@unbrained/pm-cli 2026.10.20 → 2026.10.22

package/docs/DEVELOPMENT_DEPENDENCY_SECURITY.md

@@ -1,7 +1,9 @@
 # Development dependency security
 
 Tracked by [pm-r61juc](../.agents/pm/issues/pm-r61juc.toon) and
-[pm-fnx3np](../.agents/pm/issues/pm-fnx3np.toon).
+[pm-fnx3np](../.agents/pm/issues/pm-fnx3np.toon), with independent advisory evidence in
+[pm-eqxjzl](../.agents/pm/tasks/pm-eqxjzl.toon) and MCP/Vite remediation in
+[pm-5sgx37](../.agents/pm/issues/pm-5sgx37.toon).
 
 Development tools execute during tests, benchmarks and release preparation.
 Their dependencies have the same admission requirement as production packages:
@@ -12,8 +14,34 @@ pnpm install --frozen-lockfile
 pnpm quality:dependencies
 ```
 
-This runs the full `pnpm audit`, with no production-only or severity filter,
-then verifies the installed CodSpeed bundle policy. Network/audit errors,
+This collects the full `pnpm audit --json`, with no production-only or severity
+filter, and queries every npm name/version in the pnpm v9 lockfile against
+[OSV querybatch](https://google.github.io/osv.dev/post-v1-querybatch/). The inventory
+includes development, optional and platform-specific packages. Either source's
+positive result blocks, even when the other returns zero. Unsupported resolutions,
+empty inventories, malformed or partial responses, pagination and network failures
+also block. Collection has bounded batch sizes, deadlines and no automatic retries.
+Only public npm names and versions are sent to OSV.
+
+The ignored local `.cache/dependency-security/receipt.json` records input hashes,
+complete per-package OSV coverage, feed retrieval times, registry counts and
+advisory IDs. Collection invalidates the prior receipt before querying. Database
+update times are explicitly unknown: fresh retrieval does not prove a feed is
+current. The SDK-owned `repository-static-quality` assurance gate composes a
+`repository-quality/dependency-advisories` provider that verifies this receipt
+without network access. It rejects evidence older than fifteen minutes, changed
+manifests or lockfiles, incomplete coverage and unavailable sources. Fresh evidence
+is required again on each CI/static or release run. Static checks refresh collection
+immediately before SDK assurance evaluation, which verifies advisory evidence
+before slower providers. The blocking registry command settles before OSV starts
+its network deadlines.
+
+CI retains this single receipt after successful and failed static jobs, with a
+separate artifact name for each run attempt and seven-day retention. Inspect both
+feeds before diagnosing a blocked collector: a positive advisory is a refusal,
+even when the other feed is clean.
+
+The command then verifies the installed CodSpeed bundle policy. Network/audit errors,
 missing packages, incomplete policy entries, changed package files, and unreviewed
 upgrades all fail. `quality:static` includes this command, so the existing CI,
 nightly quality and release paths enforce it. The registry-owned local
@@ -27,6 +55,31 @@ defaults to the `latest` image. The workflow contract checks both values on
 every TruffleHog step. Recheck the action's executable selectors when renewing
 its commit pin.
 
+## Vitest mocker advisory pair
+
+[pm-vitest4112](../.agents/pm/tasks/pm-vitest4112.toon) coordinates the
+[manual-registration finding](../.agents/pm/issues/pm-vitestmanual.toon) and
+[Windows redirect finding](../.agents/pm/issues/pm-vitestredirect.toon).
+[GHSA-qxg6-89mg-rqv8](https://github.com/advisories/GHSA-qxg6-89mg-rqv8)
+and [GHSA-xp26-3454-mjgp](https://github.com/advisories/GHSA-xp26-3454-mjgp)
+affect the previously locked `@vitest/mocker` 4.1.11. The compatible Vitest and
+coverage-provider pair now requires 4.1.12, whose shared mock-source generator
+serializes module URLs and export names, including asynchronous rebinding, and
+whose public redirect handler normalizes backslashes before the file allowlist
+check. Both fixes apply to public mocker/interceptor WebSocket handlers. The
+repository's Node test configurations do not register these handlers, so the
+affected development dependency does not establish an exploitable CLI or SDK
+route.
+
+The retained hosted OSV receipt identified both advisories while the registry
+audit returned zero. Keep full-lock admission mandatory and verify the patched
+graph against both feeds. This patch keeps Vitest 4, the CodSpeed peer contract
+and the Vite 7 override; the broader Vitest 5 migration remains separate. The
+installed-handler regressions run in coverage and the required native Windows
+cohort, whose aggregate refuses failed, canceled or skipped partitions. The
+October 15 patch releases meet pnpm's one-day minimum age on October 21 without
+an exclusion. Dependabot's seven-day scheduling cooldown is unchanged.
+
 ## Indexed source-map offsets
 
 [pm-dba47](../.agents/pm/issues/pm-dba47.toon) tracks Dependabot alert 47 and

package/docs/MCP_OPTION_CONFORMANCE.md

@@ -1,12 +1,38 @@
 # MCP Option Conformance
 
-Tracked by [pm-v0s2rm](../.agents/pm/chores/pm-v0s2rm.toon).
+Tracked by [pm-v0s2rm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-v0s2rm.toon), [pm-gh1538](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-gh1538.toon), and [pm-ap7ilf](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ap7ilf.toon).
+These repository-only tracking records are excluded from npm.
 
 An integration test can pass while an undeclared option is ignored. That leaves
 the test asserting a behavior it never exercised. The repository therefore
 treats emitted MCP unknown-option diagnostics as test failures, while the
 production server retains its advisory warning behavior for clients.
 
+`pm_create` and `pm_update` accept the canonical mutation fields advertised by
+their input schemas either at the top level or inside `options`. `pm_run` with
+the corresponding action uses the same SDK normalization. Explicit nested
+options take precedence, including CLI
+aliases for the same field. Repeatable inputs, numeric values, and linked-resource
+aliases use the shared mutation contracts before persistence. Native SDK `run`
+callers continue to put update fields inside `options`.
+
+Malformed option containers, values discarded from known scalar fields, and malformed repeatable
+entries refuse before execution with `invalid_argument_value` and
+`changed: false`. Declared boolean mutation fields, their aliases, and receipt
+controls must be booleans, including `false`; this covers clear/replace flags,
+parent/dependency exceptions, duplicate allowance, and `force`. These checks preserve project-defined
+custom fields and template-based type resolution while preventing a bad field
+from disappearing as a sibling field is written.
+Array values that become CLI CSV inputs, such as `tags`, must contain only
+strings and are checked before conversion. Validation follows nested precedence:
+an explicit valid nested value replaces a flat value before either is normalized.
+
+For example, `{ "id": "pm-one", "options": {}, "priority": 4 }` changes priority;
+with `"options": { "priority": 2 }`, priority becomes `2`. Create also honors its
+advertised explicit `id`, `deadline`, and other metadata. Regressions check the
+discovered schema, persisted values and verified history, and compare item and
