@mutmutco/codex-plugin 4.6.6 → 4.6.7

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mmi",
-  "version": "4.6.6",
+  "version": "4.6.7",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/cli/dist/main.cjs

@@ -15315,7 +15315,7 @@ async function mintFilingWriteToken(deps) {
   try {
     return await mintFromMember(
       deps,
-      { metadata: "read", contents: "write", issues: "write", pull_requests: "write" },
+      { metadata: "read", contents: "write", issues: "write", pull_requests: "write", workflows: "write" },
       APP_VAULT_KEYS
     );
   } catch (e) {
@@ -27456,10 +27456,10 @@ var rollout_plan_default = {
     note: "The v4.0.0 stamp happens at cut time (D6e #4463); until then the candidate is the origin/development head artifacts (built cli/dist + npm pack), identity proven by dist content hash (D6a)."
   },
   baseline: {
-    version: "4.6.6",
-    tag: "v4.6.6",
-    commit: "8431efc33b8c",
-    npm: "@mutmutco/cli@4.6.6"
+    version: "4.6.7",
+    tag: "v4.6.7",
+    commit: "c78249dd0d9d",
+    npm: "@mutmutco/cli@4.6.7"
   },
   exitCriterion: "fleet-n-of-n",
   hubOnlyShortcut: "forbidden",
@@ -27476,14 +27476,14 @@ var rollout_plan_default = {
           repo: "mutmutco/mmi-hub",
           role: "canary",
           schedule: "train",
-          v3Target: "v4.6.6"
+          v3Target: "v4.6.7"
         }
       ],
       rollbackTrigger: "Any red inside the post-contract soak window: `devops train gate` FAIL attributable to the v4 doors, Hub endpoint health probe failure, a pre-v4 client admitted instead of receiving actionable HTTP 426, or npm consumer install/doctor failure on the v4-only dist.",
       rollback: {
         independent: true,
-        mechanism: "npm dist-tag latest -> 4.6.6 and redeploy the Hub Lambda from tag v4.6.6 (8431efc33b8c); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
-        v3Target: "v4.6.6 (@mutmutco/cli@4.6.6, tag commit 8431efc33b8c \u2014 last known-good release carrying the repo-index v4-only contract)"
+        mechanism: "npm dist-tag latest -> 4.6.7 and redeploy the Hub Lambda from tag v4.6.7 (c78249dd0d9d); installed clients repair via `mmi-cli doctor`. No other cohort is touched.",
+        v3Target: "v4.6.7 (@mutmutco/cli@4.6.7, tag commit c78249dd0d9d \u2014 last known-good release carrying the repo-index v4-only contract)"
       }
     },
     {

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "4.6.6",
+  "version": "4.6.7",
   "description": "MMI Future CLI — the org dev toolbox and shared cross-IDE engine for every registry-declared MMI coding surface.",
   "type": "module",
   "license": "UNLICENSED",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/codex-plugin",
-  "version": "4.6.6",
+  "version": "4.6.7",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/rcand/SKILL.md

