@unbrained/pm-cli 2026.8.15 → 2026.8.17

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Official marketplace for pm CLI — native git-based project management for Claude Code and AI coding agents.",
-    "version": "2026.8.15"
+    "version": "2026.8.17"
   },
   "plugins": [
     {
       "name": "pm-claude",
       "source": "./plugins/pm-claude",
       "description": "Native pm CLI integration for Claude Code — 28 MCP tools, 5 workflow skills, 14 slash commands, 4 subagents, hybrid TUI task tracking, session context injection, and coordination subagents for git-based project management without leaving Claude Code.",
-      "version": "2026.8.15",
+      "version": "2026.8.17",
       "author": {
         "name": "unbrained",
         "url": "https://github.com/unbraind/pm-cli"

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # Changelog
 
+## 2026.8.17 - 2026-08-17
+
+### Added
+
+- History-derived defect recurrence gate: turn resolved incident patterns into targeted local and hosted CI protections ([pm-1qkivy](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-1qkivy.toon))
+- Agent skills routed to a workflow loop but named no capability family and no read-cost, so four of twelve command families and the entire output-budget surface were unreachable through progressive disclosure ([pm-f6zjpq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-f6zjpq.toon))
+
+### Fixed
+
+- Linked tests retain high-volume Vitest output without aborting ([pm-giks4s](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-giks4s.toon))
+- A declared context intent returns no context when combined with the narrowing flag, and its refusal receipt reports 122 tokens against a 2400 budget as the reason it does not fit ([pm-3crymx](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-3crymx.toon))
+- The relationship lexicon cannot express recurrence, so a defect family fixed thirty times is thirty unrelated nodes to every graph algorithm ([pm-ouyq3n](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ouyq3n.toon))
+- The gate contributors run before merging fails on every Claude Code workstation and passes on the runner for the same tree, because a harness probe writes advisory warnings into the surface the token budget measures ([pm-95h7pg](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-95h7pg.toon))
+- The public-surface gate enumerates its own hand-written entrypoint list, so two published code exports ship ungoverned and ./cli publishes 86 internal functions as typed API ([pm-suhxny](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-suhxny.toon))
+- GH-1033: read fields selectors can erase identity and requested empty collections ([pm-4fwgaz](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-4fwgaz.toon))
+- GH-1036/GH-1040: history integrity verdicts and repairs are incompatible across supported CLI versions ([pm-0wfdim](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-0wfdim.toon))
+- GH-1032: extension manifests silently accept unenforced version-floor spellings ([pm-qqoumq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-qqoumq.toon))
+- GH-1038: docs linked-resource pair syntax corrupts URLs and splits labeled entries ([pm-fpdk37](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-fpdk37.toon))
+- GH-1039: graph impact discards dependency direction and makes the direction selector inert ([pm-jn1x30](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-jn1x30.toon))
+
+### Other
+
+- Decision: adopt reviewed defect-evidence field constraints into audited workspace history ([pm-4smp5b](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/decisions/pm-4smp5b.toon))
+- Defect-escape ratchet: every escaped defect must land a gate that would have caught it, tracked as evidence on the fixing item ([pm-rtn5h6](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-rtn5h6.toon))
+- Boundary-fixture gate: every value that must match a system outside this repository is tested against a captured real sample, never against a fixture the production code generated ([pm-0pzgit](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-0pzgit.toon))
+- Disposition the test-only escape hatch published through the ./cli entrypoint: 86 internal functions are consumer-visible API with no support intent ([pm-rf120g](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-rf120g.toon))
+
+## 2026.8.16 - 2026-08-16
+
+### Fixed
+
+- Workspace history integrity refusals escape typed CLI recovery and become high Sentry faults ([pm-2zkvxm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-2zkvxm.toon))
+- GH-1019/GH-1020/GH-1021: Node 24 nightly platform regressions after PR \#1016 ([pm-zno2iu](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-zno2iu.toon))
+- GH-814/GH-821/GH-1034: SDK metadata reads must distinguish missing, invalid, and unreadable tracker roots from empty ([pm-23xkss](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-23xkss.toon))
+- GH-1028: history-author-acknowledge bulk mutation lacks dry-run and misreports empty selection ([pm-mcxk8v](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-mcxk8v.toon))
+- GH-1030: contracts --json --full is wholly omitted by the default output budget ([pm-2qvq7a](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-2qvq7a.toon))
+- Auto Release blocker closure ignores successful recovery dispatch and reruns the stale tag-push workflow ([pm-db8onn](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-db8onn.toon))
+- A commit pushed directly to the default branch can never be released: both analyzer-evidence fallbacks presuppose a pull request, and nothing declares that precondition ([pm-u1baah](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-u1baah.toon))
+
+### Other
+
+- PR \#1035 final review convergence: POSIX enumeration wording and plan-level replication ratchet ([pm-k9l7e1](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-k9l7e1.toon))
+- PR \#1035 exact-head review follow-up: sandbox-safe proof, completion uniqueness, replacement equivalence, and test isolation ([pm-jv3y4q](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-jv3y4q.toon))
+- Retire the bespoke gate scripts onto the assurance primitives, with a recorded per-script disposition so 6,500 lines of external enforcement either moves into the product or says why it cannot ([pm-4ok4ex](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-4ok4ex.toon))
+
 ## 2026.8.15 - 2026-08-15
 