+history bytes after invalid mutations to prove atomic refusal.
+
 Every run using [vitest.config.ts](../vitest.config.ts) installs
 [McpContractReporter](../scripts/mcp-contract-reporter.mts). The reporter records
 the emitting file, full test name, option, tool, and action, and rejects the run

package/docs/MERGE_SAFETY.md

@@ -667,6 +667,14 @@ Never remove conflict markers manually while leaving the authoritative item and
 
 `transactions/` and `checkpoints/` are per-branch crash-recovery state, not shared project context. `pm init` places both below the resolved tracker root in the managed `.gitignore` block, including custom `--pm-path` roots.
 
+Each tracker sharing a repository retains its own cache exclusions and merge
+patterns in either initialization order. Tracker names containing Git wildcard
+characters are escaped as literal paths, while the generated item/history globs
+remain active. Unrelated user rules and curated evaluation files are preserved.
+These contracts are tracked by
+[pm-nl60tbxzkjwp](../.agents/pm/issues/pm-nl60tbxzkjwp.toon) and
+[pm-47wuv8awpqvj](../.agents/pm/issues/pm-47wuv8awpqvj.toon).
+
 Ignore rules do not remove files that were already committed. `pm health`
 (`integrity`) and `pm validate` (`storage_integrity`) therefore scan Git's
 index for tracked files below `runtime/`, `search/`, `locks/`,

package/docs/READ_OUTPUT_CONTRACTS.md

@@ -85,8 +85,87 @@ If brief still exceeds the ceiling, normal compaction and eventual refusal
 apply. `estimated_tokens` measures the emitted envelope;
 `omitted_result_estimated_tokens` measures the useful result that could not fit.
 
+## Typed producer pages
+
+Tracked by [pm-oybmsd](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-oybmsd.toon),
+[pm-jqgkis](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-jqgkis.toon), and
+[pm-qal1uw](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-qal1uw.toon)
+(repository-only tracker records excluded from npm).
+Native `PmClient.list`, `search`, and `context` reads and their standalone
+convenience functions return sparse metadata when `after` resumes a producer
+page. Retain the first page's filters, projection, sorting, totals and completeness
+certificate. Subsequent pages carry `continuation_contract` with
+`metadata: "reference"` and `restore_with: "omit --after"`; repeated metadata
+is optional in `PmReadOutputProducerContinuation<Result>`. Follow `next_cursor`
+until it is empty, rather than relying on the optional `has_more` field.
+
+Calls whose options contain no producer cursor retain their first-page types.
+Omitting the options argument has the same precise type as passing `{}` for
+client and standalone `list`, `context`, and `search` calls; it does not imply
+that an explicit budget, session, or output cursor was supplied.
+Options with an optional cursor can return either page shape. When a budget,
+session, or output cursor is possible, first use `isReadOutputBudgetExceeded`
+to narrow the omission branch before accessing rows. This remains required for
+unions of option shapes: a budgeted variant cannot be erased by an unbudgeted
+variant. The low-level query producers retain their original result contracts;
+metadata suppression belongs to the shared native SDK transport.
+
+```ts
+const first = await client.list({ brief: true, limit: "10" });
+consume(first.items);
+let cursor = first.next_cursor;
+while (cursor) {
+  const page = await client.list({ brief: true, limit: "10", after: cursor });
+  consume(page.items);
+  cursor = page.next_cursor;
+}
+```
+
 ## Cross-Call Context Sessions
 
+Typed session results are tracked by
+[pm-t1p1jv](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-t1p1jv.toon)
+(repository-only tracker record excluded from npm). After narrowing budget
+omission with `isReadOutputBudgetExceeded`, use `isReadOutputSessionReference`
+from the SDK or `sdk/core` before accessing row prose or a search hit's nested
+`item`. A reference contains only `id` and `context_ref`. Calls with no session,
+including calls that specify only an output budget, retain their ordinary row
+types. The direct `applyReadOutputDimensions` helper also infers session
+capability from its options, including the accepted `output_session` spelling.
+Unspecified or explicitly undefined session options retain ordinary rows;
+optional, union, or dynamically typed session options admit references.
+`PmReadOutputSessionResult<Result>` models literal `row_contract.row_keys`
+paths (including nested arrays and keyed maps). Dynamic path declarations
+conservatively admit references in nested collections, and envelopes without a
+row declaration use the top-level array fallback. Keep package row paths literal
+with `as const` to preserve precision in package result declarations.
+
+```ts
+const page = await client.context({ outputSession: sessionState });
+if (!isReadOutputBudgetExceeded(page)) {
+  for (const row of page.high_level) {
+    if (isReadOutputSessionReference(row)) consumeReference(row.context_ref);
+    else consumeTitle(row.title);
+  }
+}
+```
+
+Read-option recovery is tracked by
+[pm-7gpx34](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-7gpx34.toon)
+(repository-only tracker record excluded from npm). For explicit static encoding,
+use `--output-format toon|json` across read commands. Completeness uses
+`--output-include full` on list, search and get; context detail depth uses
+`--depth full`. These controls retain the normal row and token ceilings.
+When `context --full`, `list/search --depth full`, or `--toon` on list, search,
+context or get is refused,
+the error provides `recovery.suggested_retry_args` for the same command with the
+supported spelling. The SDK's `resolveReadOptionRetryArgs` exposes the same
+token-preserving correction. Conflicting controls or ambiguous operands do not
+receive a guessed retry.
+An explicit `--json` conflicts with `--toon`, so that invocation receives no
+encoding-changing retry. Non-conflicting TOON refusals include the corrected
+command in human output without requiring JSON diagnostics.
+
 `--output-session <json>` / `outputSession` composes the four per-call
 dimensions across a request group. The caller supplies versioned state and
 passes the returned `read_session.next_state` to the next read:

package/docs/RELATIONSHIP_GRAPH.md

@@ -238,6 +238,21 @@ Every returned node is explainable: `role` names its semantic family (`prerequis
 
 `meta.completeness` reports result quality: the exact in-memory kernel emits `complete` or `truncated`, and the contract reserves `sampled`, `approximate`, `stale_index`, and `redacted` for index-backed or policy-filtered providers so consumers can branch on one field.
 
+The packer orders direct prerequisite and ancestor endpoints before optional
+descendants or related nodes, reserves their direct relationship costs, and
+emits root-incident edges first. An oversized edge is skipped so later feasible
+edges can still be returned. The same order governs cursor pages; the cursor
+fingerprint identifies this packing policy and rejects earlier-policy cursors. An
+edge limit or a budget too small for an endpoint and its edges can still omit
+evidence: inspect the direct-family totals, omitted counts and completeness
+before using the packet to make a decision. The native adapter also reports
