@mutmutco/codex-plugin 4.6.29 → 4.6.30

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.29",
+  "version": "4.6.30",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -28248,10 +28248,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.29",
-    tag: "v4.6.29",
-    commit: "36e01a038f52",
-    npm: "@mutmutco/cli@4.6.29"
+    version: "4.6.30",
+    tag: "v4.6.30",
+    commit: "52569fa5c01e",
+    npm: "@mutmutco/cli@4.6.30"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28268,14 +28268,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.29"
+          v3Target: "v4.6.30"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.29 and redeploy the Hub Lambda from tag v4.6.29 (36e01a038f52); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.29 (@mutmutco/cli@4.6.29, tag commit 36e01a038f52 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.30 and redeploy the Hub Lambda from tag v4.6.30 (52569fa5c01e); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.30 (@mutmutco/cli@4.6.30, tag commit 52569fa5c01e \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -39363,8 +39363,9 @@ function blessedHubActionPins(constants = gate_budget_exports) {
   }
   return pins;
 }
+var PIN_COMMIT_FORMAT = "commit-format:runbook-unaffected";
 function pinTableDigest(pins) {
-  return (0, import_node_crypto11.createHash)("sha1").update([...pins].map(([a, s]) => `${a}@${s}`).sort().join("\n")).digest("hex");
+  return (0, import_node_crypto11.createHash)("sha1").update([PIN_COMMIT_FORMAT, ...[...pins].map(([a, s]) => `${a}@${s}`).sort()].join("\n")).digest("hex");
 }
 var HUB_ACTION_USE = /^(\s*-?\s*uses:\s*['"]?mutmutco\/mmi-hub\/\.github\/actions\/)([\w.-]+)@([^\s'"#]+)([^\n]*)$/i;
 function staleHubActionPins(body, pins = blessedHubActionPins()) {
@@ -39484,7 +39485,9 @@ async function runPinTick(input) {
       if (!next.changes.length) continue;
       lines2.push(...next.changes.map((c) => `- \`${path2}:${c.line}\` ${c.action}: \`${c.from.slice(0, 12)}\` \u2192 \`${c.to.slice(0, 12)}\``));
       const tmp = (0, import_node_path29.join)((0, import_node_os17.tmpdir)(), `mmi-pin-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      const put = { message: `ci: pin MMI-Hub actions in ${path2} to the blessed SHAs`, content: encodeGitHubContents(next.body), branch };
+      const put = { message: `ci: pin MMI-Hub actions in ${path2} to the blessed SHAs
+
+Runbook-Unaffected: SHA-only MMI-Hub action pin move; no workflow step changes`, content: encodeGitHubContents(next.body), branch };
       if (file.sha) put.sha = file.sha;
       (0, import_node_fs32.writeFileSync)(tmp, JSON.stringify(put), "utf8");
       try {
@@ -42451,9 +42454,19 @@ async function runPrLandOnce(prNumber, options, deps) {
       }
     }
   }
-  const checksWaitError = (checksWait) => {
+  const isConflicting = (state) => state.mergeStateStatus === "DIRTY" || state.mergeable === "CONFLICTING";
+  const conflictError = () => `pr land #${prNumber}: branch conflicts with base \u2014 merge origin/development into the branch (never rebase a pushed branch), rebuild any checked-in artifacts, then push before landing${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`;
+  const readPrState = async () => {
+    const state = await deps.readPrState(prNumber, repo);
+    if (!isConflicting(state)) return state;
+    await (deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))))(PR_HEAD_UPDATE_API_READ_DELAY_MS);
+    return deps.readPrState(prNumber, repo);
+  };
+  let prState;
+  const checksWaitError = async (checksWait) => {
     if (checksWait.status === "conflicting") {
-      return `checks-wait conflicting: ${checksWait.reason ?? "PR is conflicting with the base branch"}`;
+      prState = await readPrState();
+      return isConflicting(prState) ? conflictError() : void 0;
     }
     if (checksWait.status === "failure" || checksWait.status === "timeout" || checksWait.status === "rate-limited") {
       return `checks-wait ${checksWait.status}${checksWait.detail ? `: ${checksWait.detail}` : ""}`;
@@ -42461,11 +42474,11 @@ async function runPrLandOnce(prNumber, options, deps) {
     return void 0;
   };
   base.checksWait = await deps.waitForChecks(prNumber, repo);
-  const waitError = checksWaitError(base.checksWait);
-  if (waitError) return { ...base, error: hasQueue ? `${waitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : waitError };
+  const waitError = await checksWaitError(base.checksWait);
+  if (waitError) return { ...base, error: hasQueue && base.checksWait.status !== "conflicting" ? `${waitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : waitError };
   const driftAfterChecks = await headDrift("after checks");
   if (driftAfterChecks) return driftAfterChecks;
-  let prState = await deps.readPrState(prNumber, repo);
+  prState = prState ?? await readPrState();
   if (!hasQueue && pinned && prState.mergeStateStatus === "BEHIND") {
     return {
       ...base,
@@ -42480,16 +42493,11 @@ async function runPrLandOnce(prNumber, options, deps) {
       return { ...base, error: `pr land #${prNumber}: ${e.message}` };
     }
     base.checksWait = await deps.waitForChecks(prNumber, repo);
-    const reWaitError = checksWaitError(base.checksWait);
-    if (reWaitError) return { ...base, error: hasQueue ? `${reWaitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : reWaitError };
-    prState = await deps.readPrState(prNumber, repo);
-  }
-  if (prState.mergeStateStatus === "DIRTY" || prState.mergeable === "CONFLICTING") {
-    return {
-      ...base,
-      error: `pr land #${prNumber}: branch conflicts with base \u2014 rebase/merge development, rebuild any checked-in artifacts, then re-push before landing${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`
-    };
+    const reWaitError = await checksWaitError(base.checksWait);
+    if (reWaitError) return { ...base, error: hasQueue && base.checksWait.status !== "conflicting" ? `${reWaitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : reWaitError };
+    prState = await readPrState();
   }
+  if (isConflicting(prState)) return { ...base, error: conflictError() };
   if (hasQueue && !deps.enqueueQueue) throw new Error("queue-only enqueue adapter unavailable; no merge dispatched");
   const merge = await mergeAutoWithTransientRetry(prNumber, repo, hasQueue ? { ...deps, mergeAuto: (pr, target) => deps.enqueueQueue(pr, target, pinned) } : deps);
   base.mergeStatus = merge.mergeStatus;

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.29",
+  "version": "4.6.30",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.29",
+  "version": "4.6.30",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/hotfix/suite.md

@@ -1,2 +1,2 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
+In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 

package/skills/rcand/suite.md

@@ -1,4 +1,4 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
+In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 
 Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.