@mutmutco/codex-plugin 4.6.26 → 4.6.27

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.26",
+  "version": "4.6.27",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -28179,10 +28179,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.26",
-    tag: "v4.6.26",
-    commit: "bab0b3157d41",
-    npm: "@mutmutco/cli@4.6.26"
+    version: "4.6.27",
+    tag: "v4.6.27",
+    commit: "b83c0c39cb1f",
+    npm: "@mutmutco/cli@4.6.27"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28199,14 +28199,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.26"
+          v3Target: "v4.6.27"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.26 and redeploy the Hub Lambda from tag v4.6.26 (bab0b3157d41); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.26 (@mutmutco/cli@4.6.26, tag commit bab0b3157d41 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.27 and redeploy the Hub Lambda from tag v4.6.27 (b83c0c39cb1f); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.27 (@mutmutco/cli@4.6.27, tag commit b83c0c39cb1f \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -43931,6 +43931,20 @@ ${list}
 Co-authored-by: GitHub <noreply@github.com>
 `;
 }
+function checkQueueSquashOverride(title, pr, messages, root) {
+  if (messages.length <= 1 || !messages.some((message2) => /^\s*Test-Policy-Override\s*:/im.test(`${message2.headline}
+${message2.body}`)) || readMessageOverride2(githubQueueSquashMessage(title, pr, messages), root)) return void 0;
+  return {
+    mergeStatus: "failed",
+    preparation: {
+      status: "preparation-needed",
+      reason: "queue-message-override",
+      issueTargets: [],
+      nextAction: "PR author: this repository squashes with COMMIT_MESSAGES, and GitHub composes a multi-commit squash as a list of every commit message followed by its own co-author block, so this Test-Policy-Override trailer would not be in the final trailer block the queue check reads. First, add one commit on this same branch whose message ends with a trailer block carrying the Test-Policy-Override waiver, push (no force-push), then rerun pr land on the same PR. This makes the waiver the final trailer block of the LAST commit. As a fallback, put the change in ONE commit whose message ends with a trailer block carrying the waiver: push a new branch whose single commit has the same tree, parented on the PR base; open it as a new PR and close this one, then rerun pr land. Keep repository settings unchanged."
+    },
+    error: "queue preparation needed: the multi-commit COMMIT_MESSAGES squash would bury the Test-Policy-Override waiver mid-message, so the queue check would fail malformed-override-trailer"
+  };
+}
 async function inspectQueuePreparation(pr, repo, options) {
   const read = options.read ?? readApi;
   const queueRead = options.read ?? actorReadApi;
@@ -44044,21 +44058,9 @@ ${pull.body}`;
     ])];
     return { kind: "refused", result: preparation("queue-message", targets, `GitHub's unchanged ${policy.body} message is unsafe for ${targets.map((number) => `${repo}#${number}`).join(", ")}. ${closingGuardDiagnostic(verdict.message)} See preparation.nextAction for the exact \`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\` remedy.`) };
   }
-  if (method === "SQUASH" && policy.body === "COMMIT_MESSAGES" && messages.length > 1 && options.bodyText == null && messages.some((message2) => /^\s*Test-Policy-Override\s*:/im.test(`${message2.headline}
-${message2.body}`)) && !readMessageOverride2(githubQueueSquashMessage(pull.title, pr, messages), process.cwd())) {
-    return {
-      kind: "refused",
-      result: {
-        mergeStatus: "failed",
-        preparation: {
-          status: "preparation-needed",
-          reason: "queue-message-override",
-          issueTargets: [],
-          nextAction: "PR author: this repository squashes with COMMIT_MESSAGES, and GitHub composes a multi-commit squash as a list of every commit message followed by its own co-author block, so this Test-Policy-Override trailer would not be in the final trailer block the queue check reads. Put the change in ONE commit whose message ends with a trailer block carrying the waiver (no force-push: push a new branch whose single commit has the same tree, parented on the PR base; open it as a new PR and close this one), or make the waiver the final trailer block of the LAST commit, then rerun pr land. Keep repository settings unchanged."
-        },
-        error: "queue preparation needed: the multi-commit COMMIT_MESSAGES squash would bury the Test-Policy-Override waiver mid-message, so the queue check would fail malformed-override-trailer"
-      }
-    };
+  if (method === "SQUASH" && policy.body === "COMMIT_MESSAGES" && options.bodyText == null) {
+    const refusal = checkQueueSquashOverride(pull.title, pr, messages, process.cwd());
+    if (refusal) return { kind: "refused", result: refusal };
   }
   const requiredBody = options.bodyText ?? composedBody;
   const prBodyPreservesOverrides = requiredBody != null && method === "SQUASH" && policy.body === "PR_BODY" && options.bodyText == null && prBodyPreservesCommitOverrides(messages, headline, pull.body, process.cwd());
@@ -47947,6 +47949,16 @@ function evaluateFilelessComposeGuard(input) {
   }
   return { ok: true };
 }
+function positionalOrRepoFlagTarget(commandName, positional, repoFlag) {
