@mutmutco/codex-plugin 4.6.29 → 4.6.31

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.29",
+  "version": "4.6.31",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -24526,19 +24526,7 @@ function formatBulkClaimSummary(results) {
   const notClaimed = skipped.map((r) => `${r.ref}${/already claimed by /i.test(r.reason) ? " (held by another lane)" : ""}`);
   return `claimed ${landed.length} of ${results.length}: ${landed.length ? `${landed.join(", ")} landed` : "none landed"}; not claimed: ${notClaimed.join(", ")}`;
 }
-async function claimBoardIssues(options, deps = {}) {
-  const cfg = resolveBoardConfig(options.config);
-  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
-  const selectors = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const raw of options.selectors) {
-    const selector = parseIssueSelector(raw, collected.repo, options.repo);
-    const key = `${selector.repo.toLowerCase()}#${selector.number}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    selectors.push(selector);
-  }
-  const ctx = await prepareClaimContext(options, selectors, deps, collected, snapshot);
+async function runBulkClaims(ctx, selectors, options) {
   const results = new Array(selectors.length);
   let next = 0;
   const worker = async () => {
@@ -24555,6 +24543,71 @@ async function claimBoardIssues(options, deps = {}) {
     }
   };
   await Promise.all(Array.from({ length: Math.min(CLAIM_CONCURRENCY, selectors.length) }, () => worker()));
+  return results;
+}
+function claimArgsError(refs, all) {
+  if (all && refs.length) return `--all claims the whole board; drop the explicit refs (${refs.join(" ")}) or drop --all`;
+  if (!all && !refs.length) return "missing issue ref: pass one or more refs, or --all for every open claimable item on the board";
+  return void 0;
+}
+async function claimAllBoardIssues(options, deps = {}) {
+  const cfg = resolveBoardConfig(options.config);
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
+  const ctx = await prepareClaimContext(options, [], deps, collected, snapshot);
+  const { primary } = ctx.report;
+  const assignee = options.assignee ?? "@me";
+  const login = assignee === "@me" ? ctx.report.viewer : assignee.replace(/^@/, "");
+  const selectors = [];
+  const skipped = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of [...primary.userOwned, ...primary.claimable, ...primary.unownedInFlight, ...primary.taken]) {
+    const key = item.ref.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (item.contentType !== "Issue") {
+      skipped.push({ ref: item.ref, reason: "not an issue" });
+      continue;
+    }
+    if (item.state !== "OPEN") {
+      skipped.push({ ref: item.ref, reason: `issue is ${item.state.toLowerCase()} but its card is ${item.status}` });
+      continue;
+    }
+    if (item.status === "In Review") {
+      skipped.push({ ref: item.ref, reason: "In Review \u2014 a whole-board claim does not pull review cards back to In Progress; claim it by ref to reclaim" });
+      continue;
+    }
+    const verdict = evaluateClaim(item, login);
+    if (!verdict.ok) {
+      skipped.push({ ref: item.ref, reason: verdict.reason.replace(/ \(never chain separate claims.*$/, "") });
+      continue;
+    }
+    selectors.push({ repo: item.repository, number: item.number });
+  }
+  ctx.selectedRefs = new Set(selectors.map((s) => `${s.repo}#${s.number}`.toLowerCase()));
+  const results = await runBulkClaims(ctx, selectors, options);
+  return {
+    viewer: ctx.report.viewer,
+    repo: ctx.report.repo,
+    results,
+    skipped,
+    failed: results.filter((result) => !result.claimed).length,
+    ...ctx.report.warnings.length ? { warnings: [...ctx.report.warnings] } : {}
+  };
+}
+async function claimBoardIssues(options, deps = {}) {
+  const cfg = resolveBoardConfig(options.config);
+  const { collected, snapshot } = await collectBoardPreferringSnapshot(cfg, options, deps);
+  const selectors = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const raw of options.selectors) {
