@mutmutco/hermes-plugin 4.1.9 → 4.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/hermes-plugin",
-  "version": "4.1.9",
+  "version": "4.1.11",
   "description": "MMI canonical skills transported as a Hermes Agent native plugin.",
   "author": {
     "name": "MMI Future",

package/plugin.yaml

@@ -1,7 +1,7 @@
 {
   "manifest_version": 1,
   "name": "mmi",
-  "version": "4.1.9",
+  "version": "4.1.11",
   "description": "MMI canonical workflow skills and fail-closed pre-tool policy gates.",
   "provides_hooks": [
     "pre_tool_call"

package/skills/release/SKILL.md

@@ -186,12 +186,21 @@ direction is a gate. Read the rows.
 Treating doctor's exit code as the gate halts a healthy train on cosmetic drift — or, worse, teaches an
 operator to ignore doctor's exit code entirely.
 
+**`mmi-cli devops release --apply` and `mmi-cli devops rcand --apply` now run an active npm-major preflight
+before any branch/tag mutation (#5666).** They read the repo's expected CI npm from `.github/workflows/gate.yml`
+(when the infra gate's exact node pin maps to a bundled npm, e.g. node 24.19.0 → npm 11.17.0) or, when
+gate.yml only declares a floating node major with no bundled npm, from the publish workflow's explicit npm pin
+(e.g. `npx --yes npm@11.17.0 pack` in `publish.yml`). Local `npm -v` must match that npm **major**; a
+mismatch refuses `--apply` with an align-local-npm remedy — the same class of failure the fold-failure notes
+below describe, but caught before a wasted apply.
+
 **A local `npm ci` failure during the fold on a lockfile CI already accepted is an npm-major mismatch, not a
 bad lockfile (#4578).** Before touching the lockfile, compare toolchains:
 ```bash
 npm -v
 gh api repos/{owner}/{repo}/actions/runs --jq '.workflow_runs[0].id'   # or read the gate log's
 # `node -v && npm -v` toolchain-preflight line (#3446) for the npm major CI ran with
+# When gate.yml has no bundled npm pin, read the publish workflow npm pin instead (#5666).
 ```
 A different npm MAJOR (e.g. local 12 vs. CI's 11) resolves the same lockfile differently and throws `Missing:
 <pkg> from lock file` on a lockfile that is not actually broken. Align the local npm major
@@ -204,7 +213,8 @@ BEFORE inspecting package contents (deleted dir, malformed `package.json`, missi
 ```bash
 npm -v
 # green gate npm from the gate log's `node -v && npm -v` toolchain-preflight line (#3446),
-# or the exact node pin in `.github/workflows/gate.yml` (Hub infra gate: node 24.19.0 → npm 11.17.0)
+# the exact node pin in `.github/workflows/gate.yml` (Hub infra gate: node 24.19.0 → npm 11.17.0),
+# or the publish workflow npm pin when gate.yml has no bundled npm (#5666)
 ```
 When local npm differs from the green gate (e.g. local npm 12 vs CI's 11.17.0), align local npm
 (`npm install -g npm@<gate npm>`) and rerun the train — do not rewrite the publish surface for an
@@ -655,13 +665,28 @@ self-hosted Linux runner) — or on an operator machine with the **same OS and n
 runner. Elsewhere (Windows, a clean Linux container with a different packer, a mismatched npm major) a
 `tarball identity mismatch` can false-fail even when the published bytes match the tag: three different
 SSRIs (registry / Windows pack / container pack) with content-identical unpacked trees is the expected
-cross-environment shape, not a substituted artifact. Off the publish environment, either:
+cross-environment shape for surfaces with no publish-time staged payload, not a substituted artifact.
+Off the publish environment, either:
 - fall back to an **unpacked-content** proof — download the registry tarball (`npm pack <pkg>@X.Y.Z`
   from the registry, or `npm view … dist.tarball`), `npm pack` from the tag checkout, unpack both, and
-  `diff -r` the trees (empty diff ⇒ identity OK; do not alarm on SSRI alone), or
+  compare the trees (do not alarm on SSRI alone). Hub host-plugin npm surfaces stage the canonical
+  `skills/` tree and declared hook-policy `scripts/` into the package at publish time via
+  `assembleDeclaredPayloads` (#5471); those paths are gitignored and absent from a plain tag checkout,
+  so a local `npm pack` without staging cannot reproduce them and an empty `diff -r` is an unreachable
+  bar (#5677), not evidence of substitution. For those surfaces, prove identity in two parts:
+  1. **Committed package content** — `diff -r` the unpacked trees while excluding each publish-time
+     staged path relative to the package root (for `@mutmutco/claude-plugin`:
+     `diff -r -x skills -x scripts …`; list all staged targets with
+     `node --input-type=module -e "import { generatedPayloadPaths } from './scripts/distribution-assembly.mjs'; console.log(generatedPayloadPaths().join('\\n'))"` and strip each surface's `assembly.rootPath` prefix). Empty diff ⇒ the committed package matches.
+  2. **Staged payload** — for each excluded path, compare the registry unpacked copy against the tag
+     checkout repo source named in that surface's `surfaces.json` assembly sync (`directories` sync:
+     `diff -r reg/package/skills skills/`; `files` sync: `cmp` each `include` entry against
+     `<sourcePath>/<name>`). Alternatively, run
+     `node --input-type=module -e "import { assembleDeclaredPayloads } from './scripts/distribution-assembly.mjs'; assembleDeclaredPayloads()"` on the tag checkout before the local `npm pack` so a plain `diff -r` compares the full publish payload.
+  Surfaces with no publish-time staged payload still use a plain `diff -r` (empty diff ⇒ identity OK), or
 - skip the registry identity read with
   `node scripts/release-distribution.mjs verify "X.Y.0" --skip-npm-view` and verify published content
-  by hand the same way.
+  by hand the same way (including the staged-payload split above when applicable).
 Do not treat an off-runner SSRI mismatch as a broken release, and do not change how the runner publishes
 to paper over a local packer difference.