@mutmutco/kilo-plugin 3.107.5 → 3.109.0

package/agent/reviewer.md

@@ -45,7 +45,7 @@ file and the task the caller handed you.
 
 ## What to review
 
-Resolve the change first. If the caller handed you a bundle (a `mmi-cli pr review` JSON payload, or an
+Resolve the change first. If the caller handed you a bundle (a `mmi-cli devops pr review` JSON payload, or an
 explicit diff), review exactly that. Otherwise derive it from the checkout — the PR diff, or
 `git diff <base>...HEAD` against the base the caller names (default `origin/development`). Read the changed
 files in full where the diff alone is ambiguous; trace callers and downstream effects rather than

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/kilo-plugin",
-  "version": "3.107.5",
+  "version": "3.109.0",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/scripts/command-ladder-core.mjs

@@ -11,10 +11,10 @@
 
 /** The exhaustive covered-write set: a raw `gh <object> <verb>` that `mmi-cli` already owns. */
 export const COVERED_GH_WRITES = [
-  { object: 'issue', verb: 'create', replacement: 'mmi-cli issue create' },
-  { object: 'issue', verb: 'comment', replacement: 'mmi-cli issue comment' },
-  { object: 'pr', verb: 'create', replacement: 'mmi-cli pr create' },
-  { object: 'pr', verb: 'merge', replacement: 'mmi-cli pr merge (or mmi-cli pr land)' },
+  { object: 'issue', verb: 'create', replacement: 'mmi-cli oracle issue create' },
+  { object: 'issue', verb: 'comment', replacement: 'mmi-cli oracle issue comment' },
+  { object: 'pr', verb: 'create', replacement: 'mmi-cli devops pr create' },
+  { object: 'pr', verb: 'merge', replacement: 'mmi-cli devops pr merge (or mmi-cli devops pr land)' },
 ];
 
 /** Remove quoted spans so a covered phrase inside a `--body "..."` literal does not trip the gate. */

package/scripts/env-write-lint.mjs

@@ -10,7 +10,7 @@ import { applyPatchWriteTargets, invokesApplyPatch } from './edit-tool-paths.mjs
 
 const DENY_REASON =
   'No .env — the org is env-free. This command creates a .env file; don\'t. Deliver config vault-native '
-  + '(`mmi-cli stage` injects secrets into the process env; `mmi-cli secrets` manages names). If something '
+  + '(`mmi-cli stage` injects secrets into the process env; `mmi-cli vault secrets` manages names). If something '
   + 'genuinely cannot proceed without a .env, STOP and consult the board (file an issue) — do not create it.';
 
 /** True for a token that names a REAL .env file (`.env` or `.env.<suffix>`), excluding the allowed template

package/scripts/pretooluse-shell-gates.mjs

@@ -94,7 +94,7 @@ function expectedProtectionReason(original, input, analyzer, semanticClass) {
   const recovery = located.semanticClass === 'environment enumeration'
     ? 'Query only the required variables by explicit non-secret name, in a separate tool call.'
     : located.semanticClass === 'secret-value output'
-      ? 'Use a verifier or consumer that returns status without values; when its contract requires vault injection, invoke it through `mmi-cli secrets use`.'
+      ? 'Use a verifier or consumer that returns status without values; when its contract requires vault injection, invoke it through `mmi-cli vault secrets use`.'
       : 'Use the vault-native route named above, and run any safe sibling diagnostics as separate tool calls.';
   return `${original} Entire compound tool call was cancelled before execution; safe sibling diagnostics did not run. `
     + `This is an expected safety refusal, not a tool defect. Rejected segment ${located.ordinal}: `

package/scripts/vault-edit-gate.mjs

@@ -31,7 +31,7 @@ export function analyze(input) {
     reason:
       'No .env — the org is env-free. Never create, edit, or write a .env file (not even a local or '
       + 'gitignored one). Deliver config vault-native: `mmi-cli stage` injects the declared secrets into the '
-      + 'compose process env (no file), and `mmi-cli secrets` manages the names. If something genuinely cannot '
+      + 'compose process env (no file), and `mmi-cli vault secrets` manages the names. If something genuinely cannot '
       + 'proceed without a .env, STOP and consult the board (file an issue) — do not create the file.',
   };
 }

package/skills/hotfix/SKILL.md

@@ -79,7 +79,10 @@ side) and regenerated by the bump/fold step. Source TS under `src/` / `cli/src/`
 