+    const selector = parseIssueSelector(raw, collected.repo, options.repo);
+    const key = `${selector.repo.toLowerCase()}#${selector.number}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    selectors.push(selector);
+  }
+  const ctx = await prepareClaimContext(options, selectors, deps, collected, snapshot);
+  const results = await runBulkClaims(ctx, selectors, options);
   return {
     viewer: ctx.report.viewer,
     repo: ctx.report.repo,
@@ -25980,7 +26033,7 @@ var BLESSED_RUN_WITH_BUDGET_SHA = "cb31a94c89729beac83500ad4d301132dcfe2e4c";
 var BLESSED_RUNNER_GATE_SHA = "7f9a25df2ce7198c67407b42d0c548f75ce3f430";
 var BLESSED_RUNNER_CHECK_POLICY_SHA = "67bb2012710a96d21be825c29a5d5c2b4b8001e2";
 var BLESSED_KIT_AGENT_FILES_SHA = "e976df208d891b215844386c1cac0f161946b6fa";
-var BLESSED_JEV_FAILURES_SHA = "d5278c6133318b33727483ddfdfddc8f841e3ef6";
+var BLESSED_JEV_FAILURES_SHA = "20ce7d5e0d85cdc7e14bbacbc8b6afdabee6bd41";
 var BLESSED_VERDICT_RECEIPT_SHA = "";
 var BLESSED_RUNBOOK_GUARD_SHA = "e661e0aedc0e58b73c738bf6cdfeac65e5914584";
 var REMOTE_USE = /^mutmutco\/MMI-Hub\/\.github\/actions\/run-with-budget@(\S+)$/;
@@ -28248,10 +28301,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.29",
-    tag: "v4.6.29",
-    commit: "36e01a038f52",
-    npm: "@mutmutco/cli@4.6.29"
+    version: "4.6.31",
+    tag: "v4.6.31",
+    commit: "53e22eaf158d",
+    npm: "@mutmutco/cli@4.6.31"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28268,14 +28321,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.29"
+          v3Target: "v4.6.31"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.29 and redeploy the Hub Lambda from tag v4.6.29 (36e01a038f52); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.29 (@mutmutco/cli@4.6.29, tag commit 36e01a038f52 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.31 and redeploy the Hub Lambda from tag v4.6.31 (53e22eaf158d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.31 (@mutmutco/cli@4.6.31, tag commit 53e22eaf158d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -39363,8 +39416,9 @@ function blessedHubActionPins(constants = gate_budget_exports) {
   }
   return pins;
 }
+var PIN_COMMIT_FORMAT = "commit-format:runbook-unaffected";
 function pinTableDigest(pins) {
-  return (0, import_node_crypto11.createHash)("sha1").update([...pins].map(([a, s]) => `${a}@${s}`).sort().join("\n")).digest("hex");
+  return (0, import_node_crypto11.createHash)("sha1").update([PIN_COMMIT_FORMAT, ...[...pins].map(([a, s]) => `${a}@${s}`).sort()].join("\n")).digest("hex");
 }
 var HUB_ACTION_USE = /^(\s*-?\s*uses:\s*['"]?mutmutco\/mmi-hub\/\.github\/actions\/)([\w.-]+)@([^\s'"#]+)([^\n]*)$/i;
 function staleHubActionPins(body, pins = blessedHubActionPins()) {
@@ -39484,7 +39538,9 @@ async function runPinTick(input) {
       if (!next.changes.length) continue;
       lines2.push(...next.changes.map((c) => `- \`${path2}:${c.line}\` ${c.action}: \`${c.from.slice(0, 12)}\` \u2192 \`${c.to.slice(0, 12)}\``));
       const tmp = (0, import_node_path29.join)((0, import_node_os17.tmpdir)(), `mmi-pin-propagate-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}.json`);
-      const put = { message: `ci: pin MMI-Hub actions in ${path2} to the blessed SHAs`, content: encodeGitHubContents(next.body), branch };
+      const put = { message: `ci: pin MMI-Hub actions in ${path2} to the blessed SHAs
+
+Runbook-Unaffected: SHA-only MMI-Hub action pin move; no workflow step changes`, content: encodeGitHubContents(next.body), branch };
       if (file.sha) put.sha = file.sha;
       (0, import_node_fs32.writeFileSync)(tmp, JSON.stringify(put), "utf8");
       try {
@@ -42451,9 +42507,19 @@ async function runPrLandOnce(prNumber, options, deps) {
       }
     }
   }
-  const checksWaitError = (checksWait) => {
+  const isConflicting = (state) => state.mergeStateStatus === "DIRTY" || state.mergeable === "CONFLICTING";