+`relationship_context_bounds` in `omission_receipt` whenever the producer is
+truncated. Increase the relevant bounds or follow the node cursor for more
+detail; a full projection alone does not remove traversal limits.
+
+Tracked by [pm-gh1534](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-gh1534.toon)
+(repository tracker records are excluded from npm).
+
 Node, edge, depth, kind, direction, and token bounds are independent. The cursor fingerprint covers semantic filters and traversal shape, so it is rejected when reused for a different root or query. Output remains a plain object suitable for TOON, JSON, JSONL, MCP, or a custom UI; adapters own rendering and do not reimplement traversal.
 
 The native adapter is `pm deps <id> --format context`. It is also available through `PmClient.deps`, `runAction({ action: "deps" })`, and the MCP `pm_deps` tool. `--max-depth`, `--node-limit`, `--edge-limit`, `--token-budget`, `--cursor`, `--direction`, and repeatable or comma-separated `--kind` map directly to the public SDK context options; `--summary` keeps only counts. Unknown `--kind` values fail fast with the registered-kind list instead of silently matching nothing. Tree and graph formats share those first four bounds, use safe defaults when omitted, and report deterministic truncation metadata instead of recursively expanding a cyclic or multiply-linked graph without limit.

package/docs/RELEASING.md

@@ -315,6 +315,14 @@ missing locked package. npm 12 ignores published shrinkwraps; shipping
 a shrinkwrap alone therefore cannot enforce this contract. SDK consumers
 supply the bounded optional Node types peer themselves.
 
+Physical entrypoint verification is tracked by
+[pm-tl7vlu](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-tl7vlu.toon)
+(repository-only tracker record excluded from npm). The dependency advisory CLI
+resolves both its invocation and module to physical paths, so directory aliases
+and Node's symlink-preserving main-module mode still execute verification and
+return a receipt or failure status. Module imports expose the collector without
+starting verification.
+
 Push the final implementation commit through a reviewed pull request first,
 wait for DeepScan and CodeFactor to finish on that reviewed SHA, then run the
 canonical registry-owned preflight:

package/docs/SDK.md

@@ -164,6 +164,19 @@ snapshot. Breaking SDK changes require a date-based release and matching
 package compatibility bounds or migration guidance. Never refresh the snapshot
 merely to silence an unexplained diff.
 
+The mutation-admission update adds optional `changed?: false` to
+`PmCliErrorContext`. The conservative signature gate records this interface
+addition with a breaking acknowledgement; existing context objects and error
+codes remain valid. Consumers need no data migration or new dependency bounds.
+When adopting this update, read `error.context?.changed === false` as proof of a
+preflight refusal. An absent property gives no guarantee about writes; do not
+coerce it to `false` or treat an executed failure as safe to retry. Consumers
+that enumerate error keys should accept the additional optional property.
+JavaScript create/update callers must also remove misspelled keys and move
+mutation fields into `options` on generic `run` calls: these requests now fail
+instead of silently dropping fields. See [Robust Automation Pattern](#robust-automation-pattern)
+for supported aliases and runtime schema discovery.
+
 The snapshot also records an aggregate-completeness census. Every public symbol
 from every non-testing SDK subpath must be available from
 `@unbrained/pm-cli/sdk`; deliberate test-only exclusions require a named reason.
@@ -210,6 +223,36 @@ follow the migration guidance for changed unions or error codes. The shared
 [primitive inventory](SDK_PRIMITIVE_INVENTORY.md) records CLI/MCP ownership:
 presentation modules import the SDK and have zero private-core edges.
 
+### Lock ownership and recovery
+
+Use the public `acquireLock` primitive when a package must serialize its own
+state changes. Always await its release in `finally`:
+
+```ts
+import { acquireLock } from "@unbrained/pm-cli/sdk";
+
+async function writePackageState(pmRoot: string, write: () => Promise<void>) {
+  const release = await acquireLock(pmRoot, "example.state", 3600, "example-package", false, true, 30_000);
+  try {
+    await write();
+  } finally {
+    await release();
+  }
+}
+```
+
+The built-in provider automatically recovers a provably dead original Linux
+owner before TTL. Unknown owners retain the existing lease policy. Conflicts
+expose the lock identity, observed process state and wait advice through
+`PmCliError.context`. Force does not bypass an unexpired lock whose owner is
+alive or unverifiable. TTL expiry permits removal regardless of owner liveness.
+An expired holder can continue writing, so mutual exclusion beyond TTL is not
+guaranteed. Choose a TTL longer than the critical section, or fence protected
+resource writes at the caller. See
+[Configuration](CONFIGURATION.md#common-settings) for host identity, local
+recovery audit receipts and `PM_LOCK_WAIT_MS` precedence. Extension lock
+providers retain responsibility for their own ownership and recovery policy.
+
 ### Portable merge settlement
 
 Tracked by [pm-gh1475](../.agents/pm/issues/pm-gh1475.toon) and
@@ -1659,6 +1702,16 @@ contract compact and fail-safe for newly added flags. Use
 package-authored query surface. `encodeQueryCursor`, `decodeQueryCursorState`, and
 `paginateQueryRows` remain the transport-neutral continuation primitives.
 
+`decodeQueryCursorEnvelope`, `decodeQueryCursorState`, and
+`resolveQueryCursorStart` accept an optional final `cursorFlag` argument
+(`"--after"`, the default, or `"--cursor"`) so package-authored queries can
+name their actual producer flag in refusal guidance. Relationship packets use
+`--cursor`. The deps action additionally returns a scoped executable
+`recovery.suggested_retry_args` for a fresh query after a malformed or mismatched
+cursor; it preserves traversal and output policy while removing the rejected
+producer cursor and stale output continuation. See
+[pm-ohgg1b](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ohgg1b.toon).
+
 At the storage boundary, the metadata cache maintains a rebuildable SQLite
 query projection under the same source cursor and cross-process writer lock as
 the JSON metadata/body/collection tiers. Bounded default-order light `list`
@@ -1846,6 +1899,22 @@ compact rounded report metrics for stable machine output.
 
 ### Context relevance and evaluation
 
+Context test health is tracked by
+[pm-gh1535](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-gh1535.toon)
+(repository tracker records are excluded from npm). `ContextResult.tests` counts
+the complete matching active population, independently of the focus page and
+token selection. `scope: "matching_active_items"` and `total_items` declare its
+denominator, including active items without tests. Draft, blocked-lifecycle and
+terminal items are excluded unless the project schema classifies their status
+as active. The main summary still counts every matching lifecycle status.
+Consumers constructing `TestHealthSummary` values must supply the new scope and
+denominator fields; consumers reading results can use them directly.
