@mutmutco/kilo-plugin 4.2.6 → 4.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/kilo-plugin",
-  "version": "4.2.6",
+  "version": "4.2.7",
   "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {

package/skills/release/SKILL.md

@@ -187,13 +187,25 @@ Treating doctor's exit code as the gate halts a healthy train on cosmetic drift
 operator to ignore doctor's exit code entirely.
 
 **`mmi-cli devops release --apply` and `mmi-cli devops rcand --apply` now run an active npm-major preflight
-before any branch/tag mutation (#5666).** They read the repo's expected CI npm, in this order (#5866):
-an explicit `npm-version:` on the gate's `runner-node-toolchain` step; else the infra gate's exact node pin
-through the bundled-npm map (only for an estate that still carries a retired pre-#5870 pin); else the
-publish workflow's own npm pin (`npm install -g npm@12`, the #5870 retirement shape). Local `npm -v`
+before any branch/tag mutation (#5666).** They read the repo's expected CI npm, in this order (#5866,
+#5893): an explicit `npm-version:` on the gate's `runner-node-toolchain` step; else an explicit
+`npm install -g npm@<major>` step in gate.yml; else the infra gate's exact node pin through the
+bundled-npm map (only for an estate that still carries a retired pre-#5870 pin); else the publish
+workflow's own npm pin (`npm install -g npm@12`, the #5870 retirement shape). Local `npm -v`
 must match that npm **major**; a
 mismatch refuses `--apply` before any repository write.
 
+**Both gate shapes are a declaration; only a gate that declares NEITHER falls through (#5893).** A lane
+that installs its own npm has stated its npm as plainly as an `npm-version:` input — the shape differs, the
+intent does not. Reading only `npm-version:` skipped Jerv-JervCode's gate (floating `node-version: 24`
+plus `npm install -g npm@12`), fell through to publish.yml's stale npm 11, and prescribed a downgrade the
+repo had already retired (#2845, MMI-Hub#5871); the publish smoke then failed under npm 11 (`Cannot find
+module jiti/package.json` — a packed global install materializes no dependency closure under npm 11 once
+the root declares `bundleDependencies`), shipping v1.57.7 to main with a Release but no npm publish.
+**When gate.yml and publish.yml disagree on the npm major, that is a repo defect** — one lane will run the
+wrong toolchain whichever the preflight believes. The preflight names it and proceeds; fix it with a PR
+moving both pins together, never by silently trusting publish.yml.
+
 **Check which side is wrong before repairing (#5862).** The receipt names one direction — move the machine
 to the pin — and that is only right when the pin is current. Compare it against the registry first:
 
@@ -225,7 +237,8 @@ bad lockfile (#4578).** Before touching the lockfile, compare toolchains:
 npm -v
 gh api repos/{owner}/{repo}/actions/runs --jq '.workflow_runs[0].id'   # or read the gate log's
 # `node -v && npm -v` toolchain-preflight line (#3446) for the npm major CI ran with
-# When gate.yml has no bundled npm pin, read the publish workflow npm pin instead (#5666).
+# Read the gate's OWN declared npm first — `npm-version:` or `npm install -g npm@X` (#5893);
+# only a gate that declares neither falls back to the publish workflow npm pin (#5666).
 ```
 A different npm MAJOR (e.g. local 12 vs. CI's 11) resolves the same lockfile differently and throws `Missing:
 <pkg> from lock file` on a lockfile that is not actually broken. Align the local npm major
@@ -238,8 +251,9 @@ BEFORE inspecting package contents (deleted dir, malformed `package.json`, missi
 ```bash
 npm -v
 # green gate npm from the gate log's `node -v && npm -v` toolchain-preflight line (#3446),
-# the gate's declared `npm-version:`, or an exact node pin that maps to a bundled npm,
-# or the publish workflow npm pin when gate.yml has no bundled npm (#5666)
+# the gate's declared `npm-version:` or its `npm install -g npm@X` step (#5893), or an exact
+# node pin that maps to a bundled npm, or the publish workflow npm pin when the gate declares
+# no npm of its own (#5666)
 ```
 When local npm differs from the green gate (e.g. local npm 11 vs CI's 12), align local npm
 (`npm install -g npm@<gate npm>`) and rerun the train — do not rewrite the publish surface for an