@mutmutco/pi-plugin 4.6.48 → 4.6.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/pi-plugin",
-  "version": "4.6.48",
+  "version": "4.6.49",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/skills/board/SKILL.md

@@ -35,7 +35,9 @@ parsed mmi-claim evidence object, null when unclaimed; `openPullRequests` lists
 closing-issue body links name the item — on the full JSON object that list lives at `report.pullRequests`,
 never `openPullRequests`). Partial reads
 exit nonzero; `--allow-partial` only when the dev accepts an incomplete board. The CLI partitions rows into
-**Yours**, **Free to claim** and **Taken**; stale stamps (4 hours without work) hold nothing. Recovery
+**Yours**, **Free to claim** and **Taken**; stale stamps (4 hours without work) hold nothing. Asked who
+holds an item, answer with its recorded stamp (`surface/session@host`) and age, never a family name or
+"an earlier session"; a stamp is not proof that session is alive ([reference.md](reference.md)). Recovery
 moves: a zero-byte or empty `.jerv/tmp/*.json` (`Unexpected end of JSON input`) means a shell-redirected
 read FAILED — re-run with `--out` and check the exit code before parsing; a Status change on an existing
 item is `mmi-cli oracle board move <status> <ref>`, never a hand-written `gh api graphql`

package/skills/board/reference.md

@@ -43,6 +43,14 @@ stale. Work means the stamp, an issue comment, a commit on the issue's branch, o
 PR that closes it. Any of these in the last 4 hours keeps the hold; a date that cannot be read counts as
 work. A takeover keeps the old branch and PR and names them, so the new session continues them.
 
+A holder question ("who holds these?") is answered per item from the board read: the stamp's
+`surface/session@host` and its work age. "Codex", "another agent" or "an earlier session of mine" is not
+an answer. A stamp names who claimed the item; it does not prove that session is alive or reachable.
+Never report an item as moving, active or "still with" a session unless that session answered on intercom,
+or named work in the window is attributable to it. Commits and PRs pushed through a shared bot account
+prove only that someone pushed; the PR body or commit text may name the author seat, so read it before
+saying. Otherwise say the holder is unknown and apply the stale and takeover rules.
+
 `--bodies` fetches body and comments for every scoped issue. In the JSON, read them at
 `row.details.body` and `row.details.comments` — not `row.body` or `row.comments`. `--bundle-details` is
 the cheaper variant that covers only `userOwned` and `claimable` — prefer it when the plan is limited

package/skills/bootstrap/seeds/manifest.json

@@ -7,6 +7,8 @@
     { "target": ".github/ISSUE_TEMPLATE/task.yml", "source": "self", "ownership": "org", "classes": ["deployable", "content"] },
     { "target": ".github/ISSUE_TEMPLATE/config.yml", "source": "self", "ownership": "repo", "classes": ["deployable", "content"] },
     { "target": "scripts/next-version.mjs", "source": "self", "ownership": "org", "classes": ["deployable"], "releaseTracks": ["full", "direct", "trunk"] },
+    {"target": "scripts/ordered-test-run.mjs", "source": "self", "ownership": "org", "classes": ["deployable"], "repos": ["mm-work", "mm-pm", "jerv-jervcode"]},
+    {"target": "scripts/test-child-report.mjs", "source": "self", "ownership": "org", "classes": ["deployable"], "repos": ["mm-work", "mm-pm", "jerv-jervcode"]},
     { "target": ".github/workflows/gate.yml", "source": "seed:gate.template.yml", "ownership": "repo", "classes": ["deployable"], "waivers": { "mmi-katip": "gates through py-gate and web-gate (in-job path filters, #3836) and its registry requiredChecks name exactly those two; a generic Node gate.yml here is red noise on every PR and would be re-created by every apply (#6333)." } },
     { "target": ".github/workflows/agent-pr.yml", "source": "self", "ownership": "org", "classes": ["deployable"], "waivers": { "jerv-jervcode": "pins this workflow's EXACT step shapes in its own scripts/workflow-boundary-core.mjs — a literal repositories: Jerv-JervCode token scope, and whole-step equality for the surface and verdict legs. #4040 widened the org seed to the same hardened boundary (pull_request_target off the trusted base, an immutable BASE..HEAD compare with a file-count equality wall, a per-repo App token scope, and a certified-head merge), so the two now agree on substance. They cannot agree on bytes: a seed serving 16 repos resolves its token scope and its required contexts at run time, which exact-step equality rejects by construction. The waiver is permanent by design, not a deferral — lifting it would mean weakening the strictest repo to match a fleet file." } },
     { "target": ".github/rulesets/mmi-product-required-checks.json", "source": "seed:mmi-product-required-checks.template.json", "ownership": "org", "classes": ["deployable"] },