 ### Fixed
@@ -419,7 +464,6 @@
 - GH-824: core-field recovery must name dedicated flags instead of extension activation ([pm-2jtbl8](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-2jtbl8.toon))
 - CodeFactor fixed-only success payload blocks exact-head release gate ([pm-xcrlkl](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xcrlkl.toon))
 - Both declared context intents are unreachable because the intent applier assigns field-group names into the section value domain, and the two validators give contradictory advice ([pm-ai45y9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ai45y9.toon))
-- GH-814: SDK metadata reads must distinguish missing and invalid tracker roots from an empty tracker ([pm-23xkss](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-23xkss.toon))
 - The runtime contract enumeration is not closed over the surface it can resolve: 14 rendered commands, including the list-open that AGENTS.md mandates, are contract-backed by name yet absent from every enumeration ([pm-6j7r1a](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-6j7r1a.toon))
 - GH-817: machine-readable flag contracts need semantic invocation metadata and stdin capability ([pm-11phn1](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-11phn1.toon))
 
@@ -1252,12 +1296,12 @@
 
 ### Fixed
 
+- GH-363: Windows nightly (Node 24) red — runtime-loader colon-path + telemetry detached-spawn unhandled error + npm-install regression ([pm-xaib](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xaib.toon))
 - pm validate --check-files mis-handles remote (URL) doc/file references: flagged as deleted and silently destroyed by --prune-missing ([pm-k2n4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-k2n4.toon))
 - pm next hides completed-container closeout rows while leaf work exists ([pm-9g87](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-9g87.toon))
 - MCP action-schema contracts drifted from CLI flag tables (guide.list, health.brief, validate.parentCycleSeverity, contracts.full) ([pm-zx13](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-zx13.toon))
 - describeExtensionBlueprint omits importer/exporter-with-options command definitions (parity gap vs describeExtensionActivation) ([pm-zqes](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-zqes.toon))
 - Contracts command lookup should handle package namespace roots ([pm-y1o4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-y1o4.toon))
-- GH-363: Windows nightly (Node 24) red — runtime-loader colon-path + telemetry detached-spawn unhandled error + npm-install regression ([pm-xaib](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xaib.toon))
 - CI: make Codecov badge uploads branch-explicit ([pm-x878](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-x878.toon))
 - deriveExtensionCapabilities omits 'schema' for importer/exporter options.flags (declarative blueprint under-grant) ([pm-v3ty](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-v3ty.toon))
 - pm install does not scaffold extension-contributed item-type folders (transient missing_directory health warning) ([pm-rjab](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-rjab.toon))
@@ -1280,6 +1324,7 @@
 