+  const conflictError = () => `pr land #${prNumber}: branch conflicts with base \u2014 \`git fetch origin\`, merge origin/development into the branch (never rebase a pushed branch), resolve the conflicts, regenerate any checked-in artifacts, commit and push, then re-run \`mmi-cli devops pr land ${prNumber} --repo ${repo}\` once${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`;
+  const readPrState = async () => {
+    const state = await deps.readPrState(prNumber, repo);
+    if (!isConflicting(state)) return state;
+    await (deps.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms))))(PR_HEAD_UPDATE_API_READ_DELAY_MS);
+    return deps.readPrState(prNumber, repo);
+  };
+  let prState;
+  const checksWaitError = async (checksWait) => {
     if (checksWait.status === "conflicting") {
-      return `checks-wait conflicting: ${checksWait.reason ?? "PR is conflicting with the base branch"}`;
+      prState = await readPrState();
+      return isConflicting(prState) ? conflictError() : void 0;
     }
     if (checksWait.status === "failure" || checksWait.status === "timeout" || checksWait.status === "rate-limited") {
       return `checks-wait ${checksWait.status}${checksWait.detail ? `: ${checksWait.detail}` : ""}`;
@@ -42461,11 +42527,11 @@ async function runPrLandOnce(prNumber, options, deps) {
     return void 0;
   };
   base.checksWait = await deps.waitForChecks(prNumber, repo);
-  const waitError = checksWaitError(base.checksWait);
-  if (waitError) return { ...base, error: hasQueue ? `${waitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : waitError };
+  const waitError = await checksWaitError(base.checksWait);
+  if (waitError) return { ...base, error: hasQueue && base.checksWait.status !== "conflicting" ? `${waitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : waitError };
   const driftAfterChecks = await headDrift("after checks");
   if (driftAfterChecks) return driftAfterChecks;
-  let prState = await deps.readPrState(prNumber, repo);
+  prState = prState ?? await readPrState();
   if (!hasQueue && pinned && prState.mergeStateStatus === "BEHIND") {
     return {
       ...base,
@@ -42480,16 +42546,11 @@ async function runPrLandOnce(prNumber, options, deps) {
       return { ...base, error: `pr land #${prNumber}: ${e.message}` };
     }
     base.checksWait = await deps.waitForChecks(prNumber, repo);
-    const reWaitError = checksWaitError(base.checksWait);
-    if (reWaitError) return { ...base, error: hasQueue ? `${reWaitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : reWaitError };
-    prState = await deps.readPrState(prNumber, repo);
-  }
-  if (prState.mergeStateStatus === "DIRTY" || prState.mergeable === "CONFLICTING") {
-    return {
-      ...base,
-      error: `pr land #${prNumber}: branch conflicts with base \u2014 rebase/merge development, rebuild any checked-in artifacts, then re-push before landing${hasQueue ? `; ${prQueueReadHint(prNumber, repo)}` : ""}`
-    };
+    const reWaitError = await checksWaitError(base.checksWait);
+    if (reWaitError) return { ...base, error: hasQueue && base.checksWait.status !== "conflicting" ? `${reWaitError} \u2014 ${prQueueReadHint(prNumber, repo)}` : reWaitError };
+    prState = await readPrState();
   }
+  if (isConflicting(prState)) return { ...base, error: conflictError() };
   if (hasQueue && !deps.enqueueQueue) throw new Error("queue-only enqueue adapter unavailable; no merge dispatched");
   const merge = await mergeAutoWithTransientRetry(prNumber, repo, hasQueue ? { ...deps, mergeAuto: (pr, target) => deps.enqueueQueue(pr, target, pinned) } : deps);
   base.mergeStatus = merge.mergeStatus;
@@ -44060,13 +44121,13 @@ async function inspectQueuePreparation(pr, repo, options) {
   const parsed = parseRestClosingGuardInput({ state: pull.state, title: pull.title, body: pull.body }, commits, repo);
   parsed.closing = closing;
   const policy = { title: repository.squash_merge_commit_title, body: repository.squash_merge_commit_message };