+  const pos = positional?.trim() || void 0;
+  const flag = repoFlag?.trim() || void 0;
+  if (!pos || !flag) return pos ?? flag;
+  const [a, b] = [pos.toLowerCase(), flag.toLowerCase()];
+  const tail = (s) => s.split("/").pop();
+  const same2 = a === b || (!a.includes("/") || !b.includes("/")) && tail(a) === tail(b);
+  if (!same2) throw new Error(`${commandName}: positional target ${pos} and --repo ${flag} name different repos; pass one of them`);
+  return pos;
+}
 function requireProjectTarget(commandName, explicitTarget, currentRepo) {
   const target = explicitTarget?.trim() || currentRepo?.trim();
   if (!target) {
@@ -56273,6 +56285,7 @@ function githubCustodyStore(repo, baseSha, api = defaultGitHubClient()) {
     }
   };
 }
+var DISPATCH_ABSENT_AFTER_MS = 18e4;
 var ReleaseCustodySession = class _ReleaseCustodySession {
   constructor(store, sha, state) {
     this.store = store;
@@ -56371,6 +56384,13 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
   async reconcile(observer) {
     for (const effect of Object.values(this.state.effects).filter((e) => e.state === "intent")) {
       const observation = await observer(effect);
+      if (!observation.observed && observation.absent) {
+        await this.change((state) => {
+          const { [effect.id]: _dropped, ...effects } = state.effects;
+          return { ...state, effects };
+        });
+        continue;
+      }
       if (!observation.observed) throw new ReleaseCustodyError(`effect ${effect.kind} (${effect.id}) has no proven outcome; observe it before retrying`);
       await this.change((state) => ({ ...state, effects: {
         ...state.effects,
@@ -56541,7 +56561,8 @@ function effectObserver(api) {
       const fields = i.fields;
       const title = effect.kind === "tenant-deploy" ? `tenant-deploy ${i.slug} ${i.stage} @ ${i.ref}` : workflow === "get-publish.yml" ? `get-publish (${fields.product} ${fields.mode || "full"})` : workflow === "tenant-deploy.yml" ? `tenant-deploy ${fields.slug} ${fields.stage} @ ${fields.ref}` : null;
       const matches = runs2.workflow_runs.filter((run) => title && run.display_title === title && run.event === "workflow_dispatch" && run.head_sha === i.sha && !i.beforeRunIds?.includes(run.id) && Date.parse(run.created_at) >= Date.parse(effect.startedAt) - 1e3 && Date.parse(run.created_at) <= Date.parse(effect.startedAt) + 12e4);
-      return matches.length === 1 ? { observed: true, result: effect.kind === "tenant-deploy" ? null : "" } : { observed: false };
+      if (matches.length === 1) return { observed: true, result: effect.kind === "tenant-deploy" ? null : "" };
+      return matches.length === 0 && Date.now() > Date.parse(effect.startedAt) + DISPATCH_ABSENT_AFTER_MS ? { observed: false, absent: true } : { observed: false };
     }
     return { observed: false };
   };
@@ -60828,6 +60849,25 @@ function createPreparationDeps(input, io = {}) {
       if (!await docs.refResolves(candidate.root, candidate.headSha) || !await docs.refResolves(candidate.root, candidate.baseSha)) {
         return result("skipped", "exact remote candidate objects are not available locally; committed test policy was not checked");
       }
+      const log = (await exec3("git", ["-C", candidate.root, "log", "--reverse", "--format=%B%x00", `${candidate.baseSha}..${candidate.headSha}`], { timeout: GIT_TIMEOUT_MS })).stdout;
+      const messages = log.split("\0").filter((message2) => message2.trim()).map((message2) => {
+        const [headline, ...body] = message2.trim().split("\n");
+        return { headline, body: body.join("\n") };
+      });
+      const refusal = checkQueueSquashOverride("Candidate PR", "0", messages, candidate.root);
+      if (refusal) {
+        const [owner, name] = candidate.repo.split("/");
+        const metadata = await client.graphql(
+          "query($owner:String!,$name:String!,$base:String!) { repository(owner:$owner,name:$name) { squashMergeCommitMessage mergeQueue(branch:$base) { configuration { mergeMethod } } } }",
+          { owner, name, base: candidate.base }
+        );
+        const rules = await client.restPaginate(`repos/${candidate.repo}/rules/branches/${encodeURIComponent(candidate.base)}?per_page=100`);
+        const methods = [...new Set(rules.filter((rule) => rule.type === "merge_queue").map((rule) => rule.parameters?.merge_method))];
+        const method = methods.length === 1 ? methods[0] : !methods.length ? metadata.repository.mergeQueue?.configuration?.mergeMethod : void 0;
+        if (method === "SQUASH" && metadata.repository.squashMergeCommitMessage === "COMMIT_MESSAGES") {
+          return result("failed", `${refusal.error} \u2014 ${refusal.preparation.nextAction}`);
+        }
+      }
       const policy = runTestPolicy(candidate.root, { candidate: { head: candidate.headSha, base: candidate.baseSha } });
       return result(policy.ok ? "passed" : "failed", policy.ok ? `committed test policy passed at ${candidate.headSha}` : policy.findings.map((finding) => finding.detail).join("\n"));
     }
@@ -73549,13 +73589,13 @@ project.command("sync-info [owner/repo]").description("synchronize the owning Gi
   }
 });
 async function runProjectDeployGet(repoOrSlug, o) {
-  const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("org project deploy get", repoOrSlug);