 ### Other
 
+- PR \#406 review follow-up: clear partial MCP extension registries before fallback execution ([pm-dyzy](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-dyzy.toon))
 - 2026-06-25 PM ecosystem taxonomy and context backlog normalization ([pm-57vh](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/plans/pm-57vh.toon))
 - Normalize stale audit containers and intentional-open resolved items ([pm-psc0](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-psc0.toon))
 - Extend pm package init --declarative to the full capability matrix (hooks/search/importers/schema/renderers/parser/preflight/services) ([pm-lfdv](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-lfdv.toon))
@@ -1305,7 +1350,6 @@
 - Action-scoped MCP parameter descriptions: split shared name/target description per action (schema vs profile) ([pm-fq80](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-fq80.toon))
 - ADR: offline BM25 lexical provider + relevance eval harness for search quality ([pm-f2al](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/decisions/pm-f2al.toon))
 - ADR: explicit pm_format_version front-matter field for storage schema evolution ([pm-eeai](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/decisions/pm-eeai.toon))
-- PR \#406 review follow-up: clear partial MCP extension registries before fallback execution ([pm-dyzy](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-dyzy.toon))
 - Expose project profile application through MCP contracts and drift gates ([pm-bhmk](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-bhmk.toon))
 - ADR: dependency-aware actionability for pm next — ready = active leaf with no open blocked_by; reuse compareCriticalItems + shared blocked_by resolver ([pm-9x6k](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/decisions/pm-9x6k.toon))
 - registerProfile core registration surface: ExtensionApi + registry + loader gate + capability-usage + policy surface ([pm-6oox](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-6oox.toon))
@@ -1434,6 +1478,7 @@
 
 ### Fixed
 
+- pm-changelog over-escapes markdown in entry titles (parens + intra-word underscores) ([pm-3299](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-3299.toon))
 - GH-293..296 CLI parser and search regression bundle ([pm-yy45](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-yy45.toon))
 - appendLineAtomic is not truly atomic: concurrent appends to history JSONL can interleave ([pm-xy9n](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xy9n.toon))
 - Project-scope extension install writes ~69MB node_modules per workspace (peer pm-cli + transitive Sentry/OTel) ([pm-oxq2](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-oxq2.toon))
@@ -1443,7 +1488,6 @@
 - Accept --status all for duplicate-safe search and list filters ([pm-i02t](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-i02t.toon))
 - Fix nightly cross-platform reliability: macOS realpath in extension-command test and Windows .cmd spawn EINVAL ([pm-gf6f](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-gf6f.toon))
 - pm health 2.3-3.1s in dev repo (~2x the 1.3s baseline): drift-scan cache hit still reads + content-hashes every history stream ([pm-c90s](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-c90s.toon))
-- pm-changelog over-escapes markdown in entry titles (parens + intra-word underscores) ([pm-3299](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-3299.toon))
 
 ### Removed
 
@@ -1485,6 +1529,7 @@
 
 ### Fixed
 
+- PR \#266 review feedback: tighten init and dynamic option validation ([pm-at1j](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-at1j.toon))
 - pm templates: unknown subcommand + flags silently fall back to 'list' (exit 0) instead of erroring ([pm-r2kd](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-r2kd.toon))
 - linked-test-adapters package install loses ESM module type ([pm-v8fy](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-v8fy.toon))
 - GH-215: enforce timestamps in history entries ([pm-u42x](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-u42x.toon))
@@ -1494,7 +1539,6 @@
 - GH-262: prevent path-like pm init from corrupting caller tracker settings ([pm-jek2](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-jek2.toon))
 - GH-284: align pm init required schema directories with health ([pm-hl9y](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-hl9y.toon))
 - CI contracts snapshot temp cleanup can fail with ENOTEMPTY ([pm-c61g](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-c61g.toon))
-- PR \#266 review feedback: tighten init and dynamic option validation ([pm-at1j](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-at1j.toon))
 - GH-265: schema unknown subcommands must not create custom types ([pm-ablm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-ablm.toon))
 - GH-280: pm validate does not detect circular parent references (hierarchy cycles A-\>B-\>A of any length) ([pm-8vul](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-8vul.toon))
 - Auto Release retries branch push after main advances ([pm-5oti](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-5oti.toon))
@@ -1716,11 +1760,11 @@
 
 ### Other
 
+- Upgrade pm-changelog to 2026.6.9 and validate changelog fidelity ([pm-kx7v](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-kx7v.toon))
 - Document pm-linked-test-adapters package in EXTENSIONS.md and TESTING.md ([pm-yj8n](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-yj8n.toon))
 - Close stale GH issues, clarify dedupe-audit docs, and bump @sentry/node ([pm-utd6](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-utd6.toon))
 - Run verification matrix and temp-dir smoke for active cycle ([pm-rav7](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-rav7.toon))
 - SDK author-ergonomics batch: extension-manifest JSON Schema, getWorkspaceContracts memoization, FlagDefinition type/value_type unification ([pm-l0jd](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-l0jd.toon))
-- Upgrade pm-changelog to 2026.6.9 and validate changelog fidelity ([pm-kx7v](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-kx7v.toon))
 
