings;
 }
-async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set()) {
+async function directWriters(deps, repo) {
+  const collabs = await restPagedJson(deps, `repos/${repo}/collaborators?affiliation=direct`, []);
+  const writers = /* @__PURE__ */ new Set();
+  for (const c of collabs) {
+    const role = collaboratorRole(c);
+    if (role !== null && POWERED_ROLES.has(role)) writers.add(c.login.toLowerCase());
+  }
+  return writers;
+}
+async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), writers = /* @__PURE__ */ new Set()) {
   let restrictions = null;
   try {
     restrictions = await deps.client.rest("GET", `repos/${repo}/branches/${branch}/protection/restrictions`) ?? null;
@@ -27221,15 +27258,16 @@ async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @
   }
   const findings = [];
   const users = (restrictions.users ?? []).map((u) => u.login);
+  const listed = (logins, login) => [...logins].some((entry) => entry.toLowerCase() === login.toLowerCase());
   for (const login of users) {
-    if (!owners.has(login) && !projectAdmins.has(login)) {
+    if (!listed(owners, login) && !listed(projectAdmins, login) && !listed(writers, login)) {
       findings.push({
         repo,
         branch,
         kind: "train-allowlist-extra",
         severity: "medium",
         actor: login,
-        detail: `@${login} is on the ${branch} push allowlist \u2014 legitimate only if an intended full-write project-admin; confirm`,
+        detail: `@${login} is on the ${branch} push allowlist \u2014 legitimate only if an intended full-write member (project-admin or direct repo writer); confirm`,
         remediation: `# if NOT an intended full-write member: gh api -X DELETE repos/${repo}/branches/${branch}/protection/restrictions/users -f users[]="${login}"`
       });
     }
@@ -27296,8 +27334,9 @@ async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /*
   findings.push(...await auditRepoCollaborators(repo, owners, deps, projectAdmins, sanctionedAdmins));
   if (dataAccess) findings.push(...auditDataAccessContracts(repo, dataAccess));
   const track = releaseTrack ?? (repoClass === "content" ? "trunk" : void 0);
+  const writers = repo.toLowerCase() === PLUGIN_READ_REPO2.toLowerCase() ? /* @__PURE__ */ new Set() : await directWriters(deps, repo);
   for (const branch of lockedBranches(repoClass, track)) {
-    findings.push(...await auditTrainBranch(repo, branch, owners, deps, projectAdmins));
+    findings.push(...await auditTrainBranch(repo, branch, owners, deps, projectAdmins, writers));
   }
   return { repo, class: repoClass, releaseTrack: track, ok: !findings.some((f) => f.severity === "high"), findings };
 }
@@ -27766,10 +27805,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.15",
-    tag: "v4.6.15",
-    commit: "ad44168c2ed4",
-    npm: "@mutmutco/cli@4.6.15"
+    version: "4.6.17",
+    tag: "v4.6.17",
+    commit: "efe71da889a6",
+    npm: "@mutmutco/cli@4.6.17"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27786,14 +27825,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.15"
+          v3Target: "v4.6.17"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.15 and redeploy the Hub Lambda from tag v4.6.15 (ad44168c2ed4); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.15 (@mutmutco/cli@4.6.15, tag commit ad44168c2ed4 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.17 and redeploy the Hub Lambda from tag v4.6.17 (efe71da889a6); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.17 (@mutmutco/cli@4.6.17, tag commit efe71da889a6 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -47126,7 +47165,7 @@ function sshRemoteCommand(remoteCommand) {
 function shellSingleQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
-var SSH_RECIPE_AGENT_NOTE = "# agent callers: this is multi-line, so running it inline is denied (#1473/#2125).\n# Use `mmi-cli devops runtime box get <name> --ssh --script <path>` to write it to a file, then `bash <path>`.";
+var SSH_RECIPE_AGENT_NOTE = '# agent callers: this is multi-line, so running it inline is denied (#1473/#2125).\n# Use `mmi-cli devops runtime box get <name> --ssh --script <path>` to write it to a file, then `bash <path>`.\n# For a multi-line remote body add --stdin (or --body <file>): the recipe then runs `sh -s` on the box,\n# and you stream the body over stdin \u2014 `bash "<path>" < "<body-file>"` \u2014 with no remote re-quoting (#9750).';
 function sshRecipeScript(box, remoteCommand) {
