@unbrained/pm-cli 2026.8.14 → 2026.8.15

package/docs/RELEASING.md

@@ -24,7 +24,8 @@ Tracked documentation work: [pm-u9d0](../.agents/pm/epics/pm-u9d0.toon),
 [pm-lwnifd](../.agents/pm/issues/pm-lwnifd.toon), and SDK-bound reliability
 classification [pm-dqtzva](../.agents/pm/issues/pm-dqtzva.toon).
 The local/hosted gate selection contract is tracked by
-[pm-ei6x66](../.agents/pm/tasks/pm-ei6x66.toon).
+[pm-ei6x66](../.agents/pm/tasks/pm-ei6x66.toon). Release-candidate analyzer
+provenance is tracked by [pm-u1baah](../.agents/pm/issues/pm-u1baah.toon).
 
 ## Version Policy
 
@@ -80,6 +81,9 @@ Policy:
   creating an ordinal replacement; an already-successful run is recorded as
   recovered without republishing
 - release preparation must pass all quality and compatibility gates before commit+tag push
+- before dependency installation or build, auto-release verifies that the
+  candidate has exact-commit analyzer results or an immutable tree-identical
+  reviewed PR head with successful DeepScan and CodeFactor results
 - `CHANGELOG.md` is generated by the latest npm `pm-changelog` package (`pm install npm:pm-changelog --project`, then `pm changelog generate --mode replace --all-release-tags`) from closed tracker items across git release tag windows and checked in CI; do not edit it by hand
 - protected-branch pushes require `RELEASE_PAT`; Auto Release fails fast before the expensive release gates when `push=true`, `dry_run=false`, and that secret is not configured
 - release reliability gating requires `SENTRY_PERSONAL_ADMIN_TOKEN` for issue-threshold checks; Auto Release fails before creating the version commit/tag when the token is missing and `push=true`, while sourcemap upload remains optional through `SENTRY_AUTH_TOKEN`
@@ -196,8 +200,9 @@ The build writes `dist/cli-bundle/bundle-manifest.json` atomically with SHA-256
 
 4. Run the same release pipeline locally.
 
-Push the final implementation commit first, wait for DeepScan and CodeFactor to
-finish on that reviewed SHA, then run the canonical registry-owned preflight:
+Push the final implementation commit through a reviewed pull request first,
+wait for DeepScan and CodeFactor to finish on that reviewed SHA, then run the
+canonical registry-owned preflight:
 
 ```bash
 pnpm verify:preflight
@@ -207,7 +212,8 @@ The registry supplies the ordered executable plan, command arguments,
 environment, capture policy, and explicit skip policy. Its receipt distinguishes
 passed checks from declared skips. The same registry maps named PR, nightly,
 and release workflow gates; hosted-only entries must explain why no faithful
-local equivalent exists.
+local equivalent exists. Analyzer provenance is the first executable step, so
+an unreleasable candidate fails before build, coverage, or package work.
 
 The preflight includes the mandatory local hosted-analysis proof:
 
@@ -218,13 +224,44 @@ pnpm quality:hosted-analysis
 The gate accepts only DeepScan's explicit zero-new-issue status and
 CodeFactor's explicit no-issues result. Both contexts are required by `main`
 branch protection, and the release pipeline reruns the same immutable-tree
-proof. It reads the release commit first. When GitHub does not copy app results
+proof. The gate reads branch protection through REST first; if that transport
+is unavailable or its core API quota is exhausted, it queries the equivalent
+GraphQL rules across every cursor-paginated page and still requires one exact
+`main` rule with strict updates plus both analyzer contexts. Malformed,
+truncated, missing, or ambiguous admin policy data fails closed. GitHub Actions'
+ephemeral token cannot request the repository `Administration: read` permission
+required by both of those policy surfaces. When both admin transports reject
+that token, the gate uses the contents-readable `GET /branches/main` summary
+and requires that the exact candidate is the current protected branch head,
+protection is enabled and enforced, and CodeFactor plus DeepScan are effective
+required contexts. That summary intentionally cannot attest the admin-only
+strict-update setting: its receipt reports `strict: null`,
+`strict_verified: false`, and `verification_scope: effective_required_checks`
+instead of inventing a positive result. Exact or immutable identical-tree
+analyzer provenance remains mandatory and is emitted beside the policy receipt,
+so the restricted-token recovery cannot admit an unanalyzed or different-tree
+candidate. A maintainer token with administration-read access still verifies
+and reports `strict: true` through REST or paginated GraphQL. It reads the
+release commit first. When GitHub does not copy app results
 onto a merge commit, the gate may reuse a reviewed merge-parent or squash-PR
 head only when its immutable Git tree SHA exactly matches the release commit.
 Squash provenance additionally requires one unambiguous GitHub association to a
 closed PR merged into `main` with the release commit as its merge commit.
 Missing, ambiguous, or different-tree provenance fails closed.
 
+The supported default-branch arrival path is a reviewed pull request. A direct
+push to `main` is releasable only if both analyzers attached successful evidence
+to that exact commit; when they did not, the gate explicitly refuses the
+candidate instead of letting the next scheduled release discover the missing
+precondition after expensive work. CI runs `Release analyzer readiness (main)`
+on every product-relevant push to `main`, providing continuous visibility
+between release attempts. If GitHub's commit-association endpoint has not yet
+published a new merge, the gate reads the pull-request number from GitHub's
+standard merge message and accepts it only after the immutable PR resource
+confirms that exact merge SHA, `main` base, and reviewed head. Remediate a
+refused direct-main candidate by landing the next tree-changing fix through a
+reviewed PR; never copy, synthesize, or bypass analyzer evidence.
+
 ```bash
 # Read-only parity check
 pnpm release:pipeline:dry-run

