@mutmutco/pi-plugin 4.6.11 → 4.6.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/pi-plugin",
-  "version": "4.6.11",
+  "version": "4.6.13",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/bootstrap/seeds/gate.template.yml

@@ -39,6 +39,9 @@ name: gate
 #                        checks ruleset on main cannot be silently skipped by a future bootstrap (#4113).
 # GATE_BUDGET_SHA is rendered by the CLI from its blessed run-with-budget pin — not an operator knob.
 # GATE_RUNNER_SHA pins the org runner-checkout / runner-node-toolchain actions (#5610).
+# GATE_VERDICT_STEP_YAML (org CI H1) renders the first step from the blessed verdict-receipt pin: a train push
+# reuses the merge queue's exact-SHA verdict, an rc tag the train push verdict (#8206). merge_group is the full
+# set here (only pull_request fails fast or skips), so `queue-is-full-verdict: 'true'` holds. Empty pin: the legacy #8206 rc-tag step.
 # #9248 supersedes #8911's "existing self-hosted capacity only; no hosted fallback": standard included
 # GitHub-hosted images are the default source for CI, and #8671's hosted-lane ban is retired. Larger/paid
 # images stay refused (#8911) — they bill above the included allowance, which the spending limit guards.
@@ -56,13 +59,15 @@ env:
 # #3001: cancel superseded runs — agent push-bursts queue a full fresh run per push.
 # Per-PR group only (a repo-wide group hits GitHub's one-pending-slot limit and cancels
 # innocent queued runs — MMC-ZuberShade#880). Pushes group by ref: each tag and the train
-# branch supersede only themselves.
+# branch supersede only themselves. Org CI H1 (Merv, 2 Nov 2026): only PR runs cancel in progress. A running
+# push run always finishes (Hub#7710); GitHub keeps only the newest pending push per ref, and each merge
+# queue entry has its own group. Most push runs then reuse the queue verdict through the receipt step.
 concurrency:
-  group: gate-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
-  cancel-in-progress: true
+  group: gate-${{ github.event.pull_request.number || github.event.merge_group.head_ref || (github.event_name == 'push' && format('push-{0}', github.ref)) || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
-  actions: read # #8206: exact-SHA development workflow verdict
+  actions: read # #8206 / org CI H1: exact-SHA verdict receipt reads workflow runs and jobs
   contents: read
   pull-requests: read # #8343: source commit declarations omitted by queue squashes
   # MMI-Hub#7542: the product image build below reads org private packages with the workflow's
@@ -78,34 +83,7 @@ jobs:
     runs-on: ubuntu-latest  # #9248: included GitHub-hosted capacity, first choice for CI.
     defaults:
       run: { working-directory: {{GATE_WORKDIR}} }{{GATE_SERVICES_YAML}}
-    steps:
-      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
-      - name: Reuse development gate for rc tag
-        id: development-gate
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
-        with:
-          script: |
-            core.setOutput('reuse', 'false');
-            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
-            try {
-              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
-              const { data } = await github.rest.actions.listWorkflowRuns({
-                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
-                event: 'push', head_sha: context.sha, per_page: 100
-              });
-              // API returns newest first: a newer red/pending rerun must not reuse an older green.
-              const run = data.workflow_runs[0];
-              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
-                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
-              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
-                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
-              });
-              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
-              core.setOutput('reuse', 'true');
-              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
-            } catch (error) {
-              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
-            }
+    steps:{{GATE_VERDICT_STEP_YAML}}
       - if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:

package/skills/bootstrap/seeds/suite-gate.template.yml

@@ -7,10 +7,10 @@ on:
     branches: {{GATE_PUSH_BRANCHES_YAML}}
     tags: ['v*']
 concurrency:
-  group: gate-${{ github.event.pull_request.number || (github.event_name == 'push' && github.sha) || github.ref }}
-  cancel-in-progress: true
+  group: gate-${{ github.event.pull_request.number || github.event.merge_group.head_ref || (github.event_name == 'push' && format('push-{0}', github.ref)) || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 permissions:
-  actions: read # #8206: exact-SHA development workflow verdict
+  actions: read # #8206 / org CI H1: exact-SHA verdict receipt reads workflow runs and jobs
   contents: read
   pull-requests: read # #8343: source commit declarations omitted by queue squashes
   packages: read
@@ -23,34 +23,7 @@ jobs:
     # larger/paid images, GPU and custom runner groups stay refused.
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    steps:
-      # #8206: keep a fresh successful tag gate; promote the exact development verdict, not a ref.
-      - name: Reuse development gate for rc tag
-        id: development-gate
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
-        with:
-          script: |
-            core.setOutput('reuse', 'false');
-            if (context.eventName !== 'push' || !/^refs\/tags\/v.+-rc\.\d+$/.test(context.ref) || !/^[0-9a-f]{40}$/.test(context.sha)) return;
-            try {
-              const { data: current } = await github.rest.actions.getWorkflowRun({ ...context.repo, run_id: context.runId });
-              const { data } = await github.rest.actions.listWorkflowRuns({
-                ...context.repo, workflow_id: current.workflow_id, branch: 'development',
-                event: 'push', head_sha: context.sha, per_page: 100
-              });
-              // API returns newest first: a newer red/pending rerun must not reuse an older green.
-              const run = data.workflow_runs[0];
-              if (!run || run.head_sha !== context.sha || run.head_branch !== 'development' ||
-                  run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'success') return;
-              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
-                ...context.repo, run_id: run.id, filter: 'latest', per_page: 100
-              });
-              if (!jobs.some(job => job.name === 'gate' && job.status === 'completed' && job.conclusion === 'success')) return;
-              core.setOutput('reuse', 'true');
-              core.info('Reusing successful development gate run ' + run.id + ' for exact SHA ' + context.sha);
-            } catch (error) {
-              core.warning('Development gate proof unavailable; running normal gate: ' + error.message);
-            }
+    steps:{{GATE_VERDICT_STEP_YAML}}
       - if: ${{ steps.development-gate.outputs.reuse != 'true' }}
         uses: mutmutco/MMI-Hub/.github/actions/runner-checkout@{{GATE_RUNNER_SHA}}
         with:

package/skills/org-guide/references/work-and-releases.md

@@ -4,6 +4,10 @@ GitHub repository admins hold project-admin authority on their own projects with
 registry enrollment. Registry-listed admins with repository write access remain supported.
 Use `mmi-cli oracle org access role <owner/repo> --json` to verify authority for release,
 candidate, hotfix, and runtime operations. Organization membership role alone is not this check.
+Verified repository writers (GitHub write, maintain or admin) may land PRs targeting `development`
+on non-Hub repositories. `/train-authority` reports this separately as `developmentMerge`;
+it does not grant release, candidate, hotfix or runtime train authority. MMI-Hub development
+merges remain master-only.
 The Hub distribution train remains organization-master-only. It runs in the `hub-release` workflow on
 our self-hosted runners, dispatched by an org owner, never on a workstation (#9137).
 A 503 `github-rate-limited` answer means the org App's hourly GitHub allowance is used up. It is