@mutmutco/hermes-plugin 4.0.17 → 4.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/hermes-plugin",
-  "version": "4.0.17",
+  "version": "4.1.0",
   "description": "MMI canonical skills transported as a Hermes Agent native plugin.",
   "author": {
     "name": "MMI Future",

package/plugin.yaml

@@ -1,7 +1,7 @@
 {
   "manifest_version": 1,
   "name": "mmi",
-  "version": "4.0.17",
+  "version": "4.1.0",
   "description": "MMI canonical workflow skills and fail-closed pre-tool policy gates.",
   "provides_hooks": [
     "pre_tool_call"

package/skills/bootstrap/seeds/gate.template.yml

@@ -59,6 +59,15 @@ jobs:
       run: { working-directory: {{GATE_WORKDIR}} }
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      # #5427: per-job npm cache under $RUNNER_TEMP — never the shared ~/.npm. Twelve mmi-live lanes
+      # share the gha-runner home; npm hardlinks from that cache into node_modules, so one job's
+      # `npm ci` can make another job's vitest/dist/workers/forks.js vanish mid-suite (Cannot find
+      # module). Job-local cache ⇒ no cross-job hardlinks. Must land BEFORE setup-node (`cache: npm`
+      # follows `npm config get cache`). Job-level `env:` cannot use the `runner` context — write
+      # via GITHUB_ENV from the shell `$RUNNER_TEMP` instead.
+      - name: Isolate npm cache (per-job)
+        shell: bash
+        run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
       # MMI-Hub#5111: Windows CRLF in tracked shell scripts breaks Linux runners before the real
       # check can explain it. Inspect only tracked files before install; .gitattributes is the fix.
       - name: Line-ending guard

package/skills/epic/SKILL.md

@@ -99,8 +99,11 @@ part of the batch), use the inverse-friendly single link:
 mmi-cli oracle issue link-child <parent> <child>
 ```
 
-Each child is now a parallel item — fan them out one worktree + PR each. **When the last child merges,
-close the umbrella** (its board `Done` follows automatically).
+Each child is now a parallel item — fan them out one worktree + PR each. On Windows, set
+`git config core.longpaths true` on the main checkout before the first `git worktree add` (#5499). When
+several linked worktrees belong to the same clone, serialize `git branch -m` / other ref renames (or retry
+serially on `.tmp-renamed-log`) so parallel agents do not race the shared ref log (#5485). **When the last
+child merges, close the umbrella** (its board `Done` follows automatically).
 
 ## Notes
 

package/skills/hotfix/SKILL.md

@@ -83,9 +83,9 @@ the main-base PR. Do not duplicate those steps with raw branch commands, manual
 GitHub PR creation.
 
 Conflicts confined to regenerable distribution / version-fold paths (e.g. Hub `distribution-bom.json`,
-locked plugin manifests, consumer `package.json`) — and, for hub-serverless + registry-publish, shipped
-skill roots `skills/` and `.kilo-plugin/skills/` (#4363 / #4471) — are auto-resolved (take the picked
-side) and regenerated by the bump/fold step. Source TS under `src/` / `cli/src/` is never auto-resolved.
+locked plugin manifests, consumer `package.json`) — and, for hub-serverless + registry-publish, the
+canonical skill root `skills/` (#4363 / #4471) — are auto-resolved (take the picked side) and regenerated
+by the bump/fold step. Source TS under `src/` / `cli/src/` is never auto-resolved.
 
 Before cutting the hotfix branch, `hotfix start` preflights every `--from` pick on an accumulating
 `origin/main` tree (#4472). If any pick would hard-stop, it refuses with every failing pick and path and

package/skills/mmi/SKILL.md

@@ -403,7 +403,11 @@ workspace mechanics:
   (`Closes #…, #…`). When an issue must stay open (HOLD/prep), never write `Does not close #N` — GitHub
   still closes it; use `Part of #N` / `Refs #N` / `leaves #N open` only (JC#495).
 - **Parallel:** run independent work concurrently, **one PR per item**. If two would touch the same file,
-  serialize them or fold them into a batch instead.
+  serialize them or fold them into a batch instead. On Windows, set `git config core.longpaths true` on the
+  main checkout before the first `git worktree add` (#5499; see `docs/Architecture/worktrees.md`). Linked
+  worktrees of one clone still share `.git`: serialize `git branch -m` / other ref renames across those
+  worktrees, or retry serially when the error names `.git/logs/refs/.tmp-renamed-log` (#5485; see
+  `docs/Architecture/worktrees.md`).
 - **Background:** run off the hot path (a background task or CI job); poll with `/loop` if useful. Bound it
   — never block silently.
 - **Split:** keep the original as the umbrella; file each child as a **native sub-issue** of it with

package/skills/mmi-resume/SKILL.md

@@ -108,6 +108,11 @@ janitor prose. Catalog: `docs/Architecture/compute-at-read.md` (in MMI-Hub).
 | Docs index freshness | `mmi-cli oracle docs index --check` |
 | Path / symbol / meaning pointers | `mmi-cli oracle repo-index search <q>` (Hub cloud; `--semantic` optional) |
 
+**Code orientation after a handoff (#5420):** a memory handoff orients by story, not by structure. Route
+cross-repo “where does X live / how does Y flow” questions through `mmi-cli oracle find <q>` (semantic) or
+`mmi-cli oracle repo-index search <q>` (hybrid) as the first-class step — before trusting recall or grepping a
+host-native index — and open the cited source to verify a pointer hit before acting on it.
+
 ## Notes
 
 - `/mmi-resume` is read-only session orientation. It never claims, moves, or writes.

package/skills/onboard/SKILL.md

@@ -61,13 +61,16 @@ Before treating `docs/**` as current-state, teach the Hub door (Hub#4133 / #4148
 