package/docs/SDK_CONTEXT_INTEGRITY.md

@@ -1,6 +1,6 @@
 # SDK Context Integrity
 
-Tracker: [pm-0k19l7](../.agents/pm/issues/pm-0k19l7.toon), [pm-9stazf](../.agents/pm/issues/pm-9stazf.toon), [pm-tu71](../.agents/pm/issues/pm-tu71.toon), [pm-0xmajx](../.agents/pm/issues/pm-0xmajx.toon), [pm-7rrqsk](../.agents/pm/issues/pm-7rrqsk.toon), [pm-ety1qc](../.agents/pm/issues/pm-ety1qc.toon), [pm-lu6sca](../.agents/pm/features/pm-lu6sca.toon), [pm-5y05kq](../.agents/pm/issues/pm-5y05kq.toon), [pm-gjjurs](../.agents/pm/issues/pm-gjjurs.toon), [pm-h97qxd](../.agents/pm/issues/pm-h97qxd.toon), [pm-h06944](../.agents/pm/issues/pm-h06944.toon), and [pm-5t33or](../.agents/pm/features/pm-5t33or.toon).
+Tracker: [pm-0k19l7](../.agents/pm/issues/pm-0k19l7.toon), [pm-9stazf](../.agents/pm/issues/pm-9stazf.toon), [pm-tu71](../.agents/pm/issues/pm-tu71.toon), [pm-0xmajx](../.agents/pm/issues/pm-0xmajx.toon), [pm-7rrqsk](../.agents/pm/issues/pm-7rrqsk.toon), [pm-ety1qc](../.agents/pm/issues/pm-ety1qc.toon), [pm-lu6sca](../.agents/pm/features/pm-lu6sca.toon), [pm-5y05kq](../.agents/pm/issues/pm-5y05kq.toon), [pm-gjjurs](../.agents/pm/issues/pm-gjjurs.toon), [pm-h97qxd](../.agents/pm/issues/pm-h97qxd.toon), [pm-h06944](../.agents/pm/issues/pm-h06944.toon), [pm-5t33or](../.agents/pm/features/pm-5t33or.toon), [pm-in23qu](../.agents/pm/issues/pm-in23qu.toon), [pm-h8tpeh](../.agents/pm/features/pm-h8tpeh.toon), [pm-okgxwa](../.agents/pm/issues/pm-okgxwa.toon), [pm-22rzjp](../.agents/pm/issues/pm-22rzjp.toon), [pm-76fkpp](../.agents/pm/issues/pm-76fkpp.toon), [pm-igdvfq](../.agents/pm/issues/pm-igdvfq.toon), [pm-643e0k](../.agents/pm/issues/pm-643e0k.toon), and [pm-larv4r](../.agents/pm/issues/pm-larv4r.toon).
 
