@mutmutco/kilo-plugin 3.93.0 → 3.95.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/kilo-plugin",
-  "version": "3.93.0",
+  "version": "3.95.0",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/SKILL.md

@@ -355,8 +355,11 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   `--var` or `org project set <repo> --var gate={"maxSeconds":N}`); `ci audit` and the release train
   both enforce the step, so do not remove it. After apply,
   master-admin must **activate** that JSON as a repository ruleset (GitHub → Settings → Rules → Rulesets →
-  Import/create from the committed reference) so the `gate` context is required on train branches. MMI-Hub
-  keeps its own three-job gate (`cli`/`infra`/`docs`) — never apply the product ruleset there.
+  Import/create from the committed reference) so the `gate` context is required on train branches. Once the
+  gate is green on `development`, `mmi-cli ci reconcile --apply --repo $OWNER/$REPO` should flip enforcement
+  to **Active**; if it does not, use the Step 5 PUT fallback and confirm with `bootstrap verify` before
+  reporting bootstrap complete. MMI-Hub keeps its own three-job gate (`cli`/`infra`/`docs`) — never apply the
+  product ruleset there.
 - **A brand-new repo cannot pass the gate you just installed — its first commit must carry a real project
   (#2928).** The seeded `gate.yml` runs `GATE_INSTALL_CMD` + `GATE_CMD` (`npm ci` + `npm run check` by
   default) **unconditionally**. An empty repo has no `package.json`, so the gate **fails on the seed PR
@@ -410,11 +413,11 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   Step-0 axes (class, project-type, deploy-model). Do **not** write the release track, board number, or deploy
   coords as a value — the templates point at `mmi-cli org project get` (registry SSOT, never copied, so it cannot drift).
   Do not write `AGENTS.md` / `CLAUDE.md` — these are developer-owned, gitignored agent guides, never a bootstrapped repo file (the `mmi-no-agent-files-org` ruleset blocks committing them).
-- **`docs/index.md` is generated by `bootstrap apply`, once (#3545).** The seeded README's first agent
-  instruction is to read it, so it exists from the first commit and `bootstrap verify` requires it. Apply
-  **creates** it and never rewrites it: apply sees the seed list, not the tree, so regenerating an index in a
-  repo that has since added its own docs would silently drop every hand-authored entry. Once the repo has
-  docs of its own, `mmi-cli docs index --write` owns it — that reads the whole tree, and `--check` gates drift.
+- **`docs/index.md` is an optional generated routing index (#3545 / Hub#4133).** Agent entrypoints prefer
+  `mmi-cli repo-index search` + compute-at-read CLI over living prose under `docs/`. Apply may still create
+  `docs/index.md` once for link routing; it never rewrites it. Once the repo has docs of its own,
+  `mmi-cli docs index --write` owns the routing artifact and `--check` gates drift — it is not product
+  current-state SSOT. Decision records under `docs/decisions/` remain append-only *why*.
 - **Push the mandated fill past the active ruleset (#1807).** Deployable repos activate
   `mmi-product-required-checks` during apply (its `bypass_actors` is empty by design), so the `gate` check is
   required on `development`/`main` before the seeded README + architecture have ever produced a green run. The
@@ -423,8 +426,10 @@ collaborator list + the per-branch allowlist are the record — no separate rost
   `mmi-product-required-checks`, set **Enforcement** to **Disabled**, push/merge the filled `README.md` +
   `architecture.md`, then set **Enforcement** back to **Active**. Programmatic equivalent: PUT the ruleset
   with `enforcement: disabled` (a PATCH is rejected, #917/#922), push the fill, then PUT it back to
-  `active` (or re-run `bootstrap apply`, which re-activates the ruleset idempotently). Never leave enforcement
-  disabled.
+  `active` (or re-run `mmi-cli ci reconcile --apply --repo $OWNER/$REPO` once the gate is green, which
+  should activate idempotently). Before reporting bootstrap complete, run `mmi-cli bootstrap verify` and
+  confirm `product required-check ruleset enforcement active` is OK — a parked ruleset is not done. Never
+  leave enforcement disabled.
 - `.claude/settings.local.json` is local-only and gitignored; bootstrap seeds no committed `.claude/settings.json`.
 - **No agent guide is committed — none, anywhere (#2921).** `mmi-no-agent-files-org` is active with no bypass
   and restricts `AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, `.claude/**`, `.codex/**`, `.agents/**` **and

