@mutmutco/pi-plugin 4.3.56 → 4.3.57
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,5 +1,8 @@
|
|
|
1
1
|
# Vault and keyless access
|
|
2
2
|
|
|
3
|
+
GitHub repository admins are project-admins on that repository without duplicate registry
|
|
4
|
+
enrollment. Registry-listed admins with repository write access remain supported.
|
|
5
|
+
|
|
3
6
|
The two tiers describe authority and blast radius, not separate storage products:
|
|
4
7
|
|
|
5
8
|
- **Your project:** a project-admin can manage their own product's full vault tree, including
|
|
@@ -1,5 +1,11 @@
|
|
|
1
1
|
# Work and releases
|
|
2
2
|
|
|
3
|
+
GitHub repository admins hold project-admin authority on their own projects without duplicate
|
|
4
|
+
registry enrollment. Registry-listed admins with repository write access remain supported.
|
|
5
|
+
Use `mmi-cli oracle org access role <owner/repo> --json` to verify authority for release,
|
|
6
|
+
candidate, hotfix, and runtime operations. Organization membership role alone is not this check.
|
|
7
|
+
The Hub distribution train remains organization-master-only.
|
|
8
|
+
|
|
3
9
|
Start with `mmi-cli onboard` and the [board skill](../../board/SKILL.md).
|
|
4
10
|
Reading or discussing the board is read-only until the developer authorizes work.
|
|
5
11
|
Claim approved work with `mmi-cli oracle board claim <issue>`, then prepare an isolated task
|
package/skills/secrets/SKILL.md
CHANGED
|
@@ -150,7 +150,7 @@ Prefer this over manual copy piping — audit-logged, blocklist enforced.
|
|
|
150
150
|
|
|
151
151
|
- **Never echo a value** — not in chat, a commit, a log, or an issue. No command emits a value to stdout;
|
|
152
152
|
consume one keyless with `secrets use <KEY> -- <cmd>` (#2844). Treat every secret as write-once.
|
|
153
|
-
- Authority is **GitHub**: project-admin = repo `write` plus the registry `projectAdmins` entry
|
|
153
|
+
- Authority is **GitHub**: project-admin = repo `admin`, or repo `write`/`maintain` plus the registry `projectAdmins` entry; master =
|
|
154
154
|
org owner. The backend checks both with the org App token, so the decision is server-side (your token
|
|
155
155
|
scope can't widen it).
|
|
156
156
|
- Runtime consumes declared keys through its scoped broker token (and central deploy injects the declared
|