 ## Agent Quick Context
 
@@ -54,7 +54,43 @@ rows. This lets governance envelopes reduce diagnostic findings before
 omitting the whole verdict without redefining a nested tag or remediation list
 as a pagination row. Receipts name every `compacted_row_paths` entry; a complete
 omission also records the useful result's pre-omission estimate, while the
-universal recovery remains `--output-budget unbounded`.
+recovery names a bounded budget increase when no declared row path can resume.
+
+Budget-compacted declared rows instead publish a bounded `outputCursor`
+continuation on every transport. The cursor resumes the first withheld row and
+rejects a command, path, row-total, or stable-identity mismatch. This gives SDK
+and package loops a recursive self-improvement primitive: consume a bounded
+page, update context, and continue without abandoning the ceiling.
+
+`context --explain-ranking` projects explanations to the focus rows actually
+served. `candidate_count` records the scorer population and `omitted_count`
+records explanations intentionally withheld, while each returned row retains
+its rank, baseline rank, score, and per-signal contributions. Explanation cost
+therefore scales with the answer rather than with the active workspace.
+
+Unknown-option recovery is likewise derived from the declared flag lexicon.
+The structured `option_scope` is `declared_on_path`, `declared_elsewhere`, or
+`declared_nowhere`; accepting command paths are included only for the second
+case, while the third names the nearest current-path spellings and explicitly
+terminates the otherwise-unbounded command search.
+
+## Executable recovery-reference coverage
+
+Structured refusal guidance is a forward-reference contract, not decorative
+text. `verifyPmRecoveryReferences` accepts obligations derived from real error
+envelopes and observations produced by executing a retry, resolving a declared
+command path, or linking prose to an already executed recovery. Its report
+includes the total obligation set, pass fraction, sorted findings, and stable
+coverage buckets for `suggested_retry`, `candidate_command`, `example`, and
+`next_step`, including zero-population buckets.
+
+The repository integration corpus drives real CLI refusals, executes the
+emitted retry in a temporary tracker, compares candidate commands with the
+unbounded runtime contract enumeration, and binds examples and next steps to
+those proofs. A seeded unreachable observation must lower the pass fraction
+and produce `unreachable_reference`. The same corpus is a provider-backed
+blocking assertion in `repository-context-quality`, so a well-formed but broken
+recovery promise cannot pass CI merely because its text or target flag exists.
 
 ## Row discovery and exact output receipts
 
@@ -134,6 +170,26 @@ never succeeded. The same bounded pass classifies bare boolean and single-digit
 values across every recorded provenance dimension, publishes only aggregate
 harness/dimension/kind counts, and never echoes the historical value.
 
+`historyRepair` and `historyRepairAll` retain the detected history hash epoch
+instead of unconditionally upgrading it. `normalizeProvenance: true` adds a
+privacy-safe repair mode that removes invalid bounded observations and records
+only aggregate counts/classes in the synthetic audit event. The bulk form
+selects both drifted streams and streams requiring provenance normalization.
+
+Health results are self-indexing: every retained warning has a `findings` row
+with its owning check, stable code, severity, and either executable remediation
+or an explicit safe refusal. `failed_because` contains the exact warning tokens
+that decide `ok: false` and survives brief/summary projection. Extension health
+adds a host-version census by resolving the pm-cli package visible from each
+loaded extension; npm/pnpm duplicate-version skew is gate-failing while matching
+workspace-linked and deduplicated copies remain green.
+
+Linked file/doc add parsing uses one SDK allowlist. Whitespace-free filesystem
+paths and scheme-prefixed URLs remain positional even when a path or query
+contains `=`. Leading assignment syntax, including malformed URL-plus-note
+input, must use the declared `path`, `scope`, and `note` keys or fail before
+mutation.
+
 ## Replication and refusal gate
 
 `scripts/release/surface-replication-sets.json` declares replicated SDK, CLI, MCP, documentation, and test members. `pnpm quality:surface-replication` activates sets from the Git changeset, verifies every member invariant, and reports:
@@ -145,6 +201,12 @@ harness/dimension/kind counts, and never echoes the historical value.
 - an AST-derived denominator of identical named rule bodies, declared coverage,
   and a non-decreasing detected-cluster floor.
 