   return `#!/usr/bin/env bash
 ${formatSshRecipe(box, remoteCommand)}
@@ -47210,8 +47249,16 @@ function registerBoxCommands(program3) {
       await failGraceful(e.message);
     }
   });
-  box.command("get <name> [command...]").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (runs under the keyless vault wrapper and loads the key into an ssh-agent; the key is never written to a file or echoed)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").action(async (name, command, o) => {
+  box.command("get <name> [command...]").description("one box by name \u2014 its address and ssh key path; --ssh prints a ready-to-run connect recipe").option("--json", "machine-readable output").option("--ssh", "print a copy-paste ssh recipe (runs under the keyless vault wrapper and loads the key into an ssh-agent; the key is never written to a file or echoed)").option("--script <path>", "with --ssh: write the recipe to <path> and print the one line to run \u2014 the runnable form for agent callers, whose transport denies a multi-line inline body (#3385)").option("--stdin", "with --ssh --script: write the recipe with remote command sh -s so a multi-line script can be piped or redirected on stdin without remote shell re-quoting (#9750)").option("--body <file>", 'with --ssh --script: same as --stdin, and name <file> in the printed run line: bash "<script>" < "<file>" (#9750)').action(async (name, command, o) => {
     try {
+      if ((o.stdin || o.body) && (!o.ssh || !o.script)) {
+        await failGraceful("runtime box get: --stdin/--body requires --ssh --script <path> (it writes an sh -s recipe that reads the remote body from stdin)");
+        return;
+      }
+      if ((o.stdin || o.body) && command && command.length) {
+        await failGraceful("runtime box get: cannot combine --stdin/--body with trailing [command...] arguments \u2014 put the commands in the stdin body file instead");
+        return;
+      }
       const { boxes, incomplete } = await fetchInventory();
       const result = lookupBox(name, boxes, incomplete);
       if (result.kind === "unknown") {
@@ -47230,16 +47277,19 @@ function registerBoxCommands(program3) {
         await failGraceful("runtime box get: --script requires --ssh (it writes the ssh connect recipe)");
         return;
       }
-      const remote = command && command.length ? command.join(" ") : void 0;
+      const useStdin = Boolean(o.stdin || o.body);
+      const remote = useStdin ? "sh -s" : command && command.length ? command.join(" ") : void 0;
+      const stdinSource = o.body ? `"${o.body}"` : "<body.sh>";
       const wroteScript = o.ssh && o.script ? o.script : null;
+      const runLine = wroteScript ? useStdin ? `bash "${wroteScript}" < ${stdinSource}` : `bash "${wroteScript}"` : void 0;
       if (wroteScript) (0, import_node_fs37.writeFileSync)(wroteScript, sshRecipeScript(found, remote), "utf8");
       if (o.json) {
         console.log(JSON.stringify({
           box: found,
           incomplete,
-          ...wroteScript ? { script: { path: wroteScript, run: `bash "${wroteScript}"` } } : {}
+          ...wroteScript ? { script: { path: wroteScript, run: runLine, ...useStdin ? { stdin: o.body ?? true } : {} } } : {}
         }, null, 2));
-      } else if (wroteScript) console.log(`wrote ${wroteScript} \u2014 run: bash "${wroteScript}"`);
+      } else if (wroteScript) console.log(`wrote ${wroteScript} \u2014 run: ${runLine}`);
       else if (o.ssh) console.log(`${formatSshRecipe(found, remote)}
 ${SSH_RECIPE_AGENT_NOTE}`);
       else console.log(formatBoxTable([found]));
@@ -68336,6 +68386,7 @@ function registerSchedulesCommands(program3) {
 var company_emails_default = {
   _comment: "Org-level, NON-secret GitHub login -> company email map (#7678). `mmi-cli oracle org access sync <repo>` maps a repo's current developer/admin collaborators through it to rebuild the stage allowlist a project opts into with the registry field `stageAllowlist` (e.g. MM-Work's MMW_STAGE_ALLOWLIST). Bundled into mmi-cli at build time (cli/src/stage-allowlist.ts) \u2014 one source of truth, edited here in a PR. Keys are lowercase GitHub logins; a collaborator missing here is reported loudly by the sync, never silently dropped.",
   emails: {
+    guzelt: "guzel@mutatismutandis.co",
     jervaise: "suphi@mutatismutandis.co",
     sezenlerinadil: "adil@mutatismutandis.co"
   }
@@ -68360,6 +68411,22 @@ function stageAllowlistConfig(project2) {
