@mutmutco/codex-plugin 4.6.32 → 4.6.33

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.32",
+  "version": "4.6.33",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -27062,6 +27062,71 @@ function contentPutInputArgs(repo, path2, inputFile) {
     inputFile
   ];
 }
+var BANK_REQUEST_REPO = "mutmutco/Jerv-Hub";
+var BANK_REQUEST_LABEL = "bank-request";
+var BANK_REQUEST_SOURCE = "MMI-Hub#9958";
+function bankRequestTitle(repoName2) {
+  return `bank-request: coding-agent::${repoName2}`;
+}
+function bankRequestBody(fullName) {
+  return `Create the coding-agent memory bank for \`${fullName}\` (asked by \`mmi-cli devops bootstrap apply\`; see ${BANK_REQUEST_SOURCE}).`;
+}
+function planBankRequest(fullName, existing) {
+  const parsed = parseOwnerRepo(fullName);
+  const base = { title: bankRequestTitle(parsed.name), label: BANK_REQUEST_LABEL, body: bankRequestBody(parsed.fullName) };
+  if (existing == null) return { ...base, action: "skip", reason: `could not read ${BANK_REQUEST_REPO} issues` };
+  const found = existing.find((issue) => issue?.title === base.title);
+  if (found) {
+    return {
+      ...base,
+      action: "exists",
+      number: found.number,
+      state: found.state ?? "open",
+      url: found.url ?? `https://github.com/${BANK_REQUEST_REPO}/issues/${found.number}`
+    };
+  }
+  return { ...base, action: "create" };
+}
+var oneLine = (e) => String(e?.message ?? e).split("\n")[0].trim();
+function bankRequestManualStep(request, reason) {
+  return `file it by hand at https://github.com/${BANK_REQUEST_REPO}/issues/new \u2014 title "${request.title}", label ${request.label}, body: ${request.body} (${reason})`;
+}
+function renderBankRequestPlan(result) {
+  return [
+    "bootstrap apply \u2014 coding-agent memory bank request (dry-run; no issue filed):",
+    `  PLAN file issue "${result.title}" (label ${result.label}) in ${BANK_REQUEST_REPO}`,
+    `  body: ${result.body}`
+  ].join("\n");
+}
+function renderBankRequestLine(result) {
+  if (result.status === "opened") {
+    return `memory bank request: ${BANK_REQUEST_REPO}#${result.number} opened \u2014 "${result.title}" (label ${result.label})${result.url ? ` ${result.url}` : ""}`;
+  }
+  if (result.status === "exists") {
+    return `memory bank request: already requested \u2014 ${BANK_REQUEST_REPO}#${result.number} (${result.state})${result.url ? ` ${result.url}` : ""}`;
+  }
+  return `memory bank request: SKIPPED (${result.reason ?? "not attempted"}) \u2014 ${bankRequestManualStep(result, result.reason ?? "not attempted")}`;
+}
+async function runBankRequest(fullName, options, deps) {
+  const parsed = parseOwnerRepo(fullName);
+  const request = { title: bankRequestTitle(parsed.name), label: BANK_REQUEST_LABEL, body: bankRequestBody(parsed.fullName) };
+  if (options.dryRun) return { ...request, status: "planned" };
+  let existing;
+  try {
+    existing = await deps.listIssues();
+  } catch (e) {
+    return { ...request, status: "skipped", reason: `could not read ${BANK_REQUEST_REPO} issues: ${oneLine(e)}` };
+  }
+  const plan = planBankRequest(fullName, existing);
+  if (plan.action === "exists") return { ...request, status: "exists", number: plan.number, state: plan.state, url: plan.url };
+  if (plan.action === "skip") return { ...request, status: "skipped", reason: plan.reason };
+  try {
+    const created = await deps.createIssue(request);
+    return { ...request, status: "opened", number: created.number, url: created.url };
+  } catch (e) {
+    return { ...request, status: "skipped", reason: `App issue write failed: ${oneLine(e)}` };
+  }
+}
 