 ## 2026.6.9 - 2026-06-09
 
@@ -1743,9 +1787,9 @@
 
 ### Added
 
+- Add schema show-status status inspection ([pm-qpus](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-qpus.toon))
 - MCP pm_health defaults to the compact summary projection for token-efficient agent health checks ([pm-yjub](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-yjub.toon))
 - list/search: trim default filters/projection/sorting/now trailer in compact/agent mode ([pm-vhx6](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-vhx6.toon))
-- Add schema show-status status inspection ([pm-qpus](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/features/pm-qpus.toon))
 
 ### Changed
 
@@ -2005,10 +2049,10 @@
 
 ### Other
 
+- 2026-05-30 package SDK dogfood audit and startup telemetry performance pass ([pm-qmx3](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-qmx3.toon))
 - Make MCP status enum + shell completion runtime-resolved from schema (not hardcoded) ([pm-jtdc](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-jtdc.toon))
 - Calendar view/format did-you-mean + dependency and type-safety cleanup ([pm-5oxq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-5oxq.toon))
 - Defer eager per-command startup work: completion flag-strings, MCP tool schema build, telemetry flush spawn ([pm-3mal](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-3mal.toon))
-- 2026-05-30 package SDK dogfood audit and startup telemetry performance pass ([pm-qmx3](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-qmx3.toon))
 
 ## 2026.5.30 - 2026-05-30
 
@@ -2088,6 +2132,8 @@
 
 ### Other
 
+- Generate full historical CHANGELOG.md through pm-changelog ([pm-afl9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-afl9.toon))
+- Verify and repair pm-changelog-generated main CHANGELOG release alignment ([pm-5baq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-5baq.toon))
 - Deduplicate beads/todos index.ts package-runtime loader (install-safe mechanism needed) ([pm-wwa7](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-wwa7.toon))
 - Deduplicate Beads and Todos package adapter runtimes ([pm-ybfj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-ybfj.toon))
 - Deduplicate bundled package runtime option parsing helpers ([pm-y5u0](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-y5u0.toon))
@@ -2106,11 +2152,9 @@
 - Single-source Codex plugin docs tool surface ([pm-d97r](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-d97r.toon))
 - Single-source extension governance policy defaults ([pm-axd1](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-axd1.toon))
 - Unify plugin/MCP naming: pm-cli-claude→pm-claude, pm-cli-codex→pm-codex, pm-cli-native MCP→pm-mcp, packages @unbrained/pm-package-X→@unbrained/pm-X ([pm-ash0](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-ash0.toon))
-- Generate full historical CHANGELOG.md through pm-changelog ([pm-afl9](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-afl9.toon))
 - Calendar + SDK + vector-search + docs review (2026-05-27) ([pm-a0w4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-a0w4.toon))
 - Agent-UX combined PR: compact mutation output (pm-ch59) + smarter unknown-flag recovery (pm-8nyc) ([pm-70mi](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/plans/pm-70mi.toon))
 - Dogfood 2026-05-20 low-severity CLI polish backlog (config UX, init verbosity, help alias bloat, default-safety, doc/validator drift) ([pm-5k2w](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-5k2w.toon))
-- Verify and repair pm-changelog-generated main CHANGELOG release alignment ([pm-5baq](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-5baq.toon))
 - Single-source guide-shell routing snippets across docs ([pm-48vd](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-48vd.toon))
 - Single-source Plan workflow examples across plugin docs ([pm-3y56](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-3y56.toon))
 - Keep large modules maintainable via barrel re-export splits + explicit uncovered allowlist ([pm-3cbk](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/decisions/pm-3cbk.toon))
@@ -2148,6 +2192,7 @@
 