+Markdown limits failing-item identities to the effective focus limit (or the
+default context limit) and native token budget, with `items_failing_omitted`
+when detail is withheld. Population counters remain exact. Structured SDK and
+MCP results retain the complete failing-item collection before their normal
+read-output budget handling.
+
 Tracked by [pm-4k6b](../.agents/pm/features/pm-4k6b.toon),
 [pm-h3no](../.agents/pm/tasks/pm-h3no.toon),
 [pm-3hps](../.agents/pm/tasks/pm-3hps.toon),
@@ -2576,7 +2645,8 @@ import { createPmCliExpectedError } from "@unbrained/pm-cli/sdk/runtime";
 
 ## Authoring Builders
 
-Tracked: [pm-12tj](../.agents/pm/features/pm-12tj.toon) (design rationale: ADR [pm-3mph](../.agents/pm/decisions/pm-3mph.toon)).
+Tracked: [pm-12tj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-12tj.toon) (design rationale: ADR [pm-3mph](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/decisions/pm-3mph.toon)); exactness and literal inference: [pm-gh1539](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-gh1539.toon).
+These repository-only tracking records are excluded from npm.
 
 The `define*` builders are the authoring half of the `author → register → test`
 loop: they type a registration definition where you write it, before it ever
@@ -2619,7 +2689,8 @@ export function activate(api: ExtensionApi): void {
 
 Object-definition builders (`defineExtensionManifest`, `defineCommand`,
 `defineFlag`, `defineItemType`, `defineItemField`, `defineMigration`,
-`defineSearchProvider`, `defineVectorStoreAdapter`) preserve the narrow literal
+`defineSearchProvider`, `defineVectorStoreAdapter`, `defineProjectProfile`) use
+const type parameters to preserve the narrow literal
 type. `defineExtensionManifest` additionally contract-checks the in-module
 manifest mirror where it is authored and pairs with `deriveExtensionCapabilities`
 (see [Declarative Authoring](#declarative-authoring)). Function-definition
@@ -2632,11 +2703,16 @@ parameter is contextually typed instead of falling back to `any`. The
 [`assertRegistered*`](#testing-helpers) helpers below verify these same
 definitions once registered.
 
-The object builders reject unknown keys at the call site, including
-`defineFlag`, item type/field, migration, search-provider, and vector-adapter
-definitions. This catches misspellings without weakening the runtime registry's
-forward-compatible storage boundary. Schema builders explicitly include their
-supported `default`/`values` and item-type description/default-status fields.
+The object builders reject unknown top-level keys, including command, manifest,
+and profile definitions and separately authored variables. This catches
+misspellings without changing the runtime registry's storage boundary. Keep
+package-specific annotations beside the registration definition. Existing values
+already typed as a registration contract remain usable; a builder cannot recover
+literal information that was widened before the call. Flag builders support
+`repeatable` and `value_validation`; schema builders include their supported
+`default`/`values` and item-type description/default-status fields. Scoped renderer
+and preflight object builders also retain literal command ownership while
+contextually typing their callbacks.
 
 ## Declarative Authoring
 
@@ -3289,6 +3365,27 @@ history and retains mutation governance.
 
 ## Robust Automation Pattern
 
+Native `PmClient.create`, `update`, and their generic `run` routes reject unknown
+option names at runtime, including JavaScript callers and injected extension
+clients ([pm-fl3phm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-fl3phm.toon),
+a repository-only tracker record excluded from npm). A typo such as
+`priorty` refuses the whole request with `PmCliError.code =
+"invalid_argument_value"`, `context.reason = "unknown_mutation_option"`, a
+nearest-name hint when available, and `context.changed = false`. Put mutation
+fields under `options` when using `run`; existing declared top-level aliases
+remain accepted. Workspace schema option identities remain available through
+`run`, while typed convenience methods support extension item fields through `field`.
+MCP retains its existing transport-specific admission contract. The no-change
+receipt applies to these preflight refusals; an executed operation's outcome
+and evidence must be assessed separately.
+
+MCP create/update normalize their advertised mutation fields through the SDK and
+refuse malformed values atomically; see [MCP option conformance](MCP_OPTION_CONFORMANCE.md).
+Embedded hosts can use `readRuntimeFieldOptionValue(options, definition)` with
+definitions from `resolveRuntimeFieldRegistry(settings.schema)` to recognize the
+same project-field aliases as persistence. These helpers are exported from the
+aggregate SDK, so hosts can preserve customization without copying key mappings.
+
 1. Read `PM_TOOL_ACTIONS` or `PM_TOOL_PARAMETERS_SCHEMA` for baseline static validation.
 2. Load runtime contracts with `getContracts(pmRoot, { runtimeOnly: true })` or run `pm contracts --runtime-only --json` inside the target project.
 3. Verify the action appears in `actions` and has `action_availability[].invocable: true`.

package/docs/TESTING.md

@@ -56,6 +56,17 @@ policy-check budget. This allocation is tracked by
 [pm-a3c6g4](../.agents/pm/tasks/pm-a3c6g4.toon); broader runner qualification
 remains with [pm-bj7rq0](../.agents/pm/issues/pm-bj7rq0.toon).
 
+The same serial cohort runs the ten-thousand-item aggregation, cold governance
+read, and surface-replication fixture files after parallel contracts
+([pm-ckb8w5](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-ckb8w5.toon),
+a repository-only tracker record excluded from npm). Their original input
+populations, assertions, per-test deadlines and retry policy remain in force.
+
+The context decision keeper also runs in that phase, preserving its 200-item
+corpus and 30-second completion-regression deadline. Allocation is tracked by
+[pm-j2vwbh](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-j2vwbh.toon)
+(a repository-only tracker record excluded from npm).
+
 `node scripts/run-tests.mjs` wraps Vitest in temporary tracker roots, disables
 external Sentry delivery for the build, test workers, and their nested CLI
 children, then cleans the roots up. Instrumentation tests can still exercise
@@ -567,6 +578,18 @@ the descriptor registry does not yet know about.
 For in-place metadata corrections and context admission/refusal semantics, see
 [Linked-test edits](LINKED_TEST_EDITS.md).
 
+Run-option admission is tracked by
+[pm-hdvxqg](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-hdvxqg.toon)
+(a repository-only tracker record excluded from npm).
+`pm test` requires `--run` for `--timeout`, `--progress`, execution context,
+environment directives, and run selectors. Registration-only calls refuse these
+options before saving links. Combined edits and execution validate the effective
+post-edit selection under the item lock before persistence, including out-of-range
+indexes and unmatched selectors. These admission errors carry `changed: false`
+in structured output. A valid request that executes a failing child can still
+save its accepted edits and execution evidence; inspect its run results before
+retrying.
+
 Add tests to the item that owns the work:
 