 Before cutting the hotfix branch, `hotfix start` preflights every `--from` pick on an accumulating
 `origin/main` tree (#4472). If any pick would hard-stop, it refuses with every failing pick and path and
-prescribes **one** main-clean synthesis development PR for the whole batch (pattern #4467) — not N
+prescribes **one** development-based cite-only synthesis PR for the whole batch (#4643; the old
+"cut from origin/main" pattern #4467 wording is retired — a main-parented branch must never merge
+into development, #4365/#4371): cut from `origin/development`, regenerate the conflicting content so
+it cherry-picks cleanly onto `origin/main`, land it with the cite-only marker (the #5096 flow) — not N
 serial ports. Behavior changes still land on `development` first through a normal PR, then rerun hotfix
 start from the port merge SHA(s) — never hand-resolve onto main.
 

package/skills/mmi/SKILL.md

@@ -303,7 +303,7 @@ something else* paths.)
      ```
   It lands on the board as Todo automatically — confirm the link from the JSON. (Templates differ per
   repo; read the actual `.yml` set rather than assuming bug/feature/task.)
-- **File a friction report (org-tooling pain):** `mmi-cli report --title "<one-line>" --body "<what hurt>"`
+- **File a friction report (org-tooling pain):** `mmi-cli learning report --title "<one-line>" --body "<what hurt>"`
   files it on the Hub board via your Hub session and dedups against the open reports (a confident
   duplicate becomes a +1 comment, not a new issue). The actual GitHub write runs server-side with the
   Hub App's own token (#263), so no MMI-Hub repo access is required to file. Never read Hub coordinates or

package/skills/rcand/SKILL.md

@@ -97,9 +97,11 @@ exists — a tag minted before the conflict resolution points at the wrong SHA.
 
 ## Step 3 — tag the rc
 
-The shared helper derives the next rc tag from existing tags (re-run-safe — `-rc.N` increments):
+The shared helper derives the next rc tag from existing tags (re-run-safe — `-rc.N` increments). `rc` mode
+requires `MMI_BUMP_INTENT` (PATCH is `/hotfix`-only, so a planned release is `minor` or `major`; the train
+refuses without it):
 ```bash
-TAG=$(node scripts/next-version.mjs rc)   # -> vX.Y.0-rc.N
+TAG=$(MMI_BUMP_INTENT=minor node scripts/next-version.mjs rc)   # -> vX.Y.0-rc.N
 git tag "$TAG"
 ```
 
@@ -187,6 +189,13 @@ Version `vX.Y.0-rc.N` · merged commits · rc deploy run + env URL.
 - **MAJOR / exact-target cycle:** for a release the tag math can't derive (a MAJOR like `2.0.0`, or skipping
   a version already on npm), export `MMI_RELEASE_VERSION=X.Y.Z` before `/rcand` — `next-version.mjs rc` then
   opens that exact cycle (validated to move strictly forward). Keep it exported through `/release`.
+- **`MMI_BUMP_INTENT=major|minor|patch` is required for `next-version.mjs rc`** (Step 3) — it selects the
+  increment for an ordinary release and is never inferred; absence is a hard refusal, not a default.
+  **Export it for the whole run:** `mmi-cli devops rcand --apply` resolves the intent itself and refuses
+  mid-train with the same message, so passing it only as a one-off prefix on the `next-version.mjs` command
+  leaves the apply to fail after the preflight has already passed. This is
+  a different knob from `MMI_RELEASE_VERSION` above: `MMI_BUMP_INTENT` picks the increment,
+  `MMI_RELEASE_VERSION` overrides the computed version entirely and is for the exceptional case only.
 