 ### Other
 
+- Install and validate pm-changelog package ([pm-7811](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-7811.toon))
 - history-repair command + legacy drift cleanup + replay dedup ([pm-c3dx](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/plans/pm-c3dx.toon))
 - Deduplicate templates package runtime and legacy command implementation ([pm-ypqp](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-ypqp.toon))
 - Deduplicate mutation author fallback resolution across commands ([pm-xh0y](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-xh0y.toon))
@@ -2165,7 +2210,6 @@
 - Deduplicate comments, notes, and learnings command stacks ([pm-9y8q](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-9y8q.toon))
 - Deduplicate front-matter key-order contract literals in tests ([pm-8fx3](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-8fx3.toon))
 - Extract shared temporary-directory lifecycle helpers for tests ([pm-7tug](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-7tug.toon))
-- Install and validate pm-changelog package ([pm-7811](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/tasks/pm-7811.toon))
 - Extract shared direct CLI spawn helper for integration tests ([pm-401l](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/chores/pm-401l.toon))
 
 ## 2026.5.23 - 2026-05-23
@@ -2692,6 +2736,7 @@
 
 ### Security
 
+- Ignore local .env files for telemetry/security operations ([pm-qgvj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-qgvj.toon))
 - Track GitHub Dependabot alert \#8 for undici (GHSA-wqq4-5wpv-mx2g) ([pm-v6vi](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-v6vi.toon))
 - Track GitHub Dependabot alert \#11 for undici (GHSA-9qxr-qj54-h672) ([pm-tl4d](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-tl4d.toon))
 - Track GitHub Dependabot alert \#12 for undici (GHSA-cxrh-j4jr-qwg3) ([pm-pagj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-pagj.toon))
@@ -2712,7 +2757,6 @@
 - Track GitHub Dependabot alert \#27 for undici (GHSA-4992-7rv2-5pvq) ([pm-02c4](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-02c4.toon))
 - Issue: Private IP address in committed pm task files ([pm-xk8b](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-xk8b.toon))
 - Track GitHub Dependabot alert \#19 for undici (GHSA-f269-vfmq-vjvj) ([pm-rb9v](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-rb9v.toon))
-- Ignore local .env files for telemetry/security operations ([pm-qgvj](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-qgvj.toon))
 - Track GitHub Dependabot alert \#22 for undici (GHSA-vrm6-8vpv-qv8q) ([pm-i1rm](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-i1rm.toon))
 - Track GitHub Dependabot alert \#21 for undici (GHSA-4992-7rv2-5pvq) ([pm-cg7l](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-cg7l.toon))
 - Track GitHub Dependabot alert \#29 for picomatch (GHSA-3v7f-55p6-f55p) ([pm-5e88](https://github.com/unbraind/pm-cli/blob/main/.agents/pm/issues/pm-5e88.toon))