@@ -38,7 +38,7 @@ mkdir -p .jerv/tmp && r=$(mktemp .jerv/tmp/rcand-receipt.XXXXXX)
 mmi-cli devops rcand --apply --json --out "$r"
 ```
 
-`--watch` blocks on the deploy. Version-manifest merge conflicts take `development` (any other refuses); the `-rc.N` tag is re-run-safe. Deploy by model: `tenant-deploy.yml` for tenant-container; serverless, registry-publish and solo-container deploy via their push-triggered workflow. Never push, force or commit to `rc` by hand.
+`--watch` blocks on the deploy. Version-manifest merge conflicts take `development` (any other refuses); the `-rc.N` tag is re-run-safe. Deploy by model: the Hub's central deployer `mutmutco/MMI-Hub/.github/workflows/tenant-deploy.yml` for tenant-container (a tenant repo carries no deploy workflow in its own `.github/workflows/`, so read deploy status from the receipt's `runUrl` or `mmi-cli devops read run watch <run-id> --repo mutmutco/MMI-Hub --exit-status --interval 60`); serverless, registry-publish and solo-container deploy via their push-triggered workflow. Never push, force or commit to `rc` by hand.
 
 ## Verify
 

package/skills/rcand/recovery.md

@@ -1 +1 @@
-Every refusal and every doctor blocker names its `code` and `anchor`: open the finding's `anchor` URL and follow that entry, nothing else ([shared recovery](../release/train-common.md#recovery)). A candidate whose immutable rc tag passed policy but whose `origin/rc` was not pushed continues with `mmi-cli devops rcand --resume --watch --json --out <fresh-receipt>` — the only continuation form: `--resume` never re-tags, and `--apply` mints the next `-rc.N` for a new cut only. A promoted candidate whose rc deploy failed retries it, once the cause is fixed, with `mmi-cli devops rcand --retry-deploy --watch --json --out <fresh-receipt>` — same tag and SHA, never re-cut or re-pushed; `--resume` only re-reads that failed leg. Supersede is the last resort, with the authorized human's fresh approval. A refused train is a stop (Merge floor): fix the cause on `development` through a normal PR, then rerun; a rejected protected push leaves the local tag for an authorized rerun, never a force.
+Every refusal and every doctor blocker names its `code` and `anchor`: open the finding's `anchor` URL and follow that entry, nothing else ([shared recovery](../release/train-common.md#recovery)). A candidate whose immutable rc tag passed policy but whose `origin/rc` was not pushed continues with `mmi-cli devops rcand --resume --watch --json --out <fresh-receipt>` — the only continuation form: `--resume` never re-tags, and `--apply` mints the next `-rc.N` for a new cut only. A promoted candidate whose rc deploy failed retries it, once the cause is fixed, with `mmi-cli devops rcand --retry-deploy --watch --json --out <fresh-receipt>` — same tag and SHA, never re-cut or re-pushed; `--resume` only re-reads that failed leg. For `tenant-container` repos, the deploy runs on the Hub's central deployer (`mutmutco/MMI-Hub/.github/workflows/tenant-deploy.yml`, never a local `.github/workflows/` file in the tenant repo): inspect or watch it via the receipt's `runUrl` or `mmi-cli devops read run watch <run-id> --repo mutmutco/MMI-Hub --exit-status --interval 60`. Supersede is the last resort, with the authorized human's fresh approval. A refused train is a stop (Merge floor): fix the cause on `development` through a normal PR, then rerun; a rejected protected push leaves the local tag for an authorized rerun, never a force.

package/skills/release/verification.md

@@ -19,7 +19,7 @@ Read the saved result, never the exit code (`1` = a follow-up failed after promo
 
 - `releaseVerdict.releaseStatus` + `followUpStatus`: `succeeded` + `pending` is shipped, follow-up unresolved. `--resume` receipts carry the same `releaseVerdict` (`command: release-resume`) plus `mode` and `state`.
 - `deployStatus`: `pending` is never terminal; `promoted: true` holds even when a deploy failed.
-- `workflowRuns`: every run on the release SHA (discover them with the bounded run-list read at the top, filtered locally by the receipt SHA); watch each non-success entry to conclusion with `mmi-cli devops read run watch <run-id> --repo {owner}/{repo} --exit-status --interval 60`. `parallel: true` marks legs run together. Name the red run: `deploy.yml`, `publish.yml`, `tenant-deploy.yml` and `jerv-gateway` are deploy/publish verdicts; a `gate` push run is ordinary CI.
+- `workflowRuns`: every run on the release SHA (discover them with the bounded run-list read at the top, filtered locally by the receipt SHA); watch each non-success entry to conclusion with `mmi-cli devops read run watch <run-id> --repo {owner}/{repo} --exit-status --interval 60` (or `--repo mutmutco/MMI-Hub` for the central tenant deployer). `parallel: true` marks legs run together. Name the red run: `deploy.yml`, `publish.yml`, `mutmutco/MMI-Hub/.github/workflows/tenant-deploy.yml` (the Hub's central deployer — a tenant repo carries no local deploy workflow, so read its status from the receipt's `runUrl` or `mmi-cli devops read run watch <run-id> --repo mutmutco/MMI-Hub`) and `jerv-gateway` are deploy/publish verdicts; a `gate` push run is ordinary CI.
 - `announceNote`: `announced`, `skipped`, `not announced` (deploy/publish not green; a `--resume` with the same `--announce-summary-file` posts it), or the failure note. A failed announcement keeps its summary file; an uncertain delivery is never replayed automatically. Never install AWS, ask for AWS credentials, or copy the Slack key.
 - `devRollForward` / `rcAlignment`: `pushed`, or `pr-pending` with an alignment PR to land by true merge; read `autoMergeRequest.mergeMethod` from `mmi-cli devops read pr view <n> --repo {owner}/{repo} --json autoMergeRequest`: it must be `MERGE`, and `SQUASH` is a stop.
 - `versionFold`, `rcRetirement`, `checkout`: `returned`, or the reason you are still on `main`.