-  const preparation = (reason, targets, detail) => ({
+  const preparation = (reason, targets, detail, nextAction) => ({
     mergeStatus: "failed",
     preparation: {
       status: "preparation-needed",
       reason,
       issueTargets: targets.map((number) => `${repo}#${number}`),
-      nextAction: reason === "queue-message" ? `PR author: if PR #${pr} is meant to close ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"}, add ${targets.length ? targets.map((number) => `\`Closes #${number}\``).join(", ") : "`Closes #N`"} to the PR body (\`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) and rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\` without pushing a new head; if ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"} must stay open, remove the closing phrases from the source commit or PR text using ${targets.length ? targets.map((number) => `\`Part of #${number}\``).join(", ") : "`Part of #N`"} / ${targets.length ? targets.map((number) => `\`Refs #${number}\``).join(", ") : "`Refs #N`"}, then re-run checks and \`pr land\` with the prepared head. A queue cannot accept --squash-body-file.` : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged."
+      nextAction: nextAction ?? (reason === "queue-message" ? `PR author: if PR #${pr} is meant to close ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"}, add ${targets.length ? targets.map((number) => `\`Closes #${number}\``).join(", ") : "`Closes #N`"} to the PR body (\`mmi-cli devops pr edit ${pr} --repo ${repo} --body-file .jerv/tmp/pr-${pr}-body.md\`) and rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\` without pushing a new head; if ${targets.length ? targets.map((number) => `#${number}`).join(", ") : "#N"} must stay open, remove the closing phrases from the source commit or PR text using ${targets.length ? targets.map((number) => `\`Part of #${number}\``).join(", ") : "`Part of #N`"} / ${targets.length ? targets.map((number) => `\`Refs #${number}\``).join(", ") : "`Refs #N`"}, then re-run checks and \`pr land\` with the prepared head. A queue cannot accept --squash-body-file.` : "PR author: prepare the source commit messages and required trailers without a body override; re-run checks and pr land. GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy. The combined queue candidate must pass with the updated shared trailer reader. Keep repository settings unchanged.")
     },
     error: `queue preparation needed: ${detail}`
   });
@@ -44149,7 +44210,17 @@ ${pull.body}`;
         }
       };
     }
-    return { kind: "refused", result: preparation("queue-message-override", [], "the requested sanitized body or trailer arrangement cannot be sent to queue admission") };
+    const trailerKeys = (message2) => {
+      const keys = [...new Set(parseTrailers(message2.trim(), process.cwd()).map((trailer) => trailer.split(":")[0].trim()))];
+      return keys.length ? keys.join(", ") : "none";
+    };
+    const source = options.bodyText != null ? "the explicit body override" : "the body composed from the source commit messages";
+    const detail = `the requested sanitized body or trailer arrangement cannot be sent to queue admission: queue merge method ${method}, squash body policy ${policy.body ?? "unknown"}; required body is ${source} (trailer keys: ${trailerKeys(`${headline}
+
+${requiredBody}`)}), but the message the queue would send carries trailer keys: ${trailerKeys(actualMessage)}`;