package/README.md

@@ -21,19 +21,19 @@
 
 ## Start Here
 
-| Need                                                           | Read                                                                                                                                    |
-| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
-| Install and create the first item                              | [Quickstart](docs/QUICKSTART.md)                                                                                                        |
-| New maintainer onboarding                                      | [Onboarding](docs/ONBOARDING.md)                                                                                                        |
-| Agent workflow and token-minimal loops                         | [Agent Guide](docs/AGENT_GUIDE.md)                                                                                                      |
-| Command families and examples                                  | [Command Reference](docs/COMMANDS.md)                                                                                                   |
-| Shell, CI, and machine-client composition                       | [CLI Scripting Contract](docs/SCRIPTING.md)                                                                                              |
-| Settings, storage, search, and output                          | [Configuration](docs/CONFIGURATION.md)                                                                                                  |
-| Safe test execution and linked tests                           | [Testing](docs/TESTING.md)                                                                                                              |
-| Security reporting and resilience controls                    | [Security Policy](SECURITY.md), [Security Governance](docs/SECURITY_GOVERNANCE.md)                                                      |
-| Package and extension authoring                                | [Packages and Extensions](docs/EXTENSIONS.md), [SDK](docs/SDK.md), [Customization Primitives](docs/SDK_CUSTOMIZATION_PRIMITIVES.md), [Evidence Traceability](docs/SDK_EVIDENCE_TRACEABILITY.md), and [Agent Runtime Primitives](docs/AGENT_RUNTIME_PRIMITIVES.md) |
-| Maintainer release process (daily auto-release + local parity) | [Releasing](docs/RELEASING.md)                                                                                                          |
-| Contributor internals                                          | [Architecture](docs/ARCHITECTURE.md)                                                                                                    |
+| Need                                                           | Read                                                                                                                                                                                                                                                                                                                        |
+| -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Install and create the first item                              | [Quickstart](docs/QUICKSTART.md)                                                                                                                                                                                                                                                                                            |
+| New maintainer onboarding                                      | [Onboarding](docs/ONBOARDING.md)                                                                                                                                                                                                                                                                                            |
+| Agent workflow and token-minimal loops                         | [Agent Guide](docs/AGENT_GUIDE.md)                                                                                                                                                                                                                                                                                          |
+| Command families and examples                                  | [Command Reference](docs/COMMANDS.md)                                                                                                                                                                                                                                                                                       |
+| Shell, CI, and machine-client composition                      | [CLI Scripting Contract](docs/SCRIPTING.md)                                                                                                                                                                                                                                                                                 |
+| Settings, storage, search, and output                          | [Configuration](docs/CONFIGURATION.md)                                                                                                                                                                                                                                                                                      |
+| Safe test execution and linked tests                           | [Testing](docs/TESTING.md)                                                                                                                                                                                                                                                                                                  |
+| Security reporting and resilience controls                     | [Security Policy](SECURITY.md), [Security Governance](docs/SECURITY_GOVERNANCE.md)                                                                                                                                                                                                                                          |
+| Package and extension authoring                                | [Packages and Extensions](docs/EXTENSIONS.md), [SDK](docs/SDK.md), [Context Integrity](docs/CONTEXT_INTEGRITY_CONTRACTS.md), [Customization Primitives](docs/SDK_CUSTOMIZATION_PRIMITIVES.md), [Evidence Traceability](docs/SDK_EVIDENCE_TRACEABILITY.md), and [Agent Runtime Primitives](docs/AGENT_RUNTIME_PRIMITIVES.md) |
+| Maintainer release process (daily auto-release + local parity) | [Releasing](docs/RELEASING.md)                                                                                                                                                                                                                                                                                              |
+| Contributor internals                                          | [Architecture](docs/ARCHITECTURE.md)                                                                                                                                                                                                                                                                                        |
 
 Full documentation starts at [docs/README.md](docs/README.md).
 

package/dist/cli/error-guidance.d.ts

@@ -13,6 +13,7 @@ interface GuidanceMessage {
     why?: string;
     examples?: string[];
     nextSteps?: string[];
+    verificationErrors?: string[];
     recovery?: PmCliErrorRecoveryPayload;
 }
 /** Documents the json error envelope payload exchanged by command, SDK, and package integrations. */
@@ -35,6 +36,8 @@ export interface JsonErrorEnvelope {
     examples?: string[];
     /** Value that configures or reports next steps for this contract. */
     next_steps?: string[];
+    /** Exact integrity verifier findings that caused the operation to refuse. */
+    verification_errors?: string[];
     /** Value that configures or reports recovery for this contract. */
     recovery?: PmCliErrorRecoveryPayload;
 }
@@ -58,6 +61,8 @@ export interface ErrorClassification {
     examples?: string[];
     /** Value that configures or reports next steps for this contract. */
     next_steps?: string[];
+    /** Exact integrity verifier findings that caused the operation to refuse. */
+    verification_errors?: string[];
     /** Value that configures or reports recovery for this contract. */
     recovery?: PmCliErrorRecoveryPayload;
 }