package/skills/bootstrap/seeds/runbook-unaffected.json

@@ -7,6 +7,14 @@
     "blob": "7faba0bb3ee48074702da48d149657820d74de1a",
     "reason": "comment-only header: the train applies only to repos with a release lane; MM-Work and its modules merge to development and it goes live with no release, rc or candidate stage (#10071); no runtime or operator behaviour change"
   },
+  "scripts/test-child-report.mjs": {
+    "blob": "067ccb6497be9440d7b87c1423970c829aefc6f8",
+    "reason": "new helper imported by scripts/ordered-test-run.mjs that only formats a diagnostic `[tests] child-died` line (exit, signal, cases, cgroup memory) for a file that fails with no failing case (#10185); no CLI flag, env var, exit code or operator step changes, so no runbook section changes"
+  },
+  "scripts/ordered-test-run.mjs": {
+    "blob": "f6f9ec7ffa59c33a1f9cba194f4fbe576dea74bb",
+    "reason": "diagnostic output only (#10185, #10193: the child import is optional, loaded only when scripts/test-child-report.mjs exists): a file that fails with no failing case now adds one `[tests] child-died` line (exit, signal, cases, cgroup memory) after the duration table, via the seeded scripts/test-child-report.mjs child import; exit codes, ordering and the failure summary are unchanged. Plus the optional second-argument hooks seam (#10168): hooks.fileFailure and hooks.runEnd are undefined by default, so the run, its report, its exit code and its .jerv/jev-test-order.jsonl record are unchanged for MM-Work and MM-PM; no new CLI flag, env var or operator step, and the jev-tests guidance that the runner does not read JEV_RECENT_FAILURES_FILE yet still holds"
+  },
   "README.md": {
     "blob": "46f5e07288931eee1c26362219b9d4271a5ed49e",
     "reason": "the developer-environment seed block now says Hub release trains (repos that have one) stay org-owner only and MM-Work and its modules have none — merge and go live (#10071); no runbook step changes"