 ```bash

package/docs/agent-task-token-baseline.json

@@ -1 +1 @@
-{"version":5,"transcript_version":2,"transcript_digest":"sha256:6d4041acfaa4075dde1972d6127a74f18916f7661738b4f5d5fd47a61c179a78","estimator":"ceil(utf8_bytes / 4)","comparison_scope":"plan_recovery_tracker_root_canonicalized","measurement_scope":"output_before_token_accounting","published_with_release":true,"orientation":{"canonical_task_id":"orientation-context-intent","required_capabilities":["actionable_work","active_ownership","workspace_state"],"measured_winner_tokens":1087,"protocols":[{"task_id":"orientation-context-intent","command_count":1,"estimated_tokens":1087,"capabilities":["actionable_work","active_ownership","workspace_state"],"capability_evidence":{"actionable_work":[{"step_id":"context","field_path":"hierarchy"}],"active_ownership":[{"step_id":"context","field_path":"activity"}],"workspace_state":[{"step_id":"context","field_path":"summary.active_items"}]}},{"task_id":"orientation-operating-rules","command_count":4,"estimated_tokens":2325,"capabilities":["actionable_work","active_ownership","workspace_state"],"capability_evidence":{"actionable_work":[{"step_id":"open","field_path":"items"}],"active_ownership":[{"step_id":"in-progress","field_path":"items"}],"workspace_state":[{"step_id":"context","field_path":"summary.active_items"}]}},{"task_id":"orientation-contracts-next","command_count":2,"estimated_tokens":5203,"capabilities":["actionable_work","active_ownership","workspace_state"],"capability_evidence":{"actionable_work":[{"step_id":"next","field_path":"recommended.id"}],"active_ownership":[{"step_id":"next","field_path":"held_by_others"}],"workspace_state":[{"step_id":"next","field_path":"summary.in_progress"}]}}]},"tasks":[{"id":"orientation-context-intent","max_estimated_tokens":1087,"steps":[{"id":"context","max_estimated_tokens":1087,"accounting_mode":"self_reported"}]},{"id":"orientation-contracts-next","max_estimated_tokens":5203,"steps":[{"id":"contracts","max_estimated_tokens":4481,"accounting_mode":"self_reported"},{"id":"next","max_estimated_tokens":722,"accounting_mode":"self_reported"}]},{"id":"orientation-operating-rules","max_estimated_tokens":2325,"steps":[{"id":"context","max_estimated_tokens":1087,"accounting_mode":"self_reported"},{"id":"search","max_estimated_tokens":164,"accounting_mode":"self_reported"},{"id":"open","max_estimated_tokens":878,"accounting_mode":"self_reported"},{"id":"in-progress","max_estimated_tokens":196,"accounting_mode":"self_reported"}]},{"id":"context-bootstrap","max_estimated_tokens":2010,"steps":[{"id":"triage","max_estimated_tokens":552,"accounting_mode":"self_reported"},{"id":"orient","max_estimated_tokens":1087,"accounting_mode":"self_reported"},{"id":"inspect","max_estimated_tokens":371,"accounting_mode":"self_reported"}]},{"id":"closed-domain-recovery","max_estimated_tokens":630,"steps":[{"id":"refuse-intent","max_estimated_tokens":259,"accounting_mode":"self_reported"},{"id":"retry-intent","max_estimated_tokens":371,"accounting_mode":"self_reported"}]},{"id":"unknown-option-recovery","max_estimated_tokens":596,"steps":[{"id":"refuse-option","max_estimated_tokens":433,"accounting_mode":"self_reported"},{"id":"retry-option","max_estimated_tokens":163,"accounting_mode":"self_reported"}]},{"id":"lifecycle-mutation","max_estimated_tokens":812,"steps":[{"id":"create","max_estimated_tokens":20,"accounting_mode":"self_reported"},{"id":"inspect-open","max_estimated_tokens":363,"accounting_mode":"self_reported"},{"id":"close","max_estimated_tokens":31,"accounting_mode":"self_reported"},{"id":"inspect-closed","max_estimated_tokens":398,"accounting_mode":"self_reported"}]},{"id":"bulk-effect-outcomes","max_estimated_tokens":326,"steps":[{"id":"create-bulk-target","max_estimated_tokens":20,"accounting_mode":"self_reported"},{"id":"partial-effect","max_estimated_tokens":174,"accounting_mode":"self_reported"},{"id":"no-effect","max_estimated_tokens":132,"accounting_mode":"self_reported"}]},{"id":"plan-execution-mutations","max_estimated_tokens":806,"steps":[{"id":"create-plan","max_estimated_tokens":21,"accounting_mode":"self_reported"},{"id":"add-step","max_estimated_tokens":254,"accounting_mode":"self_reported"},{"id":"complete-step","max_estimated_tokens":253,"accounting_mode":"self_reported"},{"id":"inspect-plan","max_estimated_tokens":278,"accounting_mode":"self_reported"}]}],"composite_max_estimated_tokens":13795}