package/dist/cli/error-guidance.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6f4c3f5d-9acc-5e2c-9351-12fdcfcdb56a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5251395b-715a-5559-a7d5-ca3bc4a1bb16")}catch(e){}}();
 import { resolveRecoveryCommandName } from "../sdk/agent/command-recovery.js";
 import { renderPmCommand } from "./argv-utils.js";
 import { discoverNearbyPmRoot } from "../sdk/tracker-root-discovery.js";
@@ -266,6 +266,10 @@ export function renderGuidanceMessage(message) {
         lines.push("");
         lines.push(...renderList("Next steps:", message.nextSteps));
     }
+    if (message.verificationErrors && message.verificationErrors.length > 0) {
+        lines.push("");
+        lines.push(...renderList("Verification errors:", message.verificationErrors));
+    }
     const recoveryLines = renderRecoveryBundle(message.recovery);
     if (recoveryLines.length > 0) {
         lines.push("");
@@ -291,6 +295,9 @@ function guidanceToJsonEnvelope(message, exitCode) {
     if (message.nextSteps && message.nextSteps.length > 0) {
         payload.next_steps = message.nextSteps;
     }
+    if (message.verificationErrors && message.verificationErrors.length > 0) {
+        payload.verification_errors = message.verificationErrors;
+    }
     if (message.recovery) {
         payload.recovery = message.recovery;
     }
@@ -313,6 +320,9 @@ function guidanceToClassification(message) {
     if (message.nextSteps && message.nextSteps.length > 0) {
         payload.next_steps = message.nextSteps;
     }
+    if (message.verificationErrors && message.verificationErrors.length > 0) {
+        payload.verification_errors = message.verificationErrors;
+    }
     if (message.recovery) {
         payload.recovery = message.recovery;
     }
@@ -405,6 +415,8 @@ function applyPmCliErrorContext(guidance, rawMessage, context) {
     const type = normalizeContextValue(context.type, errorType(code));
     const examples = normalizeContextList(context.examples) ?? guidance.examples;
     const nextSteps = normalizeContextList(context.nextSteps) ?? guidance.nextSteps;
+    const verificationErrors = normalizeContextList(context.verification_errors) ??
+        guidance.verificationErrors;
     const fallbackTitle = guidance.code === "command_failed" && context.code
         ? buildFallbackTitleFromMessage(normalizedRawMessage)
         : undefined;
@@ -421,6 +433,7 @@ function applyPmCliErrorContext(guidance, rawMessage, context) {
         why: normalizeContextValue(context.why, guidance.why),
         examples,
         nextSteps,
+        verificationErrors,
         recovery,
     };
 }
@@ -1224,4 +1237,4 @@ export const _testOnly = {
     resolveKnownPackageCommandHint,
 };
 //# sourceMappingURL=error-guidance.js.map
-//# debugId=6f4c3f5d-9acc-5e2c-9351-12fdcfcdb56a
+//# debugId=5251395b-715a-5559-a7d5-ca3bc4a1bb16

package/dist/cli/public.d.ts

@@ -0,0 +1,2 @@
+/** Run one embedded CLI invocation without leaking its exit status into the host process. */
+export declare function runPmCli(rawArgv?: string[]): Promise<void>;

package/dist/cli/public.js

@@ -0,0 +1,21 @@
+/**
+ * @module cli/public
+ *
+ * Publishes the supported embeddable CLI entrypoint without exposing the
+ * implementation module's repository-only test seams to package consumers.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8e212bdf-7568-54dd-91aa-7de146d65d03")}catch(e){}}();
+import { runPmCli as runInternalPmCli } from "./main.js";
+/** Run one embedded CLI invocation without leaking its exit status into the host process. */
+export async function runPmCli(rawArgv) {
+    const previousExitCode = process.exitCode;
+    try {
+        await runInternalPmCli(rawArgv);
+    }
+    finally {
+        process.exitCode = previousExitCode;
+    }
+}
+//# sourceMappingURL=public.js.map
+//# debugId=8e212bdf-7568-54dd-91aa-7de146d65d03