+    const next = options.bodyText != null ? `PR author: a merge queue accepts no body override; drop --body/--squash-body-file and place the required trailer(s) where the queue's ${method}${method === "SQUASH" ? ` (${policy.body})` : ""} message reads them, then rerun \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.` : method !== "SQUASH" ? `PR author: the queue's ${method} method keeps the original commit messages, so the required trailer(s) must sit in a source commit message's final trailer block; amend the commit, push, re-run checks and \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.` : policy.body === "BLANK" ? `PR author: squash body policy BLANK sends an empty body, so no trailer from the commits or PR body reaches the queue commit; the waiver cannot survive queue admission with unchanged repository settings \u2014 remove the need for the override or ask a maintainer. Keep repository settings unchanged.` : `PR author: squash body policy ${policy.body} does not reproduce the composed body; consolidate the required trailer(s) into one source commit message's final trailer block, push, re-run checks and \`mmi-cli devops pr land ${pr} --repo ${repo}\`. Keep repository settings unchanged.`;
+    const caveat = " GitHub may append coauthors even to one source commit, so source consolidation alone does not prove the generated message passes test policy; the combined queue candidate must pass with the shared trailer reader.";
+    return { kind: "refused", result: preparation("queue-message-override", [], detail, next + caveat) };
   }
   return { kind: "ready", head, pull, read, queueRead, write, ...verdict.message ? { warning: verdict.message } : {} };
 }
@@ -46215,9 +46286,41 @@ function registerBoardCommands(program3) {
     }
   });
   withExamples(mutating(
-    board.command("claim <issues...>").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs); the board scan rides the Hub snapshot, same as board read").addHelpText("after", "\nclaim reads the board through the same Hub snapshot leg as `board read` (the App-installation\ncredential, never your personal GraphQL pool); the direct user-auth read is an emergency fallback\nand is named in a Warning line after the verdict (#6162).\n\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n\nreclaim from In Review (#6339): an In Review item with no holder, or one held by the claiming\nlogin, is claimable \u2014 it moves back to In Progress and the receipt names the status it came from.\nAn In Review item another login holds is refused (ask the holder, or wait for the review to land),\nand Done stays refused. The board status is the authority; no PR state is consulted.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
+    board.command("claim [issues...]").description("claim issues: assign them and move their Project v2 Status to In Progress \u2014 idempotent, so an item already yours and In Progress succeeds unchanged (one or more refs, or --all for the whole board); the board scan rides the Hub snapshot, same as board read").addHelpText("after", "\nclaim reads the board through the same Hub snapshot leg as `board read` (the App-installation\ncredential, never your personal GraphQL pool); the direct user-auth read is an emergency fallback\nand is named in a Warning line after the verdict (#6162).\n\nevery claim stamps a lane-identity marker comment on the issue (`<!-- mmi-claim: \u2026 -->`,\nsurface/session@host) so other agents can attribute the hold (#3727). The session is the\nhost-exported id when the surface provides one, otherwise a per-process `synth-` fallback \u2014\na claim is never anonymous (#5245). `board show`, doctor and unclaim read the latest marker.\n\nsame-owner resume (#6035): when the prior marker was posted by YOUR login on THIS host and its\nlocal session is verifiably dead (transcript probe), the claim proceeds as a resume without\n--force and names the evidence. A live, foreign-host, or unprobeable prior lane still refuses.\n\nreclaim from In Review (#6339): an In Review item with no holder, or one held by the claiming\nlogin, is claimable \u2014 it moves back to In Progress and the receipt names the status it came from.\nAn In Review item another login holds is refused (ask the holder, or wait for the review to land),\nand Done stays refused. The board status is the authority; no PR state is consulted.