package/skills/bootstrap/seeds/README.template.md

@@ -18,12 +18,13 @@ access runbook → [repo-access](https://github.com/mutmutco/MMI-Hub/blob/develo
 
 Read this section at the start of agent work in this repo.
 
-- **Docs entry point:** read `docs/index.md` first — the generated routing index (`mmi-cli docs index
-  --write`); `--check` gates drift, so it can never fall out of sync with the `docs/` tree.
+- **Structure search:** `mmi-cli repo-index search <path|symbol|meaning>` — Hub cloud pointer hits
+  (Hub#4133). Prefer this over inventing wiki pages or trusting stale inventories under `docs/`.
 - **Durable WHY:** `docs/decisions/` — one file per decision, prose only for what was chosen and
-  rejected; never a description of current state.
-- **Current state:** code + `mmi-cli org project get` — release track, board, and deploy coords are
-  registry facts, resolved live, never copied into a doc where they can go stale.
+  rejected; never a description of current state. Do not maintain living current-state under `docs/`.
+- **Current state:** code + compute-at-read CLI (`mmi-cli org project get`, `board`, `status`,
+  `org schedules`, …) — registry facts, resolved live. Optional generated `docs/index.md` is a
+  **routing** index only (`mmi-cli docs index --check`), not product truth.
 - **GitHub wikis are retired org-wide** — this repo does not publish to a `.wiki.git`; do not create one.
 - **Stack:** (languages, frameworks, major services)
 - **Run locally:** (install, dev server, `/stage` if non-obvious)

package/skills/bootstrap/seeds/gate.template.yml

@@ -3,6 +3,9 @@ name: gate
 # and v* tags so /release and /hotfix can discover required contexts on the tagged SHA.
 #
 # Runner: self-hosted mmi-runner (mmi-live) — see docs/Guides/gh-runner-runbook.md in MMI-Hub.
+# #4118: if GATE_CMD runs tsgo or other memory-heavy typecheck / browser work, pin this job to
+#   runs-on: [self-hosted, linux, x64, mmi-heavy]
+# instead — standard lanes are MemoryMax=1200M and will cgroup-OOM those workloads.
 # Stack-aware (#1550): the runtime is rendered into the setup-step `if:` — both the Node and Python
 # setup steps live in the file but only the one matching GATE_RUNTIME runs. Knobs (override at
 # bootstrap with --var):
@@ -14,7 +17,13 @@ name: gate
 #   GATE_PY_VERSION    — Python version for setup-python ({{GATE_PY_VERSION}})
 #   GATE_MAX_SECONDS   — run-with-budget wall-clock ceiling in seconds ({{GATE_MAX_SECONDS}}); 300 default,
 #                        tighten per repo (org project set --var gate={"maxSeconds":N}) once measured (#3178)
+#   GATE_PUSH_BRANCHES_YAML — YAML list of push branches that trigger the workflow file (rendered by
+#                        bootstrap from the release track; not usually hand-passed)
+#   GATE_FULL_RUN_BRANCH — train branch whose PUSHES run the full gate job (development on full/direct;
+#                        main on trunk). `main` is ALWAYS included in the job `if:` below so a required-
+#                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
+# (seed touch: keep kilo mirror + BOM digests in lockstep after classifier land.)
 on:
   pull_request:
   push:
@@ -37,7 +46,10 @@ permissions:
 