+    target = await projectTarget("org project deploy get", positionalOrRepoFlagTarget("org project deploy get", repoOrSlug, o.repo));
   } catch (e) {
     return fail(e.message);
   }
+  const cfg = await loadConfig();
   const out = await fetchDeployFactsBySlug(slugOf(target), registryClientDeps(cfg));
   if (!out) return failGraceful(`org project deploy get: Hub deploy facts read failed for ${target}`);
   const stage = o.stage?.trim();
@@ -73563,8 +73603,12 @@ async function runProjectDeployGet(repoOrSlug, o) {
   const payload = stage ? { slug: out.slug, stage, deploy: out.stages[stage] ?? null } : out;
   console.log(JSON.stringify(payload, null, 2));
 }
-var projectDeploy = project.command("deploy").description("read nonsecret DEPLOY# facts (domain, port, deploy path, substrate, host presence)").argument("[ownerRepo]", "shorthand for `get <owner/repo>`").addOption(new Option("--stage <stage>", "dev | rc | main").choices(["dev", "rc", "main"])).option("--json", "machine-readable output").action(async (ownerRepo, o) => runProjectDeployGet(ownerRepo, o));
-projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# facts for one project; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").choices(["dev", "rc", "main"])).option("--json", "machine-readable output").action(async (repoOrSlug, o) => runProjectDeployGet(repoOrSlug, { stage: projectDeploy.opts().stage, json: o.json }));
+var projectDeploy = project.command("deploy").description("read nonsecret DEPLOY# facts (domain, port, deploy path, substrate, host presence)").argument("[ownerRepo]", "shorthand for `get <owner/repo>`").addOption(new Option("--stage <stage>", "dev | rc | main").choices(["dev", "rc", "main"])).option("--repo <owner/repo>", "target repo (alias for the positional; defaults to the current repo)").option("--json", "machine-readable output").action(async (ownerRepo, o) => runProjectDeployGet(ownerRepo, o));
+projectDeploy.command("get [owner/repo]").description("read nonsecret DEPLOY# facts for one project; defaults to the current repo").addOption(new Option("--stage <stage>", "dev | rc | main").choices(["dev", "rc", "main"])).option("--repo <owner/repo>", "target repo (alias for the positional; defaults to the current repo)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => runProjectDeployGet(repoOrSlug, {
+  stage: projectDeploy.opts().stage,
+  json: o.json,
+  repo: projectDeploy.opts().repo ?? o.repo
+}));
 projectDeploy.command("doctor").description("read-only estate port scan; --box lists its DEPLOY# owners and suggests free 8xxx ports (master-only)").option("--box <name>", "resolve box from the live Hetzner inventory and inspect its ports").option("--json", "machine-readable output").action(async (o) => {
   const cfg = await loadConfig();
   const report = await fetchDeployPortCollisions(registryClientDeps(cfg));
@@ -73593,13 +73637,14 @@ projectDeploy.command("doctor").description("read-only estate port scan; --box l
   if (report.error && report.status !== 403) return failGraceful(`org project deploy doctor: ${report.error}`);
   if (!report.ok && !report.error) process.exitCode = 1;
 });
-projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one stage's DEPLOY# row for a project that no longer deploys through it (#7095, master-only). --stage is required. DRY-RUN by default \u2014 pass --apply to actually write; defaults to the current repo. Refuses a tenant-container project's live main row.").addOption(new Option("--stage <stage>", "dev | rc | main (required)").choices(["dev", "rc", "main"])).option("--apply", "actually retire (default is a dry-run preview of the row that would be retired)").option("--decommissioned", "main only (#8148): retire a tenant-container main row after `runtime tenant control <repo> main retire`; the box must show main gone").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
+projectDeploy.command("retire [owner/repo]").description("retire (tombstone) one stage's DEPLOY# row for a project that no longer deploys through it (#7095, master-only). --stage is required. DRY-RUN by default \u2014 pass --apply to actually write; defaults to the current repo. Refuses a tenant-container project's live main row.").addOption(new Option("--stage <stage>", "dev | rc | main (required)").choices(["dev", "rc", "main"])).option("--apply", "actually retire (default is a dry-run preview of the row that would be retired)").option("--decommissioned", "main only (#8148): retire a tenant-container main row after `runtime tenant control <repo> main retire`; the box must show main gone").option("--repo <owner/repo>", "target repo (alias for the positional; defaults to the current repo)").option("--json", "machine-readable output").action(async (repoOrSlug, o) => {
   const stage = projectDeploy.opts().stage;
   if (!stage) return fail("org project deploy retire: --stage is required (dev | rc | main)");
   const cfg = await loadConfig();
   let target;
   try {
-    target = await projectTarget("org project deploy retire", repoOrSlug);
+    const repoFlag = projectDeploy.opts().repo ?? o.repo;
+    target = await projectTarget("org project deploy retire", positionalOrRepoFlagTarget("org project deploy retire", repoOrSlug, repoFlag));
   } catch (e) {
     return fail(e.message);
   }