\n\nwhole board (#9930): --all reads the board once and claims every open item of this repo's primary\nboard that the per-ref claim may take (yours, unassigned Todo, unowned In Progress), carrying each\nitem's branch/worktree lane evidence forward like a per-ref claim. It prints one line per item, then\nthe refs it skipped and why (assigned to another login, In Review, closed, not an issue). Without\n--force a live foreign lane is skipped with its reason, never stolen; --force takes it as the\nper-ref --force would. --all with explicit refs is an error.\n").option("--json", "machine-readable output").option("--repo <owner/repo>", "current repo for local issue numbers (defaults to git origin)").option("--for <login>", "assign to this login instead of @me \u2014 agent claims on behalf of the master").option("--force", "take an item already claimed by another lane that shows live evidence of active work (#3727)").option("--all", "claim every open claimable item on the current repo's board in one pass (combine with --force/--repo; not with explicit refs) (#9930)").option("--check", "read-only: run every claim gate and report the verdict, writing nothing \u2014 exits 1 with the same refusal a real claim would raise (#4511)").option("--allow-partial", "return success JSON if assignment succeeds but the status move fails"),
     (_opts, args) => ({ command: "oracle board claim", issues: args[0] ?? [] })
-  ).action(async (issueRefs, o) => {
+  ).action(async (issueRefs = [], o) => {
+    const argsError = claimArgsError(issueRefs, o.all);
+    if (argsError) return failGraceful(`oracle board claim failed: ${argsError}`);
+    if (o.all) {
+      try {
+        const config = await loadConfigForBoardSelector2("", o.repo);
+        const all = await claimAllBoardIssues({
+          config,
+          repo: o.repo,
+          assignee: o.for,
+          force: o.force,
+          check: o.check,
+          allowPartial: o.allowPartial
+        }, { snapshot: registryClientDeps(config) });
+        if (o.json) {
+          console.log(JSON.stringify({ results: all.results, skipped: all.skipped }));
+          printClaimWarnings(all.warnings, true);
+        } else {
+          for (const result of all.results) {
+            console.log(result.claimed ? claimVerdict(result.ref, result) : `Skipped ${result.ref}: ${result.reason}`);
+          }
+          for (const skip of all.skipped) console.log(`Skipped ${skip.ref}: ${skip.reason}`);
+          const landed = all.results.filter((r) => r.claimed).length;
+          console.log(`claim --all: ${landed} of ${all.results.length} attempted item(s) claimed; ${all.skipped.length} not attempted`);
+          printClaimWarnings(all.warnings);
+        }
+        if (all.failed > 0) process.exitCode = 1;
+      } catch (e) {
+        if (refuseRateLimited(e, o.json)) return;
+        return failGraceful(`oracle board claim failed: ${e.message}`);
+      }
+      return;
+    }
     if (issueRefs.length === 1) {
       const issueRef = issueRefs[0];
       try {
@@ -46276,11 +46379,13 @@ function registerBoardCommands(program3) {
   }), [
     "mmi-cli oracle board claim 2680",
     "mmi-cli oracle board claim 2680 2681 --for teammate-login",
-    "mmi-cli oracle board claim 2680 --check"
+    "mmi-cli oracle board claim 2680 --check",
+    "mmi-cli oracle board claim --all --force"
   ], [
     "Pass raw issue numbers/refs, not URLs.",
     "Claim already assigns and moves Status to In Progress, so do not also board move it.",
     "Multiple refs are handled as a batch and return per-item results.",
+    "To claim the whole board, use --all (with --force to take live lanes) instead of a hand-built ref list.",
     "--check is the live gate read (it calls GitHub); --dry-run only echoes the parsed argv plan.",
     // #5552: agents guess `oracle issue claim`; that route does not exist — board claim is the only write.
     "Never run `oracle issue claim` \u2014 claims are board mutations; only `oracle board claim <ref>` is valid.",
@@ -60790,9 +60895,13 @@ async function checkDocsIndexAtHead(opts, deps) {
 }
 