   const stages = cfg.stages.filter((s) => ALLOWLIST_STAGES.includes(s));
   return stages.length > 0 ? { key: cfg.key, stages } : null;
 }
+function resolveStageAllowlistTarget(repo, projects) {
+  if (!projects) return { kind: "registry-unreadable", exitCode: 1, message: "org access sync: could not read the org project registry \u2014 nothing written" };
+  const project2 = projects.find((p) => (p.repos ?? []).some((r) => r.toLowerCase() === repo.toLowerCase())) ?? null;
+  if (!project2) return { kind: "unregistered", exitCode: 1, message: `org access sync: ${repo} is not in the org project registry \u2014 nothing written` };
+  if (project2.stageAllowlist == null) {
+    return {
+      kind: "no-opt-in",
+      exitCode: 0,
+      json: { repo, optIn: null, stages: [], skipped: "no-stageAllowlist" },
+      message: `org access sync: ${repo} has no stageAllowlist opt-in \u2014 nothing to rebuild (set it with \`mmi-cli oracle org project set ${repo} --var 'stageAllowlist={"key":"<KEY>","stages":["dev"]}'\`)`
+    };
+  }
+  const config = stageAllowlistConfig(project2);
+  if (!config) return { kind: "malformed", exitCode: 1, message: `org access sync: ${repo} has a malformed stageAllowlist in the registry \u2014 set it with \`mmi-cli oracle org project set ${repo} --var 'stageAllowlist={"key":"<KEY>","stages":["dev"]}'\`` };
+  return { kind: "sync", exitCode: 0, config };
+}
 function developerAdminLogins(collaborators) {
   const logins = /* @__PURE__ */ new Set();
   for (const c of collaborators) {
@@ -72175,11 +72242,13 @@ access.command("sync [repo]").description("rebuild the stage allowlist (e.g. MM-
   if (!repo) return fail("org access sync: pass <owner/repo> or run inside a repo checkout");
   const cfg = await loadConfig();
   if (!cfg.sagaApiUrl) return fail("org access sync: Hub API URL not configured");
-  const projects = await fetchProjectsList(registryClientDeps(cfg));
-  if (!projects) return failGraceful("org access sync: could not read the org project registry \u2014 nothing written");
-  const project2 = projects.find((p) => (p.repos ?? []).some((r) => r.toLowerCase() === repo.toLowerCase())) ?? null;
-  const config = stageAllowlistConfig(project2);
-  if (!config) return failGraceful(`org access sync: ${repo} has no stageAllowlist opt-in \u2014 set it with \`mmi-cli oracle org project set ${repo} --var 'stageAllowlist={"key":"<KEY>","stages":["dev"]}'\``);
+  const target = resolveStageAllowlistTarget(repo, await fetchProjectsList(registryClientDeps(cfg)));
+  if (target.kind === "no-opt-in") {
+    console.log(o.json ? JSON.stringify(target.json, null, 2) : target.message);
+    return;
+  }
+  if (target.kind !== "sync") return failGraceful(target.message);
+  const config = target.config;
   const secretsDeps = makeSecretsDeps(cfg);
   const client = defaultGitHubClient();
   const result = await syncStageAllowlist({

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.15",
+  "version": "4.6.17",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.15",
+  "version": "4.6.17",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/reference.md

@@ -309,7 +309,15 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   with `--var GATE_MAX_SECONDS=` (300s onboarding default — tighten once the gate is measured, via
   `--var` or `org project set <repo> --var gate={"maxSeconds":N}`); `ci audit` and the release train
   both enforce the step, so do not remove it. The tenant-container product image build (#7542)
-  shares that ceiling — no separate knob. Every trigger runs the full `GATE_CMD`. A repo whose checks
+  shares that ceiling — no separate knob. Node gates can opt into the shared memory policy (#9710), with
+  `--var GATE_CHECK_PARALLEL_MIN_FREE_MB=0` by default: no policy step or scheduling variable is rendered,
+  so existing scheduler behavior stays unchanged. A positive caller-measured minimum free MiB opts in;
+  the step then exports `RUN_CHECK_SERIAL=1` unless that minimum is met, and missing output keeps `1`.
+  A check script may consume that switch without changing its command or coverage. Opt in only after a
+  matched full-check serial/parallel experiment records duration, effective memory, whole-check peak,
+  OOM-event deltas and exit status. Python renders no policy step or variable. Shared pin propagation preserves
+  consumer thresholds; new seed delivery and live adoption remain separate verification.