package/skills/hotfix/SKILL.md

@@ -52,7 +52,7 @@ mkdir -p .jerv/tmp && r1=$(mktemp .jerv/tmp/hotfix-start.XXXXXX)
 mmi-cli devops hotfix start --from <pr|sha>[,<pr|sha>…] --json --out "$r1"
 ```
 
-2. Verify: local gate, required review, acceptance criteria. Merge with `mmi-cli devops pr merge <number> --squash --wait` (waits for CI and review; keep the `-x` trailer). Because Hub's default branch is `development`, it closes no issue; no raw GitHub issue operations.
+2. Verify: local gate, required review, acceptance criteria. Merge with `mmi-cli devops pr merge <number> --squash --wait` (waits for CI and review; keep the `-x` trailer). For MMI-Hub, a full patch release through the `hub-release` workflow already carries every merged `development` change, so prefer it over a hotfix whose `main`-base PR cannot be merged by the agent's credential (`main`'s push allowlist); never hand the merge to the owner. Because Hub's default branch is `development`, it closes no issue; no raw GitHub issue operations.
 
 3. Release:
 

package/skills/org-guide/references/design.md

@@ -168,7 +168,10 @@ Craft essentials every agent applies (owner, 2026-10-25, #8839):
   space scale read live from the page's `:root` `--space-*` / `--mm-space-*` tokens (kit 4px fallback
   steps when a board defines none), so off-scale padding/gap/sibling-margin values and 1–3px sibling
   edge near-misses are named in `check.json` `detail.rhythm` / `detail.align` and fail the run
-  (exit 0 clean, 2 with faults — no standing caveat). Boards that load `/kit/kit.css` and
+  (exit 0 clean, 2 with faults — no standing caveat). A padding counts as on-scale when either it or
+  padding + the same-side border is (15px + 1px border = a 16px inset); a value above the largest
+  scale step is layout-derived, counted as `rhythmUnjudged` / `detail.rhythmUnjudged` and never
+  fails the run (#10134). Boards that load `/kit/kit.css` and
   `/kit/kit.js` are canvas boards: use `review.mjs <folder> --no-open`, which serves the kit beside
   each board on `127.0.0.1` and runs live-DOM `impeccable detect` per board.
   `artifacts/review/kit-assets.mjs`, `review.mjs`'s kit and board serving, and
@@ -179,7 +182,15 @@ Craft essentials every agent applies (owner, 2026-10-25, #8839):
   instead of looping `impeccable detect` with shell redirection — it runs one
   `detect <url> --viewport WxH --json` per URL x width x theme (theme merged into the URL query),
   writes one validated `check.json`, and treats empty or unparseable detect output as an operational
-  failure that names the run with the captured stderr, never a clean pass.
+  failure that names the run with the captured stderr, never a clean pass. Each run also opens the
+  same themed URL in Playwright and measures the live DOM with the pack path's own rhythm/alignment
+  sampler against the page's `:root` `--space-*` / `--mm-space-*` scale (#10134): off-scale
+  padding/gap/sibling-margin values and 1–3px sibling edge near-misses land in that run's
+  `rhythm` / `align` counts and `detail.rhythm` / `detail.align` and fail the matrix (exit 2), judged
+  by the same border-inclusive and `rhythmUnjudged` rules as the pack path; a page
+  that exposes no kit scale (`no-kit-scale`) or could not be opened is a named `geometryError`
+  (exit 1). A live app page check is not clean until this geometry pass ran on it: a clean
+  `impeccable detect` alone never covers spacing rhythm or control alignment.
 
 ### Shared support-script invocation
 

package/skills/release/SKILL.md

@@ -7,7 +7,7 @@ description: Ship rc or direct-track development to main and production. Use for
 
 # /release — ship to main + prod
 
-Bare `minor|major|patch` (default `patch`), never a flag. A production release normally needs Jervaise's yes unless a standing authorization covers this repo. Support sessions (`MMI-Hub`, `Jerv-Hub`, `Jerv-JervCode`) hold such a standing owner authorization (2026-10-25) to release at their discretion during active suite runs without repeated per-release approval ([suite.md](suite.md)). All standard release preflight, gate, and verification checks still apply. `minor`: `MMI_BUMP_REASON`. `major`: also `MMI_MAJOR_APPROVED=<exact version>` after the yes (bump rules: [verification.md](verification.md)).
+Bare `minor|major|patch` (default `patch`), never a flag. A production release normally needs Jervaise's yes unless a standing authorization covers this repo. Support sessions (`MMI-Hub`, `Jerv-Hub`, `Jerv-JervCode`) hold such a standing owner authorization (2026-10-25, widened 2026-11-07) to land PRs and cut patch releases as needed at any time (active suite runs, AFK sessions, and ordinary runs) without asking the owner to press Merge or approve the cut ([suite.md](suite.md)). All standard release preflight, gate, and verification checks still apply. `minor`: `MMI_BUMP_REASON`. `major`: also `MMI_MAJOR_APPROVED=<exact version>` after the yes (bump rules: [verification.md](verification.md)).
 
 ## Lane
 

package/skills/release/suite.md

@@ -2,4 +2,4 @@ MM-Work and its modules (MM-Account, MM-Chat, MM-Inspo, MM-Moments, MM-PM, MM-St
 
 The Hub's own release train (MMI-Hub, Jerv-Hub, Jerv-JervCode and other non-MM repos with a release lane) is unchanged and never applies to MM-Work or its modules.
 
-Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25) to cut and ship releases at their discretion during suite runs without repeated per-release approval, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.
+Support sessions (MMI-Hub, Jerv-Hub, Jerv-JervCode) are not suite members and hold standing owner authorization (2026-10-25, widened 2026-11-07) to land PRs and cut and ship patch releases as needed at any time (suite runs, AFK sessions, and ordinary runs) without asking the owner to press Merge or approve the cut, and under the owner's 2026-11-01 ruling each support session strives during a suite run to finish its own board and cut a patch release for landed-but-unreleased merges so suite members pick the update up in that run instead of waiting for a later cut, keeping all standard release preflight, gate, and verification checks.

package/skills/release/train-common.md

@@ -16,7 +16,7 @@ Every refusal and every doctor blocker names its `code` and `anchor`: open the f
 
 ## Merge floor
 
-- **Ordinary development PRs land with `mmi-cli devops pr land <number>`.** If a merge-queue group leaves the queue with no failed check, `pr land` re-queues once (or rerun `mmi-cli devops pr land <number>` once); a refused land is a stop to report verbatim — never fall back to a hand/admin merge, actor override (`MMI_ACTOR=personal`), or interim workaround. The rules below are for the train's own merges.
+- **Ordinary development PRs land with `mmi-cli devops pr land <number>`.** Support sessions (`MMI-Hub`, `Jerv-Hub`, `Jerv-JervCode`) land their own PRs (`mmi-cli devops pr land` / `pr merge`) under standing owner authorization (2026-11-07) without asking the owner; never ask the owner to press Merge. If a merge-queue group leaves the queue with no failed check, `pr land` re-queues once (or rerun `mmi-cli devops pr land <number>` once); a refused land is a stop to report verbatim — never fall back to a hand/admin merge, actor override (`MMI_ACTOR=personal`), or interim workaround. The rules below are for the train's own merges.
 - **Never squash-merge a tagged commit (#3167).** A squash re-mints the SHA and orphans the tag, so tag-anchored checks mis-read. Any merge that carries an already-tagged commit — the `main → development` roll-forward, an alignment PR, a hotfix fold PR — lands as a true merge: `mmi-cli devops pr merge <number> --auto --merge` (or `--wait --merge`); `--wait` alone still squashes. The hotfix main-base PR itself may squash: its tag lands after, on the merged `main` HEAD, and the `-x` trailer must survive the squash message.
 - **A refused train is a stop, never a license to finish by hand.** Every fail-closed halt — doctor blocker, authority probe, coverage guard, untolerated conflict, required checks, stray tag, ledger — ends the run. Fix the cause on `development` through a normal PR and rerun the train; never hand-resolve on `main`, hand-cherry-pick, bare-push a train branch, ack to save time, or bypass a check.
 - **Probe the latest Release tag, not branches or stale local tags (#2734).** Queue: `mmi-cli devops read pr queue <number> --repo <owner/repo> --json`; gh rejects `mergeQueueEntry`.