 ```bash
 mmi-cli oracle repo-index search <path-or-symbol-or-meaning>   # Hub cloud pointers (default)
-mmi-cli oracle repo-index search "where …" --semantic          # Titan meaning over embeddings
+mmi-cli oracle repo-index search "where …" --semantic          # BGE meaning over embeddings
 mmi-cli oracle repo-index status --cloud                        # is the estate index live?
 ```
 
 Host indexes (Cursor / Kilo) stay local helpers; **Hub `repo-index` is the org SSOT structure door**.
-Living current-state still comes from live verbs (`org schedules`, `board read`, …) — see
-`docs/Architecture/compute-at-read.md`. Do not invent wiki prose from pointer hits.
+After any memory handoff, cross-repo code-orientation questions go through `mmi-cli oracle find <q>` (semantic)
+or the `repo-index search` door above as the first-class step (#5420), and every pointer hit gets verified
+against the cited source before you act on it. Living current-state still comes from live verbs
+(`org schedules`, `board read`, …) — see `docs/Architecture/compute-at-read.md`. Do not invent wiki prose
+from pointer hits.
 
 ## Notes
 

package/skills/rcand/SKILL.md

@@ -57,8 +57,11 @@ primary checkout.
 
 Preconditions: on `development`, clean tree. The clean-tree check rejects UNTRACKED scratch too, not just
 modified tracked files — if `--apply` stops with `working tree must be clean before …`, run `git status
---porcelain` on the paths it named and read both columns. Gitignore the `??` scratch (or move it to a
-gitignored path like `tmp/`). Treat every tracked state except exactly ` M` as real work to commit or stash;
+--porcelain` on the paths it named and read both columns. For `?? .jerv/` / `?? .pi/` (org-managed agent
+scratch), run `mmi-cli doctor --apply` to write the managed `.gitignore` block — do not hand-edit
+`.gitignore` (#5409). The train CLI already ignores those live-session dirs (#5397); doctor is the durable
+heal so `git status` stays clean. For other `??` scratch, gitignore it (or move it to a gitignored path
+like `tmp/`). Treat every tracked state except exactly ` M` as real work to commit or stash;
 for ` M`, discard only when `git diff HEAD --numstat -- <paths>` is empty, and only with
 `git checkout -- <paths>`. Plain `git diff --numstat` prints nothing for a merely staged change, so it
 cannot tell real work from line-ending churn (#1472, #4004).
@@ -125,7 +128,13 @@ Required status checks are **per-repo branch protection, not a fixed list** —
 SHA has no check-runs yet, so when checks ARE required, pushing the branch *first* is structurally rejected
 until CI catches up (it then succeeds on a retry — avoidable noise). Push the **tag first**: it lands the
 SHA and triggers the repo's CI without touching the protected branch ref. Then probe what `rc` actually
-requires and wait only for those contexts:
+requires and wait only for those contexts.
+
+**Preflight (#5428):** before the immutable tag, `mmi-cli devops rcand --apply` inspects each required
+context's workflow `on:` triggers. If a required context (e.g. `py-gate` / `web-gate`) is pull_request-only
+and cannot fire on a tag push, the train **refuses before tagging** with a teaching error — never publish a
+candidate tag then wait on an event that cannot fire. Fix the gate to also trigger on `push: tags: ['v*']`
+(see MMI-Hub `gate.yml`), or remove those contexts from the rc ruleset (`ci audit` / reconcile).
 