+  Every trigger runs the full `GATE_CMD`. A repo whose checks
   need a service container or an extra budgeted step declares them in its registry gate config, never by
   hand-editing the rendered gate (#7407): `gate.services` is keyed by service name with `image`, `env`,
   `ports`, one-line `options` and `tmpfs` paths; `gate.steps` is a list of `{name, command, env,

package/skills/bootstrap/seeds/gate.template.yml

@@ -32,6 +32,8 @@ name: gate
 #   GATE_PY_VERSION    — Python version for setup-python ({{GATE_PY_VERSION}})
 #   GATE_MAX_SECONDS   — run-with-budget wall-clock ceiling in seconds ({{GATE_MAX_SECONDS}}); 300 default,
 #                        tighten per repo (org project set --var gate={"maxSeconds":N}) once measured (#3178)
+#   GATE_CHECK_PARALLEL_MIN_FREE_MB — measured minimum free MiB for parallel Node checks; 0 leaves scheduling unchanged.
+#                        Override only after a matched complete-check experiment (#9710).
 #   GATE_PUSH_BRANCHES_YAML — YAML list of push branches that trigger the workflow file (rendered by
 #                        bootstrap from the release track; not usually hand-passed)
 #   GATE_FULL_RUN_BRANCH — train branch whose PUSHES run the full gate job (development on full/direct;
@@ -39,6 +41,7 @@ name: gate
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
 # GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
+# GATE_CHECK_POLICY_SHA pins the opt-in memory policy; once configured, missing output selects serial (#9710).
 # GATE_VERDICT_STEP_YAML (org CI H1) renders the first step from the blessed verdict-receipt pin: a train push
 # reuses the merge queue's exact-SHA verdict, an rc tag the train push verdict (#8206). merge_group is the full
 # set here (only pull_request fails fast or skips), so `queue-is-full-verdict: 'true'` holds. Empty pin: the legacy #8206 rc-tag step.
@@ -185,7 +188,7 @@ jobs:
         run: |
           python3 --version || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — python3 not on PATH after setup-python. This is the runner, not your diff; no install or test ran. Re-run the job; if it persists the mmi-runner python toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
       - run: {{GATE_INSTALL_CMD}}
-        if: ${{ steps.development-gate.outputs.reuse != 'true' }}{{GATE_JEV_FETCH_YAML}}
+        if: ${{ steps.development-gate.outputs.reuse != 'true' }}{{GATE_JEV_FETCH_YAML}}{{GATE_CHECK_POLICY_STEP_YAML}}
       # #3178: the check runs under the org wall-clock budget — a hung suite dies at the ceiling instead
       # of squatting a runner lane for GitHub's 6h default. ci-audit + the release train enforce this step.
       # #9293: PRs fail fast, merge_group and tags run everything. pytest reads PYTEST_ADDOPTS natively; a
@@ -198,7 +201,7 @@ jobs:
       # outcomes step runs under always() (pass or fail).
       - uses: mutmutco/MMI-Hub/.github/actions/run-with-budget@{{GATE_BUDGET_SHA}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
-        env:
+        env:{{GATE_CHECK_POLICY_ENV_YAML}}
           MMI_FAIL_FAST: ${{ github.event_name == 'pull_request' && '1' || '' }}
           PYTEST_ADDOPTS: ${{ github.event_name == 'pull_request' && format('--maxfail=1 {0}', env.JEV_PYTEST_ARGS) || '' }}
           MMI_JEV_SKIP_ARGS: ${{ github.event_name == 'pull_request' && env.JEV_VITEST_ARGS || '' }}

package/skills/org-guide/references/work-and-releases.md

@@ -5,9 +5,9 @@ registry enrollment. Registry-listed admins with repository write access remain
 Use `mmi-cli oracle org access role <owner/repo> --json` to verify authority for release,
 candidate, hotfix, and runtime operations. Organization membership role alone is not this check.
 Verified repository writers (GitHub write, maintain or admin) may land PRs targeting `development`
-on non-Hub repositories. `/train-authority` reports this separately as `developmentMerge`;
-it does not grant release, candidate, hotfix or runtime train authority. MMI-Hub development
-merges remain master-only.
+and hold rc/main merge authority (`train: true`) on non-Hub product repositories (#9748) — keep them
+on those repos' branch-lock push allowlists. They keep the `developer` role: no `/secrets` or
+`/tenant-control` authority. The Hub's development merges and its distribution train remain master-only.
 The Hub distribution train remains organization-master-only. It runs in the `hub-release` workflow on
 our self-hosted runners, dispatched by an org owner, never on a workstation (#9137).
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is