 // src/train-apply-contracts.ts
 var import_node_fs21 = require("node:fs");
@@ -28301,10 +28366,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.32",
-    tag: "v4.6.32",
-    commit: "0e477e5e2765",
-    npm: "@mutmutco/cli@4.6.32"
+    version: "4.6.33",
+    tag: "v4.6.33",
+    commit: "80768b0b2052",
+    npm: "@mutmutco/cli@4.6.33"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -28321,14 +28386,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.32"
+          v3Target: "v4.6.33"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.32 and redeploy the Hub Lambda from tag v4.6.32 (0e477e5e2765); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.32 (@mutmutco/cli@4.6.32, tag commit 0e477e5e2765 \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.33 and redeploy the Hub Lambda from tag v4.6.33 (80768b0b2052); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.33 (@mutmutco/cli@4.6.33, tag commit 80768b0b2052 \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {
@@ -51508,6 +51573,7 @@ function registerBootstrapCommands(program3) {
     }
     const actions = [];
     const applied = [];
+    let bankRequest = null;
     let applyDeployModel;
     let applyProjectType;
     try {
@@ -51986,6 +52052,48 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         applied.push(`ddb register ${registerPayload.slug} (failed: ${why})`);
       }
     }
+    if (!onlyTarget) {
+      bankRequest = await runBankRequest(repo, { dryRun: !o.execute }, {
+        listIssues: async () => {
+          const listed = await gh2([
+            "issue",
+            "list",
+            "--repo",
+            BANK_REQUEST_REPO,
+            "--state",
+            "all",
+            "--search",
+            `in:title "${bankRequestTitle(parsedRepo.name)}"`,
+            "--json",
+            "number,title,state,url",
+            "--limit",
+            "50"
+          ]);
+          const rows = JSON.parse(listed.stdout || "[]");
+          if (!Array.isArray(rows)) throw new Error("issue list is not an array");
+          return rows;
+        },
+        createIssue: async (request) => {
+          const out = await gh2([
+            "issue",
+            "create",
+            "--repo",
+            BANK_REQUEST_REPO,
+            "--title",
+            request.title,
+            "--body",
+            request.body,
+            "--label",
+            request.label
+          ]);
+          const url = out.stdout.trim().split("\n").pop()?.trim() ?? "";
+          const number = Number(/(\d+)$/.exec(url)?.[1]);
+          if (!url || !Number.isFinite(number)) throw new Error(`issue create returned no issue URL: ${out.stdout.trim().slice(0, 200)}`);
+          return { number, url };
+        }
+      });
+      if (o.execute) applied.push(renderBankRequestLine(bankRequest));
+    }
     if (o.execute && !onlyTarget) {
       const github = await readBootstrapGitHubFacts(repo, effectiveTrack, controlClient);
       controlDeployFacts = await fetchDeployFactsBySlug(slug, registryClientDeps(await loadConfig()));
@@ -52081,13 +52189,15 @@ ${onlyManagedBlock ? `Only the marker-bounded Hub-managed block inside repo-owne
         return failGraceful(`bootstrap apply: cannot plan labels/environments; no writes made: ${e.message}`);
       }
     }
-    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedBranch: seedPlan.branch, seedBaseSha: scopedPlan?.baseSha, seedPrUrl, actions, controlPlane: controlRows, labels: ancillaryPlan, environments: environmentPlan, applied, ddbWrites }, null, 2));
+    if (o.json) console.log(JSON.stringify({ repo, class: o.class, sourceSha: seedSource.sha, only: onlyTarget || null, execute: o.execute, seedDelivery: seedPlan.mode, seedBranch: seedPlan.branch, seedBaseSha: scopedPlan?.baseSha, seedPrUrl, actions, controlPlane: controlRows, labels: ancillaryPlan, environments: environmentPlan, bankRequest, applied, ddbWrites }, null, 2));
     else {
       console.log(renderSeedPlan(actions));
       if (controlRows.length) console.log(`
 ${renderBootstrapControlPlan(controlRows)}`);
       if (ancillaryPlan && environmentPlan) console.log(`
 ${renderBootstrapAncillaryPlan(ancillaryPlan, environmentPlan, repoEnvironmentSpecs(repo, effectiveTrack, suiteSlug).filter((spec) => spec.exception).map((spec) => ({ name: spec.name, detail: spec.exception })))}`);
+      if (bankRequest?.status === "planned") console.log(`
+${renderBankRequestPlan(bankRequest)}`);
       if (o.execute) console.log(`
 LIVE apply to ${repo}:
   ${applied.join("\n  ")}`);
@@ -56455,6 +56565,7 @@ async function verifyCustodyBootstrap(value, api, controller, requiredContexts,
 // src/release-custody.ts
 var RELEASE_CUSTODY_BRANCH = "mmi-release-state";
 var RELEASE_CUSTODY_PATH = "release-custody.json";
+var HUB_RELEASE_CUSTODY_JOB = "release";
 var ReleaseCustodyError = class extends Error {
   constructor(message2) {
     super("Release custody: " + message2);
@@ -56528,6 +56639,14 @@ function githubCustodyStore(repo, baseSha, api = defaultGitHubClient()) {
         `repos/${repo}/actions/runs/${controller.runId}/attempts/${controller.runAttempt}`
       );
       return run.id === controller.runId && run.run_attempt === controller.runAttempt && run.path === HUB_RELEASE_WORKFLOW && run.status === "completed";
+    },
+    async jobCompleted(controller) {
+      const jobs = await api.rest(
+        "GET",
+        `repos/${repo}/actions/runs/${controller.runId}/attempts/${controller.runAttempt}/jobs?per_page=100`
+      );
+      const job = (jobs?.jobs ?? []).find((row) => row.name === (controller.job ?? HUB_RELEASE_CUSTODY_JOB));
+      return job?.status === "completed" && job.conclusion === "success";
     }
   };
 }
@@ -56546,8 +56665,12 @@ var ReleaseCustodySession = class _ReleaseCustodySession {
   poison;
   static async acquire(store, controller, repo, initialize, prepare) {
     const found = await store.read();
-    if (found.state && !await store.terminal(found.state.controller)) {
-      throw new ReleaseCustodyError(`previous controller run ${found.state.controller.runId} attempt ${found.state.controller.runAttempt} is not proven terminal`);
+    const prior = found.state?.controller;
+    if (prior) {
+      const handoff = prior.runId === controller.runId && prior.runAttempt === controller.runAttempt;
+      if (!(handoff ? await store.jobCompleted(prior) : await store.terminal(prior))) {
+        throw new ReleaseCustodyError(handoff ? `previous controller ${prior.job ?? HUB_RELEASE_CUSTODY_JOB} job of run ${prior.runId} attempt ${prior.runAttempt} is not proven completed` : `previous controller run ${prior.runId} attempt ${prior.runAttempt} is not proven terminal`);
+      }
     }
     let state = {
       ...found.state ?? { schema: "mmi-release-custody/v1", repo, precutId: (0, import_node_crypto21.randomUUID)(), effects: {}, ...await initialize() },
@@ -56845,7 +56968,7 @@ function withHubReleaseCustody(deps) {
         if (!authority.ok || !authority.train || authority.authenticatedDelegation !== true) {
           throw new ReleaseCustodyError("repository custody requires the server-verified owner-triggered train session");
         }
-        const controller = { ...runIdentity, token: (0, import_node_crypto21.randomUUID)() };
+        const controller = { ...runIdentity, token: (0, import_node_crypto21.randomUUID)(), ...process.env.GITHUB_JOB ? { job: process.env.GITHUB_JOB } : {} };
         const raw = localRaw(path2);
         const requiredContexts = () => discoverRequiredCheckContexts(
           deps,