package/dist/cli/register-history-author.js

@@ -1,18 +1,20 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="50a7ce23-2abf-5240-b426-b73cb704e329")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2745d577-4f6c-5b9e-b54a-e1451e022d63")}catch(e){}}();
 import { resolvePmRoot } from "../sdk/runtime-primitives.js";
-import { acknowledgeUnknownAuthorHistoryEvents, resolveUnknownAuthorAcknowledgmentSelector, } from "../sdk/author-attribution.js";
+import { acknowledgeUnknownAuthorHistoryEventsFromTransport } from "../sdk/author-attribution.js";
 import { collect, getGlobalOptions, printResult, readOptionString, } from "./registration-helpers.js";
 async function runHistoryAuthorAcknowledgeAction(options, command) {
     const globalOptions = getGlobalOptions(command);
     const rawEvents = Array.isArray(options.event)
         ? options.event
         : [];
-    const selector = resolveUnknownAuthorAcknowledgmentSelector(rawEvents, options.allActionable === true);
-    const result = await acknowledgeUnknownAuthorHistoryEvents(resolvePmRoot(process.cwd(), globalOptions.path), {
-        events: selector.events,
-        all_actionable: selector.all_actionable,
-        attributed_author: readOptionString(options, "attributedAuthor"),
+    const result = await acknowledgeUnknownAuthorHistoryEventsFromTransport(resolvePmRoot(process.cwd(), globalOptions.path), {
+        historyEvent: rawEvents,
+        allActionable: options.allActionable === true,
+        dryRun: options.dryRun === true,
+        planFingerprint: readOptionString(options, "planFingerprint"),
+        limit: options.limit,
+        attributedAuthor: readOptionString(options, "attributedAuthor"),
         reviewer: readOptionString(options, "reviewer"),
         reason: readOptionString(options, "reason"),
     });
@@ -24,11 +26,14 @@ export function registerHistoryAuthorAcknowledgeCommand(program) {
         .command("history-author-acknowledge")
         .option("--event <item-id:line>", "Unknown-author event coordinate (repeatable)", collect)
         .option("--all-actionable", "Select all actionable events")
-        .requiredOption("--attributed-author <value>", "Reviewed principal attribution")
-        .requiredOption("--reviewer <value>", "Disposition reviewer")
-        .requiredOption("--reason <value>", "Review evidence")
+        .option("--dry-run", "Preview a deterministic source-bound plan")
+        .option("--plan-fingerprint <sha256>", "Apply the exact fingerprint returned by --dry-run")
+        .option("--limit <n>", "Maximum coordinate rows returned in the plan")
+        .option("--attributed-author <value>", "Reviewed principal attribution")
+        .option("--reviewer <value>", "Disposition reviewer")
+        .option("--reason <value>", "Review evidence")
         .description("Append audited dispositions for immutable unknown-author events.")
         .action(runHistoryAuthorAcknowledgeAction);
 }
 //# sourceMappingURL=register-history-author.js.map
-//# debugId=50a7ce23-2abf-5240-b426-b73cb704e329
+//# debugId=2745d577-4f6c-5b9e-b54a-e1451e022d63

package/dist/cli/register-mutation.js

@@ -1,8 +1,8 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="60ee1ab9-00a0-50a7-839e-4938ecc6a48f")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7feb0fe0-386c-56dc-afe1-e7b4ce1bc95a")}catch(e){}}();
 import { resolveBodyFileContent, EXIT_CODE, splitCommaList, PmCliError, createUnknownSubcommandError, } from "../sdk/runtime-primitives.js";
 import { CREATE_COMMANDER_OPTION_REGISTRATION_CONTRACTS, PLAN_CREATE_METADATA_PARAMETER_KEYS, UPDATE_COMMANDER_OPTION_REGISTRATION_CONTRACTS, } from "../sdk/cli-contracts.js";
-import { BUILTIN_ITEM_TYPE_VALUES } from "../types/index.js";
+import { BUILTIN_ITEM_TYPE_VALUES, PLAN_STEP_LINK_KIND_VALUES, } from "../types/index.js";
 import { MERGE_DRIVER_ARTIFACT_VALUES, runMergeDriver, runMergeInstall, runMergeReconcile, runMergeReceiptReport, } from "./commands/merge.js";
 import { runAppend } from "./commands/append.js";
 import { runClose } from "./commands/close.js";
@@ -1565,7 +1565,7 @@ export function registerMutationCommands(program, registrationOptions = {}) {
         .option("--step-replacement <value>", "Replacement reference for a superseded step")
         .option("--depends-on <value>", "Pm item ids the step depends on (repeatable, csv-friendly)", collect)
         .option("--link <value>", "Pm item id to link (repeatable, csv-friendly)", collect)
-        .option("--link-kind <value>", "Link kind: related|blocks|blocked_by|depends_on|discovered_from|implements|verifies|supersedes")
+        .option("--link-kind <value>", `Link kind: ${PLAN_STEP_LINK_KIND_VALUES.join("|")}`)
         .option("--link-note <value>", "Optional note for the link")
         .option("--promote-to-item-dep", "Also add the linked id as a top-level item dependency when linking")
         .option("--allow-multiple-active", "Allow multiple steps to be in_progress at once")
@@ -1840,4 +1840,4 @@ export function registerMutationCommands(program, registrationOptions = {}) {
         .action(runDepsAction);
 }
 //# sourceMappingURL=register-mutation.js.map
-//# debugId=60ee1ab9-00a0-50a7-839e-4938ecc6a48f
+//# debugId=7feb0fe0-386c-56dc-afe1-e7b4ce1bc95a