 // src/pr-create-preparation.ts
+function rejectionReason(error) {
+  const text = (error instanceof Error ? error.message : String(error)).trim().split("\n")[0] || "no error detail";
+  return text.length > 300 ? `${text.slice(0, 300)}\u2026` : text;
+}
 async function preparePrCreate(input, deps = createPreparationDeps(input)) {
   const observations = [];
-  const refs = await deps.candidate().catch(() => ({ findings: ["candidate refs unavailable; verify the repository and pushed head/base before retrying"] }));
+  const refs = await deps.candidate().catch((error) => ({ findings: [`candidate refs unavailable (${rejectionReason(error)}); verify the repository and pushed head/base before retrying`] }));
   observations.push(...refs.findings.map((detail) => ({ check: "refs", state: "unavailable", detail })));
   if (refs.candidate) observations.push({ check: "refs", state: "passed", detail: `candidate ${refs.candidate.headSha} against ${refs.candidate.baseSha}` });
   const reads = await Promise.allSettled([
@@ -60803,10 +60912,10 @@ async function preparePrCreate(input, deps = createPreparationDeps(input)) {
   const [claims, docs, policy] = reads;
   if (claims.status === "fulfilled") {
     observations.push(...claims.value.findings.length ? claims.value.findings.map((detail) => ({ check: "claims", state: "failed", detail })) : [{ check: "claims", state: "passed", detail: "issue and claim evidence read" }]);
-  } else observations.push({ check: "claims", state: "unavailable", detail: "issue/claim evidence unavailable; retry the read" });
-  if (docs.status === "rejected") observations.push({ check: "docs", state: "unavailable", detail: "committed docs observation unavailable; retry the read" });
+  } else observations.push({ check: "claims", state: "unavailable", detail: `issue/claim evidence unavailable (${rejectionReason(claims.reason)}); retry the read` });
+  if (docs.status === "rejected") observations.push({ check: "docs", state: "unavailable", detail: `committed docs observation unavailable (${rejectionReason(docs.reason)}); retry the read` });
   else if (docs.value) observations.push({ check: "docs", state: docs.value.state, detail: [docs.value.detail, docs.value.fix].filter(Boolean).join(" \u2014 ") });
-  if (policy.status === "rejected") observations.push({ check: "policy", state: "unavailable", detail: "committed test-policy observation unavailable; check policy validity and fetch full candidate history before retrying" });
+  if (policy.status === "rejected") observations.push({ check: "policy", state: "unavailable", detail: `committed test-policy observation unavailable (${rejectionReason(policy.reason)}); check policy validity and fetch full candidate history before retrying` });
   else if (policy.value) observations.push(policy.value);
   const findings = observations.filter((item) => item.state === "failed" || item.state === "unavailable");
   let attempted = false;
@@ -60938,7 +61047,12 @@ function createPreparationDeps(input, io = {}) {
           return result("failed", `${refusal.error} \u2014 ${refusal.preparation.nextAction}`);
         }
       }
-      const policy = runTestPolicy(candidate.root, { candidate: { head: candidate.headSha, base: candidate.baseSha } });
+      let policy;
+      try {
+        policy = runTestPolicy(candidate.root, { candidate: { head: candidate.headSha, base: candidate.baseSha } });
+      } catch (error) {
+        return result("unavailable", `committed test policy could not be evaluated: ${rejectionReason(error)} \u2014 fix test-policy.json if it is malformed, or run \`git fetch --unshallow\` if a history read failed`);
+      }
       return result(policy.ok ? "passed" : "failed", policy.ok ? `committed test policy passed at ${candidate.headSha}` : policy.findings.map((finding) => finding.detail).join("\n"));
     }
   };
@@ -64968,9 +65082,13 @@ function projectInfoOutcome(projectInfoSync) {
 }
 function buildReleaseVerdict(commandName, result, projectInfoSync) {
   const alignmentPending = result.devRollForward?.status === "pr-pending" || result.rcAlignment?.status === "pr-pending";
+  const deployOutcome = reduceFollowUpOutcomes([
+    deployFollowUpOutcome(result.deployStatus),
+    deployFollowUpOutcome(aggregateWorkflowRuns(result.workflowRuns ?? []))
+  ]);
   const followUpStatus = deriveTrainFollowUpStatus({
     projectInfo: projectInfoOutcome(projectInfoSync),
-    deploy: deployFollowUpOutcome(result.deployStatus),
+    deploy: deployOutcome,
     rcRetirement: result.rcRetirement === "failed" ? result.rcRetirementCategory === "wait-timeout" ? "unresolved" : "failure" : "ok",
     alignment: alignmentPending ? "unresolved" : "ok",
     foldPort: "ok"
@@ -64990,9 +65108,14 @@ function buildReleaseVerdict(commandName, result, projectInfoSync) {
 }
 function buildResumeReleaseVerdict(result, projectInfoSync) {
   const resumeStatus = resumeFollowUpOf(result.state);
+  const deployOutcome = reduceFollowUpOutcomes([
+    // No dispatch (e.g. an alignment-only resume) keeps the old 'ok' deploy dimension.
+    deployFollowUpOutcome(result.dispatch?.deployStatus ?? "success"),
+    deployFollowUpOutcome(aggregateWorkflowRuns(result.dispatch?.workflowRuns ?? []))
+  ]);
   const followUpStatus = deriveTrainFollowUpStatus({
     projectInfo: projectInfoOutcome(projectInfoSync),
-    deploy: "ok",
+    deploy: deployOutcome,
     rcRetirement: "ok",
     alignment: resumeStatus === "failed" ? "failure" : resumeStatus === "pending" ? "unresolved" : "ok",
     foldPort: "ok"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.29",
+  "version": "4.6.31",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.29",
+  "version": "4.6.31",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/runbook-unaffected.json