 jobs:
   gate:
-    if: ${{ github.event_name != 'push' || github.ref_name == '{{GATE_FULL_RUN_BRANCH}}' || github.ref_type == 'tag' }}
+    # #4113: bake `main` into the template permanently. GATE_FULL_RUN_BRANCH selects the train push
+    # that runs the full job; main must never become skippable via bootstrap vars alone while the
+    # org ruleset still requires `gate` on main.
+    if: ${{ github.event_name != 'push' || github.ref_name == '{{GATE_FULL_RUN_BRANCH}}' || github.ref_name == 'main' || github.ref_type == 'tag' }}
     runs-on: [self-hosted, linux, x64, mmi-live]
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }

package/skills/onboard/SKILL.md

@@ -53,6 +53,20 @@ Close with one grounding line: gates green (or the one gate to fix), and the sin
 usually `mmi-cli board claim <n>` for the recommended item, or the readiness fix if a gate is red. Don't
 claim on the user's behalf; let them take the first item when ready.
 
+## Step 2b — structure door (compute-at-read)
+
+Before treating `docs/**` as current-state, teach the Hub door (Hub#4133 / #4148):
+
+```bash
+mmi-cli repo-index search <path-or-symbol-or-meaning>   # Hub cloud pointers (default)
+mmi-cli repo-index search "where …" --semantic          # Titan meaning over embeddings
+mmi-cli repo-index status --cloud                        # is the estate index live?
+```
+
+Host indexes (Cursor / Kilo) stay local helpers; **Hub `repo-index` is the org SSOT structure door**.
+Living current-state still comes from live verbs (`org schedules`, `board read`, …) — see
+`docs/Architecture/compute-at-read.md`. Do not invent wiki prose from pointer hits.
+
 ## Notes
 
 - `/onboard` is the first-session, readiness-first wrapper. Once a repo is known-good, `/resume` is the

package/skills/resume/SKILL.md

@@ -54,6 +54,20 @@ For the full board partition (yours / claimable / taken) run `/mmi`.
 Lead with one line: toolchain OK (or the heal to run), the branch + what's in flight, and the one next
 item with its claim command. Then stop. The user drives — claim, continue, or file when they say so.
 
+## Current-state doors (Hub#4120)
+
+When answering “what is true now”, **ask the CLI**, not committed markdown inventories or weekly
+janitor prose. Catalog: `docs/Architecture/compute-at-read.md` (in MMI-Hub).
+
+| Ask | Verb |
+| --- | --- |
+| Schedules / harbour lanes | `mmi-cli org schedules` / `--json` |
+| Boxes / IPs | `mmi-cli runtime box list` |
+| Registry / projects | `mmi-cli org project list\|get` |
+| Board | `mmi-cli board read` / `mmi-cli next` |
+| Docs index freshness | `mmi-cli docs index --check` |
+| Path / symbol / meaning pointers | `mmi-cli repo-index search <q>` (Hub cloud; `--semantic` optional) |
+
 ## Notes
 
 - `/resume` is read-only session orientation. It never claims, moves, or writes.

package/skills/worktree/SKILL.md

@@ -60,6 +60,13 @@ worktree, deletes the merged branch (local + origin), and prunes tracking refs.
 locked is queued and retried by `mmi-cli worktree gc sweep-deferred`. Self-authored merges need an explicit
 per-session merge grant — ask early if you don't have one.
 
+**Cwd-safe land (#4140):** `worktree land --apply` (what `pr land` runs) is designed to be invoked from
+inside the worktree you are landing. Before removal it releases the process cwd to the primary checkout
+(#1444/#2747) — on Windows, leaving cwd inside the target tree makes `rmdir` fail with `EBUSY` and leaks
+branch refs. You do not need to `cd` out first; if removal still fails (IDE lock, antivirus), the deferred
+sweep retries from a safe cwd. Prefer the primary checkout cwd only when you are running `worktree land`
+manually outside `pr land`.
+
 ## Step 5 — record + next
 
 Record durable decisions on the issue or PR, then check the board again: