@unbrained/pm-cli 2026.7.20 → 2026.7.21

package/docs/RELATIONSHIP_GRAPH.md

@@ -184,20 +184,61 @@ dominators over the root's reachable subgraph, ranking structural
 bottlenecks by gated work), and `plan` exposes `planRelationshipRemediation`
 (dry-run remediation proposals derived from audit findings and witnessed
 redundancy rows, each carrying an exact operation, policy code, evidence,
-rationale, and confidence — never auto-applied). The audit gates finding
+rationale, and confidence — never auto-applied). Three planning and structural
+subcommands complete the analytics surface: `slack` exposes
+`analyzeRelationshipSchedule` (Critical Path Method float over the order-bearing
+DAG — earliest/latest start, total slack, and critical-task classification with
+unit task durations, reusing the exact execution forward pass and adding the
+backward latest-start pass; genuine cycles are reported separately, never
+scheduled), `centrality` exposes `computeRelationshipCentrality` (exact Brandes
+shortest-path betweenness, Wasserman–Faust closeness, undirected degree, and
+precedence-oriented dependency fan-in/fan-out per node over the simple undirected graph), and
+`articulation` exposes `findRelationshipCutStructure` (iterative Tarjan low-link
+search reporting articulation points and bridges — the single points of failure
+whose removal fragments the knowledge graph). All three are deterministic and
+exact on the bounded workspace, carry explicit `cost`/`truncated` metadata, and
+honor `--kind` (centrality/articulation) and `--limit`/`--summary` bounds. The audit gates finding
 severity on lifecycle: contradictions confined to terminal items report as
 informational `legacy_ordering_cycle`/`legacy_duplicate_edge` history debt,
 while `ordering_cycle` errors and `duplicate_edge` findings require at least
 one active subject; `duplicate_edge` covers parallel same-family spellings,
 reciprocal inverse pairs included, which transitive-reduction redundancy
-deliberately skips. All subcommands resolve the workspace assembly through
-the shared fingerprint-keyed graph cache (`WorkspaceGraphCache`): the
-fingerprint digests every relationship-relevant item field, so unchanged
-workspaces in long-lived hosts reuse the assembled graph and memoized query
-results, and every envelope reports `cache` hit/miss observability next to
-its explicit `truncated` and `cost` metadata. Ids resolve
+deliberately skips. The storage-integrity family `duplicate_dependency_row`
+(warning on active holders, informational `legacy_duplicate_dependency_row`
+on terminal ones) reports raw dependency rows whose exact identity is stored
+more than once on one holder — invisible to every assembled-graph projection
+because graph construction deduplicates edges by identity, so
+`collectDuplicateDependencyRows` scans the pre-assembly item rows carried on
+the assembly. Coverage policy is type-aware: the audit profile's
+`coverage_by_type` breaks active/isolated/degree≤1 counts down per item type
+(untyped items under `(untyped)`), and `isolateExemptTypes`
+(`--exempt-isolate-type`) suppresses isolate/sparse findings for types whose
+disconnection is policy-valid without changing profile counts.
+`--save-baseline` persists the audit census through
+`saveGraphAuditBaseline`, and later audits attach the signed
+`diffRelationshipAuditSnapshots` drift (`baseline` block) — the temporal
+comparison primitive for census tracking. All subcommands resolve the
+workspace assembly through the shared fingerprint-keyed graph cache
+(`WorkspaceGraphCache`): the fingerprint digests every
+relationship-relevant item field (item type included, powering the per-type
+coverage), so unchanged workspaces in long-lived hosts reuse the assembled
+graph and memoized query results, and every envelope reports `cache`
+hit/miss observability next to its explicit `truncated` and `cost` metadata.
+One-shot processes additionally reuse the durable fingerprint-keyed index at
+`runtime/graph-cache.json` (`pm graph index` status/`--rebuild`/`--clear`;
+automatic persistence at ≥500 items, opt-in below via rebuild): atomic
+last-write-wins envelopes, corrupt-tolerant decode, never authoritative —
+every entry rebuilds from item storage on fingerprint mismatch, and
+envelopes report the `cache.durable` disposition. Ids resolve
 case-insensitively; `--summary` returns envelopes without row collections.
 
+Mutation advisories reuse the same cycle semantics incrementally:
+`collectNewOrderingCycleWarnings` builds a lightweight ordering digraph
+directly from the before/after item snapshots (no full workspace assembly)
+and scopes `collectOrderingCycles` to the changed item's weakly connected
+ordering component — exact for any cycle containing the changed item, and no
+longer paying two whole-graph SCC analyses per dependency-bearing mutation.
+
 ## Compatibility and migration
 
 Aliases normalize at registry boundaries; stored values are not silently rewritten. Imports must carry or select a compatible registry version. Federation merges definitions before edges and rejects identifier or alias collisions. Rollback removes the custom definition and its derived index only after application-owned edges have been exported or superseded; immutable history is retained.

package/docs/SDK.md

@@ -59,6 +59,8 @@ Source of truth:
 - [`src/sdk/graph/governance.ts`](../src/sdk/graph/governance.ts)
 - [`src/sdk/graph/remediation.ts`](../src/sdk/graph/remediation.ts)
 - [`src/sdk/graph/cache.ts`](../src/sdk/graph/cache.ts)
+- [`src/sdk/graph/durable-cache.ts`](../src/sdk/graph/durable-cache.ts)
+- [`src/sdk/graph/mutation-advisory.ts`](../src/sdk/graph/mutation-advisory.ts)
 - [`src/sdk/graph/run.ts`](../src/sdk/graph/run.ts)
 - [`src/sdk/relationship-history.ts`](../src/sdk/relationship-history.ts)
 - [`src/sdk/relationship-context.ts`](../src/sdk/relationship-context.ts)
@@ -84,6 +86,7 @@ Source of truth:
 - [`src/sdk/cli-bootstrap.ts`](../src/sdk/cli-bootstrap.ts)
 - [`src/sdk/cli-contracts/commander-types.ts`](../src/sdk/cli-contracts/commander-types.ts)
 - [`src/sdk/cli-contracts/commander-mutation-options.ts`](../src/sdk/cli-contracts/commander-mutation-options.ts)
+- [`src/sdk/structured-mutations.ts`](../src/sdk/structured-mutations.ts)
 
 Common authoring exports:
 
@@ -162,9 +165,14 @@ Command/action contract exports:
 - Context relevance contracts: `ContextRelevanceCandidate`, `ContextRelevanceSignals`, `ContextRelevanceScorer`, `ContextRelevanceReport`, `ContextEvaluationReader`, `ContextEvaluationScenario`, `ContextEvaluationScenarioReport`, `ContextEvaluationThresholds`, and `ContextEvaluationCorpusReport`
 - Context packing and feedback primitives: `packContextCandidates`, `recordContextUsageServing`, `recordContextUsageTouch`, `recordContextUsageTouches`, and `readContextUsageAffinity`
 - Typed annotation and relationship primitives on `PmClient`: `comments`, `notes`, `learnings`, `files`, `filesDiscover`, `docs`, `deps`, `graph`, and `append`
-- Workspace graph-query runner: `runGraph` (with `GraphCommandOptions`, `GraphResult`, and per-subcommand envelopes) resolves the workspace relationship graph through the shared fingerprint-keyed cache and dispatches bounded `ancestors`/`descendants`/`predecessors`/`successors`/`paths`/`impact`/`analyze`/`audit`/`communities`/`redundancy`/`dominators`/`plan` queries with counts-first cost, truncation, and cache metadata; the `pm graph` CLI command and `pm_graph` MCP tool are thin adapters over it.
+- Workspace graph-query runner: `runGraph` (with `GraphCommandOptions`, `GraphResult`, and per-subcommand envelopes) resolves the workspace relationship graph through the shared fingerprint-keyed cache and dispatches bounded `ancestors`/`descendants`/`predecessors`/`successors`/`paths`/`impact`/`analyze`/`audit`/`communities`/`redundancy`/`dominators`/`slack`/`centrality`/`articulation`/`plan` queries with counts-first cost, truncation, and cache metadata; the `pm graph` CLI command and `pm_graph` MCP tool are thin adapters over it.
 - Structural graph analytics: `detectRelationshipCommunities` (deterministic label-propagation clustering with `maxIterations`/`minSize` bounds and convergence reporting), `findRedundantRelationshipEdges` (transitive-reduction scan that joins each directed ordering or hierarchy kind with its inverse spelling and returns witness paths), and `computeRelationshipDominators` (Cooper–Harvey–Kennedy immediate dominators with per-node gating weights for bottleneck ranking) — all deterministic, cancellable, and cost-metered like every other graph query.
-- Incremental graph cache: `WorkspaceGraphCache`, `workspaceGraphCache`, `resetWorkspaceGraphCache`, and `computeWorkspaceGraphFingerprint` reuse the assembled workspace graph and memoize deterministic query results under a fingerprint that digests every relationship-relevant item field (id, title, status and terminal classification, parent, legacy blocker, structured dependencies), so long-lived hosts stop paying full-workspace assembly per bounded query; `GraphCacheMetadata` reports assembly/result hit-or-miss on every `runGraph` envelope.
+- Planning and fragility analytics: `analyzeRelationshipSchedule` (Critical Path Method over the order-bearing DAG — earliest/latest start, total float, critical-task classification, and makespan with unit durations, reusing the exact execution forward pass), `computeRelationshipCentrality` (exact Brandes betweenness, Wasserman–Faust closeness, undirected degree, and precedence-oriented dependency fan-in/fan-out per node), and `findRelationshipCutStructure` (iterative Tarjan articulation points and bridges — the single points of failure in the knowledge graph). `forEachMatchedRelationshipEdge` is the shared kind-matched, self-loop-skipping edge iterator these builders reuse. All are deterministic and exact on the bounded workspace.
+- Incremental graph cache: `WorkspaceGraphCache`, `workspaceGraphCache`, `resetWorkspaceGraphCache`, and `computeWorkspaceGraphFingerprint` reuse the assembled workspace graph and memoize deterministic query results under a fingerprint that digests every relationship-relevant item field (id, title, status and terminal classification, item type, parent, legacy blocker, structured dependencies), so long-lived hosts stop paying full-workspace assembly per bounded query; `GraphCacheMetadata` reports assembly/result hit-or-miss on every `runGraph` envelope.
+- Durable graph index: `openDurableGraphCache`, `persistDurableGraphResult`, `clearDurableGraphCache`, `durableGraphCacheStatus`, `shouldPersistDurableGraphCache`, and the `durableGraphCachePath`/`graphAuditBaselinePath` locators persist fingerprint-keyed deterministic query results across processes under `runtime/graph-cache.json` — atomic writes, corrupt-tolerant decode, bounded retention, never authoritative (rebuildable from item storage), optional below the `GRAPH_DURABLE_CACHE_MIN_ITEMS` threshold; `pm graph index` is the maintenance surface and `cache.durable` the per-envelope observability.
+- Temporal audit census: `RelationshipAuditSnapshot`, `diffRelationshipAuditSnapshots`, `saveGraphAuditBaseline`, and `loadGraphAuditBaseline` persist and compare point-in-time governance censuses (signed per-code and per-profile deltas, `same_snapshot` fingerprint equality) behind `pm graph audit --save-baseline` and the automatic `baseline` drift block on later audits.
+- Storage-integrity and coverage governance: `collectDuplicateDependencyRows` reports raw same-identity dependency rows duplicated on one holder (the `duplicate_dependency_row`/`legacy_duplicate_dependency_row` audit families; invisible to assembled-graph projections), `RelationshipCoverageProfile.coverage_by_type` breaks active connectivity down per item type, and `RelationshipAuditOptions.isolateExemptTypes` suppresses coverage findings for policy-valid disconnected types.
+- Incremental mutation advisory: `collectNewOrderingCycleWarnings` detects newly created ordering cycles component-scoped around the changed item over a lightweight per-snapshot ordering digraph (shared `collectOrderingCycles` Tarjan semantics with the audit; no full workspace assembly per mutation), and `resolveWorkspaceRelationshipKindRegistry` exposes the built-in-plus-extension relationship-kind registry resolution every surface shares.
 - Remediation planning: `planRelationshipRemediation` (with `RelationshipRemediationPlan`, `RelationshipRemediationStep`, and operation/confidence/code contracts) derives exact dry-run `remove`/`retype`/`supersede`/`waive`/`investigate` proposals from governance-audit findings and witnessed redundancy rows — evidence-backed, confidence-rated, and never auto-applied.
 - Annotation and relationship option/result contracts: `CommentsCommandOptions` / `CommentsResult`, `NotesCommandOptions` / `NotesResult`, `LearningsCommandOptions` / `LearningsResult`, `FilesCommandOptions` / `FilesResult`, `FilesDiscoverOptions` / `FilesDiscoverResult`, `DocsCommandOptions` / `DocsResult`, `DepsCommandOptions` / `DepsResult`, `AppendCommandOptions` / `AppendResult`
 - Annotation kernel primitives: `resolveAnnotationInput`, `runAnnotationCommand`, `resolveAnnotationIndex`, `parseAnnotationTextInput`, `limitAnnotationEntries`, `readAnnotationEntries`, `wrapOwnershipConflict`, `isErrnoError`, and their typed input/config/result contracts
@@ -800,7 +808,9 @@ tools that need to own item state without spawning `pm`.
 ### Atomic workspace transactions
 
 Tracked by [pm-4e12](../.agents/pm/features/pm-4e12.toon), with the VCS
-acceptance story [pm-8ngt](../.agents/pm/stories/pm-8ngt.toon).
+acceptance story [pm-8ngt](../.agents/pm/stories/pm-8ngt.toon) and the structured
+SDK adapters tracked by [pm-xm7c](../.agents/pm/features/pm-xm7c.toon) and
+[pm-kipd](../.agents/pm/features/pm-kipd.toon).
 
 `commitWorkspaceTransaction` is the public unit-of-work primitive for domain
 commands that must coordinate several SDK mutations. A plan supplies a stable
@@ -900,6 +910,24 @@ applied and are likewise compensated by version restore. A stable
 `transactionId` makes interrupted batches resumable across processes and
 agents.
 
+When a direct SDK operation must observe extension-owned item types, fields,
+hooks, parsers, or services, wrap it with `runWithActiveExtensions`. The scope
+loads and tears down the workspace extensions once, serializes the global
+registries across concurrent requests, and is reentrant: SDK primitives called
+inside the callback reuse the active scope instead of attempting a nested
+activation cycle.
+
+```ts
+import {
+  commitItemMutations,
+  runWithActiveExtensions,
+} from "@unbrained/pm-cli/sdk";
+
+await runWithActiveExtensions({ cwd: projectRoot }, () =>
+  commitItemMutations({ pmRoot, transactionId, author, mutations }),
+);
+```
+
 ```ts
 import { commitItemMutations } from "@unbrained/pm-cli/sdk";
 
@@ -929,6 +957,53 @@ each `addAc`/`removeAc` entry must be semicolon-free; unmatched removals are
 reported as `remove_ac_unmatched:<text>` warnings rather than disappearing as
 silent no-ops.
 
+`parseItemMutationBatch` is the strict JSON boundary for that primitive. It
+accepts either a non-empty mutation array or `{ "mutations": [...] }`, derives
+allowed option names from the exported create/update/close command contracts,
+and rejects unknown row or option keys with a did-you-mean diagnostic before a
+workspace lock or write is attempted. This lets embedded tools expose the same
+safe batch format without duplicating validation:
+
+```ts
+import {
+  commitItemMutations,
+  parseItemMutationBatch,
+} from "@unbrained/pm-cli/sdk";
+
+const mutations = parseItemMutationBatch(batchJson);
+await commitItemMutations({
+  pmRoot,
+  author: "sync-agent",
+  transactionId: "upstream-sync-2026-07-20-001",
+  mutations,
+});
+```
+
+`itemDocumentToMutationOptions` is the companion full-document adapter. It
+accepts either a direct `ItemDocument` or the envelope returned by
+`pm get <id> --json`, strips read-only metadata, maps canonical snake-case item
+fields to typed mutation options, and serializes linked facets through the same
+repeatable option forms as create/update. Explicit options win over document
+values. Unknown near-miss keys fail; application-defined fields are routed
+through the public `field` escape hatch.
+
+The built-in adapters stay deliberately thin:
+
+- `pm item mutate --transaction-id <stable-id> --stdin-json` validates and
+  commits a batch with `commitItemMutations`; `--dry-run` performs validation
+  only, and reusing the transaction id resumes or replays the durable journal.
+- `pm create --stdin-json` and `pm update <id> --stdin-json` accept a whole item
+  document. This supports the lossless `get → edit → update` agent workflow
+  without translating every field into argv.
+- MCP `pm_mutate` accepts the decoded mutation array plus the same transaction,
+  compensation, dry-run, and lock controls. It calls the same validator and SDK
+  primitive rather than spawning the CLI.
+
+The batch is logically atomic at the durable journal boundary described above,
+not an MVCC snapshot. Use stable transaction and create ids, size the lock TTL
+above the longest mutation attempt, and keep the JSON batch deterministic so a
+different agent or process can safely resume it.
+
 Package and extension lifecycle convenience methods are the SDK primitive layer
 for custom PM tools that need to manage their own package surface without
 shelling out. Use `pm.packageList`, `pm.packageInstall`,

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.7.20"
+    "version": "2026.7.21"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.7.20",
+      "version": "2026.7.21",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-claude/README.md

@@ -6,7 +6,7 @@ Native pm CLI integration for Claude Code. Use pm project management tools direc
 
 | Component | What it provides |
 |-----------|----------------|
-| **28 MCP tools** | Full pm surface: next, context, search, list, get, create, copy, focus, update, claim, release, close, comments, files, docs, notes, learnings, deps, test, validate, health, contracts, plan, append, schema, config, profile + `pm_run` for everything else |
+| **30 MCP tools** | Full pm surface: next, context, search, list, get, create, atomic mutate, copy, focus, update, claim, release, close, comments, files, docs, notes, learnings, deps, graph, test, validate, health, contracts, plan, append, schema, config, profile + `pm_run` for everything else |
 | **5 skills** | `pm-workflow`, `pm-developer`, `pm-release`, `pm-audit`, `pm-planner` — auto-loaded as Claude Code skills |
 | **14 slash commands** | Full lifecycle coverage — status, start, close, triage, audit, search, new, list, calendar, developer, planner, release, workflow, init |
 | **4 subagents** | `pm-coordinator` (batch/multi-item), `pm-triage-agent` (duplicate-safe item creation), `pm-verification-agent` (evidence + close readiness), and `pm-delivery-chain` (orchestrated delivery) |
@@ -29,7 +29,7 @@ claude plugin marketplace add /path/to/pm-cli
 # claude plugin marketplace add unbraind/pm-cli
 ```
 
-This installs all 28 MCP tools, 5 skills, 14 slash commands, 4 subagents, hybrid TUI tracking, and the session hook in one step. (`pm-claude` is the plugin name; `pm` is the marketplace name from `marketplace.json`.)
+This installs all 30 MCP tools, 5 skills, 14 slash commands, 4 subagents, hybrid TUI tracking, and the session hook in one step. (`pm-claude` is the plugin name; `pm` is the marketplace name from `marketplace.json`.)
 
 ### Option B: Global MCP server via Claude Code CLI (MCP tools only)
 
@@ -37,7 +37,7 @@ This installs all 28 MCP tools, 5 skills, 14 slash commands, 4 subagents, hybrid
 claude mcp add --transport stdio pm-mcp -- npx -y --package=@unbrained/pm-cli@latest pm-mcp
 ```
 
-This gives you the 28 MCP tools but not the skills, slash commands, or session hook.
+This gives you the 30 MCP tools but not the skills, slash commands, or session hook.
 
 ### Option C: Direct `.mcp.json` (project-scoped MCP only)
 
@@ -145,6 +145,7 @@ Spawn pm-triage-agent to set up the pm item for: add OAuth2 login support
 | `pm_list` | Filtered item list |
 | `pm_get` | Single item detail |
 | `pm_create` | Create new item |
+| `pm_mutate` | Atomically create, update, or close an ordered item batch |
 | `pm_copy` | Copy item into a new id |
 | `pm_focus` | Set or clear the focused item |
 | `pm_update` | Update metadata |
@@ -158,6 +159,7 @@ Spawn pm-triage-agent to set up the pm item for: add OAuth2 login support
 | `pm_notes` | List or add notes |
 | `pm_learnings` | List or add learnings |
 | `pm_deps` | List/add/remove dependencies |
+| `pm_graph` | Query bounded relationship graphs and analytics |
 | `pm_test` | Link or run tests |
 | `pm_validate` | Run validation checks |
 | `pm_health` | Run health diagnostics |

package/plugins/pm-claude/commands/pm-init.md

@@ -47,7 +47,7 @@ Initialize pm project tracking using native MCP tools. Argument: `$ARGUMENTS` (o
    - pm initialized at `.agents/pm/`
    - guidance mode defaults to `ask` (TTY prompt only); use `agentGuidance=add|skip|status` in `pm_run` options for deterministic behavior
    - Available slash commands: `/pm-status`, `/pm-new`, `/pm-start-task`, `/pm-close-task`, `/pm-list`, `/pm-search`, `/pm-triage`, `/pm-calendar`, `/pm-developer`, `/pm-planner`, `/pm-release`, `/pm-audit`, `/pm-workflow`
-   - All 28 MCP tools available: `pm_next`, `pm_context`, `pm_search`, `pm_list`, `pm_get`, `pm_create`, `pm_copy`, `pm_focus`, `pm_update`, `pm_append`, `pm_claim`, `pm_release`, `pm_close`, `pm_comments`, `pm_files`, `pm_docs`, `pm_notes`, `pm_learnings`, `pm_deps`, `pm_test`, `pm_validate`, `pm_health`, `pm_contracts`, `pm_schema`, `pm_config`, `pm_profile`, `pm_plan`, `pm_run`
+   - All 30 MCP tools available: `pm_next`, `pm_context`, `pm_search`, `pm_list`, `pm_get`, `pm_create`, `pm_mutate`, `pm_copy`, `pm_focus`, `pm_update`, `pm_append`, `pm_claim`, `pm_release`, `pm_close`, `pm_comments`, `pm_files`, `pm_docs`, `pm_notes`, `pm_learnings`, `pm_deps`, `pm_graph`, `pm_test`, `pm_validate`, `pm_health`, `pm_contracts`, `pm_schema`, `pm_config`, `pm_profile`, `pm_plan`, `pm_run`
    - Next: use `/pm-new <title>` to create your first item, or `/pm-status` to see the tracker state
 
 If initialization fails, report the error and suggest running `pm init` manually in the terminal.

package/plugins/pm-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-codex",
-  "version": "2026.7.20",
+  "version": "2026.7.21",
   "description": "Native Codex integration for pm-cli with bundled MCP tools, skills, commands, and agent workflows.",
   "author": {
     "name": "unbrained",