 ## Retro — one check before you finish
 Before your final report, answer one question honestly: did **this skill's own instructions** misfire

package/skills/release/SKILL.md

@@ -271,10 +271,11 @@ Nothing to do by hand; the `--apply` result reports the fold outcome (`versionFo
 ## Step 2 — tag the release
 
 Full-track repos drop the `-rc.N` suffix from the open cycle. Direct-track repos use the next cycle directly
-because they have no rc tag:
+because they have no rc tag — and `cycle` mode requires `MMI_BUMP_INTENT` (PATCH is `/hotfix`-only, so a
+planned release is `minor` or `major`; the train refuses without it):
 ```bash
-TAG=$(node scripts/next-version.mjs release)   # full-track repos -> vX.Y.0
-TAG=$(node scripts/next-version.mjs cycle)     # direct-track repos -> vX.Y.0
+TAG=$(node scripts/next-version.mjs release)                  # full-track repos -> vX.Y.0
+TAG=$(MMI_BUMP_INTENT=minor node scripts/next-version.mjs cycle)   # direct-track repos -> vX.Y.0
 git tag "$TAG"
 ```
 
@@ -386,8 +387,9 @@ consumers, or treat a product's deploy state as part of this release — those b
 `/release` or `/rcand`, never a Hub train.
 
 Before running `--apply` for MMI-Hub, resolve the real tag first:
-`TAG=$(node scripts/next-version.mjs cycle)` — always print `$TAG` (e.g. `v2.43.0`) in summaries, Slack,
-chat, and the final report; never a placeholder like `vX.Y.0` or `v0.x.0`.
+`TAG=$(MMI_BUMP_INTENT=minor node scripts/next-version.mjs cycle)` — always print `$TAG` (e.g.
+`v2.43.0`) in summaries, Slack, chat, and the final report; never a placeholder like `vX.Y.0` or
+`v0.x.0`.
 
 Write a curated summary — 3-6 very short plain lines, one change per line, dev-readable, no PR-dump —
 to a fresh temp file (`f=$(mktemp tmp/release-summary.XXXXXX)`, so a stale prior summary is never reused).
@@ -529,6 +531,15 @@ deploy run + URL + **green/red** · branch-alignment note · npm publish run + C
 
 - PATCH-level releases are `/hotfix` only (a hotfix always skips rc — it cherry-picks `development → main`
   directly); planned releases are MINOR or MAJOR. Never force-push `main`.
+- **`MMI_BUMP_INTENT=major|minor|patch` is required for direct-track's `next-version.mjs cycle`** (Step 2)
+  — it selects the increment for an ordinary release and is never inferred; absence is a hard refusal
+  (`MMI_BUMP_INTENT must be one of major|minor|patch`), not a default. **Export it for the whole run, not
+  just the tag line:** `mmi-cli devops release --apply` resolves the intent itself and refuses mid-train
+  with the same message, so a value passed only as a one-off prefix on the `next-version.mjs` command
+  leaves the apply to fail after the preflight has already passed. The same holds for
+  `mmi-cli devops rcand --apply`. This is a different knob from
+  `MMI_RELEASE_VERSION` below: `MMI_BUMP_INTENT` picks the increment, `MMI_RELEASE_VERSION` overrides the
+  computed version entirely and is for the exceptional case only.
 - **`--dev` (full-track only):** releases `development → main` skipping rc, with the same fold/tag/Release/
   deploy machinery plus the post-release rc retirement and rc alignment. Refuses (fail closed) when
   `origin/rc` carries commits not in `development`; on direct-track repos it's a no-op (they already