@mutmutco/pi-plugin 4.5.123 → 4.5.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/pi-plugin",
-  "version": "4.5.123",
+  "version": "4.5.125",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -68,6 +68,12 @@ jobs:
       - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:
           lockfile-path: {{GATE_CACHE_DEP_PATH}}
+          fetch-depth: 0 # #8129: runbook freshness needs the PR merge-base history.
+      - name: Runbook guard
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: mutmutco/MMI-Hub/.github/actions/runbook-guard@{{GATE_RUNBOOK_SHA}}
+        with:
+          base-ref: origin/${{ github.base_ref }}
       # #5427: per-job npm cache under $RUNNER_TEMP — never the shared ~/.npm. Twelve mmi-live lanes
       # share the gha-runner home; npm hardlinks from that cache into node_modules, so one job's
       # `npm ci` can make another job's vitest/dist/workers/forks.js vanish mid-suite (Cannot find

package/skills/bootstrap/seeds/manifest.json

@@ -13,6 +13,7 @@
     { "target": ".gitignore", "source": "managed-block", "ownership": "org", "classes": ["deployable", "content"] },
     { "target": ".gitattributes", "source": "seed:gitattributes.template", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "README.md", "source": "seed:README.template.md", "ownership": "repo", "classes": ["deployable", "content"], "managedBlock": { "source": "seed:readme-mmi-developer-environment.block.md", "begin": "<!-- mmi-developer-environment:start -->", "end": "<!-- mmi-developer-environment:end -->" } },
+    { "target": "docs/Guides/operator.md", "source": "seed:operator.template.md", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "architecture.md", "source": "seed:architecture.template.md", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "docs/decisions/README.md", "source": "seed:decisions-readme.template.md", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "test-policy.json", "source": "seed:test-policy.template.json", "ownership": "repo", "classes": ["deployable", "content"] },

package/skills/bootstrap/seeds/operator.template.md

@@ -0,0 +1,64 @@
+<!-- runbook -->
+# {{OWNER}}/{{REPO}} operator runbook
+
+<!-- #8129: repo-owned skeleton; fill in the TODOs and keep it current with the code. -->
+Operate from this runbook. Keep instructions current in the same PR as the code they cover.
+TODO: add section-level coverage globs once the repo's runtime paths are known.
+
+## Who may do what
+
+Production mutations need the owner's fresh approval. TODO: name the project admins and escalation path.
+```bash
+mmi-cli whoami
+mmi-cli oracle org access capabilities --repo {{OWNER}}/{{REPO}} --json
+```
+
+## Stages and where they run
+
+TODO: list stages, URLs, runtime model and hosting locations; mark non-applicable stages explicitly.
+```bash
+mmi-cli oracle org project get {{OWNER}}/{{REPO}} --json
+mmi-cli oracle org project deploy get {{OWNER}}/{{REPO}} --stage dev --json
+```
+
+## Logs and status
+
+TODO: name service logs, alert destinations and expected healthy signals. Tenant-only examples:
+```bash
+mmi-cli devops runtime tenant status {{OWNER}}/{{REPO}} dev
+mmi-cli devops runtime tenant control {{OWNER}}/{{REPO}} dev logs --lines 200
+```
+
+## Control (start, stop, restart, run-task)
+
+TODO: replace tenant examples if this repo has a different runtime; declare safe tasks in the registry.
+```bash
+mmi-cli devops runtime tenant control {{OWNER}}/{{REPO}} dev start --watch
+mmi-cli devops runtime tenant control {{OWNER}}/{{REPO}} dev stop --watch
+mmi-cli devops runtime tenant control {{OWNER}}/{{REPO}} dev restart --watch
+mmi-cli devops runtime tenant control {{OWNER}}/{{REPO}} dev run-task --task <registry-task-name> --watch
+```
+
+## Data and backups
+
+TODO: list stores, retention, backup owner, recovery objectives and the verified restore procedure.
+Do not guess restore commands or run destructive actions without explicit approval.
+
+## Third-party APIs
+
+TODO: list providers, secret key names, scopes and rotation owners; never record secret values.
+Keys are used only via `mmi-cli vault secrets use`; never print, paste or commit them.
+```bash
+mmi-cli vault secrets use --repo {{OWNER}}/{{REPO}} --key <KEY_NAME> -- <consumer-command>
+```
+
+## Quality loops
+
+TODO: name this repo's required gate, approved checks and post-deploy smoke checks.
+```bash
+mmi-cli oracle docs refs --runbooks-only
+```
+
+## Known gaps
+
+TODO: list missing operational capabilities, their owners and follow-up issues. Do not invent a workaround.

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -18,6 +18,12 @@ jobs:
       - uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:
           lockfile-path: package-lock.json
+          fetch-depth: 0 # #8129: runbook freshness needs the PR merge-base history.
+      - name: Runbook guard
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: mutmutco/MMI-Hub/.github/actions/runbook-guard@{{GATE_RUNBOOK_SHA}}
+        with:
+          base-ref: origin/${{ github.base_ref }}
       - name: Isolate npm cache
         run: echo "NPM_CONFIG_CACHE=$RUNNER_TEMP/npm-cache" >> "$GITHUB_ENV"
       - uses: mutmutco/MMI-Hub/.github/actions/runner-node-toolchain@{{GATE_RUNNER_SHA}}

package/skills/org-guide/SKILL.md

@@ -5,8 +5,7 @@ description: Read org rules for project work and reporting MMI CLI, plugin, or w
 
 # MMI organization guide
 
-Read this short entry before MMI project work. Then read **only the topic relevant to the task**;
-do not load the whole guidebook or repeat it in the conversation. For a human introduction, use
+Read this entry before MMI project work, then **only the topic relevant to the task**. For a human introduction, use
 the [MMI help skill](../mmi-help/SKILL.md).
 
 ## Essential rules
@@ -17,6 +16,7 @@ the [MMI help skill](../mmi-help/SKILL.md).
   command arguments, or repository environment files.
 - Personal agent instructions and host settings stay local and gitignored in product repositories.
   Do not commit AGENTS.md, CLAUDE.md, or copied plugin instructions.
+- Operate from the repo's `docs/Guides/operator.md`; update it with the code it covers.
 - Claim approved work through the board, use the repository's checks, and land through MMI.
   A request for help or a plan does not authorize a change or a production release.
 - When an MMI tooling bug affects a developer other than `jervaise`, ask before filing a Hub report.