@mutmutco/hermes-plugin 4.1.4 → 4.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/hermes-plugin",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "description": "MMI canonical skills transported as a Hermes Agent native plugin.",
   "author": {
     "name": "MMI Future",

package/plugin.yaml

@@ -1,7 +1,7 @@
 {
   "manifest_version": 1,
   "name": "mmi",
-  "version": "4.1.4",
+  "version": "4.1.6",
   "description": "MMI canonical workflow skills and fail-closed pre-tool policy gates.",
   "provides_hooks": [
     "pre_tool_call"

package/skills/bootstrap/seeds/gate.template.yml

@@ -23,6 +23,7 @@ name: gate
 #                        main on trunk). `main` is ALWAYS included in the job `if:` below so a required-
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
+# GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
 # Estate policy 2026-08-23: GitHub-hosted Windows (`windows-latest` / windows-*) is forbidden org-wide.
 # Do not add a windows-compat (or any other) job that runs-on GH-hosted Windows. Linux self-hosted
 # (mmi-live / mmi-heavy) is the only CI merge gate. Rare Windows proof stays on the owner's machine or
@@ -58,7 +59,9 @@ jobs:
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
+        with:
+          lockfile-path: {{GATE_CACHE_DEP_PATH}}
       # #5427: per-job npm cache under $RUNNER_TEMP — never the shared ~/.npm. Twelve mmi-live lanes
       # share the gha-runner home; npm hardlinks from that cache into node_modules, so one job's
       # `npm ci` can make another job's vitest/dist/workers/forks.js vanish mid-suite (Cannot find
@@ -91,21 +94,17 @@ jobs:
             exit 1
           fi
       - if: ${{ '{{GATE_RUNTIME}}' == 'node' }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with: { node-version: 24, cache: npm, cache-dependency-path: {{GATE_CACHE_DEP_PATH}} }
+        uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: {{GATE_CACHE_DEP_PATH}}
       - if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: { python-version: '{{GATE_PY_VERSION}}' }
-      # MMI-Hub#3446: assert the runtime toolchain is on PATH BEFORE the install step. A runner whose
-      # node/npm (or python) is missing, or whose setup step raced, fails `{{GATE_INSTALL_CMD}}` with a
-      # bare `command not found` (exit 127) that reads like a broken diff and abandons a correct PR in an
-      # autonomous merge loop. This names the RUNNER instead — a distinguishable infra failure that
-      # `mmi-cli devops pr checks-wait` classifies as rerunnable (title `CI runner toolchain`), mirroring the
-      # disk (#3366) and browser (#808) preflights. No test ran; the diff is not implicated.
-      - name: Toolchain preflight
-        if: ${{ '{{GATE_RUNTIME}}' == 'node' }}
-        run: |
-          node -v && npm -v || { echo "::error title=CI runner toolchain::RUNNER NOT PROVISIONED — node/npm not on PATH after setup-node. This is the runner, not your diff; no install or test ran. Re-run the job (a fresh lane usually clears it); if it persists the mmi-runner node toolchain needs attention (docs/Guides/gh-runner-runbook.md in MMI-Hub)."; exit 1; }
+      # MMI-Hub#3446: assert the runtime toolchain is on PATH BEFORE the install step. Node uses the
+      # runner-node-toolchain composite above (setup-node + preflight in one action, #5610). Python
+      # keeps the inline preflight below.
       - name: Toolchain preflight
         if: ${{ '{{GATE_RUNTIME}}' == 'python' }}
         run: |

package/skills/hotfix/SKILL.md

@@ -53,12 +53,9 @@ mmi-cli oracle org access role <owner/repo> --json
 mmi-cli doctor --no-repo-writes
 ```
 
-Stop on a red authority or CLI-version result. **Hub hotfix release runs the same distribution fold as
-`/release`:** if `process.cwd()` contains whitespace, stop before `hotfix start` / `hotfix release`
-touches local `main` (#5603). Relocate the clone to a real no-space path. A subst / junction /
-drive-letter alias that hides spaces is not a valid workaround — canonical-root containment still
-sees the physical path, so materialization inputs resolve outside the alias root. See `/release`
-Step 0e.
+Stop on a red authority or CLI-version result. Hub hotfix release runs the same distribution fold as
+`/release`; its hook-contract verifier executes adapter commands as a native argv without a shell
+(#5605), so a checkout path containing spaces is supported.
 
 The worktree must be clean; move scratch into `tmp/` or
 gitignore it rather than widening the hotfix diff. A TRACKED path named in a `working tree must be clean

package/skills/release/SKILL.md

@@ -109,8 +109,6 @@ development` inside it fails outright when `development` is already checked out
 worktrees cannot have the same branch checked out twice). If you are in such a worktree, exit it first and
 run the release from the primary checkout.
 
-**Hub `/release` also refuses a checkout path that contains spaces — prove that in Step 0e before touching local `main`.** A subst/junction/alias that hides the spaces is not a workaround.
-
 The clean-tree check rejects UNTRACKED scratch too, not just modified tracked files. When `--apply` or
 `--resume` stops with `working tree must be clean before …`, run `git status --porcelain` on the paths it
 named and read BOTH status columns before touching anything (#1472, #4004):
@@ -144,6 +142,23 @@ git rev-list --count origin/main..origin/development
 ```
 `0` → stop ("nothing to release").
 