 ```bash
 git push origin "vX.Y.0-rc.N"                 # lands the SHA + triggers the repo's CI

package/skills/release/SKILL.md

@@ -112,7 +112,10 @@ The clean-tree check rejects UNTRACKED scratch too, not just modified tracked fi
 `--resume` stops with `working tree must be clean before …`, run `git status --porcelain` on the paths it
 named and read BOTH status columns before touching anything (#1472, #4004):
 
-- `??` — untracked scratch. Gitignore it, or move it to a gitignored path like `tmp/`, then retry.
+- `??` — untracked scratch. For `?? .jerv/` / `?? .pi/` (org-managed agent scratch), run
+  `mmi-cli doctor --apply` to write the managed `.gitignore` block — do not hand-edit `.gitignore`
+  (#5409). The train CLI already ignores those live-session dirs (#5397); doctor is the durable heal.
+  For other `??` paths, gitignore them, or move them to a gitignored path like `tmp/`, then retry.
 - exactly ` M` (blank staged column) — the only state that can be churn rather than work. Test it with
   `git diff HEAD --numstat -- <paths>`: non-empty is a real edit to commit or stash; empty means the
   worktree normalizes straight back to HEAD (an LF↔CRLF rewrite, say), and `git checkout -- <paths>`
@@ -510,6 +513,12 @@ correct). Read the model from the registry (`mmi-cli oracle org project get {own
 - **repository-owned serverless / registry-publish** (e.g. Jerv-PowerTools' `Deploy Jerv Memory`) — there is
   no `runtime tenant redeploy` for these; re-run the repo's OWN declared `workflow_dispatch` deploy workflow at
   the promoted-equivalent ref: `gh workflow run <deploy-workflow> --repo {owner}/{repo} --ref <ref>`.
+- **hub-serverless** (MMI-Hub) — when `deploy.yml` fails the repo-index v4 readiness gate (`stale-commit` /
+  not-ready authorities), the promoted ref is fine; repair cloud v4 authorities first (#5405). List failing
+  authorities with `mmi-cli oracle repo-index status --cloud`, run
+  `mmi-cli oracle repo-index sync-estate --repo <owner/repo>` for each, re-probe with
+  `mmi-cli oracle repo-index health --live --queries-only`, then `gh run rerun --failed` on the failed
+  deploy run. Do not re-tag.
 
 Name the sanctioned dispatch mechanism you used in the train report.
 

package/skills/stage/SKILL.md

@@ -116,18 +116,29 @@ gated at the **Cloudflare edge** (#1761). The CLI detects your IP, dispatches th
 rule scoped to your dev host + IP). The box no longer IP-gates dev. No SSH from your machine; everything
 moves through the central workflows.
 
+**Deploy-model preflight (#5466 / #5467).** `/stage --live` is **not** generally available. Read
+`deployModel` first (`mmi-cli oracle org project get {owner}/{repo}` → `deployModel`, or the dry
+`mmi-cli stage --live --json` refusal). It applies only to **`tenant-container`** repos (the same
+model the Hub tenant-deploy + tenant-control gates require). **`registry-publish` is not applicable**
+for live stages — nor are hub-serverless, solo-container, static-cdn, content, or none. For an
+unsupported model the dry plan refuses **before** offering `--apply` / `--down`; do not invent a
+tenant deploy or gate.
+
 ```bash
-mmi-cli stage --live           # dry-run plan
+mmi-cli stage --live           # dry-run plan (refuses when deployModel is not tenant-container)
 mmi-cli stage --live --apply   # deploy + gate your IP at the Cloudflare edge
 ```
 
-Tear it down when done — the runtime stops and the Cloudflare edge gate is removed:
+Tear it down when done — **only when `--apply` actually created a runtime or gate**. The runtime stops
+and the Cloudflare edge gate is removed:
 
 ```bash
 mmi-cli stage --live --down --apply
 ```
 
-Personal dev stages only — rc/live environments still move exclusively through the promotion train.
+If apply never landed (unsupported model, failed dispatch, or you never ran `--apply`), `--down` is a
+**safe no-op** — do not promise teardown of a stage that was never created. Personal dev stages only —
+rc/live environments still move exclusively through the promotion train.
 
 ## Step 3 — report
 
@@ -136,7 +147,9 @@ The stage URL, what's running (server + tools), the workspace path (`tmp/stage/`
 ## Notes
 
 - `/stage` is local — no AWS, no deploy, no board or version effect. The one cloud exception is
-  `--live`: an on-demand **dev** stage of your branch, gated to your IP at the Cloudflare edge (above).
+  `--live`: an on-demand **dev** stage of your branch for **`tenant-container`** repos only, gated to
+  your IP at the Cloudflare edge (above). Preflight `deployModel` before offering it; `registry-publish`
+  and other models have no live stage.
 - Remote rc/live environments move only through `/rcand`, `/release`, and `/hotfix`.
 - Everything is gitignored; `/stage` never produces a tracked change.
 - **Playwright MCP output goes to `tmp/`**, never the repo root: if you drive the Playwright MCP server,