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.26",
+  "version": "4.6.27",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.26",
+  "version": "4.6.27",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -172,11 +172,15 @@ jobs:
       # MMI-Hub#5871: declare the npm MAJOR rather than inheriting whatever the runner's node bundles.
       # A bare major, never an exact patch (it goes stale and then prescribes downgrading operator
       # hosts toward it, #5862) and never `latest` (it takes the next major silently, #4782).
+      # MMI-Hub#9850: this single gate job is the designated hosted npm cache writer (auto saves only on a
+      # default-branch push), keyed on the one lockfile its install uses.
       - if: ${{ steps.development-gate.outputs.reuse != 'true' && ('{{GATE_RUNTIME}}' == 'node') }}
         uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
         with:
           node-version: 24
           npm-version: '12'
+          hosted-npm-cache: auto
+          hosted-npm-cache-lockfiles: {{GATE_CACHE_DEP_PATH}}
       - if: ${{ steps.development-gate.outputs.reuse != 'true' && ('{{GATE_RUNTIME}}' == 'python') }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: { python-version: '{{GATE_PY_VERSION}}' }

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -37,11 +37,17 @@ jobs:
       - name: Isolate npm cache
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
+      # MMI-Hub#9850: the single gate job is the designated hosted npm cache writer (auto saves only on a
+      # default-branch push), keyed on both lockfiles its two installs below use.
       - uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         with:
           node-version: 24
           npm-version: '12'
+          hosted-npm-cache: auto
+          hosted-npm-cache-lockfiles: |
+            package-lock.json
+            module/package-lock.json
       - run: npm ci --no-audit --no-fund
         if: ${{ steps.development-gate.outputs.reuse != 'true' }}
       - run: npm ci --prefix module --no-audit --no-fund