@@ -1,7 +1,7 @@
 {
   ".github/workflows/agent-pr.yml": {
-    "blob": "dff394ae296224bc1d40f2ab4953d30a89bc5a91",
-    "reason": "runs-on only: the two seconds-long guard legs moved off the busy CI pool to the reserved journey/deploy pool with a 5-minute cap (#9211); job logic, steps, permissions and operator responsibilities unchanged"
+    "blob": "e85a80c65b26531a330917fb4b5d8f563a0f0d0c",
+    "reason": "sole-write-path guard reads retry transient GitHub API 5xx/429/transport failures up to 3 attempts, then fail closed with the same messages (#9911); permissions, refs, guarded paths and operator responsibilities unchanged"
   },
   "scripts/next-version.mjs": {
     "blob": "2c1985b59edc779695479559074e7654c1574a11",

package/skills/hotfix/suite.md

@@ -1,2 +1,2 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
+In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: run `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` instead (a lead-only cut needs `--suite-solo --owner-go`). On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 

package/skills/rcand/suite.md

@@ -1,4 +1,4 @@
-In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync.
+In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 
 Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.
 

package/skills/release/SKILL.md

@@ -11,7 +11,7 @@ Bare `minor|major|patch` (default `patch`), never a flag. A production release n
 
 ## Lane
 
-Read `mmi-cli oracle org project get {owner}/{repo} --json` and name the lane ([verification.md](verification.md) Lane rules); unreadable META → stop. [suite.md](suite.md) for MM-Work; [vercel.md](vercel.md) for Vercel.
+Read `mmi-cli oracle org project get {owner}/{repo} --json` and name the lane ([verification.md](verification.md) Lane rules); unreadable META → stop. On `releaseTrack: single` (MM-Work and its modules) or `trunk` there is no release lane. On single track a merge to development auto-deploys the `main` stage, and release, rcand and hotfix refuse. A merged single-track change is live once that deploy is green. A trunk repo follows its own declared publishing workflow. Never tell the owner a landed change waits on a release. [suite.md](suite.md) for suite cuts; [vercel.md](vercel.md) for Vercel.
 
 ## Preflight
 

package/skills/release/suite.md

@@ -1,3 +1,5 @@
+MM-Work and most of its modules are `releaseTrack: single` ([work-and-releases.md](../org-guide/references/work-and-releases.md)). A merge to development auto-deploys their `main` stage, so a landed change is live once that deploy is green. Never tell the owner such a change waits on a release. Read each repo's `releaseTrack` with `mmi-cli oracle org project get <owner/repo> --json` before naming any cut. A suite cut also cuts the MM-Work lead's rcand, which refuses while MM-Work is single track.
+
 In the suite lead (MM-Work) a plain rcand, release or hotfix refuses: the suite path is `mmi-cli devops suite rcand --owner-go` or `mmi-cli devops suite release --owner-go` (a lead-only cut needs `--suite-solo --owner-go`). `--owner-go` records Jervaise's explicit go for that one cut; it is never the agent's own flag. Never pass it on your own authority: a held train or a stale MM-Work cut (`suite abandon --owner-go`, then `suite rcand --owner-go`) is handed to the suite orchestrator with that exact command sequence, and runs only after the owner says go. On your own, run only the read-only previews `mmi-cli devops suite rcand --dry-run` and `mmi-cli devops suite hotfix <member> --dry-run`; `suite release` and `suite abandon` have no dry-run, so never run them yourself. A real suite rcand, release, hotfix or abandon runs only on the owner's go, executed by the owner or the suite orchestrator. A suite member cannot run standalone rcand, release or hotfix: cut from the suite lead; only a backward-compatible solo backend release/hotfix with explicit owner approval may pass `--suite-solo --owner-go`, and its MM-Work development pin PR must land before the suite is in sync. A suite member never asks for, proposes or prompts an rc, release or hotfix — the suite orchestrator is the only voice that brings a cut to Jervaise, so a member session states what landed and stops instead of offering a cut.
 
 Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.