@mutmutco/pi-plugin 4.1.5 → 4.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/pi-plugin",
-  "version": "4.1.5",
+  "version": "4.1.7",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/hotfix/SKILL.md

@@ -53,12 +53,9 @@ mmi-cli oracle org access role <owner/repo> --json
 mmi-cli doctor --no-repo-writes
 ```
 
-Stop on a red authority or CLI-version result. **Hub hotfix release runs the same distribution fold as
-`/release`:** if `process.cwd()` contains whitespace, stop before `hotfix start` / `hotfix release`
-touches local `main` (#5603). Relocate the clone to a real no-space path. A subst / junction /
-drive-letter alias that hides spaces is not a valid workaround — canonical-root containment still
-sees the physical path, so materialization inputs resolve outside the alias root. See `/release`
-Step 0e.
+Stop on a red authority or CLI-version result. Hub hotfix release runs the same distribution fold as
+`/release`; its hook-contract verifier executes adapter commands as a native argv without a shell
+(#5605), so a checkout path containing spaces is supported.
 
 The worktree must be clean; move scratch into `tmp/` or
 gitignore it rather than widening the hotfix diff. A TRACKED path named in a `working tree must be clean

package/skills/release/SKILL.md

@@ -109,8 +109,6 @@ development` inside it fails outright when `development` is already checked out
 worktrees cannot have the same branch checked out twice). If you are in such a worktree, exit it first and
 run the release from the primary checkout.
 
-**Hub `/release` also refuses a checkout path that contains spaces — prove that in Step 0e before touching local `main`.** A subst/junction/alias that hides the spaces is not a workaround.
-
 The clean-tree check rejects UNTRACKED scratch too, not just modified tracked files. When `--apply` or
 `--resume` stops with `working tree must be clean before …`, run `git status --porcelain` on the paths it
 named and read BOTH status columns before touching anything (#1472, #4004):
@@ -144,6 +142,23 @@ git rev-list --count origin/main..origin/development
 ```
 `0` → stop ("nothing to release").
 
+**Checkout topology — verify the lane's refs exist locally before apply (#5624).** A fresh single-branch
+`development` clone has no local `main`; the train then fails or rolls back at `git checkout main`. Before
+any merge or `--apply`, confirm every ref the lane will touch is present as a local tracking branch:
+
+```bash
+git branch --list development main   # direct-track (and full-track --dev)
+git branch --list rc main            # full-track rc → main
+```
+
+A missing ref is a topology gap, not a train failure — materialize it from origin, never force past it:
+
+```bash
+git fetch origin main:main           # (or development:development / rc:rc) — creates the local ref
+```
+
+Re-run the `--list` until every ref the lane touches is present, then proceed.
+
 ## Step 0a — stale CLI preflight (#1410)
 
 Before local gates or `release --apply`, ensure the repo-local / PATH `mmi-cli` matches the released train
@@ -300,33 +315,6 @@ Current state is compute-at-read + the estate repo-index (`mmi-cli oracle repo-i
 If shipping code made a hand-written surface wrong, fix it on `development` as an ordinary PR
 **outside** the train — never as a release Step.
 
-## Step 0e — Hub checkout path must not contain spaces (#5603)
-
-**Hub `/release` only. Do this before Step 1 — before any `git checkout main`, merge, or `--apply`.**
-The Hub fold runs `scripts/check-hook-contract.mjs`. That verifier's Cursor probe still executes the
-adapter command through `shell: true`. An unquoted launcher path is then split at the first space
-(`E:\AI Projects\Mutatis Mutandis\MMI-Hub` → `E:\AI`), so the fold never gets a coherent argv. Stop
-when the checkout path contains whitespace; do not discover this after local `main` has already moved.
-
-Prove it from the release checkout:
-
-```bash
-node -e "const p = process.cwd(); if (/\s/.test(p)) { console.error('Hub /release: checkout path contains spaces:\\n' + p + '\\nStop. Clone or move MMI-Hub to a path with no spaces. subst/junction/alias is not a workaround.'); process.exit(1); }"
-```
-
-Non-zero → **stop**. Relocate the clone to a real path without spaces (for example `C:\src\MMI-Hub` or
-`/opt/mmi/MMI-Hub`) and re-run `/release` from that checkout. Do not reset, merge, or fold on the
-spaced tree.
-
-**A subst / junction / directory-junction / drive-letter alias that hides spaces is not a valid
-workaround.** Mapping `E:\AI Projects\Mutatis Mutandis\MMI-Hub` onto `M:\` only hides spaces in the
-*logical* cwd. Canonical-root containment still sees the physical path: the fold's materialization
-inputs resolve through that physical location, which then sits outside the alias root and fails
-containment. Clone or move the repository; do not alias around the spaces.
-
-This constraint is Hub-fold specific (the hook-contract verifier). Product-repo `/release` does not
-run that script; still prefer a no-space checkout.
-
 ## Step 1 — merge to main (never force)
 
 Full-track repos:
@@ -374,9 +362,10 @@ What the fold bumps, by repo:
   prepare` — spine dogfood (`scripts/spine-dogfood.mjs`: verify docs/surfaces + the managed `.gitignore` block),
   every registry-declared version holder, adapter payload synchronization, build output, and the public
   artifact bill of materials — then verifies the set (`verify --skip-npm-view`). That prepare path runs
-  `scripts/check-hook-contract.mjs`; Step 0e must already have passed, or the Cursor probe splits on a
-  spaced checkout. Publication and staging both derive from `surfaces.json`; there is no second package
-  list. Claude, Codex, Kimi, Cursor, and Kilo are active.
+  `scripts/check-hook-contract.mjs`, which executes host adapter commands as a native argv without a
+  shell (#5605), so a checkout path that contains spaces is supported; the spaced-path argv regression
+  is pinned in `infra/plugin-set.test.mjs`. Publication and staging both derive from `surfaces.json`;
+  there is no second package list. Claude, Codex, Kimi, Cursor, and Kilo are active.
 - **App-style repos with a root `package.json`** (most products): the manifest + lockfile version via
   `npm version --no-git-tag-version`, kept in lockstep with the release tag.
 - **Repos with neither:** nothing to fold — the tag is the version.