+**Checkout topology — verify the lane's refs exist locally before apply (#5624).** A fresh single-branch
+`development` clone has no local `main`; the train then fails or rolls back at `git checkout main`. Before
+any merge or `--apply`, confirm every ref the lane will touch is present as a local tracking branch:
+
+```bash
+git branch --list development main   # direct-track (and full-track --dev)
+git branch --list rc main            # full-track rc → main
+```
+
+A missing ref is a topology gap, not a train failure — materialize it from origin, never force past it:
+
+```bash
+git fetch origin main:main           # (or development:development / rc:rc) — creates the local ref
+```
+
+Re-run the `--list` until every ref the lane touches is present, then proceed.
+
 ## Step 0a — stale CLI preflight (#1410)
 
 Before local gates or `release --apply`, ensure the repo-local / PATH `mmi-cli` matches the released train
@@ -182,6 +197,19 @@ A different npm MAJOR (e.g. local 12 vs. CI's 11) resolves the same lockfile dif
 <pkg> from lock file` on a lockfile that is not actually broken. Align the local npm major
 (`npm install -g npm@<CI major>`) and re-run `npm ci` before rewriting or regenerating the lockfile.
 
+**A pre-tag `npm publish --dry-run` failure whose stack trace is inside npm internals — e.g.
+libnpmpublish cannot find its declared sigstore dependency (`MODULE_NOT_FOUND`) — is toolchain
+corruption / an npm-major mismatch, not a malformed publish surface (#5616).** Compare toolchains
+BEFORE inspecting package contents (deleted dir, malformed `package.json`, missing `files`):
+```bash
+npm -v
+# green gate npm from the gate log's `node -v && npm -v` toolchain-preflight line (#3446),
+# or the exact node pin in `.github/workflows/gate.yml` (Hub infra gate: node 24.19.0 → npm 11.17.0)
+```
+When local npm differs from the green gate (e.g. local npm 12 vs CI's 11.17.0), align local npm
+(`npm install -g npm@<gate npm>`) and rerun the train — do not rewrite the publish surface for an
+npm-internal missing module.
+
 **A `npm ci was killed (signal SIGTERM)` failure during the fold is a cold npm cache, not a lockfile or
 toolchain problem (#4841).** The signature is the kill, not error text: no `Missing:` line, no lockfile
 complaint at all — the fold's child-process budget expired while a cold cache installed the full tree.
@@ -287,33 +315,6 @@ Current state is compute-at-read + the estate repo-index (`mmi-cli oracle repo-i
 If shipping code made a hand-written surface wrong, fix it on `development` as an ordinary PR
 **outside** the train — never as a release Step.
 
-## Step 0e — Hub checkout path must not contain spaces (#5603)
-
-**Hub `/release` only. Do this before Step 1 — before any `git checkout main`, merge, or `--apply`.**
-The Hub fold runs `scripts/check-hook-contract.mjs`. That verifier's Cursor probe still executes the
-adapter command through `shell: true`. An unquoted launcher path is then split at the first space
-(`E:\AI Projects\Mutatis Mutandis\MMI-Hub` → `E:\AI`), so the fold never gets a coherent argv. Stop
-when the checkout path contains whitespace; do not discover this after local `main` has already moved.
-
-Prove it from the release checkout:
-
-```bash
-node -e "const p = process.cwd(); if (/\s/.test(p)) { console.error('Hub /release: checkout path contains spaces:\\n' + p + '\\nStop. Clone or move MMI-Hub to a path with no spaces. subst/junction/alias is not a workaround.'); process.exit(1); }"
-```
-
-Non-zero → **stop**. Relocate the clone to a real path without spaces (for example `C:\src\MMI-Hub` or
-`/opt/mmi/MMI-Hub`) and re-run `/release` from that checkout. Do not reset, merge, or fold on the
-spaced tree.
-
-**A subst / junction / directory-junction / drive-letter alias that hides spaces is not a valid
-workaround.** Mapping `E:\AI Projects\Mutatis Mutandis\MMI-Hub` onto `M:\` only hides spaces in the
-*logical* cwd. Canonical-root containment still sees the physical path: the fold's materialization
-inputs resolve through that physical location, which then sits outside the alias root and fails
-containment. Clone or move the repository; do not alias around the spaces.
-
-This constraint is Hub-fold specific (the hook-contract verifier). Product-repo `/release` does not
-run that script; still prefer a no-space checkout.
-
 ## Step 1 — merge to main (never force)
 
 Full-track repos:
@@ -361,9 +362,10 @@ What the fold bumps, by repo:
   prepare` — spine dogfood (`scripts/spine-dogfood.mjs`: verify docs/surfaces + the managed `.gitignore` block),
   every registry-declared version holder, adapter payload synchronization, build output, and the public
   artifact bill of materials — then verifies the set (`verify --skip-npm-view`). That prepare path runs
-  `scripts/check-hook-contract.mjs`; Step 0e must already have passed, or the Cursor probe splits on a
-  spaced checkout. Publication and staging both derive from `surfaces.json`; there is no second package
-  list. Claude, Codex, Kimi, Cursor, and Kilo are active.
+  `scripts/check-hook-contract.mjs`, which executes host adapter commands as a native argv without a
+  shell (#5605), so a checkout path that contains spaces is supported; the spaced-path argv regression
+  is pinned in `infra/plugin-set.test.mjs`. Publication and staging both derive from `surfaces.json`;
+  there is no second package list. Claude, Codex, Kimi, Cursor, and Kilo are active.
 - **App-style repos with a root `package.json`** (most products): the manifest + lockfile version via
   `npm version --no-git-tag-version`, kept in lockstep with the release tag.
 - **Repos with neither:** nothing to fold — the tag is the version.