package/skills/org-guide/references/design.md

@@ -56,6 +56,11 @@ design work follows one harmonized **Front-Loaded Impeccable v4.7.0 + MM Artifac
   before choosing pieces; `exists` reports whether the requested guide exists. Never guess
   repo-root `node_modules/@mutmutco/mmwork-ds/docs/components/<Piece>.md`; component guides
   live in `<Piece>/guide.md`. No install/cache means capability remains unknown.
+  **Loading state comes from the content (#9851).** A page or component renders its loading state
+  from the same component tree as its real content: the kit Page `busy` or the component's own
+  loading state, drawing the real rows inert or hidden. Never hand-author a separate placeholder
+  skeleton kept in sync by hand. Every UI change checks the loading and loaded DOM structure match,
+  so an indicator cannot drift from the content it fronts.
 
 How the five pillars fit together (owner, 2026-10-25):
 

package/skills/org-guide/references/work-and-releases.md

@@ -161,6 +161,8 @@ Production changes require explicit authorization from the authorized human.
 Read the selected release skill before operating the train. Let it choose versions, run gates,
 publish, deploy, and verify the resulting release. A refusal requires fixing its cause; do not
 finish by hand, bypass checks, or start a duplicate release.
+Finish the board before a release cut: every item of this cycle is merged and `Done` first; a queued
+lane is not a landed one.
 Versions: patch is the default for fixes and small compatible additions. Minor is a deliberate call
 for a real feature, with a one-line reason. Major is a new start or direction and needs the owner's
 fresh approval before tagging. A breaking change refuses until it is shimmed or made an approved

package/skills/release/SKILL.md

@@ -15,6 +15,8 @@ Read `mmi-cli oracle org project get {owner}/{repo} --json` and name the lane ([
 
 ## Preflight
 
+Board first: `mmi-cli oracle board read --repo <owner/repo>`; cut only once every in-flight item of this cycle is merged and `Done` ([train-common.md](train-common.md#board-first)).
+
 `mmi-cli devops train doctor --lane release --heal --json`; read it per [train-common.md](train-common.md#doctor).
 
 ## Apply

package/skills/release/train-common.md

@@ -1,7 +1,11 @@
-# Train skills: shared doctor, recovery, merge floor, report and retro
+# Train skills: shared board-first, doctor, recovery, merge floor, report and retro
 
 `/release`, `/rcand` and `/hotfix` read this one file (from a sibling skill: `../release/train-common.md`). Each skill keeps only what differs by lane.
 
+## Board first
+
+Before any release cut, read the repo's own board: `mmi-cli oracle board read --repo <owner/repo>`. Every in-flight item of this cycle — claimed, in review, queued in the autolander, or awaiting landing — must be merged and `Done` first. A queued lane is not a landed one: wait for its landing to report merge and board `Done`. The cut is the last step of a board cycle, never interleaved with pending landings; otherwise the version ships without them and needs a second cut. Standing backlog nobody is working is not in flight and does not block.
+
 ## Doctor
 
 The preflight JSON is on stdout alone: a stale CLI first prints its self-update notice on stderr and re-runs itself, so parse stdout only, never `2>&1`. Read `ready`, then `findings[]`: each carries `code`, `severity` (`blocker` · `warning` · `healed` · `info`), `source` (`local` · `origin`), `remedy` and `anchor`. `ready: false` → stop and quote every blocker's `code` and `remedy`; an unread origin is never green. The apply step (`release --apply`, `rcand --apply`, `hotfix start`, `hotfix release`) re-runs the doctor first, with heal on.