+Trigger entries may constrain a shared file with `changed_lines_contain_any`.
+The set then activates only when an added or removed diff line carries one of
+those contract markers. Missing diff evidence fails closed and activates the
+set, while an unrelated hunk in the same shared table does not force artificial
+edits across every replicated member.
+
 Query waivers directly with:
 
 ```bash

package/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.8.14"
+    "version": "2026.8.15"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.8.14",
+      "version": "2026.8.15",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-cli",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "description": "Git-native project management CLI for humans and agents.",
   "type": "module",
   "packageManager": "pnpm@11.10.0",
@@ -120,11 +120,11 @@
     "lint:complexity:baseline": "eslint . --suppress-rule complexity --suppress-rule sonarjs/cognitive-complexity",
     "lint:duplicates": "jscpd --config .jscpd.json",
     "lint:codefactor": "pnpm quality:static",
-    "quality:static": "pnpm build && pnpm exec tsx scripts/release/static-quality-gate.mts --max-eslint-suppressions 113 --max-coverage-ignore-pragmas 477 --min-docstring-coverage 100 --min-exported-docstring-coverage 100 --min-member-docstring-coverage 100 && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node scripts/release/absence-tolerance-gate.mjs && node scripts/release/token-budget-gate.mjs && node scripts/release/context-intent-calibration-gate.mjs && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded",
+    "quality:static": "pnpm build && node scripts/release/repository-assurance.mjs repository-static-quality --trigger ci --json && node scripts/release/audit-package-boundary.mjs && node scripts/release/package-sdk-contract-parity.mjs && node scripts/release/surface-replication-gate.mjs && node dist/cli.js assurance run tracker-context-quality --trigger ci --dry-run --json --output-budget unbounded && node scripts/release/gate-registry.mjs && node scripts/sdk-surface-snapshot.mjs --check && node scripts/bench/sdk-entrypoint-costs.mjs --check && node scripts/bench/cli-transport-floor.mjs --check && node dist/cli.js assurance run graph-composition --trigger ci --dry-run --json --output-budget unbounded && node dist/cli.js assurance run record-integrity --trigger ci --dry-run --json --output-budget unbounded",
     "quality:token-budget": "node scripts/release/token-budget-gate.mjs",
     "quality:token-surface": "node scripts/measure-agent-token-surface.mjs --check",
     "quality:token-surface:update": "pnpm build && node scripts/measure-agent-token-surface.mjs --update",
-    "quality:context-eval": "pnpm build && node scripts/release/context-eval-gate.mjs && node scripts/release/retrieval-eval-gate.mjs --negative-control && node scripts/release/retrieval-eval-gate.mjs && node scripts/release/agent-task-token-gate.mjs --negative-control && node scripts/release/agent-task-token-gate.mjs && pnpm quality:token-surface",
+    "quality:context-eval": "pnpm build && node scripts/release/repository-assurance.mjs repository-context-quality --trigger ci --json && pnpm quality:token-surface",
     "quality:agent-task-token": "pnpm build && node scripts/release/agent-task-token-gate.mjs",
     "quality:agent-task-token:update": "pnpm build && node scripts/release/agent-task-token-gate.mjs --update",
     "quality:retrieval-eval": "pnpm build && node scripts/release/retrieval-eval-gate.mjs",

package/packages/pm-beads/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-beads",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package for importing Beads JSONL records.",

package/packages/pm-calendar/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-calendar",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package for calendar and agenda views.",

package/packages/pm-command-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-command-kit",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm exemplar package for the commands capability: registerCommand, registerFlags, and registerParser.",

package/packages/pm-digital-twin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-digital-twin",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a temporal production-facility digital twin built entirely on public pm SDK and extension primitives.",

package/packages/pm-governance-audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-governance-audit",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package for governance audit and normalization workflows.",

package/packages/pm-guide-shell/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-guide-shell",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package for guide and shell completion workflows.",

package/packages/pm-kanban/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-kanban",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm archetype package: a complete Kanban continuous-flow profile built on public SDK primitives.",

package/packages/pm-lifecycle-hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-lifecycle-hooks",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package demonstrating safe lifecycle hook registration.",

package/packages/pm-linked-test-adapters/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-linked-test-adapters",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package for optional linked-test run management adapters and reporters.",

package/packages/pm-search-advanced/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-search-advanced",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package for semantic, hybrid, and reindex search workflows.",

package/packages/pm-templates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-templates",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package for reusable create templates.",

package/packages/pm-todos/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-todos",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "First-party pm package for Todo markdown import and export.",

package/packages/pm-vcs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unbrained/pm-vcs-sdk-exemplar",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "private": true,
   "type": "module",
   "description": "Beyond-PM exemplar: a VCS-style changeset workflow built entirely on public pm SDK and extension primitives.",

package/plugins/pm-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pm-claude",
   "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents (coordinator, delivery-chain, triage, verification), hybrid TUI task tracking (pm as persistent store + Claude Code task panel as live view), session context injection, and full git-based project management without leaving Claude Code.",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "author": {
     "name": "unbrained",
     "url": "https://github.com/unbraind/pm-cli"

package/plugins/pm-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pm-codex",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "description": "Native Codex integration for pm-cli with bundled MCP tools, skills, commands, and agent workflows.",
   "author": {
     "name": "unbrained",