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.32",
+  "version": "4.6.33",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.32",
+  "version": "4.6.33",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -55,6 +55,8 @@ mmi-cli devops bootstrap apply "$OWNER/$REPO" --class deployable \
 
 `tenant-container` repos need a `docker-compose.yml` and Dockerfile building from the shipped source archive (no prebuilt `dist/`); bootstrap seeds both from `skills/bootstrap/seeds/`. The seeded compose is fileless: label `mmi.runtime-env: "true"`, no `env_file`, loopback-only port; deploy injects the stage's vault values (`DEPLOY#<stage>.noEnvFile: true`), so the app reads plain env vars, never self-loads SSM, never ships a `.env`. For an MM-Work module or non-suite web-app with OAuth META, read [reference.md](reference.md) before the first CI/deploy or OAuth provisioning.
 
+`bootstrap apply --execute` also asks Jerv-Hub for this repo's coding-agent memory bank, by filing one `bank-request: coding-agent::<RepoName>` issue (label `bank-request`) there; if it reports that step SKIPPED with a manual next step, the MMI App could not file it — file that issue by hand at https://github.com/mutmutco/Jerv-Hub/issues/new and carry on.
+
 **Stage port block:** `tenant-container` and `solo-container` need Hub registry `portRange` (`bootstrap verify` fails without it). `bootstrap apply --execute` assigns it; for older META run `mmi-cli stage port-range <Repo>` (idempotent).
 
 ## Step 7 — org-managed .gitignore block