+{"version":5,"transcript_version":2,"transcript_digest":"sha256:6d4041acfaa4075dde1972d6127a74f18916f7661738b4f5d5fd47a61c179a78","estimator":"ceil(utf8_bytes / 4)","comparison_scope":"plan_recovery_tracker_root_canonicalized","measurement_scope":"output_before_token_accounting","published_with_release":true,"orientation":{"canonical_task_id":"orientation-context-intent","required_capabilities":["actionable_work","active_ownership","workspace_state"],"measured_winner_tokens":1087,"protocols":[{"task_id":"orientation-context-intent","command_count":1,"estimated_tokens":1087,"capabilities":["actionable_work","active_ownership","workspace_state"],"capability_evidence":{"actionable_work":[{"step_id":"context","field_path":"hierarchy"}],"active_ownership":[{"step_id":"context","field_path":"activity"}],"workspace_state":[{"step_id":"context","field_path":"summary.active_items"}]}},{"task_id":"orientation-operating-rules","command_count":4,"estimated_tokens":2139,"capabilities":["actionable_work","active_ownership","workspace_state"],"capability_evidence":{"actionable_work":[{"step_id":"open","field_path":"items"}],"active_ownership":[{"step_id":"in-progress","field_path":"items"}],"workspace_state":[{"step_id":"context","field_path":"summary.active_items"}]}},{"task_id":"orientation-contracts-next","command_count":2,"estimated_tokens":5203,"capabilities":["actionable_work","active_ownership","workspace_state"],"capability_evidence":{"actionable_work":[{"step_id":"next","field_path":"recommended.id"}],"active_ownership":[{"step_id":"next","field_path":"held_by_others"}],"workspace_state":[{"step_id":"next","field_path":"summary.in_progress"}]}}]},"tasks":[{"id":"orientation-context-intent","max_estimated_tokens":1087,"steps":[{"id":"context","max_estimated_tokens":1087,"accounting_mode":"self_reported"}]},{"id":"orientation-contracts-next","max_estimated_tokens":5203,"steps":[{"id":"contracts","max_estimated_tokens":4481,"accounting_mode":"self_reported"},{"id":"next","max_estimated_tokens":722,"accounting_mode":"self_reported"}]},{"id":"orientation-operating-rules","max_estimated_tokens":2139,"steps":[{"id":"context","max_estimated_tokens":1087,"accounting_mode":"self_reported"},{"id":"search","max_estimated_tokens":164,"accounting_mode":"self_reported"},{"id":"open","max_estimated_tokens":712,"accounting_mode":"self_reported"},{"id":"in-progress","max_estimated_tokens":176,"accounting_mode":"self_reported"}]},{"id":"context-bootstrap","max_estimated_tokens":2077,"steps":[{"id":"triage","max_estimated_tokens":619,"accounting_mode":"self_reported"},{"id":"orient","max_estimated_tokens":1087,"accounting_mode":"self_reported"},{"id":"inspect","max_estimated_tokens":371,"accounting_mode":"self_reported"}]},{"id":"closed-domain-recovery","max_estimated_tokens":630,"steps":[{"id":"refuse-intent","max_estimated_tokens":259,"accounting_mode":"self_reported"},{"id":"retry-intent","max_estimated_tokens":371,"accounting_mode":"self_reported"}]},{"id":"unknown-option-recovery","max_estimated_tokens":596,"steps":[{"id":"refuse-option","max_estimated_tokens":433,"accounting_mode":"self_reported"},{"id":"retry-option","max_estimated_tokens":163,"accounting_mode":"self_reported"}]},{"id":"lifecycle-mutation","max_estimated_tokens":812,"steps":[{"id":"create","max_estimated_tokens":20,"accounting_mode":"self_reported"},{"id":"inspect-open","max_estimated_tokens":363,"accounting_mode":"self_reported"},{"id":"close","max_estimated_tokens":31,"accounting_mode":"self_reported"},{"id":"inspect-closed","max_estimated_tokens":398,"accounting_mode":"self_reported"}]},{"id":"bulk-effect-outcomes","max_estimated_tokens":326,"steps":[{"id":"create-bulk-target","max_estimated_tokens":20,"accounting_mode":"self_reported"},{"id":"partial-effect","max_estimated_tokens":174,"accounting_mode":"self_reported"},{"id":"no-effect","max_estimated_tokens":132,"accounting_mode":"self_reported"}]},{"id":"plan-execution-mutations","max_estimated_tokens":806,"steps":[{"id":"create-plan","max_estimated_tokens":21,"accounting_mode":"self_reported"},{"id":"add-step","max_estimated_tokens":254,"accounting_mode":"self_reported"},{"id":"complete-step","max_estimated_tokens":253,"accounting_mode":"self_reported"},{"id":"inspect-plan","max_estimated_tokens":278,"accounting_mode":"self_reported"}]}],"composite_max_estimated_tokens":13676}

package/marketplace.json

@@ -1 +1 @@
-{"name":"pm","owner":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"description":"Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.","version":"2026.10.20","plugins":[{"name":"pm-claude","source":"./plugins/pm-claude","description":"Native pm CLI integration for Claude Code — 32 MCP tools, 14 workflow skills with slash invocations, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.","version":"2026.10.20","author":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"homepage":"https://github.com/unbraind/pm-cli","repository":"https://github.com/unbraind/pm-cli","license":"MIT","keywords":["pm-cli","project-management","mcp","tasks","agents","workflows","git-native","task-tracker","ai"],"category":"productivity"}]}
+{"name":"pm","owner":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"description":"Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.","version":"2026.10.22","plugins":[{"name":"pm-claude","source":"./plugins/pm-claude","description":"Native pm CLI integration for Claude Code — 32 MCP tools, 14 workflow skills with slash invocations, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.","version":"2026.10.22","author":{"name":"unbrained","url":"https://github.com/unbraind/pm-cli"},"homepage":"https://github.com/unbraind/pm-cli","repository":"https://github.com/unbraind/pm-cli","license":"MIT","keywords":["pm-cli","project-management","mcp","tasks","agents","workflows","git-native","task-tracker","ai"],"category":"productivity"}]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.10.20",
+  "version": "2026.10.22",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.28.5",

package/packages/pm-beads/package.json

@@ -1 +1 @@
-{"name":"@unbrained/pm-beads","version":"2026.10.20","private":true,"type":"module","description":"First-party pm package for importing Beads JSONL records.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-beads#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-beads"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","beads"],"pm":{"aliases":["beads"],"extensions":["extensions/beads"],"catalog":{"display_name":"Beads Import","category":"migration","summary":"Import Beads JSONL records into pm while preserving source IDs.","tags":["migration","beads","import"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-beads#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-beads","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}
+{"name":"@unbrained/pm-beads","version":"2026.10.22","private":true,"type":"module","description":"First-party pm package for importing Beads JSONL records.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-beads#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-beads"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","beads"],"pm":{"aliases":["beads"],"extensions":["extensions/beads"],"catalog":{"display_name":"Beads Import","category":"migration","summary":"Import Beads JSONL records into pm while preserving source IDs.","tags":["migration","beads","import"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-beads#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-beads","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}

package/packages/pm-calendar/package.json

@@ -1 +1 @@
-{"name":"@unbrained/pm-calendar","version":"2026.10.20","private":true,"type":"module","description":"First-party pm package for calendar and agenda views.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-calendar#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-calendar"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","calendar","agenda"],"pm":{"aliases":["calendar"],"extensions":["extensions/calendar"],"catalog":{"display_name":"Calendar Views","category":"workflow","summary":"Show agenda, day, week, and month views for deadlines, reminders, and scheduled events.","tags":["calendar","agenda","workflow"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-calendar#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-calendar","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}
+{"name":"@unbrained/pm-calendar","version":"2026.10.22","private":true,"type":"module","description":"First-party pm package for calendar and agenda views.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-calendar#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-calendar"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","calendar","agenda"],"pm":{"aliases":["calendar"],"extensions":["extensions/calendar"],"catalog":{"display_name":"Calendar Views","category":"workflow","summary":"Show agenda, day, week, and month views for deadlines, reminders, and scheduled events.","tags":["calendar","agenda","workflow"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-calendar#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-calendar","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}

package/packages/pm-command-kit/package.json

@@ -1 +1 @@
-{"name":"@unbrained/pm-command-kit","version":"2026.10.20","private":true,"type":"module","description":"First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-command-kit#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-command-kit"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","sdk","commands","exemplar"],"pm":{"aliases":["command-kit"],"extensions":["extensions/command-kit"],"catalog":{"display_name":"Command Kit Exemplar","category":"sdk","summary":"Copy-paste-able exemplar for registerCommand, registerFlags, and registerParser.","tags":["sdk","commands","parser","exemplar"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-command-kit#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-command-kit","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}
+{"name":"@unbrained/pm-command-kit","version":"2026.10.22","private":true,"type":"module","description":"First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-command-kit#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-command-kit"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","sdk","commands","exemplar"],"pm":{"aliases":["command-kit"],"extensions":["extensions/command-kit"],"catalog":{"display_name":"Command Kit Exemplar","category":"sdk","summary":"Copy-paste-able exemplar for registerCommand, registerFlags, and registerParser.","tags":["sdk","commands","parser","exemplar"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-command-kit#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-command-kit","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}

package/packages/pm-digital-twin/package.json

@@ -1 +1 @@
-{"name":"@unbrained/pm-digital-twin","version":"2026.10.20","private":true,"type":"module","description":"Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-digital-twin#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-digital-twin"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","sdk","digital-twin","event-sourcing","temporal-graph","exemplar"],"pm":{"aliases":["digital-twin","twin"],"extensions":["extensions/digital-twin"],"catalog":{"display_name":"Digital Twin SDK Exemplar","category":"sdk","summary":"Temporal facility graph proving event replay, point-in-time state, invariants, federation, checkpoints, and compact exports through public SDK contracts.","tags":["sdk","digital-twin","event-sourcing","graph","offline-first","exemplar"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-digital-twin#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-digital-twin","report":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-digital-twin/GAP_REPORT.md"}},"docs":["README.md","GAP_REPORT.md"],"examples":["README.md"]}}
+{"name":"@unbrained/pm-digital-twin","version":"2026.10.22","private":true,"type":"module","description":"Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-digital-twin#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-digital-twin"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","sdk","digital-twin","event-sourcing","temporal-graph","exemplar"],"pm":{"aliases":["digital-twin","twin"],"extensions":["extensions/digital-twin"],"catalog":{"display_name":"Digital Twin SDK Exemplar","category":"sdk","summary":"Temporal facility graph proving event replay, point-in-time state, invariants, federation, checkpoints, and compact exports through public SDK contracts.","tags":["sdk","digital-twin","event-sourcing","graph","offline-first","exemplar"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-digital-twin#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-digital-twin","report":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-digital-twin/GAP_REPORT.md"}},"docs":["README.md","GAP_REPORT.md"],"examples":["README.md"]}}

package/packages/pm-governance-audit/package.json

@@ -1 +1 @@
-{"name":"@unbrained/pm-governance-audit","version":"2026.10.20","private":true,"type":"module","description":"First-party pm package for governance audit and normalization workflows.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-governance-audit#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-governance-audit"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","governance","audit","normalize","hooks"],"pm":{"aliases":["governance-audit","audit"],"extensions":["extensions/governance-audit"],"catalog":{"display_name":"Governance Audit","category":"governance","summary":"Run dedupe audits, comments audits, and normalize sweeps as package-owned workflows.","tags":["governance","audit","normalize","hooks"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-governance-audit#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-governance-audit","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}
+{"name":"@unbrained/pm-governance-audit","version":"2026.10.22","private":true,"type":"module","description":"First-party pm package for governance audit and normalization workflows.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-governance-audit#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-governance-audit"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","governance","audit","normalize","hooks"],"pm":{"aliases":["governance-audit","audit"],"extensions":["extensions/governance-audit"],"catalog":{"display_name":"Governance Audit","category":"governance","summary":"Run dedupe audits, comments audits, and normalize sweeps as package-owned workflows.","tags":["governance","audit","normalize","hooks"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-governance-audit#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-governance-audit","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}

package/packages/pm-guide-shell/package.json

@@ -1 +1 @@
-{"name":"@unbrained/pm-guide-shell","version":"2026.10.20","private":true,"type":"module","description":"First-party pm package for guide and shell completion workflows.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-guide-shell#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-guide-shell"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","guide","completion","shell"],"pm":{"aliases":["guide-shell"],"extensions":["extensions/guide-shell"],"catalog":{"display_name":"Guide + Shell UX","category":"workflow","summary":"Restore guide documentation and shell completion commands as package-owned UX surfaces.","tags":["guide","completion","shell"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-guide-shell#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-guide-shell","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}
+{"name":"@unbrained/pm-guide-shell","version":"2026.10.22","private":true,"type":"module","description":"First-party pm package for guide and shell completion workflows.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-guide-shell#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-guide-shell"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","guide","completion","shell"],"pm":{"aliases":["guide-shell"],"extensions":["extensions/guide-shell"],"catalog":{"display_name":"Guide + Shell UX","category":"workflow","summary":"Restore guide documentation and shell completion commands as package-owned UX surfaces.","tags":["guide","completion","shell"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-guide-shell#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-guide-shell","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}

package/packages/pm-kanban/package.json

@@ -1 +1 @@
-{"name":"@unbrained/pm-kanban","version":"2026.10.20","private":true,"type":"module","description":"First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-kanban#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-kanban"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","sdk","profile","archetype","kanban","exemplar"],"pm":{"aliases":["kanban"],"extensions":["extensions/kanban"],"catalog":{"display_name":"Kanban Archetype","category":"sdk","summary":"Installable Kanban continuous-flow archetype: Card item type, flow fields, and a ProjectProfileDefinition built on public SDK primitives.","tags":["sdk","profile","archetype","kanban","schema","exemplar"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-kanban#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-kanban","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}
+{"name":"@unbrained/pm-kanban","version":"2026.10.22","private":true,"type":"module","description":"First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-kanban#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-kanban"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","sdk","profile","archetype","kanban","exemplar"],"pm":{"aliases":["kanban"],"extensions":["extensions/kanban"],"catalog":{"display_name":"Kanban Archetype","category":"sdk","summary":"Installable Kanban continuous-flow archetype: Card item type, flow fields, and a ProjectProfileDefinition built on public SDK primitives.","tags":["sdk","profile","archetype","kanban","schema","exemplar"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-kanban#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-kanban","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}

package/packages/pm-lifecycle-hooks/package.json

@@ -1 +1 @@
-{"name":"@unbrained/pm-lifecycle-hooks","version":"2026.10.20","private":true,"type":"module","description":"First-party pm package demonstrating safe lifecycle hook registration.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-lifecycle-hooks#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-lifecycle-hooks"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","hooks","lifecycle","sdk"],"pm":{"aliases":["lifecycle-hooks"],"extensions":["extensions/lifecycle-hooks"],"catalog":{"display_name":"Lifecycle Hooks","category":"sdk","summary":"Default-inert lifecycle hook exemplar for package authors.","tags":["hooks","lifecycle","sdk"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-lifecycle-hooks#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-lifecycle-hooks","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}
+{"name":"@unbrained/pm-lifecycle-hooks","version":"2026.10.22","private":true,"type":"module","description":"First-party pm package demonstrating safe lifecycle hook registration.","homepage":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-lifecycle-hooks#readme","repository":{"type":"git","url":"git+https://github.com/unbraind/pm-cli.git","directory":"packages/pm-lifecycle-hooks"},"bugs":{"url":"https://github.com/unbraind/pm-cli/issues"},"keywords":["pm-package","project-management","hooks","lifecycle","sdk"],"pm":{"aliases":["lifecycle-hooks"],"extensions":["extensions/lifecycle-hooks"],"catalog":{"display_name":"Lifecycle Hooks","category":"sdk","summary":"Default-inert lifecycle hook exemplar for package authors.","tags":["hooks","lifecycle","sdk"],"links":{"docs":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-lifecycle-hooks#readme","repository":"https://github.com/unbraind/pm-cli/tree/main/packages/pm-lifecycle-hooks","report":"https://github.com/unbraind/pm-cli/issues"}},"docs":["README.md"],"examples":["README.md"]}}